One full-stack developer for the database, the API and the front end.

migrations/007_invites.sqlsql

create table invites (
  id          uuid primary key default gen_random_uuid(),
  team_id     uuid not null references teams (id) on delete cascade,
  email       text not null,
  token_hash  bytea not null unique,       -- the token itself is only ever emailed
  expires_at  timestamptz not null default now() + interval '7 days',
  accepted_at timestamptz
);

-- One open invite per person per team, whatever the email's capitalisation.
create unique index invites_one_open
  on invites (team_id, lower(email))
  where accepted_at is null;

Why:The database enforces the rules too. Only a hash of the invite token is stored, invites expire on their own, and the same person can't have two open invites to one team.

src/routes/invites.tsts

import { randomBytes, createHash } from 'node:crypto';
import { z } from 'zod';

const Invite = z.object({ email: z.string().trim().email().max(254) });

// requireRole checks the signed-in user is an owner of this team.
router.post('/teams/:teamId/invites', requireRole('owner'), async (req, res) => {
  const parsed = Invite.safeParse(req.body);
  if (!parsed.success) return res.status(422).json({ error: 'Enter a valid email address.' });

  const token = randomBytes(32).toString('base64url');
  const tokenHash = createHash('sha256').update(token).digest();
  try {
    await db.query(
      'insert into invites (team_id, email, token_hash) values ($1, $2, $3)',
      [req.params.teamId, parsed.data.email, tokenHash],
    );
  } catch (err: any) {
    if (err.code === '23505') return res.status(409).json({ error: 'That person already has an invite.' });
    throw err;
  }

  await queue.add('send-invite', { email: parsed.data.email, token });
  res.status(201).end();
});

Why:Input is validated at the boundary, only owners can invite, and the database's uniqueness rule becomes a clear 409 instead of a 500. The email is sent from the queue, so the request returns at once.

app/team/InviteForm.tsxtsx

'use client';
import { useState } from 'react';

type State = { status: 'idle' | 'sending' | 'sent' | 'error'; message?: string };

export function InviteForm({ teamId }: { teamId: string }) {
  const [state, setState] = useState<State>({ status: 'idle' });

  async function onSubmit(e: React.FormEvent<HTMLFormElement>) {
    e.preventDefault();
    const email = new FormData(e.currentTarget).get('email');
    setState({ status: 'sending' });
    const res = await fetch(`/api/teams/${teamId}/invites`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ email }),
    });
    if (res.ok) return setState({ status: 'sent', message: 'Invite sent.' });
    const { error } = await res.json().catch(() => ({ error: 'Something went wrong. Try again.' }));
    setState({ status: 'error', message: error });
  }

  return (
    <form onSubmit={onSubmit}>
      <label htmlFor="invite-email">Teammate's email</label>
      <input id="invite-email" name="email" type="email" required autoComplete="off" />
      <button disabled={state.status === 'sending'}>
        {state.status === 'sending' ? 'Sending…' : 'Send invite'}
      </button>
      <p role="status">{state.message}</p>
    </form>
  );
}

Why:The screen shows the API's own error messages, disables the button while sending and announces the result to screen readers, so the feature works for everyone, not just on the happy path.

test/invites.test.tsts

import { test } from 'node:test';
import assert from 'node:assert/strict';
import request from 'supertest';
import { app } from '../src/app';
import { loginAs } from './helpers';

test('owners can invite, and a duplicate gets a clear 409', async () => {
  const owner = await loginAs('owner');
  const invite = () =>
    request(app)
      .post(`/teams/${owner.teamId}/invites`)
      .set('Cookie', owner.cookie)
      .send({ email: '[email protected]' });

  assert.equal((await invite()).status, 201);
  assert.equal((await invite()).status, 409);
});

test('members cannot invite', async () => {
  const member = await loginAs('member');
  const res = await request(app)
    .post(`/teams/${member.teamId}/invites`)
    .set('Cookie', member.cookie)
    .send({ email: '[email protected]' });
  assert.equal(res.status, 403);
});

Why:The tests hit the real API and database, so they prove the whole feature works, including who is allowed to use it, before it ships.