fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

internal/domain/invite/inviteDomain.go

@@ -15,6 +15,8 @@ var ErrInviteAlreadyAccepted = errors.New("invite already accepted")
 
 const Lifetime = 3 * 24 * time.Hour
 
+const Retention = 30 * 24 * time.Hour
+
 type Status string
 
 const (
@@ -42,3 +44,13 @@ func (i Invite) StatusAt(now time.Time) Status {
 	}
 	return StatusExpired
 }
+
+func (i Invite) IsStaleAt(now time.Time) bool {
+	switch i.StatusAt(now) {
+	case StatusAccepted:
+		return now.After(i.AcceptedAt.Add(Retention))
+	case StatusExpired:
+		return now.After(i.ExpiresAt.Add(Retention))
+	}
+	return false
+}