{identityKnown && identity?.email
? <>This invite is bound to {identity.email}. A few quick details and you're in.
: <>You've been invited to review confidential materials for our Series Seed round. A few quick details and you're in.}
);
}
function Reassure({ label, sub }) {
return (
{label}
{sub}
);
}
// Shown after the cover for identityKnown visitors — they confirm or correct
// the name + firm the admin guessed at invite time. Sent to /api/onboarding
// at the end (along with the 3 question answers) so the investor record is
// updated to whatever they typed.
function ConfirmIdentityStep({ name, setName, firm, setFirm, email, onNext }) {
const canContinue = name.trim().length > 0;
return (
Confirm your details
Signed in as {email}. Confirm your name and firm — we may have guessed wrong from the invite.
);
}
function EmailStep({ email, setEmail }) {
// Read remembered credentials. Email pre-fills; invite token enables a
// one-click sign-in (no email round-trip) so long as the invite is still
// valid server-side. Both are cleared by "Use a different email".
const lastEmail = React.useMemo(() => {
try { return localStorage.getItem('arbcap_last_email') || ''; } catch (e) { return ''; }
}, []);
const cachedToken = React.useMemo(() => {
try { return localStorage.getItem('arbcap_invite_token') || ''; } catch (e) { return ''; }
}, []);
const [recognized, setRecognized] = React.useState(!!lastEmail);
React.useEffect(() => {
if (lastEmail && !email) setEmail(lastEmail);
// eslint-disable-next-line
}, []);
const [busy, setBusy] = React.useState(false);
const [sent, setSent] = React.useState(false);
const [error, setError] = React.useState(null);
const valid = /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email);
const useDifferentEmail = () => {
setRecognized(false);
setEmail('');
try {
localStorage.removeItem('arbcap_last_email');
localStorage.removeItem('arbcap_invite_token');
} catch (e) {}
};
// One-click sign-in: re-redeem the cached invite token. If the server
// says the invite is expired/revoked, drop the cache and fall back to
// the email-based magic-link path.
const signInWithCache = async () => {
if (busy) return;
setBusy(true); setError(null);
try {
const r = await fetch('/api/invite/redeem', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
credentials: 'include',
body: JSON.stringify({ token: cachedToken }),
});
if (r.ok) {
// Cookie is set; reload to bootstrap as authenticated.
window.location.href = window.location.pathname;
return;
}
// Token no good — clear cache and surface the email path.
try { localStorage.removeItem('arbcap_invite_token'); } catch (e) {}
const data = await r.json().catch(() => ({}));
setError(data.error === 'invite_expired' ? 'invite expired'
: data.error === 'invite_revoked' ? 'access revoked'
: 'cached invite no longer valid');
} catch (e) {
setError(e.message);
} finally {
setBusy(false);
}
};
const sendLink = async () => {
if (!valid || busy) return;
setBusy(true); setError(null);
try {
const r = await fetch('/api/auth/request-magic-link', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ email }),
});
if (!r.ok) throw new Error(`HTTP ${r.status}`);
setSent(true);
} catch (e) {
setError(e.message);
} finally {
setBusy(false);
}
};
if (sent) {
return (
Check your inbox
If {email} is on the invite list, a sign-in link is on its way. The link is valid for 30 minutes.
Didn't get it after a minute? Check spam, then{' '}
.
);
}
// Returning-user variant: cached identity. Primary action is a one-click
// sign-in using the stored invite token (no email round-trip). Email-based
// magic link stays as a secondary fallback.
if (recognized) {
return (
Welcome back
{cachedToken
? <>Sign in as {email} on this device.
: <>We'll send a fresh sign-in link to {email}. One click, valid 30 minutes.}