From 4bf404beecb22613c8dfc3911fcf56e6cd7f50fa Mon Sep 17 00:00:00 2001
From: Allan Lasser <lasser.allan@gmail.com>
Date: Mon, 20 Apr 2026 16:38:43 -0400
Subject: [PATCH 1/6] Restrict org admin invitation actions to users with
 confirmed emails

---
 frontend/css/gps.css                          | 11 +++++--
 squarelet/organizations/models/invitation.py  |  4 +++
 squarelet/organizations/tests/test_views.py   | 31 +++++++++++++++++++
 squarelet/organizations/views/members.py      | 10 ++++++
 .../organizations/invitation_detail.html      | 20 ++++++++++++
 .../organizations/organization_list.html      | 20 +-----------
 .../organization_managemembers.html           |  8 ++---
 7 files changed, 79 insertions(+), 25 deletions(-)

diff --git a/frontend/css/gps.css b/frontend/css/gps.css
index 8285d3990..301fcac10 100644
--- a/frontend/css/gps.css
+++ b/frontend/css/gps.css
@@ -442,6 +442,7 @@ strong {
 
 .empty {
   display: flex;
+  margin: 0 auto;
   width: 16.5rem;
   padding: 1.5rem;
   flex-direction: column;
@@ -453,12 +454,18 @@ strong {
   border: 1.282px solid var(--Gray-2, #d8dee2);
 }
 
+.empty--no-border {
+  border: none;
+}
+
 .empty p {
   align-self: stretch;
-  margin: 0;
+  font-family: "Source Sans Pro";
+  line-height: 1.4;
   color: var(--gray-4);
+  margin: 0 auto;
   text-align: center;
-  font-family: "Source Sans Pro";
+  max-width: 60ch;
 }
 
 .card {
diff --git a/squarelet/organizations/models/invitation.py b/squarelet/organizations/models/invitation.py
index a5869022e..f25b70753 100644
--- a/squarelet/organizations/models/invitation.py
+++ b/squarelet/organizations/models/invitation.py
@@ -103,6 +103,10 @@ class Meta:
     def __str__(self):
         return f"Invitation: {self.uuid}"
 
+    @property
+    def is_admin_role(self):
+        return self.role == InvitationRole.admin
+
     def send(self):
 
         if self.request:
diff --git a/squarelet/organizations/tests/test_views.py b/squarelet/organizations/tests/test_views.py
index 14fc99a9f..13b0b019a 100644
--- a/squarelet/organizations/tests/test_views.py
+++ b/squarelet/organizations/tests/test_views.py
@@ -1641,6 +1641,13 @@ class TestInvitationAccept(ViewTestMixin):
     view = views.InvitationAccept
     url = "/organizations/{uuid}/invitation/"
 
+    def _create_verified_email(self, user):
+        EmailAddress.objects.update_or_create(
+            user=user,
+            email=user.email,
+            defaults={"verified": True, "primary": True},
+        )
+
     def test_accept(self, rf, invitation_factory, user_factory):
         invitation = invitation_factory()
         user = user_factory()
@@ -1649,6 +1656,30 @@ def test_accept(self, rf, invitation_factory, user_factory):
         assert invitation.accepted_at is not None
         assert invitation.organization.has_member(user)
 
+    def test_accept_admin_requires_verified_email(
+        self, rf, invitation_factory, user_factory
+    ):
+        """Users without a verified email cannot accept admin invitations"""
+        invitation = invitation_factory(role=InvitationRole.admin)
+        user = user_factory()
+        response = self.call_view(rf, user, {"action": "accept"}, uuid=invitation.uuid)
+        invitation.refresh_from_db()
+        assert invitation.accepted_at is None
+        assert not invitation.organization.has_member(user)
+        assert response.status_code == 302
+
+    def test_accept_admin_with_verified_email(
+        self, rf, invitation_factory, user_factory
+    ):
+        """Users with a verified email can accept admin invitations"""
+        invitation = invitation_factory(role=InvitationRole.admin)
+        user = user_factory()
+        self._create_verified_email(user)
+        self.call_view(rf, user, {"action": "accept"}, uuid=invitation.uuid)
+        invitation.refresh_from_db()
+        assert invitation.accepted_at is not None
+        assert invitation.organization.has_member(user)
+
     def test_reject(self, rf, invitation_factory, user_factory):
         invitation = invitation_factory()
         user = user_factory()
diff --git a/squarelet/organizations/views/members.py b/squarelet/organizations/views/members.py
index c602fc431..00816fd70 100644
--- a/squarelet/organizations/views/members.py
+++ b/squarelet/organizations/views/members.py
@@ -280,6 +280,16 @@ def post(self, request, *args, **kwargs):
         invitation = self.get_object()
         action = request.POST.get("action")
         if action == "accept":
+            if (
+                invitation.role == InvitationRole.admin
+                and not request.user.emailaddress_set.filter(verified=True).exists()
+            ):
+                messages.error(
+                    request,
+                    "You must verify your email address before accepting "
+                    "an admin invitation.",
+                )
+                return redirect("organizations:invitation", uuid=invitation.uuid)
             invitation.accept(request.user)
             messages.success(request, "Invitation accepted")
 
diff --git a/squarelet/templates/organizations/invitation_detail.html b/squarelet/templates/organizations/invitation_detail.html
index 6e623582a..a3fe306a3 100644
--- a/squarelet/templates/organizations/invitation_detail.html
+++ b/squarelet/templates/organizations/invitation_detail.html
@@ -2,6 +2,7 @@
 {% load static %}
 {% load thumbnail %}
 {% load i18n %}
+{% load email_verification %}
 
 {% block title %}Organization: {{ invitation.organization.name }}{% endblock %}
 
@@ -52,6 +53,13 @@ <h2>
           out and sign back in with the account you'd like to use.
         {% endblocktrans %}
       </p>
+      {% if invitation.is_admin_role and not request.user|has_verified_email %}
+      <p>
+        {% blocktrans %}
+          You must verify your email address before you can accept an admin invitation.
+        {% endblocktrans %}
+      </p>
+      {% endif %}
       {% else %}
       <p>
         {% blocktrans %}
@@ -75,6 +83,17 @@ <h2>
       {% endif %}
 
       {% if request.user.is_authenticated %}
+        {% if invitation.is_admin_role and not request.user|has_verified_email %}
+        <div class="control-group">
+          <form class="email-actions" action="{% url "account_email" %}" method="post">
+            {% csrf_token %}
+            <input type="hidden" name="email" value="{{request.user.email}}" />
+            <button class="button primary" type="submit" name="action_send">
+              {% trans "Verify your email address" %}
+            </button>
+          </form>
+        </div>
+        {% else %}
         <div class="control-group">
             <button class="button primary" type="submit" name="action" value="accept">
               {% trans "Accept" %}
@@ -84,6 +103,7 @@ <h2>
             </button>
           </div>
         </div>
+        {% endif %}
       {% else %}
         <div class="control-group">
             <a href="{% url "account_signup" %}?next={{request.path}}" class="button primary">
diff --git a/squarelet/templates/organizations/organization_list.html b/squarelet/templates/organizations/organization_list.html
index bec8fc644..f7411cae3 100644
--- a/squarelet/templates/organizations/organization_list.html
+++ b/squarelet/templates/organizations/organization_list.html
@@ -1,5 +1,5 @@
 {% extends "base.html" %}
-{% load static i18n avatar django_vite email_verification %}
+{% load static i18n avatar django_vite %}
 
 {% block title %}Organizations{% endblock %}
 
@@ -102,23 +102,6 @@ <h2>{% trans "Your organizations" %}</h2>
     </section>
 
     <section class="invites">
-      {% if not request.user|has_verified_email %}
-      <div class="empty">
-        <p>
-          {% blocktrans %}
-          You must verify your email address before you can send requests
-          or receive invitations to join an organization.
-          {% endblocktrans %}
-        </p>
-        <form class="email-actions" action="{% url "account_email" %}" method="post">
-          {% csrf_token %}
-          <input type="hidden" name="email" value="{{user.email}}" />
-          <button class="btn primary small" type="submit" name="action_send">
-            {% trans "Confirm your email address" %}
-          </button>
-        </form>
-      </div>
-      {% else %}
         {% if potential_orgs %}
         <div id="pre-approved" class="pre-approved">
           <header>
@@ -213,7 +196,6 @@ <h2>{% trans "Pending requests" %}</h2>
           </div>
           {% endif %}
         </div>
-      {% endif %}
     </section>
   </main>
 </article>
diff --git a/squarelet/templates/organizations/organization_managemembers.html b/squarelet/templates/organizations/organization_managemembers.html
index 57aa86a61..90e78b9cb 100644
--- a/squarelet/templates/organizations/organization_managemembers.html
+++ b/squarelet/templates/organizations/organization_managemembers.html
@@ -144,8 +144,8 @@ <h2>
         </form>
       </div>
       {% empty %}
-      <div class="empty">
-        <h3>No pending requests</h3>
+      <div class="empty empty--no-border">
+        <p>No pending requests</p>
       </div>
       {% endfor %}
     </div>
@@ -207,8 +207,8 @@ <h2>
           </div>
         </div>
       {% empty %}
-        <div class="empty">
-          <h3>No pending invitations</h3>
+        <div class="empty empty--no-border">
+          <p>No pending invitations</p>
         </div>
       {% endfor %}
       </div>

From df5421822ac27b4613ddb113ed18f5f46146f6f0 Mon Sep 17 00:00:00 2001
From: Allan Lasser <lasser.allan@gmail.com>
Date: Tue, 21 Apr 2026 10:45:39 -0400
Subject: [PATCH 2/6] Creates reusable InvitationAcceptForm that can be bound
 to an invitation

---
 squarelet/organizations/forms.py              | 45 +++++++++++++++++++
 squarelet/organizations/views/detail.py       |  9 +++-
 squarelet/organizations/views/members.py      | 26 ++++++-----
 .../account/onboarding/join_org.html          | 10 +----
 .../organizations/invitation_accept_form.html | 20 +++++++++
 .../organizations/invitation_detail.html      |  5 +--
 .../organizations/organization_list.html      | 10 +----
 .../organizations/your_organizations.html     | 10 +----
 .../templates/users/user_invitations.html     | 10 +----
 squarelet/users/onboarding.py                 |  2 +
 squarelet/users/views.py                      | 12 ++++-
 11 files changed, 106 insertions(+), 53 deletions(-)
 create mode 100644 squarelet/templates/organizations/invitation_accept_form.html

diff --git a/squarelet/organizations/forms.py b/squarelet/organizations/forms.py
index d2f6ce55d..2c7b23e9c 100644
--- a/squarelet/organizations/forms.py
+++ b/squarelet/organizations/forms.py
@@ -282,6 +282,51 @@ class AddMemberForm(forms.Form):
     )
 
 
+class InvitationAcceptForm(forms.Form):
+    """
+    Validates that a user can accept an invitation.
+    Admin-role invitations require the user to have a verified email address.
+    Exposes a class method to bind the class to an Invitation object.
+    """
+
+    template_name = "organizations/invitation_accept_form.html"
+
+    def __init__(self, *args, invitation, user, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.invitation = invitation
+        self.user = user
+
+    @property
+    def requires_email_verification(self):
+        return (
+            self.invitation.role == InvitationRole.admin
+            and not self.user.emailaddress_set.filter(verified=True).exists()
+        )
+
+    def clean(self):
+        cleaned_data = super().clean()
+        if self.requires_email_verification:
+            raise forms.ValidationError(
+                _("You must verify your email address before accepting "
+                  "an admin invitation.")
+            )
+        return cleaned_data
+
+    def get_context(self):
+        context = super().get_context()
+        context["invitation"] = self.invitation
+        context["user"] = self.user
+        context["requires_email_verification"] = self.requires_email_verification
+        return context
+
+    @classmethod
+    def attach_to_invitations(cls, invitations, user):
+        """Attach an accept_form to each invitation in the list."""
+        for invitation in invitations:
+            invitation.accept_form = cls(invitation=invitation, user=user)
+        return invitations
+
+
 class MergeForm(forms.Form):
     """A form to merge two organizations"""
 
diff --git a/squarelet/organizations/views/detail.py b/squarelet/organizations/views/detail.py
index 7355d4685..0048815be 100644
--- a/squarelet/organizations/views/detail.py
+++ b/squarelet/organizations/views/detail.py
@@ -18,6 +18,7 @@
 # Squarelet
 from squarelet.core.mixins import AdminLinkMixin
 from squarelet.core.utils import get_redirect_url, is_rate_limited, new_action
+from squarelet.organizations.forms import InvitationAcceptForm
 from squarelet.organizations.models import Invitation, Membership, Organization, Plan
 from squarelet.organizations.tasks import sync_wix
 
@@ -353,7 +354,9 @@ def get_context_data(self, **kwargs):
         context["potential_orgs"] = []
         if user.is_authenticated:
             context["pending_requests"] = list(user.get_pending_requests())
-            context["pending_invitations"] = list(user.get_pending_invitations())
+            context["pending_invitations"] = InvitationAcceptForm.attach_to_invitations(
+                list(user.get_pending_invitations()), user
+            )
             context["potential_orgs"] = list(user.get_potential_organizations())
 
         context["has_pending"] = bool(
@@ -370,7 +373,9 @@ def get_context_data(self, **kwargs):
             ).get_viewable(self.request.user)
         )
         context["potential_organizations"] = list(user.get_potential_organizations())
-        context["pending_invitations"] = list(user.get_pending_invitations())
+        context["pending_invitations"] = InvitationAcceptForm.attach_to_invitations(
+            list(user.get_pending_invitations()), user
+        )
 
         return context
 
diff --git a/squarelet/organizations/views/members.py b/squarelet/organizations/views/members.py
index 00816fd70..9d64a3936 100644
--- a/squarelet/organizations/views/members.py
+++ b/squarelet/organizations/views/members.py
@@ -9,8 +9,7 @@
 
 # Squarelet
 from squarelet.core.utils import get_redirect_url, new_action, pluralize
-from squarelet.organizations.choices import InvitationRole
-from squarelet.organizations.forms import AddMemberForm
+from squarelet.organizations.forms import AddMemberForm, InvitationAcceptForm
 from squarelet.organizations.mixins import OrganizationPermissionMixin
 from squarelet.organizations.models import Invitation, Membership, Organization
 
@@ -263,6 +262,14 @@ class InvitationAccept(DetailView):
     slug_field = "uuid"
     slug_url_kwarg = "uuid"
 
+    def get_context_data(self, **kwargs):
+        context = super().get_context_data(**kwargs)
+        if self.request.user.is_authenticated:
+            context["accept_form"] = InvitationAcceptForm(
+                invitation=self.object, user=self.request.user
+            )
+        return context
+
     def dispatch(self, request, *args, **kwargs):
         """
         If the user is not authenticated, store the invitation in the session,
@@ -280,15 +287,12 @@ def post(self, request, *args, **kwargs):
         invitation = self.get_object()
         action = request.POST.get("action")
         if action == "accept":
-            if (
-                invitation.role == InvitationRole.admin
-                and not request.user.emailaddress_set.filter(verified=True).exists()
-            ):
-                messages.error(
-                    request,
-                    "You must verify your email address before accepting "
-                    "an admin invitation.",
-                )
+            form = InvitationAcceptForm(
+                request.POST, invitation=invitation, user=request.user
+            )
+            if not form.is_valid():
+                for error in form.non_field_errors():
+                    messages.error(request, error)
                 return redirect("organizations:invitation", uuid=invitation.uuid)
             invitation.accept(request.user)
             messages.success(request, "Invitation accepted")
diff --git a/squarelet/templates/account/onboarding/join_org.html b/squarelet/templates/account/onboarding/join_org.html
index e19de3aa4..b4c3357c4 100644
--- a/squarelet/templates/account/onboarding/join_org.html
+++ b/squarelet/templates/account/onboarding/join_org.html
@@ -50,15 +50,7 @@ <h2>{% trans "Pending requests" %}</h2>
         <div class="invite">
           {% include "account/team_list_item.html" with organization=invite.organization %}
           
-          <form method="post" action="{% url "organizations:invitation" uuid=invite.uuid %}" class="actions">
-            {% csrf_token %}
-            <button class="btn primary ghost" type="submit" name="action" value="accept">
-              {% trans "Accept" %}
-            </button>
-            <button class="btn danger ghost" type="submit" name="action" value="reject">
-              {% trans "Reject" %}
-            </button>
-          </form>
+          {{ invite.accept_form }}
         </div>
         {% endfor %}
       </div>
diff --git a/squarelet/templates/organizations/invitation_accept_form.html b/squarelet/templates/organizations/invitation_accept_form.html
new file mode 100644
index 000000000..bf2c372d2
--- /dev/null
+++ b/squarelet/templates/organizations/invitation_accept_form.html
@@ -0,0 +1,20 @@
+{% load i18n %}
+{% if requires_email_verification %}
+<form class="email-actions" action="{% url "account_email" %}" method="post">
+  {% csrf_token %}
+  <input type="hidden" name="email" value="{{ user.email }}" />
+  <button class="btn small primary" type="submit" name="action_send">
+    {% trans "Verify email to accept" %}
+  </button>
+</form>
+{% else %}
+<form method="post" action="{% url "organizations:invitation" uuid=invitation.uuid %}" class="actions">
+  {% csrf_token %}
+  <button class="btn small primary" type="submit" name="action" value="accept">
+    {% trans "Accept" %}
+  </button>
+  <button class="btn small danger ghost" type="submit" name="action" value="reject">
+    {% trans "Reject" %}
+  </button>
+</form>
+{% endif %}
diff --git a/squarelet/templates/organizations/invitation_detail.html b/squarelet/templates/organizations/invitation_detail.html
index a3fe306a3..658ba736f 100644
--- a/squarelet/templates/organizations/invitation_detail.html
+++ b/squarelet/templates/organizations/invitation_detail.html
@@ -2,7 +2,6 @@
 {% load static %}
 {% load thumbnail %}
 {% load i18n %}
-{% load email_verification %}
 
 {% block title %}Organization: {{ invitation.organization.name }}{% endblock %}
 
@@ -53,7 +52,7 @@ <h2>
           out and sign back in with the account you'd like to use.
         {% endblocktrans %}
       </p>
-      {% if invitation.is_admin_role and not request.user|has_verified_email %}
+      {% if accept_form.requires_email_verification %}
       <p>
         {% blocktrans %}
           You must verify your email address before you can accept an admin invitation.
@@ -83,7 +82,7 @@ <h2>
       {% endif %}
 
       {% if request.user.is_authenticated %}
-        {% if invitation.is_admin_role and not request.user|has_verified_email %}
+        {% if accept_form.requires_email_verification %}
         <div class="control-group">
           <form class="email-actions" action="{% url "account_email" %}" method="post">
             {% csrf_token %}
diff --git a/squarelet/templates/organizations/organization_list.html b/squarelet/templates/organizations/organization_list.html
index f7411cae3..e6e2a4c3e 100644
--- a/squarelet/templates/organizations/organization_list.html
+++ b/squarelet/templates/organizations/organization_list.html
@@ -146,15 +146,7 @@ <h2>{% trans "Pending invitations" %}</h2>
             <div class="invite">
               {% include "account/team_list_item.html" with organization=invite.organization %}
 
-              <form method="post" action="{% url "organizations:invitation" uuid=invite.uuid %}" class="actions">
-                {% csrf_token %}
-                <button class="btn small primary" type="submit" name="action" value="accept">
-                  {% trans "Accept" %}
-                </button>
-                <button class="btn small danger ghost" type="submit" name="action" value="reject">
-                  {% trans "Reject" %}
-                </button>
-              </form>
+              {{ invite.accept_form }}
             </div>
             {% endfor %}
           </div>
diff --git a/squarelet/templates/organizations/your_organizations.html b/squarelet/templates/organizations/your_organizations.html
index 7cfb9d615..7b3a21ac0 100644
--- a/squarelet/templates/organizations/your_organizations.html
+++ b/squarelet/templates/organizations/your_organizations.html
@@ -30,15 +30,7 @@ <h3>{% trans "Open invitations" %}</h3>
   {% for invite in pending_invitations %}
     <div class="invite">
       {% include "account/team_list_item.html" with organization=invite.organization %}
-      <form method="post" action="{% url "organizations:invitation" uuid=invite.uuid %}" class="actions actions-nowrap">
-        {% csrf_token %}
-        <button class="small btn primary" type="submit" name="action" value="accept">
-          {% trans "Accept" %}
-        </button>
-        <button class="small btn danger ghost" type="submit" name="action" value="reject">
-          {% trans "Reject" %}
-        </button>
-      </form>
+      {{ invite.accept_form }}
     </div>
   {% endfor %}
 </div>
diff --git a/squarelet/templates/users/user_invitations.html b/squarelet/templates/users/user_invitations.html
index 3b6a1a0ff..7101d357c 100644
--- a/squarelet/templates/users/user_invitations.html
+++ b/squarelet/templates/users/user_invitations.html
@@ -53,15 +53,7 @@
         {% if is_own_page %}
         <td class="invitation-actions">
           {% if not invitation.accepted_at and not invitation.rejected_at and not invitation.withdrawn_at %}
-            <form method="post" action="{% url "organizations:invitation" uuid=invitation.uuid %}">
-              {% csrf_token %}
-              <button class="btn small primary" type="submit" name="action" value="accept">
-                {% trans "Accept" %}
-              </button>
-              <button class="btn small danger ghost" type="submit" name="action" value="reject">
-                {% trans "Reject" %}
-              </button>
-            </form>
+            {{ invitation.accept_form }}
           {% elif invitation.rejected_at %}
             <form method="post" action="{% url "users:invitations" username=target_user.username %}">
               {% csrf_token %}
diff --git a/squarelet/users/onboarding.py b/squarelet/users/onboarding.py
index 4a89f0c88..1e4d01a27 100644
--- a/squarelet/users/onboarding.py
+++ b/squarelet/users/onboarding.py
@@ -16,6 +16,7 @@
 from allauth.mfa.totp.internal.flows import activate_totp
 
 # Squarelet
+from squarelet.organizations.forms import InvitationAcceptForm
 from squarelet.organizations.models.payment import Plan
 from squarelet.users.forms import PremiumSubscriptionForm
 
@@ -161,6 +162,7 @@ def should_execute(self, request):
     def get_context_data(self, request):
         user = request.user
         invitations, potential_orgs = self._get_joinable_orgs(user)
+        InvitationAcceptForm.attach_to_invitations(invitations, user)
         return {
             "invitations": invitations,
             "potential_orgs": potential_orgs,
diff --git a/squarelet/users/views.py b/squarelet/users/views.py
index 15894972b..cd647331e 100644
--- a/squarelet/users/views.py
+++ b/squarelet/users/views.py
@@ -47,6 +47,7 @@
 # Squarelet
 from squarelet.core.mixins import AdminLinkMixin
 from squarelet.core.utils import new_action
+from squarelet.organizations.forms import InvitationAcceptForm
 from squarelet.organizations.models import Invitation, ReceiptEmail
 from squarelet.organizations.models.payment import Plan
 from squarelet.organizations.views import UpdateSubscription
@@ -137,7 +138,9 @@ def get_context_data(self, **kwargs):
         )
         context["is_own_page"] = user == self.request.user
         context["potential_organizations"] = list(user.get_potential_organizations())
-        context["pending_invitations"] = list(user.get_pending_invitations())
+        context["pending_invitations"] = InvitationAcceptForm.attach_to_invitations(
+            list(user.get_pending_invitations()), user
+        )
         context["pending_requests"] = list(user.get_pending_requests())
         context["verified"] = user.verified_journalist()
         context["verified_organizations"] = list(
@@ -605,6 +608,13 @@ class UserInvitationsView(BaseUserInvitationRequestView):
     is_request_view = False
     redirect_url_name = "users:invitations"
 
+    def get_context_data(self, **kwargs):
+        context = super().get_context_data(**kwargs)
+        InvitationAcceptForm.attach_to_invitations(
+            context["invitations"], self.request.user
+        )
+        return context
+
 
 class UserRequestsView(BaseUserInvitationRequestView):
     """View to display all requests sent by a user"""

From 7d04651798d3cade0e208dc1681ab02b254fe778 Mon Sep 17 00:00:00 2001
From: Allan Lasser <lasser.allan@gmail.com>
Date: Tue, 21 Apr 2026 15:18:05 -0400
Subject: [PATCH 3/6] Test, format, pylint

---
 squarelet/organizations/forms.py         | 6 ++++--
 squarelet/organizations/views/members.py | 1 +
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/squarelet/organizations/forms.py b/squarelet/organizations/forms.py
index 2c7b23e9c..730a0cdc7 100644
--- a/squarelet/organizations/forms.py
+++ b/squarelet/organizations/forms.py
@@ -307,8 +307,10 @@ def clean(self):
         cleaned_data = super().clean()
         if self.requires_email_verification:
             raise forms.ValidationError(
-                _("You must verify your email address before accepting "
-                  "an admin invitation.")
+                _(
+                    "You must verify your email address before accepting "
+                    "an admin invitation."
+                )
             )
         return cleaned_data
 
diff --git a/squarelet/organizations/views/members.py b/squarelet/organizations/views/members.py
index 9d64a3936..4e9151b70 100644
--- a/squarelet/organizations/views/members.py
+++ b/squarelet/organizations/views/members.py
@@ -9,6 +9,7 @@
 
 # Squarelet
 from squarelet.core.utils import get_redirect_url, new_action, pluralize
+from squarelet.organizations.choices import InvitationRole
 from squarelet.organizations.forms import AddMemberForm, InvitationAcceptForm
 from squarelet.organizations.mixins import OrganizationPermissionMixin
 from squarelet.organizations.models import Invitation, Membership, Organization

From 18cb481a59393e8217f22eb18207fc418731d02a Mon Sep 17 00:00:00 2001
From: Allan Lasser <lasser.allan@gmail.com>
Date: Tue, 21 Apr 2026 22:11:39 -0400
Subject: [PATCH 4/6] Add CSRF token to form template

---
 squarelet/organizations/forms.py         | 12 +++++++++---
 squarelet/organizations/views/detail.py  |  4 ++--
 squarelet/organizations/views/members.py |  4 +++-
 squarelet/users/onboarding.py            |  2 +-
 squarelet/users/views.py                 |  4 ++--
 5 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/squarelet/organizations/forms.py b/squarelet/organizations/forms.py
index 730a0cdc7..f66370ee2 100644
--- a/squarelet/organizations/forms.py
+++ b/squarelet/organizations/forms.py
@@ -2,6 +2,7 @@
 from django import forms
 from django.core.validators import validate_email
 from django.db.models.aggregates import Min
+from django.middleware.csrf import get_token
 from django.urls import reverse
 from django.utils.translation import gettext_lazy as _
 
@@ -291,10 +292,11 @@ class InvitationAcceptForm(forms.Form):
 
     template_name = "organizations/invitation_accept_form.html"
 
-    def __init__(self, *args, invitation, user, **kwargs):
+    def __init__(self, *args, invitation, user, request=None, **kwargs):
         super().__init__(*args, **kwargs)
         self.invitation = invitation
         self.user = user
+        self.request = request
 
     @property
     def requires_email_verification(self):
@@ -319,13 +321,17 @@ def get_context(self):
         context["invitation"] = self.invitation
         context["user"] = self.user
         context["requires_email_verification"] = self.requires_email_verification
+        if self.request:
+            context["csrf_token"] = get_token(self.request)
         return context
 
     @classmethod
-    def attach_to_invitations(cls, invitations, user):
+    def attach_to_invitations(cls, invitations, user, request=None):
         """Attach an accept_form to each invitation in the list."""
         for invitation in invitations:
-            invitation.accept_form = cls(invitation=invitation, user=user)
+            invitation.accept_form = cls(
+                invitation=invitation, user=user, request=request
+            )
         return invitations
 
 
diff --git a/squarelet/organizations/views/detail.py b/squarelet/organizations/views/detail.py
index 0048815be..711235147 100644
--- a/squarelet/organizations/views/detail.py
+++ b/squarelet/organizations/views/detail.py
@@ -355,7 +355,7 @@ def get_context_data(self, **kwargs):
         if user.is_authenticated:
             context["pending_requests"] = list(user.get_pending_requests())
             context["pending_invitations"] = InvitationAcceptForm.attach_to_invitations(
-                list(user.get_pending_invitations()), user
+                list(user.get_pending_invitations()), user, request=self.request
             )
             context["potential_orgs"] = list(user.get_potential_organizations())
 
@@ -374,7 +374,7 @@ def get_context_data(self, **kwargs):
         )
         context["potential_organizations"] = list(user.get_potential_organizations())
         context["pending_invitations"] = InvitationAcceptForm.attach_to_invitations(
-            list(user.get_pending_invitations()), user
+            list(user.get_pending_invitations()), user, request=self.request
         )
 
         return context
diff --git a/squarelet/organizations/views/members.py b/squarelet/organizations/views/members.py
index 4e9151b70..d7dde0f17 100644
--- a/squarelet/organizations/views/members.py
+++ b/squarelet/organizations/views/members.py
@@ -267,7 +267,9 @@ def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)
         if self.request.user.is_authenticated:
             context["accept_form"] = InvitationAcceptForm(
-                invitation=self.object, user=self.request.user
+                invitation=self.object,
+                user=self.request.user,
+                request=self.request,
             )
         return context
 
diff --git a/squarelet/users/onboarding.py b/squarelet/users/onboarding.py
index 1e4d01a27..514ac1e50 100644
--- a/squarelet/users/onboarding.py
+++ b/squarelet/users/onboarding.py
@@ -162,7 +162,7 @@ def should_execute(self, request):
     def get_context_data(self, request):
         user = request.user
         invitations, potential_orgs = self._get_joinable_orgs(user)
-        InvitationAcceptForm.attach_to_invitations(invitations, user)
+        InvitationAcceptForm.attach_to_invitations(invitations, user, request=request)
         return {
             "invitations": invitations,
             "potential_orgs": potential_orgs,
diff --git a/squarelet/users/views.py b/squarelet/users/views.py
index cd647331e..56c15c8bf 100644
--- a/squarelet/users/views.py
+++ b/squarelet/users/views.py
@@ -139,7 +139,7 @@ def get_context_data(self, **kwargs):
         context["is_own_page"] = user == self.request.user
         context["potential_organizations"] = list(user.get_potential_organizations())
         context["pending_invitations"] = InvitationAcceptForm.attach_to_invitations(
-            list(user.get_pending_invitations()), user
+            list(user.get_pending_invitations()), user, request=self.request
         )
         context["pending_requests"] = list(user.get_pending_requests())
         context["verified"] = user.verified_journalist()
@@ -611,7 +611,7 @@ class UserInvitationsView(BaseUserInvitationRequestView):
     def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)
         InvitationAcceptForm.attach_to_invitations(
-            context["invitations"], self.request.user
+            context["invitations"], self.request.user, request=self.request
         )
         return context
 

From d7b345ce9859a0fedd2031ff44e5e65204c20beb Mon Sep 17 00:00:00 2001
From: Allan Lasser <lasser.allan@gmail.com>
Date: Mon, 27 Apr 2026 21:19:02 -0400
Subject: [PATCH 5/6] Fix up the invitation form

---
 .../organizations/invitation_detail.html      | 175 ++++++++++--------
 1 file changed, 98 insertions(+), 77 deletions(-)

diff --git a/squarelet/templates/organizations/invitation_detail.html b/squarelet/templates/organizations/invitation_detail.html
index 658ba736f..a4baad16a 100644
--- a/squarelet/templates/organizations/invitation_detail.html
+++ b/squarelet/templates/organizations/invitation_detail.html
@@ -11,6 +11,10 @@
     .container {
       max-width: 32rem;
       margin: 3rem auto;
+      padding: 2rem;
+      background: var(--white);
+      border-radius: 8px;
+      border: 1px solid var(--gray-2);
     }
     h2 {
       font-weight: var(--font-semibold, 600);
@@ -22,6 +26,23 @@
       gap: 1rem;
       align-items: center;
     }
+
+    .control-group form {
+      display: contents;
+    }
+    .control-group .button {
+      flex-grow: 1;
+    }
+    .control-group .button.primary {
+      flex-grow: 2;
+    }
+
+    .user-data {
+      font-weight: 500;
+    }
+    .user-data a {
+      text-decoration: underline;
+    }
   </style>
 {% endblock %}
 
@@ -35,86 +56,86 @@ <h2>
       {% trans "on MuckRock" %}
     </h2>
 
-    <form method="post">
-      {% csrf_token %}
-      <p>
-        {% blocktrans with name=invitation.organization.name %}
-          You have been invited you to join {{ name }}, an organization
-          account on MuckRock. If you have questions or think this might malicious,
-          please reach out to the organization directly to confirm.
-        {% endblocktrans %}
-      </p>
-      {% if request.user.is_authenticated %}
-      <p>
-        {% blocktrans with name=request.user.name email=request.user.email %}
-          You're currently logged in as {{ name }} with {{ email }}. If you'd
-          like to associate this invitation with another account, please sign
-          out and sign back in with the account you'd like to use.
-        {% endblocktrans %}
-      </p>
-      {% if accept_form.requires_email_verification %}
-      <p>
-        {% blocktrans %}
-          You must verify your email address before you can accept an admin invitation.
-        {% endblocktrans %}
-      </p>
-      {% endif %}
-      {% else %}
-      <p>
-        {% blocktrans %}
-        MuckRock is a non-profit organization that builds transparency tools
-        for journalists, researchers and the public.
-        {% endblocktrans %}
-      </p>
-      <p>
-        {% blocktrans %}
-          Before you can accept this account, you need to either create a new
-          account or log in with the account you'd like to join.
-        {% endblocktrans %}
-      </p>
-      <p>
-        {% blocktrans %}
-          Your MuckRock account will give you access to MuckRock,
-          DocumentCloud, FOIA Machine and Big Local News, as well as make it
-          easier to collaborate with your colleagues there.
-        {% endblocktrans %}
-      </p>
-      {% endif %}
+    <p>
+      {% blocktrans with name=invitation.organization.name %}
+        You have been invited you to join {{ name }}, an organization
+        account on MuckRock. If you have questions or think this might malicious,
+        please reach out to the organization directly to confirm.
+      {% endblocktrans %}
+    </p>
+    {% if request.user.is_authenticated %}
+    <p>
+      {% url 'users:redirect' as user_url %}
+      {% blocktrans with name=request.user.name email=request.user.email %}
+        You're currently logged in as <a class="user-data" href="{{ user_url }}">{{ name }}</a> with <span class="user-data">{{ email }}</span>.
+      {% endblocktrans %}
+    </p>
+    <p>
+      {% blocktrans %}
+       If you'd like to associate this invitation with another account,
+       please sign out and sign back in with the account you'd like to use.
+      {% endblocktrans %}
+    {% if accept_form.requires_email_verification %}
+    <p>
+      {% blocktrans %}
+        You must verify your email address before you can accept an admin invitation.
+      {% endblocktrans %}
+    </p>
+    {% endif %}
+    {% else %}
+    <p>
+      <strong>
+      {% blocktrans %}
+        Before you can accept this account, you need to either create a new
+        account or log in with the account you'd like to join.
+      {% endblocktrans %}
+      </strong>
+    </p>
+    <p>
+      {% blocktrans %}
+      MuckRock is a non-profit organization that builds transparency tools
+      for journalists, researchers and the public.
+      {% endblocktrans %}
+    </p>
+    <p>
+      {% blocktrans %}
+        Your MuckRock account will give you access to MuckRock,
+        DocumentCloud, FOIA Machine and Big Local News, as well as make it
+        easier to collaborate with your colleagues there.
+      {% endblocktrans %}
+    </p>
+    {% endif %}
 
-      {% if request.user.is_authenticated %}
-        {% if accept_form.requires_email_verification %}
-        <div class="control-group">
-          <form class="email-actions" action="{% url "account_email" %}" method="post">
-            {% csrf_token %}
-            <input type="hidden" name="email" value="{{request.user.email}}" />
-            <button class="button primary" type="submit" name="action_send">
-              {% trans "Verify your email address" %}
-            </button>
-          </form>
-        </div>
-        {% else %}
-        <div class="control-group">
-            <button class="button primary" type="submit" name="action" value="accept">
-              {% trans "Accept" %}
-            </button>
-            <button class="button caution" type="submit" name="action" value="reject">
-              {% trans "Reject" %}
-            </button>
-          </div>
-        </div>
-        {% endif %}
+    <div class="control-group">
+    {% if request.user.is_authenticated %}
+      {% if accept_form.requires_email_verification %}
+        <form class="email-actions" action="{% url "account_email" %}" method="post">
+          {% csrf_token %}
+          <input type="hidden" name="email" value="{{request.user.email}}" />
+          <button class="button primary" type="submit" name="action_send">
+            {% trans "Verify your email address" %}
+          </button>
+        </form>
       {% else %}
-        <div class="control-group">
-            <a href="{% url "account_signup" %}?next={{request.path}}" class="button primary">
-              {% trans "Sign Up" %}
-            </a>
-            <a href="{% url "account_login" %}?next={{request.path}}" class="button primary ghost">
-              {% trans "Log In" %}
-            </a>
-          </div>
-        </div>
+        <form method="post">
+          {% csrf_token %}
+          <button class="button caution" type="submit" name="action" value="reject">
+            {% trans "Reject" %}
+          </button>
+          <button class="button primary" type="submit" name="action" value="accept">
+            {% trans "Accept Invitation" %}
+          </button>
+        </form>
       {% endif %}
-    </form>
+    {% else %}
+      <a href="{% url "account_signup" %}?next={{request.path}}" class="button primary">
+        {% trans "Sign Up" %}
+      </a>
+      <a href="{% url "account_login" %}?next={{request.path}}" class="button primary ghost">
+        {% trans "Log In" %}
+      </a>
+    {% endif %}
+    </div>
 
   </div>
 {% endblock content %}

From bdf930fede00e64f22eb448ce88a61ba2a16e752 Mon Sep 17 00:00:00 2001
From: Allan Lasser <lasser.allan@gmail.com>
Date: Tue, 28 Apr 2026 08:18:29 -0400
Subject: [PATCH 6/6] Fix e2e test

---
 e2e/organizations.spec.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/e2e/organizations.spec.ts b/e2e/organizations.spec.ts
index 2e7be738f..eb10df4de 100644
--- a/e2e/organizations.spec.ts
+++ b/e2e/organizations.spec.ts
@@ -469,8 +469,8 @@ test.describe("Member Management", () => {
     const anonContext = await browser.newContext({ ignoreHTTPSErrors: true });
     const anonPage = await anonContext.newPage();
     await anonPage.goto(`https://dev.squarelet.com${invitationPath}`);
-    await expect(anonPage.locator("form a:has-text('Sign Up')")).toBeVisible();
-    await expect(anonPage.locator("form a:has-text('Log In')")).toBeVisible();
+    await expect(anonPage.locator("a:has-text('Sign Up')")).toBeVisible();
+    await expect(anonPage.locator("a:has-text('Log In')")).toBeVisible();
     await anonContext.close();
 
     // Verify the link invitation shows "Copy link" (not "Resend") on manage-members