diff --git a/app/views/families/show.html.erb b/app/views/families/show.html.erb
index a379c543..4ab423f8 100644
--- a/app/views/families/show.html.erb
+++ b/app/views/families/show.html.erb
@@ -209,7 +209,7 @@
<%= t('families.show.invite_member', default: 'Invite New Member') %>
- <%= form_with model: [@family, FamilyInvitation.new], url: family_invitations_path(@family), local: true, class: "space-y-3" do |form| %>
+ <%= form_with model: [@family, Family::Invitation.new], url: family_invitations_path(@family), local: true, class: "space-y-3" do |form| %>
<%= form.label :email, t('families.show.email_label', default: 'Email Address'), class: "label label-text font-medium mb-1" %>
<%= form.email_field :email,
diff --git a/app/views/family_mailer/member_joined.html.erb b/app/views/family_mailer/member_joined.html.erb
new file mode 100644
index 00000000..f2429b92
--- /dev/null
+++ b/app/views/family_mailer/member_joined.html.erb
@@ -0,0 +1,39 @@
+
+
+
🎉 Great news! Someone joined your family!
+
+
Hi <%= @family.owner.email %>!
+
+
+ We're excited to let you know that <%= @user.email %> has just joined your family
+ "<%= @family.name %>" on Dawarich!
+
+
+
+
Now you can:
+
+ - See <%= @user.email %>'s current location (if they've enabled sharing)
+ - Stay connected with your growing family
+ - Share your location with <%= @user.email %>
+ - Manage family members and settings from your family page
+
+
+
+
+
+ 💡 Tip: You can manage your family members and privacy settings at any time from your family dashboard.
+
+
+
+
+ Your family now has <%= @family.member_count %> member<%= @family.member_count == 1 ? '' : 's' %>.
+
+
+
+
+
+ Best regards,
+ Evgenii from Dawarich
+
+
+
diff --git a/app/views/family_mailer/member_joined.text.erb b/app/views/family_mailer/member_joined.text.erb
new file mode 100644
index 00000000..ba840d38
--- /dev/null
+++ b/app/views/family_mailer/member_joined.text.erb
@@ -0,0 +1,18 @@
+Great news! Someone joined your family!
+
+Hi <%= @family.owner.email %>!
+
+We're excited to let you know that <%= @user.email %> has just joined your family "<%= @family.name %>" on Dawarich!
+
+Now you can:
+• See <%= @user.email %>'s current location (if they've enabled sharing)
+• Stay connected with your growing family
+• Share your location with <%= @user.email %>
+• Manage family members and settings from your family page
+
+TIP: You can manage your family members and privacy settings at any time from your family dashboard.
+
+Your family now has <%= @family.member_count %> member<%= @family.member_count == 1 ? '' : 's' %>.
+
+Best regards,
+Evgenii from Dawarich
diff --git a/docs/database_index_audit.md b/docs/database_index_audit.md
deleted file mode 100644
index cd2e4c8e..00000000
--- a/docs/database_index_audit.md
+++ /dev/null
@@ -1,29 +0,0 @@
-# Database Index Audit (2025-10-05)
-
-## Observed ActiveRecord Query Patterns
-- **Visits range filter** – `log/test.log:91056` shows repeated lookups with `WHERE "visits"."user_id" = ? AND (started_at >= ? AND ended_at <= ?)` ordered by `started_at`.
-- **Imports deduplication checks** – `log/test.log:11130` runs `SELECT 1 FROM "imports" WHERE "name" = ? AND "user_id" = ?` (and variants excluding an `id`).
-- **Family invitations association** – `app/models/user.rb:22` loads `sent_family_invitations`, which issues queries on `invited_by_id` even though only `family_id` currently has an index (`db/schema.rb:108-120`).
-
-## Missing or Weak Index Coverage
-1. **`family_invitations(invited_by_id)`**
- - Evidence: association in `app/models/user.rb:22` plus schema definition at `db/schema.rb:112` lacking an index.
- - Risk: every `user.sent_family_invitations` call scans by `invited_by_id`, which will degrade as invitation counts grow.
- - Suggested fix: add `add_index :family_invitations, :invited_by_id` (consider `validate: false` first, then `validate_foreign_key` to avoid locking).
-
-2. **`visits(user_id, started_at, ended_at)`**
- - Evidence: range queries in `log/test.log:91056` rely on `user_id` plus `started_at`/`ended_at`, yet the table only has single-column indexes on `user_id` and `started_at` (`db/schema.rb:338-339`).
- - Risk: planner must combine two indexes or fall back to seq scans for wide ranges.
- - Suggested fix: add a composite index such as `add_index :visits, [:user_id, :started_at, :ended_at]` (or at minimum `[:user_id, :started_at]`) to cover the filter and ordering.
-
-3. **`imports(user_id, name)`**
- - Evidence: deduplication queries in `log/test.log:11130` filter on both columns while only `user_id` is indexed (`db/schema.rb:146-148`).
- - Risk: duplicate checks for large import histories become progressively slower.
- - Suggested fix: add a unique composite index `add_index :imports, [:user_id, :name], unique: true` if business rules prevent duplicate filenames per user.
-
-## Potentially Unused Indexes
-- `active_storage_attachments.blob_id` (`db/schema.rb:34`) and `active_storage_variant_records(blob_id, variation_digest)` (`db/schema.rb:53`) do not appear in application code outside Active Storage internals. They are required for Active Storage itself, so no action recommended beyond periodic verification with `ANALYZE` stats.
-
-## Next Steps
-- Generate and run migrations for the suggested indexes in development, then `EXPLAIN ANALYZE` the affected queries to confirm improved plans.
-- After deploying, monitor `pg_stat_statements` or query logs to ensure the new indexes are used and to detect any remaining hotspots.
diff --git a/spec/policies/family/invitation_policy_spec.rb b/spec/policies/family/invitation_policy_spec.rb
new file mode 100644
index 00000000..8cfd4dac
--- /dev/null
+++ b/spec/policies/family/invitation_policy_spec.rb
@@ -0,0 +1,264 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Family::InvitationPolicy, type: :policy do
+ let(:family) { create(:family) }
+ let(:owner) { family.creator }
+ let(:member) { create(:user) }
+ let(:other_user) { create(:user) }
+ let(:invitation) { create(:family_invitation, family: family, invited_by: owner) }
+
+ before do
+ # Set up family membership for owner
+ create(:family_membership, family: family, user: owner, role: :owner)
+ # Set up family membership for regular member
+ create(:family_membership, family: family, user: member, role: :member)
+ end
+
+ describe '#show?' do
+ context 'with authenticated user' do
+ it 'allows any authenticated user to view invitation' do
+ policy = Family::InvitationPolicy.new(owner, invitation)
+
+ expect(policy).to permit(:show)
+ end
+
+ it 'allows other users to view invitation' do
+ policy = Family::InvitationPolicy.new(other_user, invitation)
+
+ expect(policy).to permit(:show)
+ end
+ end
+
+ context 'with unauthenticated user' do
+ it 'allows unauthenticated access (public endpoint)' do
+ policy = Family::InvitationPolicy.new(nil, invitation)
+
+ expect(policy).to permit(:show)
+ end
+ end
+ end
+
+ describe '#create?' do
+ context 'when user is family owner' do
+ before do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ end
+
+ it 'allows family owner to create invitations' do
+ policy = Family::InvitationPolicy.new(owner, invitation)
+
+ expect(policy).to permit(:create)
+ end
+ end
+
+ context 'when user is regular family member' do
+ before do
+ allow(member).to receive(:family).and_return(family)
+ allow(member).to receive(:family_owner?).and_return(false)
+ end
+
+ it 'denies regular family member from creating invitations' do
+ policy = Family::InvitationPolicy.new(member, invitation)
+
+ expect(policy).not_to permit(:create)
+ end
+ end
+
+ context 'when user is not in the family' do
+ it 'denies user not in the family from creating invitations' do
+ policy = Family::InvitationPolicy.new(other_user, invitation)
+
+ expect(policy).not_to permit(:create)
+ end
+ end
+
+ context 'with unauthenticated user' do
+ it 'denies unauthenticated user from creating invitations' do
+ policy = Family::InvitationPolicy.new(nil, invitation)
+
+ expect(policy).not_to permit(:create)
+ end
+ end
+ end
+
+ describe '#accept?' do
+ context 'when user email matches invitation email' do
+ let(:invited_user) { create(:user, email: invitation.email) }
+
+ it 'allows user to accept invitation sent to their email' do
+ policy = Family::InvitationPolicy.new(invited_user, invitation)
+
+ expect(policy).to permit(:accept)
+ end
+ end
+
+ context 'when user email does not match invitation email' do
+ it 'denies user with different email from accepting invitation' do
+ policy = Family::InvitationPolicy.new(other_user, invitation)
+
+ expect(policy).not_to permit(:accept)
+ end
+ end
+
+ context 'when family owner tries to accept invitation' do
+ it 'denies family owner from accepting invitation sent to different email' do
+ policy = Family::InvitationPolicy.new(owner, invitation)
+
+ expect(policy).not_to permit(:accept)
+ end
+ end
+
+ context 'with unauthenticated user' do
+ it 'denies unauthenticated user from accepting invitation' do
+ policy = Family::InvitationPolicy.new(nil, invitation)
+
+ expect(policy).not_to permit(:accept)
+ end
+ end
+ end
+
+ describe '#destroy?' do
+ context 'when user is family owner' do
+ before do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ end
+
+ it 'allows family owner to cancel invitations' do
+ policy = Family::InvitationPolicy.new(owner, invitation)
+
+ expect(policy).to permit(:destroy)
+ end
+ end
+
+ context 'when user is regular family member' do
+ before do
+ allow(member).to receive(:family).and_return(family)
+ allow(member).to receive(:family_owner?).and_return(false)
+ end
+
+ it 'denies regular family member from cancelling invitations' do
+ policy = Family::InvitationPolicy.new(member, invitation)
+
+ expect(policy).not_to permit(:destroy)
+ end
+ end
+
+ context 'when user is not in the family' do
+ it 'denies user not in the family from cancelling invitations' do
+ policy = Family::InvitationPolicy.new(other_user, invitation)
+
+ expect(policy).not_to permit(:destroy)
+ end
+ end
+
+ context 'with unauthenticated user' do
+ it 'denies unauthenticated user from cancelling invitations' do
+ policy = Family::InvitationPolicy.new(nil, invitation)
+
+ expect(policy).not_to permit(:destroy)
+ end
+ end
+ end
+
+ describe 'edge cases' do
+ context 'when invitation belongs to different family' do
+ let(:other_family) { create(:family) }
+ let(:other_family_owner) { other_family.creator }
+ let(:other_invitation) { create(:family_invitation, family: other_family, invited_by: other_family_owner) }
+
+ before do
+ create(:family_membership, family: other_family, user: other_family_owner, role: :owner)
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ end
+
+ it 'denies owner from creating invitations for different family' do
+ policy = Family::InvitationPolicy.new(owner, other_invitation)
+
+ expect(policy).not_to permit(:create)
+ end
+
+ it 'denies owner from destroying invitations for different family' do
+ policy = Family::InvitationPolicy.new(owner, other_invitation)
+
+ expect(policy).not_to permit(:destroy)
+ end
+ end
+
+ context 'with expired invitation' do
+ let(:expired_invitation) { create(:family_invitation, :expired, family: family, invited_by: owner) }
+ let(:invited_user) { create(:user, email: expired_invitation.email) }
+
+ it 'still allows user to attempt to accept expired invitation (business logic handles expiry)' do
+ policy = Family::InvitationPolicy.new(invited_user, expired_invitation)
+
+ expect(policy).to permit(:accept)
+ end
+
+ it 'allows owner to destroy expired invitation' do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ policy = Family::InvitationPolicy.new(owner, expired_invitation)
+
+ expect(policy).to permit(:destroy)
+ end
+ end
+
+ context 'with accepted invitation' do
+ let(:accepted_invitation) { create(:family_invitation, :accepted, family: family, invited_by: owner) }
+
+ it 'allows owner to destroy accepted invitation' do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ policy = Family::InvitationPolicy.new(owner, accepted_invitation)
+
+ expect(policy).to permit(:destroy)
+ end
+ end
+
+ context 'with cancelled invitation' do
+ let(:cancelled_invitation) { create(:family_invitation, :cancelled, family: family, invited_by: owner) }
+
+ it 'allows owner to destroy cancelled invitation' do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ policy = Family::InvitationPolicy.new(owner, cancelled_invitation)
+
+ expect(policy).to permit(:destroy)
+ end
+ end
+ end
+
+ describe 'authorization consistency' do
+ it 'ensures owner can both create and destroy invitations' do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ policy = Family::InvitationPolicy.new(owner, invitation)
+
+ expect(policy).to permit(:create)
+ expect(policy).to permit(:destroy)
+ end
+
+ it 'ensures regular members cannot create or destroy invitations' do
+ allow(member).to receive(:family).and_return(family)
+ allow(member).to receive(:family_owner?).and_return(false)
+ policy = Family::InvitationPolicy.new(member, invitation)
+
+ expect(policy).not_to permit(:create)
+ expect(policy).not_to permit(:destroy)
+ end
+
+ it 'ensures invited users can only accept their own invitations' do
+ invited_user = create(:user, email: invitation.email)
+ policy = Family::InvitationPolicy.new(invited_user, invitation)
+
+ expect(policy).to permit(:accept)
+ expect(policy).not_to permit(:create)
+ expect(policy).not_to permit(:destroy)
+ end
+ end
+end
diff --git a/spec/policies/family/membership_policy_spec.rb b/spec/policies/family/membership_policy_spec.rb
new file mode 100644
index 00000000..a6c83630
--- /dev/null
+++ b/spec/policies/family/membership_policy_spec.rb
@@ -0,0 +1,312 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Family::MembershipPolicy, type: :policy do
+ let(:family) { create(:family) }
+ let(:owner) { family.creator }
+ let(:member) { create(:user) }
+ let(:another_member) { create(:user) }
+ let(:other_user) { create(:user) }
+
+ let(:owner_membership) { create(:family_membership, :owner, family: family, user: owner) }
+ let(:member_membership) { create(:family_membership, family: family, user: member) }
+ let(:another_member_membership) { create(:family_membership, family: family, user: another_member) }
+
+ describe '#show?' do
+ context 'when user is in the same family' do
+ before do
+ allow(owner).to receive(:family).and_return(family)
+ end
+
+ it 'allows family owner to view member details' do
+ policy = Family::MembershipPolicy.new(owner, member_membership)
+
+ expect(policy).to permit(:show)
+ end
+
+ it 'allows family owner to view their own membership' do
+ policy = Family::MembershipPolicy.new(owner, owner_membership)
+
+ expect(policy).to permit(:show)
+ end
+
+ it 'allows regular member to view other members' do
+ allow(member).to receive(:family).and_return(family)
+ policy = Family::MembershipPolicy.new(member, another_member_membership)
+
+ expect(policy).to permit(:show)
+ end
+
+ it 'allows member to view their own membership' do
+ allow(member).to receive(:family).and_return(family)
+ policy = Family::MembershipPolicy.new(member, member_membership)
+
+ expect(policy).to permit(:show)
+ end
+ end
+
+ context 'when user is not in the same family' do
+ it 'denies user from different family from viewing membership' do
+ policy = Family::MembershipPolicy.new(other_user, member_membership)
+
+ expect(policy).not_to permit(:show)
+ end
+ end
+
+ context 'with unauthenticated user' do
+ it 'denies unauthenticated user from viewing membership' do
+ policy = Family::MembershipPolicy.new(nil, member_membership)
+
+ expect(policy).not_to permit(:show)
+ end
+ end
+ end
+
+ describe '#update?' do
+ context 'when user is updating their own membership' do
+ it 'allows user to update their own membership settings' do
+ allow(member).to receive(:family).and_return(family)
+ policy = Family::MembershipPolicy.new(member, member_membership)
+
+ expect(policy).to permit(:update)
+ end
+
+ it 'allows owner to update their own membership' do
+ allow(owner).to receive(:family).and_return(family)
+ policy = Family::MembershipPolicy.new(owner, owner_membership)
+
+ expect(policy).to permit(:update)
+ end
+ end
+
+ context 'when user is family owner' do
+ before do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ end
+
+ it 'allows family owner to update other members settings' do
+ policy = Family::MembershipPolicy.new(owner, member_membership)
+
+ expect(policy).to permit(:update)
+ end
+
+ it 'allows family owner to update multiple members' do
+ policy1 = Family::MembershipPolicy.new(owner, member_membership)
+ policy2 = Family::MembershipPolicy.new(owner, another_member_membership)
+
+ expect(policy1).to permit(:update)
+ expect(policy2).to permit(:update)
+ end
+ end
+
+ context 'when user is regular family member' do
+ before do
+ allow(member).to receive(:family).and_return(family)
+ allow(member).to receive(:family_owner?).and_return(false)
+ end
+
+ it 'denies regular member from updating other members settings' do
+ policy = Family::MembershipPolicy.new(member, another_member_membership)
+
+ expect(policy).not_to permit(:update)
+ end
+
+ it 'denies regular member from updating owner settings' do
+ policy = Family::MembershipPolicy.new(member, owner_membership)
+
+ expect(policy).not_to permit(:update)
+ end
+ end
+
+ context 'when user is not in the family' do
+ it 'denies user from updating membership of different family' do
+ policy = Family::MembershipPolicy.new(other_user, member_membership)
+
+ expect(policy).not_to permit(:update)
+ end
+ end
+
+ context 'with unauthenticated user' do
+ it 'denies unauthenticated user from updating membership' do
+ policy = Family::MembershipPolicy.new(nil, member_membership)
+
+ expect(policy).not_to permit(:update)
+ end
+ end
+ end
+
+ describe '#destroy?' do
+ context 'when user is removing themselves' do
+ it 'allows user to remove their own membership (leave family)' do
+ allow(member).to receive(:family).and_return(family)
+ policy = Family::MembershipPolicy.new(member, member_membership)
+
+ expect(policy).to permit(:destroy)
+ end
+
+ it 'allows owner to remove their own membership' do
+ allow(owner).to receive(:family).and_return(family)
+ policy = Family::MembershipPolicy.new(owner, owner_membership)
+
+ expect(policy).to permit(:destroy)
+ end
+ end
+
+ context 'when user is family owner' do
+ before do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ end
+
+ it 'allows family owner to remove other members' do
+ policy = Family::MembershipPolicy.new(owner, member_membership)
+
+ expect(policy).to permit(:destroy)
+ end
+
+ it 'allows family owner to remove multiple members' do
+ policy1 = Family::MembershipPolicy.new(owner, member_membership)
+ policy2 = Family::MembershipPolicy.new(owner, another_member_membership)
+
+ expect(policy1).to permit(:destroy)
+ expect(policy2).to permit(:destroy)
+ end
+ end
+
+ context 'when user is regular family member' do
+ before do
+ allow(member).to receive(:family).and_return(family)
+ allow(member).to receive(:family_owner?).and_return(false)
+ end
+
+ it 'denies regular member from removing other members' do
+ policy = Family::MembershipPolicy.new(member, another_member_membership)
+
+ expect(policy).not_to permit(:destroy)
+ end
+
+ it 'denies regular member from removing owner' do
+ policy = Family::MembershipPolicy.new(member, owner_membership)
+
+ expect(policy).not_to permit(:destroy)
+ end
+ end
+
+ context 'when user is not in the family' do
+ it 'denies user from removing membership of different family' do
+ policy = Family::MembershipPolicy.new(other_user, member_membership)
+
+ expect(policy).not_to permit(:destroy)
+ end
+ end
+
+ context 'with unauthenticated user' do
+ it 'denies unauthenticated user from removing membership' do
+ policy = Family::MembershipPolicy.new(nil, member_membership)
+
+ expect(policy).not_to permit(:destroy)
+ end
+ end
+ end
+
+ describe 'edge cases' do
+ context 'when membership belongs to different family' do
+ let(:other_family) { create(:family) }
+ let(:other_family_owner) { other_family.creator }
+ let(:other_family_membership) do
+ create(:family_membership, :owner, family: other_family, user: other_family_owner)
+ end
+
+ before do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ end
+
+ it 'denies owner from viewing membership of different family' do
+ policy = Family::MembershipPolicy.new(owner, other_family_membership)
+
+ expect(policy).not_to permit(:show)
+ end
+
+ it 'denies owner from updating membership of different family' do
+ policy = Family::MembershipPolicy.new(owner, other_family_membership)
+
+ expect(policy).not_to permit(:update)
+ end
+
+ it 'denies owner from destroying membership of different family' do
+ policy = Family::MembershipPolicy.new(owner, other_family_membership)
+
+ expect(policy).not_to permit(:destroy)
+ end
+ end
+
+ context 'when owner tries to modify another owners membership' do
+ let(:co_owner) { create(:user) }
+ let(:co_owner_membership) { create(:family_membership, :owner, family: family, user: co_owner) }
+
+ before do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ end
+
+ it 'allows owner to view another owner' do
+ policy = Family::MembershipPolicy.new(owner, co_owner_membership)
+
+ expect(policy).to permit(:show)
+ end
+
+ it 'allows owner to update another owner (family owner has full control)' do
+ policy = Family::MembershipPolicy.new(owner, co_owner_membership)
+
+ expect(policy).to permit(:update)
+ end
+
+ it 'allows owner to remove another owner (family owner has full control)' do
+ policy = Family::MembershipPolicy.new(owner, co_owner_membership)
+
+ expect(policy).to permit(:destroy)
+ end
+ end
+ end
+
+ describe 'authorization consistency' do
+ it 'ensures owner can view, update, and destroy all memberships in their family' do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+
+ policy = Family::MembershipPolicy.new(owner, member_membership)
+
+ expect(policy).to permit(:show)
+ expect(policy).to permit(:update)
+ expect(policy).to permit(:destroy)
+ end
+
+ it 'ensures regular members can only manage their own membership' do
+ allow(member).to receive(:family).and_return(family)
+ allow(member).to receive(:family_owner?).and_return(false)
+
+ own_policy = Family::MembershipPolicy.new(member, member_membership)
+ other_policy = Family::MembershipPolicy.new(member, another_member_membership)
+
+ # Can manage own membership
+ expect(own_policy).to permit(:show)
+ expect(own_policy).to permit(:update)
+ expect(own_policy).to permit(:destroy)
+
+ # Can view but not manage others
+ expect(other_policy).to permit(:show)
+ expect(other_policy).not_to permit(:update)
+ expect(other_policy).not_to permit(:destroy)
+ end
+
+ it 'ensures users can always leave the family (remove own membership)' do
+ allow(member).to receive(:family).and_return(family)
+ policy = Family::MembershipPolicy.new(member, member_membership)
+
+ expect(policy).to permit(:destroy)
+ end
+ end
+end