fix: address security issue

src/services/storage-admin-repo.ts

@@ -127,6 +127,17 @@ export async function markInviteUsed(db: D1Database, code: string, userId: strin
   return (result.meta.changes ?? 0) > 0;
 }
 
+export async function revertInviteUsed(db: D1Database, code: string, userId: string): Promise<boolean> {
+  const now = new Date().toISOString();
+  const result = await db
+    .prepare(
+      "UPDATE invites SET status = 'active', used_by = NULL, updated_at = ? WHERE code = ? AND status = 'used' AND used_by = ?"
+    )
+    .bind(now, code, userId)
+    .run();
+  return (result.meta.changes ?? 0) > 0;
+}
+
 export async function revokeInvite(db: D1Database, code: string): Promise<boolean> {
   const now = new Date().toISOString();
   const result = await db

src/services/storage.ts

@@ -30,6 +30,7 @@ import {
   markInviteUsed as markStoredInviteUsed,
   pruneAuditLogs as pruneStoredAuditLogs,
   pruneAuditLogsToMax as pruneStoredAuditLogsToMax,
+  revertInviteUsed as revertStoredInviteUsed,
   revokeInvite as revokeStoredInvite,
 } from './storage-admin-repo';
 import {
@@ -313,6 +314,10 @@ export class StorageService {
     return markStoredInviteUsed(this.db, code, userId);
   }
 
+  async revertInviteUsed(code: string, userId: string): Promise<boolean> {
+    return revertStoredInviteUsed(this.db, code, userId);
+  }
+
   async revokeInvite(code: string): Promise<boolean> {
     return revokeStoredInvite(this.db, code);
   }