Good stuff

server-rs/src/routes/features.rs

@@ -16,6 +16,10 @@ fn is_false(val: &bool) -> bool {
     !val
 }
 
+fn is_empty_slice(val: &&[&str]) -> bool {
+    val.is_empty()
+}
+
 #[derive(Clone, Serialize)]
 #[serde(tag = "type")]
 pub enum FeatureInfo {
@@ -37,6 +41,10 @@ pub enum FeatureInfo {
         raw: bool,
         #[serde(skip_serializing_if = "is_false")]
         absolute: bool,
+        #[serde(skip_serializing_if = "is_empty_slice")]
+        modes: &'static [&'static str],
+        #[serde(skip_serializing_if = "is_empty")]
+        linked: &'static str,
     },
     #[serde(rename = "enum")]
     Enum {
@@ -102,6 +110,8 @@ pub fn build_features_response(data: &PropertyData) -> FeaturesResponse {
                             suffix: feature_config.suffix,
                             raw: feature_config.raw,
                             absolute: feature_config.absolute,
+                            modes: feature_config.modes,
+                            linked: feature_config.linked,
                         });
                     }
                 }

server-rs/src/routes/invites.rs

@@ -138,16 +138,13 @@ pub async fn post_invites(
     }
 }
 
-/// Validate an invite code. Requires authentication to prevent enumeration.
+/// Validate an invite code. Public endpoint — codes are 12-char random alphanumeric
+/// so enumeration is impractical, and the response only reveals valid/invalid + type.
 pub async fn get_invite(
     state: Arc<AppState>,
-    Extension(user): Extension<OptionalUser>,
+    Extension(_user): Extension<OptionalUser>,
     Path(code): Path<String>,
 ) -> Response {
-    if user.0.is_none() {
-        return StatusCode::UNAUTHORIZED.into_response();
-    }
-
     if let Err(msg) = validate_invite_code(&code) {
         return (StatusCode::BAD_REQUEST, msg).into_response();
     }