feat: refine admin access management

tests/invite-policies.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, test } from "vitest"
+
+import {
+  canReactivateInvite,
+  isWithinInviteReactivationWindow,
+  INVITE_REACTIVATION_WINDOW_DAYS,
+} from "@/lib/invite-policies"
+
+describe("invite reactivation policies", () => {
+  test("isWithinInviteReactivationWindow respects configured window", () => {
+    const now = new Date("2025-10-18T12:00:00Z")
+    const insideWindow = new Date(now.getTime() - (INVITE_REACTIVATION_WINDOW_DAYS - 1) * 24 * 60 * 60 * 1000)
+    const outsideWindow = new Date(now.getTime() - (INVITE_REACTIVATION_WINDOW_DAYS + 1) * 24 * 60 * 60 * 1000)
+
+    expect(isWithinInviteReactivationWindow(insideWindow, now)).toBe(true)
+    expect(isWithinInviteReactivationWindow(outsideWindow, now)).toBe(false)
+    expect(isWithinInviteReactivationWindow(null, now)).toBe(false)
+    expect(isWithinInviteReactivationWindow("invalid-date", now)).toBe(false)
+  })
+
+  test("canReactivateInvite returns true only for revoked invites within window", () => {
+    const now = new Date("2025-10-18T12:00:00Z")
+    const revokedRecently = {
+      status: "revoked",
+      revokedAt: new Date(now.getTime() - 2 * 24 * 60 * 60 * 1000),
+    }
+    const revokedLongAgo = {
+      status: "revoked",
+      revokedAt: new Date(now.getTime() - 10 * 24 * 60 * 60 * 1000),
+    }
+    const pendingInvite = {
+      status: "pending",
+      revokedAt: null,
+    }
+
+    expect(canReactivateInvite(revokedRecently, now)).toBe(true)
+    expect(canReactivateInvite(revokedLongAgo, now)).toBe(false)
+    expect(canReactivateInvite(pendingInvite, now)).toBe(false)
+  })
+})
+