fix: repair invite flow — URL prefix + registration UI by SrikanthAlva · Pull Request #81 · emdash-cms/emdash

SrikanthAlva · 2026-04-02T06:43:10Z

Summary

Fixes the two compounding bugs in the user invite system that made it completely non-functional (Issue #67):

Bug 1 — Invite URL drops /_emdash/ prefix: new URL("/api/auth/invite/accept", baseUrl) treats the leading / as an absolute path, discarding the /_emdash path from baseUrl. Fixed by using string concatenation and pointing the invite URL directly to the admin UI page.
Bug 2 — No UI to complete registration: Added an InviteAcceptPage in the admin SPA that validates the invite token, displays the user's email and assigned role, and drives passkey registration via the existing /auth/invite/complete endpoint.

Files changed

File	Change
`packages/auth/src/invite.ts`	Fix URL construction to preserve baseUrl path prefix; point invite URL to admin UI page
`packages/core/tests/unit/auth/invite.test.ts`	Add regression test for baseUrl with path prefix (`/_emdash`)
`packages/admin/src/components/InviteAcceptPage.tsx`	New invite acceptance page (modeled after `SignupPage.tsx`)
`packages/admin/src/lib/api/users.ts`	Add `validateInviteToken` and `completeInviteSignup` client functions
`packages/admin/src/lib/api/index.ts`	Re-export new functions and type
`packages/admin/src/router.tsx`	Register `/invite/accept` route

Test plan

Closes #67

Made with Cursor

The invite system had two compounding bugs making it completely non-functional: 1. The invite URL dropped the /_emdash/ prefix because `new URL("/api/auth/invite/accept", baseUrl)` treats the leading slash as an absolute path, discarding any path component in baseUrl. Fixed by using string concatenation: `new URL(`${baseUrl}/admin/invite/accept`)`. 2. There was no UI for invited users to complete registration. The invite link now points directly to a new admin SPA page (/_emdash/admin/invite/accept) that validates the token, shows the user's email and role, and drives passkey registration via the existing /auth/invite/complete endpoint. 3. The auth middleware blocked unauthenticated access to the invite accept page. Added /_emdash/admin/invite/accept (and /signup) to the public admin route bypass list so invited users can reach the page without an existing session. Changes: - packages/auth/src/invite.ts: fix URL construction, point to admin UI - packages/core/src/astro/middleware/auth.ts: allow unauthenticated access to invite accept and signup admin pages - packages/core/tests/unit/auth/invite.test.ts: add regression test for baseUrl with path prefix - packages/admin/src/components/InviteAcceptPage.tsx: new invite acceptance page (modeled after SignupPage) - packages/admin/src/lib/api/users.ts: add validateInviteToken and completeInviteSignup client functions - packages/admin/src/lib/api/index.ts: re-export new functions - packages/admin/src/router.tsx: register /invite/accept route Closes emdash-cms#67 Made-with: Cursor

The invite page was incorrectly using the setup/admin endpoint to generate passkey registration options, which fails with "Setup already complete" after initial setup. This adds a dedicated /api/auth/invite/register-options endpoint that validates the invite token and generates passkey options using a temporary user identity. Made-with: Cursor

changeset-bot · 2026-04-03T05:06:44Z

⚠️ No Changeset found

Latest commit: 16ee57c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

github-actions · 2026-04-03T05:06:51Z

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

SrikanthAlva · 2026-04-03T05:08:39Z

I have read the CLA document, and I hereby sign the CLA

jcheese1 · 2026-04-04T04:32:52Z

bump

jcheese1 · 2026-04-04T07:28:39Z

can we get this in, @ascorbic ? (sorry for the tag) its real blocker right now 😓

github-actions · 2026-04-05T07:27:39Z

Overlapping PRs

This PR modifies files that are also changed by other open PRs:

feat(admin): add Taxonomy Types management page #213 (3 shared files)
feat(auth): add Google Authenticator 2FA flows and setup options #73 (5 shared files)

This may cause merge conflicts or duplicated work. A maintainer will coordinate.

pkg-pr-new · 2026-04-05T07:42:53Z

Open in StackBlitz

@emdash-cms/admin

npm i https://pkg.pr.new/@emdash-cms/admin@81

@emdash-cms/auth

npm i https://pkg.pr.new/@emdash-cms/auth@81

@emdash-cms/blocks

npm i https://pkg.pr.new/@emdash-cms/blocks@81

@emdash-cms/cloudflare

npm i https://pkg.pr.new/@emdash-cms/cloudflare@81

emdash

npm i https://pkg.pr.new/emdash@81

create-emdash

npm i https://pkg.pr.new/create-emdash@81

@emdash-cms/gutenberg-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/gutenberg-to-portable-text@81

@emdash-cms/x402

npm i https://pkg.pr.new/@emdash-cms/x402@81

@emdash-cms/plugin-ai-moderation

npm i https://pkg.pr.new/@emdash-cms/plugin-ai-moderation@81

@emdash-cms/plugin-atproto

npm i https://pkg.pr.new/@emdash-cms/plugin-atproto@81

@emdash-cms/plugin-audit-log

npm i https://pkg.pr.new/@emdash-cms/plugin-audit-log@81

@emdash-cms/plugin-color

npm i https://pkg.pr.new/@emdash-cms/plugin-color@81

@emdash-cms/plugin-embeds

npm i https://pkg.pr.new/@emdash-cms/plugin-embeds@81

@emdash-cms/plugin-forms

npm i https://pkg.pr.new/@emdash-cms/plugin-forms@81

@emdash-cms/plugin-webhook-notifier

npm i https://pkg.pr.new/@emdash-cms/plugin-webhook-notifier@81

commit: 1031fed

BenjaminPrice · 2026-04-06T01:59:00Z


 	const isLoginRoute = url.pathname.startsWith("/_emdash/admin/login");
+	const isPublicAdminRoute =
+		isLoginRoute ||


As isLoginRoute is no longer used anywhere but here, the above line can be consolidated into here and reduce the number of variables.

Updated this change

BenjaminPrice · 2026-04-06T02:50:31Z

+			<div className="w-full max-w-md">
+				{/* Header */}
+				<div className="text-center mb-8">
+					<div className="text-4xl font-bold mb-2">— EmDash</div>


This is visually different from the Login page (see:

emdash/packages/admin/src/components/LoginPage.tsx

Line 272 in 5beb0dd

<LogoLockup className="h-10 mx-auto mb-2" />

) and the Setup Wizard (see:

emdash/packages/admin/src/components/SetupWizard.tsx

Line 485 in 5beb0dd

<LogoLockup className="h-10 mx-auto mb-2" />

)

Could this structure be separated into a shared component?

Included the LogoLockup component in the InviteAcceptPage

BenjaminPrice

Bugs

From the PR Description:

(1) new URL("/api/auth/invite/accept", baseUrl) discarded the /_emdash path prefix because the leading / made it absolute

I'm unable to reproduce this locally. When I generate an invite locally it has the /_emdash path prefix.

What I liked

Generally looks good. I was able to reproduce the new registration page after accepting an invite. A few other small comments have been added.

BenjaminPrice · 2026-04-06T03:12:29Z

Sorry, one more thing. This new Invitation flow could really benefit from some E2E tests being added.

…plify auth middleware route checks

SrikanthAlva · 2026-04-07T04:59:19Z

I have read the CLA document, and I hereby sign the CLA

SrikanthAlva · 2026-04-07T05:19:44Z

I have read the CLA Document and I hereby sign the CLA

…ng and API invite creation

BenjaminPrice

Bugs

The unit test createInviteToken > should create a token and return url + email fails because the generated invite URL now uses /admin/invite/accept?token= instead of the expected /_emdash/api/auth/invite/accept?token=. Either the test assertion or the URL construction needs to be updated so they agree on the correct path.

BenjaminPrice

See comment about failing test

jcheese1 · 2026-04-11T00:20:36Z

Need this in

ascorbic · 2026-04-11T08:35:01Z

@SrikanthAlva it would be great if we could get this in. Are you able to get the tests passing?

@SrikanthAlva

…test Fixes the two compounding bugs in the user invite system (Issue emdash-cms#67): - Bug 1: Invite URL drops /_emdash/ prefix. Fixed by pointing to admin UI page. - Bug 2: No UI to complete registration. Added InviteAcceptPage with passkey registration. - Bug 3 (from PR emdash-cms#81 review): Fixed failing test assertion to match new URL path. Based on PR emdash-cms#81 by @SrikanthAlva with the requested test fix applied. Closes emdash-cms#67

ascorbic · 2026-04-14T10:06:43Z

Superseded by #542

@SrikanthAlva

) * fix: repair invite flow — URL prefix + registration UI + fix failing test Fixes the two compounding bugs in the user invite system (Issue #67): - Bug 1: Invite URL drops /_emdash/ prefix. Fixed by pointing to admin UI page. - Bug 2: No UI to complete registration. Added InviteAcceptPage with passkey registration. - Bug 3 (from PR #81 review): Fixed failing test assertion to match new URL path. Based on PR #81 by @SrikanthAlva with the requested test fix applied. Closes #67 * fix: address review comments — remove unused code, use ULID, useSearch, fix duplicate button, simplify email store * fix(auth): remove signup from public admin routes Making /_emdash/admin/signup a public server-side route allowed unauthenticated direct access. The signup page is only intended to be reached via client-side navigation from the login page. Made-with: Cursor --------- Co-authored-by: Matt Kane <mkane@cloudflare.com>

SrikanthAlva force-pushed the fix/invite-flow-67 branch from c02d284 to 8c6f151 Compare April 2, 2026 07:21

SrikanthAlva added 2 commits April 3, 2026 10:36

SrikanthAlva force-pushed the fix/invite-flow-67 branch from a54c607 to 8b0b287 Compare April 3, 2026 05:06

comment update

df484a9

matildepark mentioned this pull request Apr 3, 2026

sign to emdash admin via email doesn't work - 404 #128

Closed

github-actions bot added the needs-approval label Apr 5, 2026

This was referenced Apr 5, 2026

feat(admin): add Taxonomy Types management page #213

Open

feat(auth): add Google Authenticator 2FA flows and setup options #73

Closed

github-actions bot added the overlap label Apr 5, 2026

github-actions bot added needs-rebase and removed needs-approval labels Apr 5, 2026

BenjaminPrice suggested changes Apr 6, 2026

View reviewed changes

BenjaminPrice reviewed Apr 6, 2026

View reviewed changes

Merge branch 'main' into fix/invite-flow-67

527ed96

github-actions bot added area/admin area/auth area/core size/L cla: needed and removed needs-rebase labels Apr 7, 2026

refactor: update InviteAcceptPage to use LogoLockup component and sim…

b0c8245

…plify auth middleware route checks

github-actions bot added a commit that referenced this pull request Apr 7, 2026

@SrikanthAlva has signed the CLA in #81

598a11d

github-actions bot added cla: signed and removed cla: needed labels Apr 7, 2026

BenjaminPrice mentioned this pull request Apr 7, 2026

Invite URL missing /_emdash prefix in v0.1.0 #258

Open

feat(e2e): add comprehensive invite flow tests including error handli…

2662e16

…ng and API invite creation

github-actions bot added size/XL and removed size/L labels Apr 7, 2026

Merge branch 'main' into fix/invite-flow-67

c55d87e

SrikanthAlva requested a review from BenjaminPrice April 7, 2026 07:15

BenjaminPrice suggested changes Apr 8, 2026

View reviewed changes

Merge branch 'main' into fix/invite-flow-67

1031fed

This was referenced Apr 9, 2026

feat: pluggable auth providers — add AT Protocol, refactor GitHub/Google #398

Open

Feat/atproto oauth #418

Closed

Merge branch 'main' into fix/invite-flow-67

16ee57c

ascorbic added the Awaiting author response label Apr 11, 2026

mohamedmostafa58 mentioned this pull request Apr 13, 2026

fix: repair invite flow — URL prefix + registration UI (fixes #67) #542

Merged

ascorbic closed this Apr 14, 2026

Conversation

SrikanthAlva commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Files changed

Test plan

Uh oh!

changeset-bot bot commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

github-actions bot commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

SrikanthAlva commented Apr 3, 2026

Uh oh!

jcheese1 commented Apr 4, 2026

Uh oh!

jcheese1 commented Apr 4, 2026

Uh oh!

github-actions bot commented Apr 5, 2026

Overlapping PRs

Uh oh!

pkg-pr-new bot commented Apr 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BenjaminPrice Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

SrikanthAlva Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

BenjaminPrice Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

SrikanthAlva Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

BenjaminPrice left a comment

Choose a reason for hiding this comment

Bugs

What I liked

Uh oh!

BenjaminPrice commented Apr 6, 2026

Uh oh!

SrikanthAlva commented Apr 7, 2026

Uh oh!

SrikanthAlva commented Apr 7, 2026

Uh oh!

BenjaminPrice left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Bugs

Uh oh!

BenjaminPrice left a comment

Choose a reason for hiding this comment

Uh oh!

jcheese1 commented Apr 11, 2026

Uh oh!

ascorbic commented Apr 11, 2026

Uh oh!

ascorbic commented Apr 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

SrikanthAlva commented Apr 2, 2026 •

edited

Loading

changeset-bot bot commented Apr 3, 2026 •

edited

Loading

github-actions bot commented Apr 3, 2026 •

edited

Loading

pkg-pr-new bot commented Apr 5, 2026 •

edited

Loading

BenjaminPrice left a comment •

edited

Loading