Bug: Invitations belong on the API not Client

[elog08]

Actual: The client can see a list of all invited people.

Expected The client should get the list of all invited people, only if the currently authenticated user invited them. Otherwise, the client should get a boolean answer on whether or not they are allowed

[elog08]

User should be able to CRUD only their own invitations

API

• Add a userId to the invitations.model
  • models/invitation.model
• Restrict a currently authenticated user to CRUD only invitations tied to it's ID
  • Feathers Common Hooks - Restrict
• Add a hook to to the User service to check if a new user is on the invite list
  • Check if the app is configured to use InviteOnly
  • Call the invitations service from the hook
  • In the case that a user is NOT on the list, issue a BadRequests FeathersError

Client

• Modify Admin Panel
  • Use the CRUD for invitations
• On user registation,
  • In the case that the invite list is active and you aren't invited:
    • Notify the user that they are not on the invite list,

[ncko]

Note to self: only admins can send invites and only admins can see what invites have been sent