// ForkWelcome — single-screen modal shown when /api/invite/redeem
// detects a new device on an existing invite.
//
// Decides what happens after the visitor types their email by routing
// the call to /api/invite/identify (server-side decides the tier).
// Four terminal states drive the UI:
//
// ok / owner_resumed → full reload, bootstrap picks up the session
// suggest_typo → inline "Did you mean…?" prompt
// magic_link_sent → "Check your inbox" with resend button
// pending_approval → cross-firm request queued for admin approval
// error → inline error, retry
//
// The screen is rendered in place of the room via app.jsx bootstrap
// (no router; just conditional render).
function ForkWelcome({ tweaks, ownerName, ownerFirm }) {
// Pre-fill email from localStorage if the visitor was previously
// seen on a different device. Reduces friction without leaking
// identity — only the cache on THIS browser is read.
const cachedEmail = React.useMemo(() => {
try { return localStorage.getItem('arbcap_last_email') || ''; }
catch { return ''; }
}, []);
const [email, setEmail] = React.useState(cachedEmail);
const [name, setName] = React.useState('');
const [state, setState] = React.useState('form'); // form | submitting | suggest_typo | magic_link_sent | error
const [error, setError] = React.useState(null);
const [suggested, setSuggested] = React.useState(null);
const [sentTo, setSentTo] = React.useState(null);
const [resendCount, setResendCount] = React.useState(0);
const looksLikeEmail = (v) => /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(v.trim());
const valid = looksLikeEmail(email);
const submit = async ({ emailOverride, skipTypoCheck } = {}) => {
const targetEmail = (emailOverride || email).trim();
if (!looksLikeEmail(targetEmail)) {
setError('Please enter a valid email address.');
return;
}
setState('submitting');
setError(null);
try {
const r = await fetch('/api/invite/identify', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
credentials: 'include',
body: JSON.stringify({
email: targetEmail,
name: name.trim() || null,
skip_typo_check: !!skipTypoCheck,
}),
});
const data = await r.json().catch(() => ({}));
if (!r.ok) {
setError(data.status || `HTTP ${r.status}`);
setState('form');
return;
}
if (data.status === 'ok' || data.status === 'owner_resumed') {
try { localStorage.setItem('arbcap_last_email', targetEmail); } catch {}
// Server set the session cookie. Reload bootstraps with the
// new session and lands the visitor in the room.
window.location.href = '/';
return;
}
if (data.status === 'suggest_typo') {
setSuggested(data.suggested_email);
setState('suggest_typo');
return;
}
if (data.status === 'magic_link_sent') {
setSentTo(data.email || targetEmail);
setState('magic_link_sent');
return;
}
if (data.status === 'pending_approval') {
setSentTo(data.email || targetEmail);
setState('pending_approval');
return;
}
setError(data.status || 'unknown_response');
setState('form');
} catch (e) {
setError(e.message || 'network_error');
setState('form');
}
};
const acceptSuggestion = () => {
setEmail(suggested);
submit({ emailOverride: suggested, skipTypoCheck: false });
};
const rejectSuggestion = () => {
submit({ skipTypoCheck: true });
};
const resend = () => {
setResendCount(c => c + 1);
submit({ skipTypoCheck: true });
};
// ── Brand frame (mirrors onboarding.jsx layout) ────────────────
return (
{typeof ArbWordmark === 'function' ? : null}
Welcome.
{ownerName
? <>{ownerName}{ownerFirm ? ` (${ownerFirm})` : ''} shared the Arb Capital data room with you.
: <>Someone shared the Arb Capital data room with you.}
{/* Keep the inbox screen mounted during a resend-triggered
re-submit (sentTo is the marker that we've already passed
magic_link_sent at least once). Otherwise the form
briefly flashes back to the email-entry screen between
the click and the response, which reads as if the link
never went out — exactly the wrong signal at the moment
the user is anxious about delivery. */}
{state === 'pending_approval' ? (
) : state === 'magic_link_sent' || (state === 'submitting' && sentTo) ? (
) : state === 'suggest_typo' ? (
) : (
submit()}
/>
)}
{error === 'no_pending_fork' ? 'Your welcome link expired. Open the invite link again.'
: error === 'pending_expired' ? 'Your welcome link expired. Open the invite link again.'
: error === 'already_identified' ? 'This invite was already claimed. Open the original invite link.'
: error === 'invalid_email' ? 'That doesn\'t look like a valid email address.'
: error === 'rate_limited' ? 'Too many attempts. Please wait a few minutes and try again.'
: error}
)}
If your firm is already in the room, you're in right away. If you're joining from a different organisation, your request is reviewed by our team and we'll email you a sign-in link once it's approved.
);
}
// Cross-firm request queued for admin approval. No access yet — the
// requester waits for the approval email (sent by api/admin/share-request.js
// once JB approves). Mirrors the mockup signed off with JB (2026-07-02).
function ForkPendingApproval({ requesterEmail, ownerName }) {
return (
<>
Awaiting approval
Request submitted
Thanks. Your request to access the Arb Capital data room has been sent to the team and will be processed shortly.
{ownerName ? `${ownerName} shared this room with you. ` : 'This room was shared with you. '}
Because you're joining from a different organisation, a team member reviews the request before access is granted.
Once approved, we'll email a secure sign-in link to{' '}
{requesterEmail}. You can close this tab in the meantime.
No access is granted until approval. The sign-in link is single-use and expires 30 minutes after it's sent.