refactor: apply review changes to joinrequest

lib/membership/membership.ex

@@ -353,19 +353,20 @@ defmodule Mv.Membership do
   @doc """
   Confirms a join request by token (public confirmation link).
 
-  Hashes the token, finds the JoinRequest by confirmation_token_hash, then updates
-  to status :submitted and invalidates the token. Idempotent: if already submitted,
-  returns the existing record without changing it.
+  Hashes the token, finds the JoinRequest by confirmation_token_hash, checks that
+  the token has not expired, then updates to status :submitted. Idempotent: if
+  already submitted, approved, or rejected, returns the existing record without changing it.
 
   ## Options
     - `:actor` - Must be nil for public confirm (policy allows only unauthenticated).
 
   ## Returns
-    - `{:ok, request}` - Updated or already-submitted JoinRequest
+    - `{:ok, request}` - Updated or already-processed JoinRequest
+    - `{:error, :token_expired}` - Token was found but confirmation_token_expires_at is in the past
     - `{:error, error}` - Token unknown/invalid or authorization error
   """
   def confirm_join_request(token, opts \\ []) when is_binary(token) do
-    hash = confirmation_token_hash(token)
+    hash = JoinRequest.hash_confirmation_token(token)
     actor = Keyword.get(opts, :actor)
 
     query =
@@ -378,20 +379,28 @@ defmodule Mv.Membership do
         {:error, NotFoundError.exception(resource: JoinRequest)}
 
       {:ok, request} ->
-        if request.status == :submitted do
-          {:ok, request}
-        else
-          request
-          |> Ash.Changeset.for_update(:confirm, %{}, domain: __MODULE__)
-          |> Ash.update(domain: __MODULE__, actor: actor)
-        end
+        do_confirm_request(request, actor)
 
       {:error, error} ->
         {:error, error}
     end
   end
 
-  defp confirmation_token_hash(token) do
-    :crypto.hash(:sha256, token) |> Base.encode16(case: :lower)
+  defp do_confirm_request(request, _actor)
+       when request.status in [:submitted, :approved, :rejected] do
+    {:ok, request}
   end
+
+  defp do_confirm_request(request, actor) do
+    if expired?(request.confirmation_token_expires_at) do
+      {:error, :token_expired}
+    else
+      request
+      |> Ash.Changeset.for_update(:confirm, %{}, domain: __MODULE__)
+      |> Ash.update(domain: __MODULE__, actor: actor)
+    end
+  end
+
+  defp expired?(nil), do: true
+  defp expired?(expires_at), do: DateTime.compare(expires_at, DateTime.utc_now()) == :lt
 end