feat: implement calendar invitation system with creation, acceptance, and management features

server/routes/calendar.js

@@ -413,13 +413,13 @@ router.post(['/receive-event', '/calendar-event'], calendarFederationLimiter, as
     const targetUser = await db.get('SELECT id, name, email FROM users WHERE LOWER(name) = LOWER(?)', [username]);
     if (!targetUser) return res.status(404).json({ error: 'User not found on this instance' });
 
-    // Check duplicate
-    const existing = await db.get('SELECT id FROM calendar_events WHERE uid = ? AND user_id = ?', [event_uid, targetUser.id]);
-    if (existing) return res.json({ success: true, message: 'Event already received' });
+    // Check duplicate (already in invitations or already accepted into calendar)
+    const existingInv = await db.get('SELECT id FROM calendar_invitations WHERE event_uid = ? AND to_user_id = ?', [event_uid, targetUser.id]);
+    if (existingInv) return res.json({ success: true, message: 'Calendar invitation already received' });
 
-    // Create event for the target user
+    // Store as pending invitation — user must accept before it appears in calendar
     await db.run(`
-      INSERT INTO calendar_events (uid, title, description, start_time, end_time, room_uid, user_id, color, federated_from, federated_join_url)
+      INSERT INTO calendar_invitations (event_uid, title, description, start_time, end_time, room_uid, join_url, from_user, to_user_id, color)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `, [
       event_uid,
@@ -428,10 +428,10 @@ router.post(['/receive-event', '/calendar-event'], calendarFederationLimiter, as
       start_time,
       end_time,
       room_uid || null,
+      join_url || null,
+      from_user,
       targetUser.id,
       '#6366f1',
-      from_user,
-      join_url || null,
     ]);
 
     res.json({ success: true });