feat(cli): tapir invite <email> + TAPIR_PUBLIC_URL config

Mints a single-use invitation and prints the absolute claim URL for the
operator to send. The URL base is TAPIR_PUBLIC_URL (default
https://tapir.d-ma.be). runInvite is factored from config/store wiring so
it's unit-tested against a fake inviter — no Postgres.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

cmd/tapir/invite.go

@@ -0,0 +1,61 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+	"time"
+
+	"gitea.d-ma.be/mathias/tapir/internal/adapters/store"
+	"gitea.d-ma.be/mathias/tapir/internal/config"
+)
+
+// inviteTTL is how long a minted invite stays claimable. A week is generous for a
+// human to act on an emailed link without leaving a stale capability around.
+const inviteTTL = 7 * 24 * time.Hour
+
+// inviter is the narrow store capability cmdInvite needs — minting an invitation.
+// Defined here (not store) so runInvite is testable with a fake, no Postgres.
+type inviter interface {
+	CreateInvitation(ctx context.Context, email string, ttl time.Duration) (string, error)
+}
+
+// cmdInvite mints an invitation for an email and prints the claim URL. Host-side
+// only (no Dex session): the operator runs it, copies the link, and sends it.
+// Usage: tapir invite <email>.
+func cmdInvite(ctx context.Context, args []string) error {
+	if len(args) < 1 || strings.TrimSpace(args[0]) == "" {
+		return fmt.Errorf("usage: tapir invite <email>")
+	}
+	email := strings.TrimSpace(args[0])
+
+	cfg, err := config.Load()
+	if err != nil {
+		return err
+	}
+	if strings.TrimSpace(cfg.DBDSN) == "" {
+		return fmt.Errorf("missing required config: TAPIR_DB_DSN")
+	}
+
+	st, err := store.New(ctx, cfg.DBDSN)
+	if err != nil {
+		return err
+	}
+	defer st.Close()
+
+	return runInvite(ctx, st, os.Stdout, cfg.PublicURL, email)
+}
+
+// runInvite is the testable core: mint the token and print the absolute claim URL
+// to w. Pure of config/store construction so a fake inviter exercises it.
+func runInvite(ctx context.Context, inv inviter, w io.Writer, publicURL, email string) error {
+	token, err := inv.CreateInvitation(ctx, email, inviteTTL)
+	if err != nil {
+		return fmt.Errorf("create invitation: %w", err)
+	}
+	base := strings.TrimRight(strings.TrimSpace(publicURL), "/")
+	_, err = fmt.Fprintf(w, "Invite URL (valid 7 days):\n%s/invite/%s\n", base, token)
+	return err
+}

cmd/tapir/invite_test.go

@@ -0,0 +1,59 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// fakeInviter records the mint call and returns a canned token.
+type fakeInviter struct {
+	token     string
+	err       error
+	gotEmail  string
+	gotTTL    time.Duration
+	callCount int
+}
+
+func (f *fakeInviter) CreateInvitation(_ context.Context, email string, ttl time.Duration) (string, error) {
+	f.callCount++
+	f.gotEmail, f.gotTTL = email, ttl
+	return f.token, f.err
+}
+
+func TestRunInvitePrintsURL(t *testing.T) {
+	inv := &fakeInviter{token: "deadbeefcafe"}
+	var out strings.Builder
+
+	err := runInvite(context.Background(), inv, &out, "https://tapir.d-ma.be", "new@example.com")
+	require.NoError(t, err)
+
+	require.Equal(t, "new@example.com", inv.gotEmail)
+	require.Equal(t, inviteTTL, inv.gotTTL)
+	got := out.String()
+	require.Contains(t, got, "https://tapir.d-ma.be/invite/deadbeefcafe")
+	require.Contains(t, got, "valid 7 days")
+}
+
+func TestRunInviteTrimsTrailingSlash(t *testing.T) {
+	inv := &fakeInviter{token: "tok"}
+	var out strings.Builder
+
+	err := runInvite(context.Background(), inv, &out, "https://tapir.d-ma.be/", "x@example.com")
+	require.NoError(t, err)
+	require.Contains(t, out.String(), "https://tapir.d-ma.be/invite/tok")
+	require.NotContains(t, out.String(), "//invite")
+}
+
+func TestRunInvitePropagatesError(t *testing.T) {
+	inv := &fakeInviter{err: errors.New("db down")}
+	var out strings.Builder
+
+	err := runInvite(context.Background(), inv, &out, "https://tapir.d-ma.be", "x@example.com")
+	require.Error(t, err)
+	require.Empty(t, out.String())
+}

cmd/tapir/main.go

@@ -53,6 +53,8 @@ func main() {
 		err = cmdRun(ctx, log)
 	case "serve":
 		err = cmdServe(ctx, log)
+	case "invite":
+		err = cmdInvite(ctx, os.Args[2:])
 	default:
 		usage()
 		os.Exit(2)
@@ -71,6 +73,7 @@ usage:
   tapir auth              one-time: authorize YouTube and store a refresh token
   tapir run               detect new videos, summarize, deliver to your store
   tapir serve             run the web UI (read summaries, record watch/skip/save)
+  tapir invite <email>    mint an invitation link for a new user (host-side)
   tapir list [-limit N]   list stored summaries, recent first
   tapir show <video-id>   show one summary in full