БЕЗОПАСНОСТЬ - NODEDC LAUNCHER: скрыть email публичного инвайта

server/control-plane-store.mjs

@@ -1171,7 +1171,6 @@ function isInviteExpired(invite) {
 function toPublicInvite(invite) {
   return {
     id: invite.id,
-    email: invite.email,
     role: invite.role,
     expiresAt: invite.expiresAt,
     status: isInviteExpired(invite) && invite.status !== "accepted" && invite.status !== "revoked" ? "expired" : invite.status,
@@ -1190,11 +1189,16 @@ function applyInviteRegistration(data, token, payload, { commit, provisioning =
   const invite = findInviteByToken(data, token);
   const client = findById(data.clients, invite.clientId, "client");
   const now = isoNow();
+  const requestedEmail = normalizeInviteRegistrationEmail(payload?.email);
   const email = invite.email.toLowerCase();
-  const name = optionalString(payload?.name, email.split("@")[0]);
+  const name = optionalString(payload?.name, requestedEmail.split("@")[0]);
 
   validateInviteCanBeRegistered(invite);
 
+  if (!requestedEmail || requestedEmail !== email) {
+    throw new Error("Для этой почты нет активного инвайта");
+  }
+
   let user = data.users.find((item) => item.email.toLowerCase() === email);
 
   if (user?.authentikUserId && !provisioning) {
@@ -1260,6 +1264,10 @@ function applyInviteRegistration(data, token, payload, { commit, provisioning =
   return { invite, client, user, membership, data };
 }
 
+function normalizeInviteRegistrationEmail(value) {
+  return typeof value === "string" ? value.trim().toLowerCase() : "";
+}
+
 function validateInviteCanBeRegistered(invite) {
   if (invite.status === "accepted") {
     throw new Error("Инвайт уже принят");

server/dev-server.mjs

@@ -830,20 +830,34 @@ function sanitizeNewPassword(value) {
 }
 
 function sanitizeInviteRegistrationPayload(payload) {
+  const email = typeof payload?.email === "string" ? payload.email.trim().toLowerCase() : "";
   const name = typeof payload?.name === "string" ? payload.name.trim() : "";
 
+  if (!isValidInviteRegistrationEmail(email)) {
+    throw new Error("Введите почту, на которую выписан инвайт");
+  }
+
+  if (!name) {
+    throw new Error("Введите имя");
+  }
+
   return {
+    email,
     name: name.slice(0, 120),
     password: sanitizeNewPassword(payload?.password),
   };
 }
 
+function isValidInviteRegistrationEmail(email) {
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
+}
+
 function sendInviteApiError(res, error) {
   const message = error instanceof Error ? error.message : "Инвайт недоступен";
   const status =
     message.includes("не найден")
       ? 404
-      : message.includes("другую почту")
+      : message.includes("другую почту") || message.includes("нет активного инвайта")
         ? 403
         : message.includes("истёк") || message.includes("отозван")
           ? 410