fix(plugin-auth): route invitation accept link through the Console base path

[os-zhuang]

Problem

The "accept invitation" link in invitation emails did not open. On cloud.objectos.ai the link was missing the https:// prefix (relative-looking, unclickable), and it also pointed at the wrong path.

Root cause

sendInvitationEmail built the accept URL straight from config.baseUrl with no scheme guarantee and no UI mount prefix:

const baseUrl = (this.config.baseUrl ?? '').replace(/\/$/, '');
const acceptUrl = `${baseUrl}/accept-invitation/${invitation.id}`;

Two defects:

1. Missing scheme — when baseUrl is a bare host (e.g. cloud.objectos.ai), the result is relative-looking; email clients won't linkify it.
2. Missing Console base path — verified against the objectui Console frontend: the accept-invitation page is a React Router route /accept-invitation/:invitationId mounted under the SPA basename (import.meta.env.BASE_URL = /_console/), the same router that serves /login, /register, /oauth/consent. The Console's own "copy invitation link" action builds ${origin}${BASE_URL}accept-invitation/<id>. The emailed root-path link omitted that prefix and 404'd at the host root.

Fix

The link is now built to match the frontend's canonical form:

const uiBase = (this.config.uiBasePath ?? '/_console').replace(/\/$/, '');
const acceptUrl = `${this.getCanonicalOrigin()}${uiBase}/accept-invitation/${invitation.id}`;

• getCanonicalOrigin() is hardened to always return an absolute origin — it prepends https:// when baseUrl has no scheme, and trims a trailing slash. (This also hardens the OAuth issuer / consent / device-flow URLs that share the helper.)
• The uiBasePath prefix (default /_console, configurable for Console mounted elsewhere) matches loginPage/consentPage construction already in this file and the frontend router.

Result on cloud.objectos.ai: https://cloud.objectos.ai/_console/accept-invitation/<token>.

Verification

Cross-checked against objectstack-ai/objectui:

• apps/console/src/App.tsx — <Route path="/accept-invitation/:invitationId"> inside <BrowserRouter basename={BASENAME}>, alongside /login and /register.
• packages/app-shell/.../InvitationsPage.tsx + InviteMemberDialog.tsx — the "copy link" helper builds ${origin}${BASE_URL}accept-invitation/<id>.

Tests

Added three cases (bare host → https://…/_console/…; explicit scheme preserved; custom uiBasePath honoured). Full @objectstack/plugin-auth suite passes.

Changeset

@objectstack/plugin-auth: patch.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jul 12, 2026 2:17pm

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth.

9 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/deployment/production-readiness.mdx (via @objectstack/plugin-auth)
• content/docs/getting-started/cli.mdx (via @objectstack/plugin-auth)
• content/docs/kernel/services-checklist.mdx (via @objectstack/plugin-auth)
• content/docs/permissions/authentication.mdx (via @objectstack/plugin-auth)
• content/docs/permissions/sso.mdx (via @objectstack/plugin-auth)
• content/docs/plugins/index.mdx (via @objectstack/plugin-auth)
• content/docs/plugins/packages.mdx (via @objectstack/plugin-auth)
• content/docs/releases/implementation-status.mdx (via @objectstack/plugin-auth)
• content/docs/releases/v9.mdx (via @objectstack/plugin-auth)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.