feat: add accept invite handler

cmd/server/main.go

···
 	mux.HandleFunc("PUT /api/docs/{rkey}/autosave", h.APIDocumentAutoSave)
 	mux.HandleFunc("DELETE /api/docs/{rkey}", h.APIDocumentDelete)
 	mux.HandleFunc("POST /api/docs/{rkey}/invite", h.DocumentInvite)
+	mux.HandleFunc("GET /docs/{rkey}/accept", h.AcceptInvite)
 
 	// Middleware stack
 	stack := middleware.Logger(

internal/atproto/xrpc/client.go

···
 	}
 	return nil
 }
+
+const collectionDocument = "com.diffdown.document"
+
+// GetDocument fetches a document by its rkey.
+func (c *Client) GetDocument(rkey string) (*model.Document, error) {
+	value, _, err := c.GetRecord(c.session.DID, collectionDocument, rkey)
+	if err != nil {
+		return nil, err
+	}
+
+	var doc model.Document
+	if err := json.Unmarshal(value, &doc); err != nil {
+		return nil, fmt.Errorf("unmarshal document: %w", err)
+	}
+	doc.RKey = rkey
+	return &doc, nil
+}
+
+// PutDocument creates or updates a document.
+func (c *Client) PutDocument(rkey string, doc *model.Document) (string, string, error) {
+	return c.PutRecord(collectionDocument, rkey, doc)
+}

internal/db/db.go

···
 	}
 	return &invite, nil
 }
+
+func (db *DB) DeleteInvite(token string) error {
+	_, err := db.Exec(`DELETE FROM invites WHERE token = ?`, token)
+	return err
+}

internal/handler/handler.go

···
 	h.jsonResponse(w, map[string]string{"inviteLink": inviteLink}, http.StatusOK)
 }
 
+// AcceptInvite handles an invite acceptance.
+func (h *Handler) AcceptInvite(w http.ResponseWriter, r *http.Request) {
+	user := h.currentUser(r)
+	if user == nil {
+		http.Redirect(w, r, "/auth/login", http.StatusSeeOther)
+		return
+	}
+
+	rKey := r.PathValue("rkey")
+	inviteToken := r.URL.Query().Get("invite")
+	if inviteToken == "" {
+		http.Error(w, "Invalid invite", http.StatusBadRequest)
+		return
+	}
+
+	invite, err := collaboration.ValidateInvite(h.DB, inviteToken, rKey)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	session, err := h.DB.GetATProtoSession(user.ID)
+	if err != nil || session == nil {
+		http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
+		return
+	}
+
+	client, err := h.xrpcClient(user.ID)
+	if err != nil {
+		log.Printf("AcceptInvite: xrpc client: %v", err)
+		http.Error(w, "Failed to connect to ATProto", http.StatusInternalServerError)
+		return
+	}
+
+	doc, err := client.GetDocument(rKey)
+	if err != nil {
+		http.Error(w, "Document not found", http.StatusNotFound)
+		return
+	}
+
+	for _, c := range doc.Collaborators {
+		if c == session.DID {
+			http.Redirect(w, r, "/docs/"+rKey, http.StatusSeeOther)
+			return
+		}
+	}
+
+	doc.Collaborators = append(doc.Collaborators, session.DID)
+	_, _, err = client.PutDocument(rKey, doc)
+	if err != nil {
+		log.Printf("AcceptInvite: add collaborator: %v", err)
+		http.Error(w, "Failed to add collaborator", http.StatusInternalServerError)
+		return
+	}
+
+	h.DB.DeleteInvite(invite.Token)
+
+	http.Redirect(w, r, "/docs/"+rKey, http.StatusSeeOther)
+}
+
 // --- API: Render markdown ---
 
 func (h *Handler) APIRender(w http.ResponseWriter, r *http.Request) {