Safer invites, chains, listing import and sign-in
Improvements
- Importing a property from a Rightmove or OnTheMarket link is now stricter and more reliable: only genuine listing links are accepted, slow or oversized pages are given up on quickly, and automated abuse is blocked. If a listing can't be read, you're asked to fill in the details manually instead of seeing an error.
- Accepting an invite now makes sure it was sent to your email address and hasn't expired, and team invites are handled in the same single step as property invites. If you left a chain or team before, you can be re-invited and rejoin.
Fixes
- Accounts that have been deactivated can no longer sign in using an emailed one-time code. Previously only password sign-in blocked them; now both sign-in methods send them to the account recovery page.
- Removing a link from a chain, leaving a chain, and accepting a request to join are now all-or-nothing, so a failure part-way can no longer leave a chain in a half-changed state (for example an empty leftover chain, or a request accepted without the person being added).
- When the person who holds a chain's licence leaves, the licence now reliably passes to another member who has one; previously this could fail silently and leave the chain read-only.
- Creating a team, adding or removing members, changing roles, and assigning or taking back licences are now all-or-nothing, and always checked against who you are signed in as. This fixes removing a team member (which could remove you instead), two admins assigning the same licence at once, and a team being left without an admin if setup failed part-way.
- Team invites are now created before the invite email is sent, so the code in an email always works.
- Removing a link in the middle of a chain with several branches now only splits off the part that actually becomes disconnected.

