From 42a00dd3bf598a310ce0766724497b9f19e75781 Mon Sep 17 00:00:00 2001
From: William Mantly <wmantly@gmail.com>
Date: Sat, 11 Jul 2026 11:57:29 -0400
Subject: [PATCH] Remove unused invite and SSH-key user features

Both were dead/incomplete: POST /api/user/key called a nonexistent
User.addSSHkey, and the invite flow (POST /api/user/invite, User.invite,
User.addByInvite, InviteToken) had no consumer or UI. Drop the routes, the
InviteToken model, and the per-backing invite methods.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 nodejs/models/token.js     | 25 +------------------------
 nodejs/models/user_ldap.js | 13 +------------
 nodejs/models/user_pam.js  | 38 +-------------------------------------
 nodejs/routes/user.js      | 32 ++------------------------------
 4 files changed, 5 insertions(+), 103 deletions(-)

diff --git a/nodejs/models/token.js b/nodejs/models/token.js
index 8af591d..f497e36 100644
--- a/nodejs/models/token.js
+++ b/nodejs/models/token.js
@@ -61,27 +61,4 @@ class AuthToken extends Token{
 }
 AuthToken.register();
 
-class InviteToken extends Token{
-	static _keyMap = {
-		...super._keyMap,
-		claimed_by: {default:"__NONE__", isRequired: false, type: 'string',},
-	}
-
-	async consume(data){
-		try{
-			if(this.is_valid){
-				data['is_valid'] = false;
-
-				await this.update(data);
-				return true;
-			}
-			return false;
-
-		}catch(error){
-			throw error;
-		}
-	}
-}
-InviteToken.register();
-
-module.exports = {Token, InviteToken, AuthToken};
+module.exports = {Token, AuthToken};
diff --git a/nodejs/models/user_ldap.js b/nodejs/models/user_ldap.js
index 6c6dfa1..0c22d0b 100644
--- a/nodejs/models/user_ldap.js
+++ b/nodejs/models/user_ldap.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const { Client, Attribute, Change } = require('ldapts');
-const {Token, InviteToken} = require('./token');
+const {Token} = require('./token');
 const conf = require('@simpleworkjs/conf').ldap;
 
 const client = new Client({
@@ -141,17 +141,6 @@ User.exists = async function(data){
 	}
 };
 
-User.invite = async function(){
-	try{
-		let token = await InviteToken.add({created_by: this.username});
-		
-		return token;
-
-	}catch(error){
-		throw error;
-	}
-};
-
 User.login = async function(data){
 	try{
 		let user = await this.get(data.username);
diff --git a/nodejs/models/user_pam.js b/nodejs/models/user_pam.js
index ebc83bc..3c1589f 100644
--- a/nodejs/models/user_pam.js
+++ b/nodejs/models/user_pam.js
@@ -2,7 +2,7 @@
 
 const linuxUser = require('linux-sys-user').promise();
 const objValidate = require('../utils/object_validate');
-const {Token, InviteToken} = require('./token');
+const {Token} = require('./token');
 const {promisify} = require('util');
 const pam = require('authenticate-pam');
 const authenticate = promisify(pam.authenticate);
@@ -90,31 +90,6 @@ User.create = async function(data) {
 	}
 };
 
-User.addByInvite = async function(data){
-	try{
-		let token = await InviteToken.get(data.token);
-
-		if(!token.is_valid){
-			let error = new Error('Token Invalid');
-			error.name = 'Token Invalid';
-			error.message = `Token is not valid or as allready been used. ${data.token}`;
-			error.status = 401;
-			throw error;
-		}
-
-		let user = await this.add(data);
-
-		if(user){
-			await token.consume({claimed_by: user.username});
-			return user;
-		}
-
-	}catch(error){
-		throw error;
-	}
-
-};
-
 User.remove = async function(data){
 	try{
 		return await linuxUser.removeUser(this.username);
@@ -133,17 +108,6 @@ User.setPassword = async function(data){
 	}
 };
 
-User.invite = async function(){
-	try{
-		let token = await InviteToken.add({created_by: this.username});
-		
-		return token;
-
-	}catch(error){
-		throw error;
-	}
-};
-
 User.login = async function(data){
 	try{
 		let auth = await authenticate(data.username, data.password);
diff --git a/nodejs/routes/user.js b/nodejs/routes/user.js
index 4195cfc..434d41c 100755
--- a/nodejs/routes/user.js
+++ b/nodejs/routes/user.js
@@ -13,8 +13,8 @@ function validatePassword(password){
 }
 
 // User management is global-admin-only, except the self-service routes below
-// (GET /me, PUT /password, POST /key) which any authenticated user may call for
-// their own account.
+// (GET /me, PUT /password) which any authenticated user may call for their own
+// account.
 
 router.get('/', authz.requireAdmin, async function(req, res, next){
 	try{
@@ -92,32 +92,4 @@ router.put('/password/:username', authz.requireAdmin, async function(req, res, n
 	}
 });
 
-router.post('/invite', authz.requireAdmin, async function(req, res, next){
-	try{
-		let token = await req.user.invite();
-
-		return res.json({token: token.token});
-	}catch(error){
-		next(error);
-	}
-});
-
-// Self-service: add an SSH key to your own account.
-router.post('/key', async function(req, res, next){
-	try{
-		let added = await User.addSSHkey({
-			username: authz.reqUsername(req),
-			key: req.body.key
-		});
-
-		return res.status(added === true ? 200 : 400).json({
-			message: added
-		});
-
-	}catch(error){
-		next(error);
-	}
-
-});
-
 module.exports = router;