fix

apps/api/internal/mail/mailer_test.go

@@ -118,9 +118,32 @@ func TestNewDynamicResolvesPerCall(t *testing.T) {
 	}
 }
 
+func TestInviteAndSetPasswordMessagesEscapeHTML(t *testing.T) {
+	name := `Acme <script>alert("x")</script> & Co`
+	msg := InviteMessage("https://app.example", "a@b.c", "tok", name)
+	if strings.Contains(msg.HTML, "<script>") {
+		t.Fatalf("unescaped script in HTML: %s", msg.HTML)
+	}
+	if !strings.Contains(msg.HTML, "Acme &lt;script&gt;") || !strings.Contains(msg.HTML, "&amp; Co") {
+		t.Fatalf("expected escaped company name, got %s", msg.HTML)
+	}
+	if !strings.Contains(msg.Text, name) {
+		t.Fatalf("text should keep company name: %s", msg.Text)
+	}
+
+	set := SetPasswordMessage("https://app.example", "a@b.c", `tok"onclick="alert(1)`)
+	if strings.Contains(set.HTML, `"onclick=`) {
+		t.Fatalf("unescaped token in set-password HTML: %s", set.HTML)
+	}
+	mig := MigratedSetPasswordMessage("https://app.example", "a@b.c", `tok"><img src=x>`)
+	if strings.Contains(mig.HTML, "<img") {
+		t.Fatalf("unescaped token in migrated HTML: %s", mig.HTML)
+	}
+}
+
 func TestSetPasswordURL(t *testing.T) {
 	got := SetPasswordURL("http://localhost:5174/", "tok123")
-	want := "http://localhost:5174/accept-invite?token=tok123&mode=set-password"
+	want := "http://localhost:5174/accept-invite#token=tok123&mode=set-password"
 	if got != want {
 		t.Fatalf("SetPasswordURL=%q want %q", got, want)
 	}
@@ -129,3 +152,11 @@ func TestSetPasswordURL(t *testing.T) {
 		t.Fatalf("SetPasswordMessage text missing link: %q", msg.Text)
 	}
 }
+
+func TestAcceptInviteURLUsesFragment(t *testing.T) {
+	got := AcceptInviteURL("http://localhost:5174/", "tok123")
+	want := "http://localhost:5174/accept-invite#token=tok123"
+	if got != want {
+		t.Fatalf("AcceptInviteURL=%q want %q", got, want)
+	}
+}