limit number of available per-user invites

server/djrandom/frontend/templates/user_details.html

@@ -39,9 +39,11 @@
           </form>
         </p>
 
+        {% if user.invites_left > 0 %}
         <p>
           <a href="/user/invite"><b>Invite someone</b></a>
         </p>
+        {% endif %}
 
       </div>
 

server/djrandom/frontend/user_views.py

@@ -103,6 +103,10 @@ def user_revoke_api_key(keyid):
 @app.route('/user/invite', methods=['GET', 'POST'])
 @require_auth
 def user_send_invite():
+    user = User.query.get(g.userid)
+    if not user.invites_left:
+        abort(403)
+
     form = InviteForm()
     if form.validate_on_submit():
         user = User.query.get(g.userid)
@@ -113,6 +117,8 @@ def user_send_invite():
         svcs['mailer'].send(email, 'Invitation',
                             new_user.get_activation_email(username))
 
+        user.invites_left -= 1
+        Session.add(user)
         Session.add(new_user)
         Session.commit()
         flash('invitation sent to %s' % email)

server/djrandom/model/user.py

@@ -49,6 +49,7 @@ class User(Base):
     password = Column(String(128))
     created_at = Column(DateTime())
     invited_by = Column(Integer())
+    invites_left = Column(Integer(3))
     active = Column(Boolean())
     activation_token = Column(String(40))
 
@@ -59,6 +60,7 @@ class User(Base):
         self.activation_token = utils.random_token()
         self.created_at = datetime.now()
         self.invited_by = invited_by
+        self.invites_left = 3
 
     def set_password(self, password):
         self.password = crypt.crypt(password, _salt())