fix

apps/api/internal/mail/mailer.go

@@ -107,7 +107,7 @@ func hasHeaderBreak(v string) bool {
 }
 
 func InviteMessage(webOrigin, email, token, companyName string) Message {
-	link := strings.TrimRight(webOrigin, "/") + "/accept-invite?token=" + token
+	link := AcceptInviteURL(webOrigin, token)
 	text := fmt.Sprintf("You have been invited to %s on Descrybe.\n\nAccept: %s\n", companyName, link)
 	html := fmt.Sprintf(
 		`<p>You have been invited to <strong>%s</strong> on Descrybe.</p><p><a href="%s">Accept invite</a></p>`,
@@ -116,6 +116,11 @@ func InviteMessage(webOrigin, email, token, companyName string) Message {
 	return Message{To: email, Subject: "You are invited to Descrybe", Text: text, HTML: html}
 }
 
+// AcceptInviteURL builds the durable invite / set-password accept link (hashed invite tokens).
+func AcceptInviteURL(webOrigin, token string) string {
+	return strings.TrimRight(webOrigin, "/") + "/accept-invite?token=" + token
+}
+
 // SetPasswordURL builds the HMAC set-password accept-invite link.
 func SetPasswordURL(webOrigin, token string) string {
 	return strings.TrimRight(webOrigin, "/") + "/accept-invite?token=" + token + "&mode=set-password"
@@ -133,7 +138,7 @@ func SetPasswordMessage(webOrigin, email, token string) Message {
 
 // MigratedSetPasswordMessage uses migrator invite tokens (accept-invite flow).
 func MigratedSetPasswordMessage(webOrigin, email, token string) Message {
-	link := strings.TrimRight(webOrigin, "/") + "/accept-invite?token=" + token
+	link := AcceptInviteURL(webOrigin, token)
 	text := fmt.Sprintf(
 		"Your Descrybe account was migrated. Set your password here:\n\n%s\n\nIf you did not expect this email, ignore it.\n",
 		link,