fix

apps/api/internal/httpapi/company_handlers.go

@@ -217,34 +217,18 @@ func (s *Server) handleCreateInvite(w http.ResponseWriter, r *http.Request) {
 		ClientOrLog(w, http.StatusBadRequest, "could not create invite", err, auth.ClientError)
 		return
 	}
-	companyName, _ := s.Auth.CompanyName(r.Context(), cid)
-	smtpOn := s.Mail != nil && s.Mail.Enabled()
-	sendOK := false
-	if s.Mail != nil {
-		msg := mail.InviteMessage(s.Config.WebOrigin, inv.Email, token, companyName)
-		if err := s.Mail.Send(msg); err == nil {
-			sendOK = true
-		}
-	}
-	// noop/disabled mailers return nil from Send; only count real SMTP as delivered.
-	mailSent, includeToken := inviteMailResult(smtpOn, sendOK)
-	resp := map[string]any{
-		"id": inv.ID, "email": inv.Email, "role": inv.Role,
-		"expires_at": inv.ExpiresAt, "mail_sent": mailSent, "smtp_enabled": smtpOn,
-	}
-	// Token returned when email was not delivered so operators can share the accept link.
-	if includeToken {
-		resp["token"] = token
-		resp["accept_url"] = mail.AcceptInviteURL(s.Config.WebOrigin, token)
-	}
-	JSON(w, http.StatusCreated, resp)
-}
-
-// inviteMailResult decides mail_sent and whether the accept token must be returned to the client.
-func inviteMailResult(smtpEnabled, sendOK bool) (mailSent bool, includeToken bool) {
-	mailSent = smtpEnabled && sendOK
-	includeToken = !mailSent
-	return
+	// Invites are link-based: always return the one-time accept URL for the admin to share.
+	// Email delivery is not used for team invites (SMTP may still be used for password reset, etc.).
+	JSON(w, http.StatusCreated, map[string]any{
+		"id":           inv.ID,
+		"email":        inv.Email,
+		"role":         inv.Role,
+		"expires_at":   inv.ExpiresAt,
+		"mail_sent":    false,
+		"smtp_enabled": s.Mail != nil && s.Mail.Enabled(),
+		"token":        token,
+		"accept_url":   mail.AcceptInviteURL(s.Config.WebOrigin, token),
+	})
 }
 
 func (s *Server) handleRemoveMember(w http.ResponseWriter, r *http.Request) {