admin: invite links without a username

Leaving the username empty when creating a user makes the account
invite-<hex>; the invitee picks the real username on the invite page
(taken names and the invite- prefix are refused). Without an email this
gives a plain invite link to share.

Assisted-by: Claude:opus-5

db/migrations/011_users_choose_username.rb

@@ -0,0 +1,7 @@
+Sequel.migration do
+  change do
+    # Created as "invite-<hex>"; the invitee picks the real username when
+    # accepting the invite.
+    add_column :users, :choose_username, TrueClass, null: false, default: false
+  end
+end

lib/users_admin.rb

@@ -84,6 +84,10 @@ module UsersAdmin
     app.post '/admin/users' do
       @user = User.new(username: params[:username].to_s.strip.downcase, name: params[:name].to_s.strip,
                        email: params[:email].to_s.strip.downcase.then { |e| e.empty? ? nil : e })
+      if @user.username.empty? # invitee chooses it on the invite page
+        @user.username = "invite-#{SecureRandom.hex(4)}"
+        @user.choose_username = true
+      end
       @user.superuser = params[:superuser] == '1' if current_user.superuser
       unless @user.valid? && !User[username: @user.username] && !(@user.email && User[email: @user.email])
         @error = @user.errors.full_messages.join('; ').then { |m| m.empty? ? 'Username or email already in use.' : m }
@@ -188,6 +192,19 @@ module UsersAdmin
           return erb :'admin/set_password'
         end
         user = @token.user
+        if user.choose_username
+          name = params[:username].to_s.strip.downcase
+          @error =
+            if !name.match?(User::NAME_RE) || name.start_with?('invite-') then 'Username: lowercase letters, digits, . _ @ - (2–64).'
+            elsif User.exclude(id: user.id).where(username: name).any?   then 'That username is taken.'
+            end
+          if @error
+            status 422
+            return erb :'admin/set_password'
+          end
+          user.username = name
+          user.choose_username = false
+        end
         user.password = params[:password]
         user.must_change_password = false
         user.session_version += 1

test/users_admin_test.rb

@@ -47,6 +47,31 @@ class UsersAdminTest < Minitest::Test
     refute_includes last_response.body, '/admin/invite/'   # shown once
   end
 
+  def test_invite_without_username_lets_invitee_choose
+    admin_login!
+    create_user(username: '', perm: { 'bingo' => { 'read' => '1' } })
+    u = User.where(choose_username: true).first
+    assert_match(/\Ainvite-[0-9a-f]{8}\z/, u.username)
+    get '/admin/users'
+    link = last_response.body[%r{https?://\S+?/admin/invite/[\w-]+}]
+    assert link, 'invite link shown'
+    path = URI(link).path
+    clear_cookies
+    get path
+    assert_includes last_response.body, 'Choose a username'
+    tok = last_response.body[/name="authenticity_token" value="([^"]+)"/, 1]
+    post path, { authenticity_token: tok, username: ENV['ADMIN_USER'], password: 'kate-password-12', confirm: 'kate-password-12' }
+    assert_equal 422, last_response.status                 # taken
+    post path, { authenticity_token: tok, username: 'invite-x', password: 'kate-password-12', confirm: 'kate-password-12' }
+    assert_equal 422, last_response.status                 # reserved prefix
+    post path, { authenticity_token: tok, username: 'Kate', password: 'kate-password-12', confirm: 'kate-password-12' }
+    assert_equal 302, last_response.status
+    u.refresh
+    assert_equal 'kate', u.username
+    refute u.choose_username
+    assert u.can?('bingo', 'read')
+  end
+
   def test_delete_implies_read
     admin_login!
     create_user(username: 'dave', perm: { 'bingo' => { 'delete' => '1' } })

views/admin/set_password.erb

@@ -1,13 +1,17 @@
 <div class="header">
     <h1><%= @purpose == 'invite' ? 'Welcome' : 'Reset password' %></h1>
-    <p class="tagline">Set a password for <b><%= @token.user.username %></b></p>
+    <p class="tagline"><% if @token.user.choose_username %>Choose a username and password<% else %>Set a password for <b><%= @token.user.username %></b><% end %></p>
 </div>
 
 <section class="section">
     <% if @error %><div class="form-error-base"><div><%= @error %></div></div><% end %>
     <form class="invoice-form auth-form" method="post" action="/admin/<%= @purpose %>/<%= params[:token] %>">
         <input type="hidden" name="authenticity_token" value="<%= csrf_token %>" />
-        <input type="text" name="username" value="<%= @token.user.username %>" autocomplete="username" hidden />
+        <% if @token.user.choose_username %>
+            <div class="field"><label for="username">Username <span class="optional">(lowercase letters, digits, . _ @ -)</span></label><input type="text" id="username" name="username" value="<%= params[:username] %>" autocomplete="username" autocapitalize="none" pattern="[a-z0-9][a-z0-9_.@-]{1,63}" required autofocus /></div>
+        <% else %>
+            <input type="text" name="username" value="<%= @token.user.username %>" autocomplete="username" hidden />
+        <% end %>
         <div class="field"><label for="password">Password <span class="optional">(at least <%= User::MIN_PASS %> characters)</span></label><input type="password" id="password" name="password" autocomplete="new-password" minlength="<%= User::MIN_PASS %>" required autofocus /></div>
         <div class="field"><label for="confirm">Repeat password</label><input type="password" id="confirm" name="confirm" autocomplete="new-password" required /></div>
         <button type="submit" class="download-button">Set password and log in</button>

views/admin/users/form.erb

@@ -14,7 +14,7 @@
         <input type="hidden" name="authenticity_token" value="<%= csrf_token %>" />
         <fieldset class="plain" <%= 'disabled' unless editable %>>
         <div class="invoice-grid">
-            <div class="field"><label for="username">Username</label><input type="text" id="username" name="username" value="<%= @user.username %>" <%= fresh || current_user.superuser ? 'required pattern=[a-z0-9][a-z0-9_.@-]{1,63}' : 'disabled' %> /></div>
+            <div class="field"><label for="username">Username<% if fresh %> <span class="optional">(optional)</span><% end %></label><input type="text" id="username" name="username" value="<%= @user.username %>" <%= fresh ? 'pattern=[a-z0-9][a-z0-9_.@-]{1,63} placeholder="leave empty: invitee chooses"' : (current_user.superuser ? 'required pattern=[a-z0-9][a-z0-9_.@-]{1,63}' : 'disabled') %> /></div>
             <div class="field"><label for="name">Name <span class="optional">(optional)</span></label><input type="text" id="name" name="name" value="<%= @user.name %>" /></div>
             <div class="field"><label for="email">Email <span class="optional">(for invite and password reset)</span></label><input type="email" id="email" name="email" value="<%= @user.email %>" /></div>
         </div>

views/admin/users/index.erb

@@ -25,7 +25,7 @@
                     <td><%= perm_summary(u) %></td>
                     <td>
                         <% if !u.active %><span class="badge badge-pending">disabled</span>
-                        <% elsif !u.password_digest %><span class="badge badge-pending">invited</span>
+                        <% elsif !u.password_digest %><span class="badge badge-pending">invited</span><% if u.choose_username %><br /><span class="optional">picks own username</span><% end %>
                         <% else %><span class="badge badge-paid">active</span><% end %>
                     </td>
                     <td class="mono"><%= u.last_login_at&.strftime('%Y-%m-%d %H:%M') || '—' %></td>