SDK-8833 Moved invitation param to inside authorization params

Author: rmad17

src/auth0_server_python/auth_server/server_client.py

@@ -75,7 +75,7 @@
 # dynamically from the resolved domain at login time.
 INTERNAL_AUTHORIZE_PARAMS = ["client_id", "response_type",
                              "code_challenge", "code_challenge_method", "state", "nonce", "scope",
-                             "organization", "invitation"]
+                             "organization"]
 
 _ORG_ACCESS_DENIED_FRAGMENTS = (
     "is not part of the",
@@ -583,10 +583,6 @@ async def start_interactive_login(
         if resolved_org:
             auth_params["organization"] = resolved_org
 
-        # Invitation is forwarded to /authorize but not stored for callback validation.
-        if options.invitation:
-            auth_params["invitation"] = options.invitation
-
         # Build the transaction data to store with domain
         transaction_data = TransactionData(
             code_verifier=code_verifier,

src/auth0_server_python/auth_types/__init__.py

@@ -151,7 +151,6 @@ class StartInteractiveLoginOptions(BaseModel):
     app_state: Optional[Any] = None
     authorization_params: Optional[dict[str, Any]] = None
     organization: Optional[str] = None
-    invitation: Optional[str] = None
 
 
 class LogoutOptions(BaseModel):

src/auth0_server_python/tests/test_server_client.py

@@ -4989,7 +4989,7 @@ async def test_invitation_and_org_forwarded_to_authorize(mocker):
     url = await client.start_interactive_login(
         StartInteractiveLoginOptions(
             organization="org_abc123",
-            invitation="inv_token_xyz",
+            authorization_params={"invitation": "inv_token_xyz"},
         )
     )
 
@@ -5001,7 +5001,6 @@ async def test_invitation_and_org_forwarded_to_authorize(mocker):
     assert stored.organization == "org_abc123"
 
 
-
 @pytest.mark.asyncio
 async def test_invitation_without_org_forwarded_to_authorize(mocker):
     """invitation alone appears in the URL; no organization param."""
@@ -5021,41 +5020,14 @@ async def test_invitation_without_org_forwarded_to_authorize(mocker):
         "authorization_endpoint": "https://tenant.auth0.com/authorize",
     })
 
-    url = await client.start_interactive_login(
-        StartInteractiveLoginOptions(invitation="inv_token_xyz")
-    )
-
-    assert "invitation=inv_token_xyz" in url
-    assert "organization=" not in url
-
-
-@pytest.mark.asyncio
-async def test_invitation_via_authorization_params_dict_is_ignored(mocker):
-    """invitation passed via authorization_params dict is stripped; typed field is the only path."""
-    mock_tx_store = AsyncMock()
-    mock_state_store = AsyncMock()
-    client = ServerClient(
-        domain="tenant.auth0.com",
-        client_id="test_client",
-        client_secret="test_secret",
-        redirect_uri="https://app.example.com/callback",
-        transaction_store=mock_tx_store,
-        state_store=mock_state_store,
-        secret="test_secret_key_32_chars_long!!",
-    )
-    mocker.patch.object(client, "_get_oidc_metadata_cached", return_value={
-        "issuer": "https://tenant.auth0.com/",
-        "authorization_endpoint": "https://tenant.auth0.com/authorize",
-    })
-
     url = await client.start_interactive_login(
         StartInteractiveLoginOptions(
-            authorization_params={"invitation": "inv_via_dict"},
+            authorization_params={"invitation": "inv_token_xyz"}
         )
     )
 
-    parsed = parse_qs(urlparse(url).query)
-    assert "invitation" not in parsed
+    assert "invitation=inv_token_xyz" in url
+    assert "organization=" not in url
 
 
 @pytest.mark.asyncio