An invited user who registered via BankID was funneled into creating a
company instead of joining the one they were invited to: the register
page's BankID path never processed the gnubok-invite-token cookie
(unlike the login, MFA-verify, and auth-callback paths). Observed in
production 2026-07-24.
- register: BankID signup now accepts the pending invite before routing
to /select-company, mirroring the login page's BankID path.
- lib/company/pending-invites: acceptPendingInviteByToken retries a
missed acceptance from the cookie (pending + unexpired + email match,
same rules as POST /api/team/accept); hasPendingInviteForEmail detects
a stranded invitee whose cookie is gone.
- /onboarding and /select-company retry acceptance from the cookie and
redirect to the dashboard on success, making the auth callback's
long-promised fallback real; with no cookie but a pending invitation,
both surfaces show a 'join via the link in the invitation email' hint
instead of silently asking the invitee to create a company.
- No new accept path without the token: the hint deliberately points
back to the mailed link, so mailbox possession stays required and no
company name is leaked to unverified emails.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Jakob Wennberg
15300aa8e2