MyCasaPro now creates narrowly scoped contractor invitations and commits their email delivery to a durable outbox before an SMTP provider is contacted.
What changed
Contractors can review a shared repair, inspect permitted attachments, and submit an estimate without creating an account.
Invitation tokens contain 256 bits of randomness; only SHA-256 hashes are retained, links expire after seven days, and homeowners can revoke them earlier.
The invitation and email outbox record are committed together, then a worker handles delivery, bounded retries, locking, and final status.
A narrow guest boundary
The guest route is for one repair request, not a reduced contractor account. Its response omits the homeowner identity and street address, while attachments remain behind token-scoped API authorization.
The raw invitation token is not stored. The database retains its SHA-256 hash, expiration, and revocation state, so a database read alone does not reveal a usable link.
Commit before delivery
Invitation creation and the corresponding email message enter persistent storage together. SMTP runs later through an outbox worker rather than inside the homeowner’s request transaction.
That boundary prevents a temporary mail failure from losing the invitation or forcing the user to guess whether it was created. Delivery status remains inspectable after the request returns.
Bounded retries and production limits
Workers claim a limited batch with a delivery lock, apply a per-message timeout, and record success or failure. Retries are bounded rather than looping indefinitely, and stale claims can be recovered after the lock expires.
The production package combines the web app, Go API, PostgreSQL, private uploads, SMTP delivery, HTTPS, and backup tooling on one server. The documentation also states what is not yet solved: external monitoring, rehearsed off-server recovery, horizontal storage, abuse controls, and live payment-provider integration.
Engineering note
Access creation and notification delivery are different transactions. Persisting the notification before contacting SMTP keeps a provider outage from erasing an otherwise valid invitation.
Provenance
This note is based on verified project source at commit a454540. It records a programming change, not a personal-status update.