feat: add secure invitation and reset links

tests/test_email.py

@@ -9,6 +9,7 @@ from app.config import Config
 from app.email import (
     EmailConfigurationError,
     password_reset_notice_email,
+    registration_invitation_email,
     send_transactional_email,
     verification_code_email,
 )
@@ -31,10 +32,21 @@ class TransactionalEmailTest(unittest.TestCase):
         html = password_reset_notice_email(
             username="<管理员>",
             reset_url="https://example.com/reset?x=1&y=2",
+            minutes=10,
         )
 
         self.assertIn("&lt;管理员&gt;", html)
         self.assertIn("x=1&amp;y=2", html)
+
+    def test_invitation_email_has_one_time_registration_copy(self):
+        html = registration_invitation_email(
+            invitation_url="https://example.com/invite/token",
+            minutes=10,
+        )
+
+        self.assertIn("接受邀请并注册", html)
+        self.assertIn("仅可使用一次", html)
+        self.assertIn("https://example.com/invite/token", html)
     def create_test_app(self, temp_dir: str, *, configured: bool):
         class TestConfig(Config):
             TESTING = True