Good stuff

server-rs/src/routes/invites.rs

@@ -138,16 +138,13 @@ pub async fn post_invites(
     }
 }
 
-/// Validate an invite code. Requires authentication to prevent enumeration.
+/// Validate an invite code. Public endpoint — codes are 12-char random alphanumeric
+/// so enumeration is impractical, and the response only reveals valid/invalid + type.
 pub async fn get_invite(
     state: Arc<AppState>,
-    Extension(user): Extension<OptionalUser>,
+    Extension(_user): Extension<OptionalUser>,
     Path(code): Path<String>,
 ) -> Response {
-    if user.0.is_none() {
-        return StatusCode::UNAUTHORIZED.into_response();
-    }
-
     if let Err(msg) = validate_invite_code(&code) {
         return (StatusCode::BAD_REQUEST, msg).into_response();
     }