From f62f5514f7cb8add06b37cbcd497ec6572152998 Mon Sep 17 00:00:00 2001
From: Ben Halpern <bendhalpern@gmail.com>
Date: Mon, 19 Oct 2020 16:31:26 -0400
Subject: [PATCH] Add invitations controller to Allow List (#10934)

---
 app/controllers/application_controller.rb |  1 +
 spec/requests/invitations_spec.rb         | 16 ++++++++++++++++
 2 files changed, 17 insertions(+)
 create mode 100644 spec/requests/invitations_spec.rb

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index f087b0c98..e210c7eb6 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -27,6 +27,7 @@ class ApplicationController < ActionController::Base
                           omniauth_callbacks
                           registrations
                           confirmations
+                          invitations
                           passwords
                           health_checks].freeze
   private_constant :PUBLIC_CONTROLLERS
diff --git a/spec/requests/invitations_spec.rb b/spec/requests/invitations_spec.rb
new file mode 100644
index 000000000..e3e8b4fe1
--- /dev/null
+++ b/spec/requests/invitations_spec.rb
@@ -0,0 +1,16 @@
+require "rails_helper"
+
+RSpec.describe "Invitations", type: :request do
+  let(:user) { create(:user) }
+
+  describe "Accept invitation" do
+    it "renders normal response even if site config is private" do
+      allow(SiteConfig).to receive(:public).and_return(false)
+      get "/users/invitation/accept?invitation_token=blahblahblahblah"
+      # This is a fake token, so the only thing we're testing for here is
+      # that we *do not* land on the "registrations" page which shouldn't
+      # interrupt the request, even for private forems. 
+      expect(response.body).not_to include("registration__actions")
+    end
+  end
+end