Add invitations controller to Allow List (#10934)

app/controllers/application_controller.rb

@@ -27,6 +27,7 @@ class ApplicationController < ActionController::Base
                           omniauth_callbacks
                           registrations
                           confirmations
+                          invitations
                           passwords
                           health_checks].freeze
   private_constant :PUBLIC_CONTROLLERS

spec/requests/invitations_spec.rb

@@ -0,0 +1,16 @@
+require "rails_helper"
+
+RSpec.describe "Invitations", type: :request do
+  let(:user) { create(:user) }
+
+  describe "Accept invitation" do
+    it "renders normal response even if site config is private" do
+      allow(SiteConfig).to receive(:public).and_return(false)
+      get "/users/invitation/accept?invitation_token=blahblahblahblah"
+      # This is a fake token, so the only thing we're testing for here is
+      # that we *do not* land on the "registrations" page which shouldn't
+      # interrupt the request, even for private forems. 
+      expect(response.body).not_to include("registration__actions")
+    end
+  end
+end