13 files changed, 152 insertions, 2 deletions

diff --git a/app/controllers/confirmations_controller.rb b/app/controllers/confirmations_controller.rb
index bc98eab133c..af1faca93f6 100644
--- a/app/controllers/confirmations_controller.rb
+++ b/app/controllers/confirmations_controller.rb
@@ -4,11 +4,11 @@ class ConfirmationsController < Devise::ConfirmationsController
 
   def after_confirmation_path_for(resource_name, resource)
     if signed_in?(resource_name)
-      signed_in_root_path(resource)
+      after_sign_in_path_for(resource)
     else
       sign_in(resource)
       if signed_in?(resource_name)
-        signed_in_root_path(resource)
+        after_sign_in_path_for(resource)
       else
         new_session_path(resource_name)
       end
diff --git a/app/controllers/invites_controller.rb b/app/controllers/invites_controller.rb
new file mode 100644
index 00000000000..8b1f6eeba1b
--- /dev/null
+++ b/app/controllers/invites_controller.rb
@@ -0,0 +1,57 @@
+class InvitesController < ApplicationController
+  before_filter :member
+
+  respond_to :html
+
+  layout 'navless'
+
+  def show
+
+  end
+
+  def accept
+    if member.accept_invite!(current_user)
+      case member.source
+      when Project
+        project = member.source
+        source = "project #{project.name_with_namespace}"
+        path = namespace_project_path(project.namespace, project)
+      when Group
+        group = member.source
+        source = "group #{group.name}"
+        path = group_path(group)
+      else
+        source = "who knows what"
+        path = dashboard_path
+      end
+
+      redirect_to path, notice: "You have been granted #{member.human_access} access to #{source}."
+    else
+      redirect_to :back, alert: "The invite could not be accepted."
+    end
+  end
+
+  private
+
+  def member
+    return @member if defined?(@member)
+    
+    @token = params[:id]
+    if member = Member.find_by_invite_token(@token)
+      @member = member
+    else
+      render_404
+    end
+  end
+
+  def authenticate_user!
+    return if current_user
+
+    notice = "To accept this invitation, sign in"
+    notice << " or create an account" if current_application_settings.signup_enabled?
+    notice << "."
+
+    store_location_for :user, request.fullpath
+    redirect_to new_user_session_path, notice: notice
+  end
+end
diff --git a/app/models/member.rb b/app/models/member.rb
index ec79f531740..d8cc65ca6cb 100644
--- a/app/models/member.rb
+++ b/app/models/member.rb
@@ -52,11 +52,18 @@ class Member < ActiveRecord::Base
 
   delegate :name, :username, :email, to: :user, prefix: true
 
+  def self.find_by_invite_token(invite_token)
+    invite_token = Devise.token_generator.digest(self, :invite_token, invite_token)
+    find_by(invite_token: invite_token)
+  end
+
   def invite?
     self.invite_token.present?
   end
 
   def accept_invite!(new_user)
+    return false unless invite?
+    
     self.invite_token = nil
     self.invite_accepted_at = Time.now.utc
 
diff --git a/app/views/invites/show.html.haml b/app/views/invites/show.html.haml
new file mode 100644
index 00000000000..e2657ac6df2
--- /dev/null
+++ b/app/views/invites/show.html.haml
@@ -0,0 +1,28 @@
+%h3.page-title Invitation
+
+%p
+  You have been invited
+  - if inviter = @member.created_by
+    by
+    = link_to inviter.name, user_url(inviter)
+  to join 
+  - case @member.source
+  - when Project
+    - project = @member.source
+    project
+    %strong
+      = link_to project.name_with_namespace, namespace_project_url(project.namespace, project)
+  - when Group
+    - group = @member.source
+    group
+    %strong
+      = link_to group.name, group_url(group)
+  as #{@member.human_access}.
+
+- if @member.source.users.include?(current_user)
+  %p
+    However, you are already a member of this #{@member.source.is_a?(Group) ? "group" : "project"}.
+    Sign in using a different account to accept the invitation.
+- else
+  .actions
+    = link_to "Accept invitation", accept_invite_url(@token), method: :post, class: "btn btn-success"
diff --git a/app/views/notify/group_invite_accepted_email.html.haml b/app/views/notify/group_invite_accepted_email.html.haml
new file mode 100644
index 00000000000..d50d182102b
--- /dev/null
+++ b/app/views/notify/group_invite_accepted_email.html.haml
@@ -0,0 +1,7 @@
+%p
+  #{@group_member.invite_email}, now known as
+  #{link_to @group_member.user.name, user_url(@group_member.user)},
+  has accepted your invitation to join group
+  = link_to @group.name, group_url(@group)
+  as #{@group_member.human_access}.
+
diff --git a/app/views/notify/group_invite_accepted_email.text.erb b/app/views/notify/group_invite_accepted_email.text.erb
new file mode 100644
index 00000000000..0072f5252da
--- /dev/null
+++ b/app/views/notify/group_invite_accepted_email.text.erb
@@ -0,0 +1,3 @@
+<%= @group_member.invite_email %>, now known as <%= @group_member.user.name %>, has accepted your invitation to join group <%= @group.name %> as <%= @group_member.human_access %>.
+
+<%= group_url(@group) %>
diff --git a/app/views/notify/group_member_invited_email.html.haml b/app/views/notify/group_member_invited_email.html.haml
new file mode 100644
index 00000000000..39798a2c0e6
--- /dev/null
+++ b/app/views/notify/group_member_invited_email.html.haml
@@ -0,0 +1,12 @@
+%p
+  You have been invited
+  - if inviter = @group_member.created_by
+    by
+    = link_to inviter.name, user_url(inviter)
+  to join group
+  = link_to @group.name, group_url(@group)
+  as #{@group_member.human_access}.
+
+%p
+  = link_to 'Accept invitation', invite_url(@token)
+
diff --git a/app/views/notify/group_member_invited_email.text.erb b/app/views/notify/group_member_invited_email.text.erb
new file mode 100644
index 00000000000..dec0cf0d01e
--- /dev/null
+++ b/app/views/notify/group_member_invited_email.text.erb
@@ -0,0 +1,3 @@
+You have been invited <%= "by #{@group_member.created_by.name} " if @group_member.created_by %>to join group <%= @group.name %> as <%= @group_member.human_access %>.
+
+Accept invitation: <%= invite_url(@token) %>
diff --git a/app/views/notify/project_invite_accepted_email.html.haml b/app/views/notify/project_invite_accepted_email.html.haml
new file mode 100644
index 00000000000..0c01eef7621
--- /dev/null
+++ b/app/views/notify/project_invite_accepted_email.html.haml
@@ -0,0 +1,7 @@
+%p
+  #{@project_member.invite_email}, now known as
+  #{link_to @project_member.user.name, user_url(@project_member.user)},
+  has accepted your invitation to join project
+  = link_to @project.name_with_namespace, namespace_project_url(@project.namespace, @project)
+  as #{@project_member.human_access}.
+
diff --git a/app/views/notify/project_invite_accepted_email.text.erb b/app/views/notify/project_invite_accepted_email.text.erb
new file mode 100644
index 00000000000..e90217c1ab2
--- /dev/null
+++ b/app/views/notify/project_invite_accepted_email.text.erb
@@ -0,0 +1,3 @@
+<%= @project_member.invite_email %>, now known as <%= @project_member.user.name %>, has accepted your invitation to join project <%= @group.name_with_namespace %> as <%= @project_member.human_access %>.
+
+<%= namespace_project_url(@project.namespace, @project) %>
diff --git a/app/views/notify/project_member_invited_email.html.haml b/app/views/notify/project_member_invited_email.html.haml
new file mode 100644
index 00000000000..f44adc244c9
--- /dev/null
+++ b/app/views/notify/project_member_invited_email.html.haml
@@ -0,0 +1,11 @@
+%p
+  You have been invited 
+  - if inviter = @project_member.created_by
+    by
+    = link_to inviter.name, user_url(inviter)
+  to join project
+  = link_to @project.name_with_namespace, namespace_project_url(@project.namespace, @project)
+  as #{@project_member.human_access}.
+
+%p
+  = link_to 'Accept invitation', invite_url(@token)
diff --git a/app/views/notify/project_member_invited_email.text.erb b/app/views/notify/project_member_invited_email.text.erb
new file mode 100644
index 00000000000..55b16ef6c56
--- /dev/null
+++ b/app/views/notify/project_member_invited_email.text.erb
@@ -0,0 +1,3 @@
+You have been invited <%= "by #{@project_member.created_by.name} " if @project_member.created_by %>to join project <%= @project.name_with_namespace %> as <%= @project_member.human_access %>.
+
+Accept invitation: <%= invite_url(@token) %>
diff --git a/config/routes.rb b/config/routes.rb
index de21f418329..bd2a791f94a 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -53,6 +53,15 @@ Gitlab::Application.routes.draw do
   end
   get '/s/:username' => 'snippets#user_index', as: :user_snippets, constraints: { username: /.*/ }
 
+  #
+  # Invites
+  #
+
+  resources :invites, only: [:show], constraints: { id: /[A-Za-z0-9_-]+/ } do
+    member do
+      post :accept
+    end
+  end
 
   #
   # Import