Invite URL missing /_emdash prefix — generates /api/auth/invite/accept instead of /_emdash/api/auth/invite/accept

[jmellows]

Bug

The invite URL generated by createInvite in @emdash-cms/auth/src/invite.ts (line 71) uses /api/auth/invite/accept but the actual route is injected at /_emdash/api/auth/invite/accept.

This causes invite links to 404 when clicked.

Source

// @emdash-cms/auth/src/invite.ts line 71
const url = new URL("/api/auth/invite/accept", config.baseUrl);

The route injection in emdash/src/astro/integration/routes.ts line 777:

pattern: "/_emdash/api/auth/invite/accept",

Expected

Invite URL should be https://example.com/_emdash/api/auth/invite/accept?token=...

Actual

Invite URL is https://example.com/api/auth/invite/accept?token=... — returns 404.

Workaround

Manually change /api/ to /_emdash/api/ in the invite link before sharing with invitees.

Environment

• emdash v0.1.0
• @emdash-cms/auth v0.1.0
• Astro 6.1.1
• @astrojs/cloudflare v13
• Deployed on Cloudflare Workers

[jmellows]

Additional finding: invite flow is fully broken for passkey auth without email provider

Beyond the URL prefix issue, the invite flow doesn't work at all in passkey mode without an email provider:

1. The generated URL points to the API endpoint (/api/auth/invite/accept) which returns raw JSON — not a user-facing page
2. The admin signup page (/_emdash/admin/signup) requires authentication — but new invitees don't have auth yet, so they get redirected to login
3. There's no unauthenticated page that handles invite token acceptance and passkey registration for new users

The invite API endpoints (/_emdash/api/auth/invite/accept and /_emdash/api/auth/invite/complete) are correctly marked as public in the auth middleware, but there's no corresponding public UI page that uses them.

Expected flow

1. Admin creates invite → gets URL to share
2. Invitee clicks URL → lands on a public page showing "Welcome, register your passkey"
3. Invitee registers passkey → account created → redirected to admin

Actual flow

1. Admin creates invite → gets URL with wrong prefix pointing to raw API
2. Even with corrected URL, the API returns JSON
3. Admin UI signup page requires auth, so new users can't access it

[jmellows]

Correction on my second comment: The invite flow itself works fine. The only issue is the missing /_emdash prefix in the generated URL. Once the URL is corrected manually, the invite acceptance works as expected. Apologies for the noise in my previous comment.

[jcheese1]

@jmellows whats the flow? im just getting raw json, not sure how to proceed from there.

[ascorbic]

Fixed in #542 (merged Apr 14), which repaired the invite flow URL prefix and added the missing registration UI. Closing as a duplicate of #67.