--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/mod_invites_tracking/README.md	Tue Jan 26 16:05:49 2021 +0100
@@ -0,0 +1,30 @@
+---
+labels:
+- 'Stage-Alpha'
+summary: 'Store who created the invite to create a user account'
+...
+
+Introduction
+============
+
+Invites are an intermediate way between opening registrations completely and
+closing registrations completely.
+
+By letting users invite other users to the server, an administrator exposes
+themselves again to the risk of abuse.
+
+To combat that abuse more effectively, this module allows to store (outside
+of the user’s information) who created an invite which was used to create the
+user’s account.
+
+Details
+=======
+
+Add to `modules_enabled`.
+
+Caveats
+=======
+
+- The information is not deleted even when the associated user accounts are
+  deleted.
+- Currently, there is no way to make any use of that information.

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/mod_invites_tracking/mod_invites_tracking.lua	Tue Jan 26 16:05:49 2021 +0100
@@ -0,0 +1,19 @@
+local tracking_store = module:open_store("invites_tracking");
+
+module:hook("user-registered", function(event)
+	local validated_invite = event.validated_invite or (event.session and event.session.validated_invite);
+	local new_username = event.username;
+
+	local invite_id = nil;
+	local invite_source = nil;
+	if validated_invite then
+		invite_source = validated_invite.additional_data and validated_invite.additional_data.source;
+		invite_id = validated_invite.token;
+	end
+
+	tracking_store:set(new_username, {invite_id = validated_invite.token, invite_source = invite_source});
+	module:log("debug", "recorded that invite from %s was used to create %s", invite_source, new_username)
+end);
+
+-- " " is an invalid localpart -> we can safely use it for store metadata
+tracking_store:set(" ", {version="1"});