add timeouts

server/routes/federation.js

@@ -100,6 +100,7 @@ router.post('/invite', authenticateToken, async (req, res) => {
                 'X-Federation-Origin': getFederationDomain(),
             },
             body: JSON.stringify(payload),
+            signal: AbortSignal.timeout(15_000), // 15 second timeout
         });
 
         if (!response.ok) {
@@ -192,17 +193,17 @@ router.post('/receive', async (req, res) => {
             } catch { /* column may not exist on very old installs */ }
         }
 
-        // Send notification email (fire-and-forget, don't fail the request if mail fails)
-        try {
-            const appUrl = process.env.APP_URL || '';
-            const inboxUrl = `${appUrl}/federation/inbox`;
-            const appName = process.env.APP_NAME || 'Redlight';
-            await sendFederationInviteEmail(
-                targetUser.email, targetUser.name, from_user,
-                room_name, message || null, inboxUrl, appName
-            );
-        } catch (mailErr) {
+        // Send notification email (truly fire-and-forget – never blocks the response)
+        if (targetUser.email) {
+          const appUrl = process.env.APP_URL || '';
+          const inboxUrl = `${appUrl}/federation/inbox`;
+          const appName = process.env.APP_NAME || 'Redlight';
+          sendFederationInviteEmail(
+            targetUser.email, targetUser.name, from_user,
+            room_name, message || null, inboxUrl, appName
+          ).catch(mailErr => {
             console.warn('Federation invite mail failed (non-fatal):', mailErr.message);
+          });
         }
 
         res.json({ success: true });