From d603ee8820d562e03087bbc2169bd5431f2bcdd7 Mon Sep 17 00:00:00 2001
From: ValueOn AG <p.motsch@valueon.ch>
Date: Tue, 3 Mar 2026 23:07:49 +0100
Subject: [PATCH] 2 critical fixes: pwd reset and invitation caching ui

---
 src/pages/InvitePage.tsx | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/src/pages/InvitePage.tsx b/src/pages/InvitePage.tsx
index c0bdfbd..9193e17 100644
--- a/src/pages/InvitePage.tsx
+++ b/src/pages/InvitePage.tsx
@@ -25,6 +25,7 @@ import React, { useState, useEffect } from 'react';
 import { useParams, useNavigate, Link } from 'react-router-dom';
 import { useInvitations, type InvitationValidation } from '../hooks/useInvitations';
 import api from '../api';
+import { getUserDataCache } from '../utils/userCache';
 import { FaCheckCircle, FaTimesCircle, FaSpinner, FaSignInAlt, FaUserPlus } from 'react-icons/fa';
 import styles from './InvitePage.module.css';
 
@@ -45,6 +46,7 @@ export const InvitePage: React.FC = () => {
   const [accepting, setAccepting] = useState(false);
   const [success, setSuccess] = useState(false);
   const [error, setError] = useState<string | null>(null);
+  const [userMismatch, setUserMismatch] = useState(false);
   const [userExists, setUserExists] = useState<boolean | null>(null);
 
   // Validate token on mount
@@ -84,6 +86,14 @@ export const InvitePage: React.FC = () => {
         }
       }
 
+      if (result.valid && isAuthenticated && result.targetUsername) {
+        const cachedUser = getUserDataCache();
+        if (cachedUser?.username && cachedUser.username.toLowerCase() !== result.targetUsername.toLowerCase()) {
+          localStorage.removeItem(PENDING_INVITATION_KEY);
+          setUserMismatch(true);
+        }
+      }
+
       setValidating(false);
     };
 
@@ -190,6 +200,29 @@ export const InvitePage: React.FC = () => {
     );
   }
 
+  // Authenticated but invitation is for a different user
+  if (userMismatch && validation?.valid) {
+    const cachedUser = getUserDataCache();
+    return (
+      <div className={styles.container}>
+        <div className={styles.card}>
+          <div className={styles.errorState}>
+            <FaTimesCircle className={styles.errorIcon} />
+            <h1>Falsche Anmeldung</h1>
+            <p>
+              Diese Einladung ist für <strong>{validation.targetUsername}</strong> bestimmt.
+              Sie sind als <strong>{cachedUser?.username || 'anderer Benutzer'}</strong> angemeldet.
+            </p>
+            <p>Bitte melden Sie sich ab und mit dem richtigen Konto wieder an.</p>
+            <Link to="/" className={styles.primaryButton}>
+              Zum Dashboard
+            </Link>
+          </div>
+        </div>
+      </div>
+    );
+  }
+
   // Already authenticated - show accept button
   const isFeatureInvite = !!validation.featureInstanceId;
   const introText = isFeatureInvite