admiralXS 1cb914023c fix: allow anonymous access to /invite/:token accept page (#7612) ...

## Problem

In the self-hosted build with login enabled, admin-generated invite
links point to the SPA route `/invite/<token>`, but that route is not
covered by the anonymous whitelist. Anonymous users get 401 / redirected
to `/login` before the React app can mount - even though the APIs the
page calls (`/api/v1/invite/validate`, `/api/v1/invite/accept`) are
already whitelisted. Since accepting an invite is how a *new* account is
created, requiring authentication first makes the feature unusable.

## Fix

Add `INVITE_LINK_PATTERN` (`^/invite/[^/]+/?$`) in
`RequestUriUtils.java`, matched at the end of `isPublicAuthEndpoint()` -
mirroring the existing `SHARE_LINK_PATTERN` handling. The invite data
APIs remain protected by their own token validation; only the SPA
bootstrap page becomes anonymously reachable.

## Tests

Added unit tests in `RequestUriUtilsTest.java` mirroring the share-link
tests:

- `/invite/<token>` (with/without trailing slash, with context path) ?
public
- bare `/invite` and `/invite/` ? NOT public (token segment required)
- `/invite/<token>/foo` nested paths ? NOT public
- `/inviteX` prefix over-match ? NOT public

## Verification

Pattern behavior validated against all test cases above. Live-tested on
2.14.3 self-hosted: anonymous `GET /invite/<token>` returned 401 before
the fix; the whitelisted accept flow itself (`validate` + `accept` APIs)
works anonymously end-to-end.

2026-08-21 21:47:57 +00:00

..

src

fix: allow anonymous access to /invite/:token accept page (#7612)

2026-08-21 21:47:57 +00:00

.gitignore

refactor: move modules under app/ directory and update file paths (#3938)

2025-07-14 20:53:11 +01:00

build.gradle

build(deps): bump the simple-java-mail group across 2 directories with 2 updates (#7585)

2026-08-20 15:00:25 +00:00