4 commits

Author	SHA1	Message	Date
user	20b937dcbe	chore(auth): address onboarding review follow-ups	2026-04-29 19:10:30 -07:00
user	8205e248a6	chore(auth): harden invite-link onboarding token flow	2026-04-29 18:55:11 -07:00
Ishaan Jaffer	e8461b5b97	style: run black formatter on files from main merge	2026-04-17 13:02:59 -07:00
yuneng-jiang	c2e7cf160f	fix(onboarding): prevent invite link reuse for password reset ... Moves is_accepted=True from GET /onboarding/get_token to POST /onboarding/claim_token, so the flag accurately reflects that a password has been set. Both endpoints now reject already-used links, with get_token rejecting before any user data is returned. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-02-28 17:39:03 -08:00