Auto-revoke invite links on publish

Once a post transitions to `publish`, its invite link is revoked. Existing
co-authors keep their access; the shared URL simply stops admitting new
people. The author can regenerate a fresh link after publish if they want
to continue adding collaborators.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dd32

README.md

@@ -7,7 +7,7 @@ A WordPress plugin that allows multiple authors to edit a single post via shared
 ## Features
 
 - **Co-author management** -- Add or remove co-authors from any post via the block editor sidebar panel.
-- **Shared invite links** -- Generate a shareable URL that lets any registered user join as a co-author.
+- **Shared invite links** -- Generate a shareable URL that lets any registered user join as a co-author. Links expire after 24 hours and are automatically revoked when the post is published; existing co-authors keep their access.
 - **Capability-aware** -- Co-authors can edit and read their assigned posts without gaining broader site permissions.
 - **Multisite support** -- Invited users are automatically added to the site with a subscriber role so they can access the editor.
 - **Author preservation** -- When a post's author is reassigned, the previous author is automatically kept as a co-author.

includes/class-map-invite.php

@@ -23,6 +23,20 @@ class Invite {
 	 */
 	public static function init(): void {
 		add_action( 'template_redirect', array( __CLASS__, 'handle_invite_request' ) );
+		add_action( 'transition_post_status', array( __CLASS__, 'revoke_on_publish' ), 10, 3 );
+	}
+
+	/**
+	 * Auto-revoke an active invite when a post transitions to `publish`.
+	 *
+	 * Existing co-authors keep their access; the shared link simply stops
+	 * admitting new people. The author can regenerate a fresh link if more
+	 * collaborators need to be added post-publish.
+	 */
+	public static function revoke_on_publish( string $new_status, string $old_status, \WP_Post $post ): void {
+		if ( 'publish' === $new_status && 'publish' !== $old_status ) {
+			self::revoke_invite( $post->ID );
+		}
 	}
 
 	/**

tests/Test_Invite.php

@@ -167,6 +167,49 @@ public function test_expired_token_is_cleaned_up_on_lookup(): void {
 		$this->assertSame( '', get_post_meta( $this->post_id, '_map_invite_token', true ) );
 	}
 
+	public function test_invite_is_revoked_when_post_is_published(): void {
+		Invite::init();
+
+		$draft = self::factory()->post->create(
+			array(
+				'post_author' => $this->author_id,
+				'post_status' => 'draft',
+			)
+		);
+		Invite::create_invite_url( $draft );
+		$this->assertTrue( Invite::get_invite_status( $draft )['active'] );
+
+		wp_update_post(
+			array(
+				'ID'          => $draft,
+				'post_status' => 'publish',
+			)
+		);
+
+		$this->assertFalse( Invite::get_invite_status( $draft )['active'] );
+	}
+
+	public function test_publish_to_publish_does_not_revoke(): void {
+		Invite::init();
+
+		$published = self::factory()->post->create(
+			array(
+				'post_author' => $this->author_id,
+				'post_status' => 'publish',
+			)
+		);
+		Invite::create_invite_url( $published );
+
+		wp_update_post(
+			array(
+				'ID'         => $published,
+				'post_title' => 'edited',
+			)
+		);
+
+		$this->assertTrue( Invite::get_invite_status( $published )['active'] );
+	}
+
 	public function test_shared_invite_can_be_used_by_multiple_users(): void {
 		$url      = Invite::create_invite_url( $this->post_id );
 		$token    = $this->extract_token( $url );