feat(invite-system): implement user invite functionality with registration mode control

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "redlight",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "redlight",
-      "version": "1.2.1",
+      "version": "1.3.0",
       "dependencies": {
         "axios": "^1.7.0",
         "bcryptjs": "^2.4.3",

package.json

@@ -1,7 +1,7 @@
 {
   "name": "redlight",
   "private": true,
-  "version": "1.2.1",
+  "version": "1.3.0",
   "type": "module",
   "scripts": {
     "dev": "concurrently -n client,server -c blue,green \"vite\" \"node --watch server/index.js\"",

server/config/database.js

@@ -405,17 +405,52 @@ export async function initDatabase() {
     `);
   }
 
-  // ── Default admin ───────────────────────────────────────────────────────
-  const adminEmail = process.env.ADMIN_EMAIL || 'admin@example.com';
-  const adminPassword = process.env.ADMIN_PASSWORD || 'admin123';
+  // User invite tokens (invite-only registration)
+  if (isPostgres) {
+    await db.exec(`
+      CREATE TABLE IF NOT EXISTS user_invites (
+        id SERIAL PRIMARY KEY,
+        token TEXT UNIQUE NOT NULL,
+        email TEXT NOT NULL,
+        created_by INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        used_by INTEGER REFERENCES users(id) ON DELETE SET NULL,
+        used_at TIMESTAMP,
+        expires_at TIMESTAMP NOT NULL,
+        created_at TIMESTAMP DEFAULT NOW()
+      );
+      CREATE INDEX IF NOT EXISTS idx_user_invites_token ON user_invites(token);
+    `);
+  } else {
+    await db.exec(`
+      CREATE TABLE IF NOT EXISTS user_invites (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        token TEXT UNIQUE NOT NULL,
+        email TEXT NOT NULL,
+        created_by INTEGER NOT NULL,
+        used_by INTEGER,
+        used_at DATETIME,
+        expires_at DATETIME NOT NULL,
+        created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+        FOREIGN KEY (created_by) REFERENCES users(id) ON DELETE CASCADE,
+        FOREIGN KEY (used_by) REFERENCES users(id) ON DELETE SET NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_user_invites_token ON user_invites(token);
+    `);
+  }
+
+  // ── Default admin (only on very first start) ────────────────────────────
+  const adminAlreadySeeded = await db.get("SELECT value FROM settings WHERE key = 'admin_seeded'");
+  if (!adminAlreadySeeded) {
+    const adminEmail = process.env.ADMIN_EMAIL || 'admin@example.com';
+    const adminPassword = process.env.ADMIN_PASSWORD || 'admin123';
 
-  const existingAdmin = await db.get('SELECT id FROM users WHERE email = ?', [adminEmail]);
-  if (!existingAdmin) {
     const hash = bcrypt.hashSync(adminPassword, 12);
     await db.run(
-      'INSERT INTO users (name, email, password_hash, role, email_verified) VALUES (?, ?, ?, ?, 1)',
-      ['Administrator', adminEmail, hash, 'admin']
+      'INSERT INTO users (name, display_name, email, password_hash, role, email_verified) VALUES (?, ?, ?, ?, ?, 1)',
+      ['Administrator', 'Administrator', adminEmail, hash, 'admin']
     );
+    // Mark as seeded so it never runs again, even if the admin email is changed
+    await db.run("INSERT INTO settings (key, value) VALUES ('admin_seeded', '1')");
     log.db.info(`Default admin created: ${adminEmail}`);
   }
 }

server/config/mailer.js

@@ -139,3 +139,46 @@ export async function sendFederationInviteEmail(to, name, fromUser, roomName, me
     text: `Hey ${name},\n\nYou have received a meeting invitation from ${fromUser}.\nRoom: ${roomName}${message ? `\nMessage: "${message}"` : ''}\n\nView invitation: ${inboxUrl}\n\n– ${appName}`,
   });
 }
+
+/**
+ * Send a user registration invite email.
+ * @param {string} to          – recipient email
+ * @param {string} inviteUrl   – full invite registration URL
+ * @param {string} appName     – branding app name (default "Redlight")
+ */
+export async function sendInviteEmail(to, inviteUrl, appName = 'Redlight') {
+  if (!transporter) {
+    throw new Error('SMTP not configured');
+  }
+
+  const from = process.env.SMTP_FROM || process.env.SMTP_USER;
+  const headerAppName = sanitizeHeaderValue(appName);
+  const safeAppName = escapeHtml(appName);
+
+  await transporter.sendMail({
+    from: `"${headerAppName}" <${from}>`,
+    to,
+    subject: `${headerAppName} – You've been invited`,
+    html: `
+      <div style="font-family:Arial,sans-serif;max-width:520px;margin:0 auto;padding:32px;background:#1e1e2e;color:#cdd6f4;border-radius:12px;">
+        <h2 style="color:#cba6f7;margin-top:0;">You've been invited! 🎉</h2>
+        <p>You have been invited to create an account on <strong style="color:#cdd6f4;">${safeAppName}</strong>.</p>
+        <p>Click the button below to register:</p>
+        <p style="text-align:center;margin:28px 0;">
+          <a href="${inviteUrl}"
+             style="display:inline-block;background:#cba6f7;color:#1e1e2e;padding:12px 32px;border-radius:8px;text-decoration:none;font-weight:bold;">
+            Create Account
+          </a>
+        </p>
+        <p style="font-size:13px;color:#7f849c;">
+          Or copy this link in your browser:<br/>
+          <a href="${inviteUrl}" style="color:#89b4fa;word-break:break-all;">${escapeHtml(inviteUrl)}</a>
+        </p>
+        <p style="font-size:13px;color:#7f849c;">This link is valid for 7 days.</p>
+        <hr style="border:none;border-top:1px solid #313244;margin:24px 0;"/>
+        <p style="font-size:12px;color:#585b70;">If you didn't expect this invitation, you can safely ignore this email.</p>
+      </div>
+    `,
+    text: `You've been invited to create an account on ${appName}.\n\nRegister here: ${inviteUrl}\n\nThis link is valid for 7 days.\n\n– ${appName}`,
+  });
+}

server/routes/admin.js

@@ -1,7 +1,9 @@
 import { Router } from 'express';
 import bcrypt from 'bcryptjs';
+import { v4 as uuidv4 } from 'uuid';
 import { getDb } from '../config/database.js';
 import { authenticateToken, requireAdmin } from '../middleware/auth.js';
+import { isMailerConfigured, sendInviteEmail } from '../config/mailer.js';
 import { log } from '../config/logger.js';
 
 const EMAIL_RE = /^[^\s@]{1,64}@[^\s@]{1,253}\.[^\s@]{2,}$/;
@@ -164,4 +166,98 @@ router.put('/users/:id/password', authenticateToken, requireAdmin, async (req, r
   }
 });
 
+// ── User Invite System ─────────────────────────────────────────────────────
+
+// POST /api/admin/invites - Create and send an invite
+router.post('/invites', authenticateToken, requireAdmin, async (req, res) => {
+  try {
+    const { email } = req.body;
+    if (!email || !EMAIL_RE.test(email)) {
+      return res.status(400).json({ error: 'A valid email address is required' });
+    }
+
+    const db = getDb();
+
+    // Check if user with this email already exists
+    const existing = await db.get('SELECT id FROM users WHERE email = ?', [email.toLowerCase()]);
+    if (existing) {
+      return res.status(409).json({ error: 'A user with this email already exists' });
+    }
+
+    // Check if there's already a pending invite for this email
+    const existingInvite = await db.get(
+      'SELECT id FROM user_invites WHERE email = ? AND used_at IS NULL AND expires_at > CURRENT_TIMESTAMP',
+      [email.toLowerCase()]
+    );
+    if (existingInvite) {
+      return res.status(409).json({ error: 'There is already a pending invite for this email' });
+    }
+
+    const token = uuidv4();
+    const expiresAt = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString(); // 7 days
+
+    await db.run(
+      'INSERT INTO user_invites (token, email, created_by, expires_at) VALUES (?, ?, ?, ?)',
+      [token, email.toLowerCase(), req.user.id, expiresAt]
+    );
+
+    // Send invite email if SMTP is configured
+    const baseUrl = process.env.APP_URL || `${req.protocol}://${req.get('host')}`;
+    const inviteUrl = `${baseUrl}/register?invite=${token}`;
+
+    // Load app name
+    const brandingSetting = await db.get("SELECT value FROM settings WHERE key = 'app_name'");
+    const appName = brandingSetting?.value || 'Redlight';
+
+    if (isMailerConfigured()) {
+      try {
+        await sendInviteEmail(email.toLowerCase(), inviteUrl, appName);
+      } catch (mailErr) {
+        log.admin.warn(`Invite email failed (non-fatal): ${mailErr.message}`);
+      }
+    }
+
+    res.status(201).json({ invite: { token, email: email.toLowerCase(), expiresAt, inviteUrl } });
+  } catch (err) {
+    log.admin.error(`Create invite error: ${err.message}`);
+    res.status(500).json({ error: 'Invite could not be created' });
+  }
+});
+
+// GET /api/admin/invites - List all invites
+router.get('/invites', authenticateToken, requireAdmin, async (req, res) => {
+  try {
+    const db = getDb();
+    const invites = await db.all(`
+      SELECT ui.id, ui.token, ui.email, ui.expires_at, ui.created_at, ui.used_at,
+             creator.name as created_by_name,
+             used_user.name as used_by_name
+      FROM user_invites ui
+      LEFT JOIN users creator ON creator.id = ui.created_by
+      LEFT JOIN users used_user ON used_user.id = ui.used_by
+      ORDER BY ui.created_at DESC
+    `);
+    res.json({ invites });
+  } catch (err) {
+    log.admin.error(`List invites error: ${err.message}`);
+    res.status(500).json({ error: 'Invites could not be loaded' });
+  }
+});
+
+// DELETE /api/admin/invites/:id - Delete an invite
+router.delete('/invites/:id', authenticateToken, requireAdmin, async (req, res) => {
+  try {
+    const db = getDb();
+    const invite = await db.get('SELECT id FROM user_invites WHERE id = ?', [req.params.id]);
+    if (!invite) {
+      return res.status(404).json({ error: 'Invite not found' });
+    }
+    await db.run('DELETE FROM user_invites WHERE id = ?', [req.params.id]);
+    res.json({ message: 'Invite deleted' });
+  } catch (err) {
+    log.admin.error(`Delete invite error: ${err.message}`);
+    res.status(500).json({ error: 'Invite could not be deleted' });
+  }
+});
+
 export default router;

server/routes/auth.js

@@ -112,7 +112,27 @@ const router = Router();
 // POST /api/auth/register
 router.post('/register', registerLimiter, async (req, res) => {
   try {
-    const { username, display_name, email, password } = req.body;
+    const { username, display_name, email, password, invite_token } = req.body;
+
+    // Check registration mode
+    const db = getDb();
+    const regModeSetting = await db.get("SELECT value FROM settings WHERE key = 'registration_mode'");
+    const registrationMode = regModeSetting?.value || 'open';
+
+    let validatedInvite = null;
+    if (registrationMode === 'invite') {
+      if (!invite_token) {
+        return res.status(403).json({ error: 'Registration is currently invite-only. You need an invitation link to register.' });
+      }
+      // Validate the invite token
+      validatedInvite = await db.get(
+        'SELECT * FROM user_invites WHERE token = ? AND used_at IS NULL AND expires_at > CURRENT_TIMESTAMP',
+        [invite_token]
+      );
+      if (!validatedInvite) {
+        return res.status(403).json({ error: 'Invalid or expired invitation link.' });
+      }
+    }
 
     if (!username || !display_name || !email || !password) {
       return res.status(400).json({ error: 'All fields are required' });
@@ -138,7 +158,6 @@ router.post('/register', registerLimiter, async (req, res) => {
       return res.status(400).json({ error: `Password must be at least ${MIN_PASSWORD_LENGTH} characters long` });
     }
 
-    const db = getDb();
     const existing = await db.get('SELECT id FROM users WHERE email = ?', [email]);
     if (existing) {
       return res.status(409).json({ error: 'Email is already in use' });
@@ -161,6 +180,14 @@ router.post('/register', registerLimiter, async (req, res) => {
         [username, display_name, email.toLowerCase(), hash, verificationToken, expires]
       );
 
+      // Mark invite as used if applicable
+      if (validatedInvite) {
+        const newUser = await db.get('SELECT id FROM users WHERE email = ?', [email.toLowerCase()]);
+        if (newUser) {
+          await db.run('UPDATE user_invites SET used_by = ?, used_at = CURRENT_TIMESTAMP WHERE id = ?', [newUser.id, validatedInvite.id]);
+        }
+      }
+
       // Build verification URL
       const baseUrl = process.env.APP_URL || `${req.protocol}://${req.get('host')}`;
       const verifyUrl = `${baseUrl}/verify-email?token=${verificationToken}`;
@@ -189,6 +216,11 @@ router.post('/register', registerLimiter, async (req, res) => {
       [username, display_name, email.toLowerCase(), hash]
     );
 
+    // Mark invite as used if applicable
+    if (validatedInvite) {
+      await db.run('UPDATE user_invites SET used_by = ?, used_at = CURRENT_TIMESTAMP WHERE id = ?', [result.lastInsertRowid, validatedInvite.id]);
+    }
+
     const token = generateToken(result.lastInsertRowid);
     const user = await db.get('SELECT id, name, display_name, email, role, theme, language, avatar_color, avatar_image, email_verified FROM users WHERE id = ?', [result.lastInsertRowid]);
 

server/routes/branding.js

@@ -82,11 +82,14 @@ router.get('/', async (req, res) => {
     const defaultTheme = await getSetting('default_theme');
     const logoFile = findLogoFile();
 
+    const registrationMode = await getSetting('registration_mode');
+
     res.json({
       appName: appName || 'Redlight',
       hasLogo: !!logoFile,
       logoUrl: logoFile ? '/api/branding/logo' : null,
       defaultTheme: defaultTheme || null,
+      registrationMode: registrationMode || 'open',
     });
   } catch (err) {
     log.branding.error('Get branding error:', err);
@@ -192,4 +195,19 @@ router.put('/default-theme', authenticateToken, requireAdmin, async (req, res) =
   }
 });
 
+// PUT /api/branding/registration-mode - Set registration mode (admin only)
+router.put('/registration-mode', authenticateToken, requireAdmin, async (req, res) => {
+  try {
+    const { registrationMode } = req.body;
+    if (!registrationMode || !['open', 'invite'].includes(registrationMode)) {
+      return res.status(400).json({ error: 'registrationMode must be "open" or "invite"' });
+    }
+    await setSetting('registration_mode', registrationMode);
+    res.json({ registrationMode });
+  } catch (err) {
+    log.branding.error('Update registration mode error:', err);
+    res.status(500).json({ error: 'Could not update registration mode' });
+  }
+});
+
 export default router;

server/routes/federation.js

@@ -39,7 +39,7 @@ export function wellKnownHandler(req, res) {
         federation_api: '/api/federation',
         public_key: getPublicKey(),
         software: 'Redlight',
-        version: '1.2.1',
+        version: '1.3.0',
     });
 }
 

src/contexts/AuthContext.jsx

@@ -28,8 +28,10 @@ export function AuthProvider({ children }) {
     return res.data.user;
   }, []);
 
-  const register = useCallback(async (username, displayName, email, password) => {
-    const res = await api.post('/auth/register', { username, display_name: displayName, email, password });
+  const register = useCallback(async (username, displayName, email, password, inviteToken) => {
+    const payload = { username, display_name: displayName, email, password };
+    if (inviteToken) payload.invite_token = inviteToken;
+    const res = await api.post('/auth/register', payload);
     if (res.data.needsVerification) {
       return { needsVerification: true };
     }

src/i18n/de.json

@@ -86,7 +86,9 @@
     "emailVerificationResend": "Hier klicken um eine neue Verifizierungsmail zu erhalten",
     "emailVerificationResendCooldown": "Erneut senden in {seconds}s",
     "emailVerificationResendSuccess": "Verifizierungsmail wurde gesendet!",
-    "emailVerificationResendFailed": "Verifizierungsmail konnte nicht gesendet werden"
+    "emailVerificationResendFailed": "Verifizierungsmail konnte nicht gesendet werden",
+    "inviteOnly": "Nur mit Einladung",
+    "inviteOnlyDesc": "Die Registrierung ist derzeit eingeschränkt. Sie benötigen einen Einladungslink von einem Administrator, um ein Konto zu erstellen."
   },
   "home": {
     "poweredBy": "Powered by BigBlueButton",
@@ -333,7 +335,26 @@
     "defaultThemeLabel": "Standard-Theme",
     "defaultThemeDesc": "Wird für nicht angemeldete Seiten (Gast-Join, Login, Startseite) verwendet, wenn keine persönliche Einstellung gesetzt ist.",
     "defaultThemeSaved": "Standard-Theme gespeichert",
-    "defaultThemeUpdateFailed": "Standard-Theme konnte nicht aktualisiert werden"
+    "defaultThemeUpdateFailed": "Standard-Theme konnte nicht aktualisiert werden",
+    "regModeTitle": "Registrierungsmodus",
+    "regModeDescription": "Steuern Sie, wie sich neue Benutzer registrieren können. \"Offen\" erlaubt jedem die Anmeldung. \"Nur mit Einladung\" erfordert einen Einladungslink.",
+    "regModeOpen": "Offene Registrierung",
+    "regModeInvite": "Nur mit Einladung",
+    "regModeSaved": "Registrierungsmodus aktualisiert",
+    "regModeFailed": "Registrierungsmodus konnte nicht aktualisiert werden",
+    "inviteTitle": "Benutzer-Einladungen",
+    "inviteDescription": "Laden Sie neue Benutzer per E-Mail ein. Sie erhalten einen Registrierungslink, der 7 Tage gültig ist.",
+    "sendInvite": "Einladung senden",
+    "inviteSent": "Einladung gesendet!",
+    "inviteFailed": "Einladung konnte nicht gesendet werden",
+    "inviteDeleted": "Einladung gelöscht",
+    "inviteDeleteFailed": "Einladung konnte nicht gelöscht werden",
+    "inviteLinkCopied": "Einladungslink kopiert!",
+    "copyInviteLink": "Einladungslink kopieren",
+    "inviteExpired": "Abgelaufen",
+    "inviteUsedBy": "Verwendet von",
+    "inviteExpiresAt": "Läuft ab am",
+    "noInvites": "Noch keine Einladungen"
   },
   "federation": {
     "inbox": "Einladungen",

src/i18n/en.json

@@ -86,7 +86,9 @@
     "emailVerificationResend": "Click here to receive a new verification email",
     "emailVerificationResendCooldown": "Resend in {seconds}s",
     "emailVerificationResendSuccess": "Verification email sent!",
-    "emailVerificationResendFailed": "Could not send verification email"
+    "emailVerificationResendFailed": "Could not send verification email",
+    "inviteOnly": "Invite Only",
+    "inviteOnlyDesc": "Registration is currently restricted. You need an invitation link from an administrator to create an account."
   },
   "home": {
     "poweredBy": "Powered by BigBlueButton",
@@ -333,7 +335,26 @@
     "defaultThemeLabel": "Default Theme",
     "defaultThemeDesc": "Applied to unauthenticated pages (guest join, login, home) when no personal preference is set.",
     "defaultThemeSaved": "Default theme saved",
-    "defaultThemeUpdateFailed": "Could not update default theme"
+    "defaultThemeUpdateFailed": "Could not update default theme",
+    "regModeTitle": "Registration Mode",
+    "regModeDescription": "Control how new users can register. \"Open\" allows everyone to sign up. \"Invite only\" requires an invitation link.",
+    "regModeOpen": "Open registration",
+    "regModeInvite": "Invite only",
+    "regModeSaved": "Registration mode updated",
+    "regModeFailed": "Could not update registration mode",
+    "inviteTitle": "User Invitations",
+    "inviteDescription": "Invite new users by email. They will receive a registration link valid for 7 days.",
+    "sendInvite": "Send invite",
+    "inviteSent": "Invitation sent!",
+    "inviteFailed": "Could not send invitation",
+    "inviteDeleted": "Invitation deleted",
+    "inviteDeleteFailed": "Could not delete invitation",
+    "inviteLinkCopied": "Invite link copied!",
+    "copyInviteLink": "Copy invite link",
+    "inviteExpired": "Expired",
+    "inviteUsedBy": "Used by",
+    "inviteExpiresAt": "Expires",
+    "noInvites": "No invitations yet"
   },
   "federation": {
     "inbox": "Invitations",

src/pages/Admin.jsx

@@ -3,7 +3,8 @@ import { useNavigate } from 'react-router-dom';
 import {
   Users, Shield, Search, Trash2, ChevronDown, Loader2,
   MoreVertical, Key, UserCheck, UserX, UserPlus, Mail, Lock, User,
-  Upload, X as XIcon, Image, Type, Palette,
+  Upload, X as XIcon, Image, Type, Palette, Send, Copy, Clock, Check,
+  ShieldCheck, Globe,
 } from 'lucide-react';
 import { useAuth } from '../contexts/AuthContext';
 import { useLanguage } from '../contexts/LanguageContext';
@@ -15,7 +16,7 @@ import toast from 'react-hot-toast';
 export default function Admin() {
   const { user } = useAuth();
   const { t, language } = useLanguage();
-  const { appName, hasLogo, logoUrl, defaultTheme, refreshBranding } = useBranding();
+  const { appName, hasLogo, logoUrl, defaultTheme, registrationMode, refreshBranding } = useBranding();
   const navigate = useNavigate();
   const [users, setUsers] = useState([]);
   const [loading, setLoading] = useState(true);
@@ -27,6 +28,12 @@ export default function Admin() {
   const [creatingUser, setCreatingUser] = useState(false);
   const [newUser, setNewUser] = useState({ name: '', display_name: '', email: '', password: '', role: 'user' });
 
+  // Invite state
+  const [invites, setInvites] = useState([]);
+  const [inviteEmail, setInviteEmail] = useState('');
+  const [sendingInvite, setSendingInvite] = useState(false);
+  const [savingRegMode, setSavingRegMode] = useState(false);
+
   // Branding state
   const [editAppName, setEditAppName] = useState('');
   const [savingName, setSavingName] = useState(false);
@@ -41,6 +48,7 @@ export default function Admin() {
       return;
     }
     fetchUsers();
+    fetchInvites();
   }, [user]);
 
   useEffect(() => {
@@ -62,6 +70,15 @@ export default function Admin() {
     }
   };
 
+  const fetchInvites = async () => {
+    try {
+      const res = await api.get('/admin/invites');
+      setInvites(res.data.invites);
+    } catch {
+      // silently fail
+    }
+  };
+
   const handleRoleChange = async (userId, newRole) => {
     try {
       await api.put(`/admin/users/${userId}/role`, { role: newRole });
@@ -172,6 +189,50 @@ export default function Admin() {
     }
   };
 
+  const handleSendInvite = async (e) => {
+    e.preventDefault();
+    setSendingInvite(true);
+    try {
+      const res = await api.post('/admin/invites', { email: inviteEmail });
+      toast.success(t('admin.inviteSent'));
+      setInviteEmail('');
+      fetchInvites();
+    } catch (err) {
+      toast.error(err.response?.data?.error || t('admin.inviteFailed'));
+    } finally {
+      setSendingInvite(false);
+    }
+  };
+
+  const handleDeleteInvite = async (id) => {
+    try {
+      await api.delete(`/admin/invites/${id}`);
+      toast.success(t('admin.inviteDeleted'));
+      fetchInvites();
+    } catch {
+      toast.error(t('admin.inviteDeleteFailed'));
+    }
+  };
+
+  const handleCopyInviteLink = (token) => {
+    const baseUrl = window.location.origin;
+    navigator.clipboard.writeText(`${baseUrl}/register?invite=${token}`);
+    toast.success(t('admin.inviteLinkCopied'));
+  };
+
+  const handleRegModeChange = async (mode) => {
+    setSavingRegMode(true);
+    try {
+      await api.put('/branding/registration-mode', { registrationMode: mode });
+      toast.success(t('admin.regModeSaved'));
+      refreshBranding();
+    } catch {
+      toast.error(t('admin.regModeFailed'));
+    } finally {
+      setSavingRegMode(false);
+    }
+  };
+
   const filteredUsers = users.filter(u =>
     (u.display_name || u.name).toLowerCase().includes(search.toLowerCase()) ||
     u.email.toLowerCase().includes(search.toLowerCase())
@@ -318,6 +379,128 @@ export default function Admin() {
         </div>
       </div>
 
+      {/* Registration Mode */}
+      <div className="card p-6 mb-8">
+        <div className="flex items-center gap-2 mb-4">
+          <ShieldCheck size={20} className="text-th-accent" />
+          <h2 className="text-lg font-semibold text-th-text">{t('admin.regModeTitle')}</h2>
+        </div>
+        <p className="text-sm text-th-text-s mb-5">{t('admin.regModeDescription')}</p>
+
+        <div className="flex items-center gap-3">
+          <button
+            onClick={() => handleRegModeChange('open')}
+            disabled={savingRegMode}
+            className={`flex items-center gap-2 px-4 py-2.5 rounded-xl border text-sm font-medium transition-colors ${
+              registrationMode === 'open'
+                ? 'border-th-accent bg-th-accent/10 text-th-accent'
+                : 'border-th-border text-th-text-s hover:bg-th-hover'
+            }`}
+          >
+            <Globe size={16} />
+            {t('admin.regModeOpen')}
+          </button>
+          <button
+            onClick={() => handleRegModeChange('invite')}
+            disabled={savingRegMode}
+            className={`flex items-center gap-2 px-4 py-2.5 rounded-xl border text-sm font-medium transition-colors ${
+              registrationMode === 'invite'
+                ? 'border-th-accent bg-th-accent/10 text-th-accent'
+                : 'border-th-border text-th-text-s hover:bg-th-hover'
+            }`}
+          >
+            <Mail size={16} />
+            {t('admin.regModeInvite')}
+          </button>
+        </div>
+      </div>
+
+      {/* User Invites */}
+      <div className="card p-6 mb-8">
+        <div className="flex items-center gap-2 mb-4">
+          <Send size={20} className="text-th-accent" />
+          <h2 className="text-lg font-semibold text-th-text">{t('admin.inviteTitle')}</h2>
+        </div>
+        <p className="text-sm text-th-text-s mb-5">{t('admin.inviteDescription')}</p>
+
+        {/* Send invite form */}
+        <form onSubmit={handleSendInvite} className="flex items-center gap-2 mb-6">
+          <div className="relative flex-1">
+            <Mail size={16} className="absolute left-3 top-1/2 -translate-y-1/2 text-th-text-s" />
+            <input
+              type="email"
+              value={inviteEmail}
+              onChange={e => setInviteEmail(e.target.value)}
+              className="input-field pl-9 text-sm"
+              placeholder={t('auth.emailPlaceholder')}
+              required
+            />
+          </div>
+          <button
+            type="submit"
+            disabled={sendingInvite || !inviteEmail.trim()}
+            className="btn-primary text-sm px-4 flex-shrink-0"
+          >
+            {sendingInvite ? <Loader2 size={14} className="animate-spin" /> : <Send size={14} />}
+            {t('admin.sendInvite')}
+          </button>
+        </form>
+
+        {/* Invite list */}
+        {invites.length > 0 && (
+          <div className="space-y-2">
+            {invites.map(inv => {
+              const isExpired = new Date(inv.expires_at) < new Date();
+              const isUsed = !!inv.used_at;
+              return (
+                <div key={inv.id} className="flex items-center justify-between gap-3 p-3 rounded-xl bg-th-bg border border-th-border">
+                  <div className="flex items-center gap-3 min-w-0">
+                    <div className={`w-8 h-8 rounded-full flex items-center justify-center flex-shrink-0 ${
+                      isUsed ? 'bg-green-500/15 text-green-400' : isExpired ? 'bg-red-500/15 text-red-400' : 'bg-th-accent/15 text-th-accent'
+                    }`}>
+                      {isUsed ? <Check size={14} /> : isExpired ? <XIcon size={14} /> : <Clock size={14} />}
+                    </div>
+                    <div className="min-w-0">
+                      <p className="text-sm font-medium text-th-text truncate">{inv.email}</p>
+                      <p className="text-xs text-th-text-s">
+                        {isUsed
+                          ? `${t('admin.inviteUsedBy')} ${inv.used_by_name}`
+                          : isExpired
+                            ? t('admin.inviteExpired')
+                            : `${t('admin.inviteExpiresAt')} ${new Date(inv.expires_at).toLocaleDateString(language === 'de' ? 'de-DE' : 'en-US')}`
+                        }
+                      </p>
+                    </div>
+                  </div>
+                  <div className="flex items-center gap-1 flex-shrink-0">
+                    {!isUsed && !isExpired && (
+                      <button
+                        onClick={() => handleCopyInviteLink(inv.token)}
+                        className="p-1.5 rounded-lg hover:bg-th-hover text-th-text-s transition-colors"
+                        title={t('admin.copyInviteLink')}
+                      >
+                        <Copy size={14} />
+                      </button>
+                    )}
+                    <button
+                      onClick={() => handleDeleteInvite(inv.id)}
+                      className="p-1.5 rounded-lg hover:bg-th-hover text-th-error transition-colors"
+                      title={t('common.delete')}
+                    >
+                      <Trash2 size={14} />
+                    </button>
+                  </div>
+                </div>
+              );
+            })}
+          </div>
+        )}
+
+        {invites.length === 0 && (
+          <p className="text-sm text-th-text-s text-center py-4">{t('admin.noInvites')}</p>
+        )}
+      </div>
+
       {/* Search */}
       <div className="card p-4 mb-6">
         <div className="relative">
@@ -409,7 +592,7 @@ export default function Admin() {
                       {openMenu === u.id && u.id !== user.id && (
                         <>
                           <div className="fixed inset-0 z-10" onClick={() => setOpenMenu(null)} />
-                          <div className="absolute right-0 top-8 z-20 w-48 bg-th-card rounded-xl border border-th-border shadow-th-lg overflow-hidden">
+                          <div className="absolute right-0 bottom-full mb-1 z-20 w-48 bg-th-card rounded-xl border border-th-border shadow-th-lg overflow-hidden">
                             <button
                               onClick={() => handleRoleChange(u.id, u.role === 'admin' ? 'user' : 'admin')}
                               className="w-full flex items-center gap-2 px-4 py-2.5 text-sm text-th-text hover:bg-th-hover transition-colors"

src/pages/Home.jsx

@@ -2,9 +2,12 @@ import { Link } from 'react-router-dom';
 import { Video, Shield, Users, Palette, ArrowRight, Zap, Globe } from 'lucide-react';
 import BrandLogo from '../components/BrandLogo';
 import { useLanguage } from '../contexts/LanguageContext';
+import { useBranding } from '../contexts/BrandingContext';
 
 export default function Home() {
   const { t } = useLanguage();
+  const { registrationMode } = useBranding();
+  const isInviteOnly = registrationMode === 'invite';
 
   const features = [
     {
@@ -54,10 +57,12 @@ export default function Home() {
             <Link to="/login" className="btn-ghost text-sm">
               {t('auth.login')}
             </Link>
-            <Link to="/register" className="btn-primary text-sm">
-              {t('auth.register')}
-              <ArrowRight size={16} />
-            </Link>
+            {!isInviteOnly && (
+              <Link to="/register" className="btn-primary text-sm">
+                {t('auth.register')}
+                <ArrowRight size={16} />
+              </Link>
+            )}
           </div>
         </nav>
 
@@ -78,11 +83,13 @@ export default function Home() {
           </p>
 
           <div className="flex items-center gap-4 justify-center">
-            <Link to="/register" className="btn-primary text-base px-8 py-3">
-              {t('home.getStarted')}
-              <ArrowRight size={18} />
-            </Link>
-            <Link to="/login" className="btn-secondary text-base px-8 py-3">
+            {!isInviteOnly && (
+              <Link to="/register" className="btn-primary text-base px-8 py-3">
+                {t('home.getStarted')}
+                <ArrowRight size={18} />
+              </Link>
+            )}
+            <Link to="/login" className={`${isInviteOnly ? 'btn-primary' : 'btn-secondary'} text-base px-8 py-3`}>
               {t('auth.login')}
             </Link>
           </div>

src/pages/Login.jsx

@@ -2,6 +2,7 @@ import { useState, useEffect } from 'react';
 import { Link, useNavigate } from 'react-router-dom';
 import { useAuth } from '../contexts/AuthContext';
 import { useLanguage } from '../contexts/LanguageContext';
+import { useBranding } from '../contexts/BrandingContext';
 import { Mail, Lock, ArrowRight, Loader2, AlertTriangle, RefreshCw } from 'lucide-react';
 import BrandLogo from '../components/BrandLogo';
 import api from '../services/api';
@@ -16,6 +17,7 @@ export default function Login() {
   const [resending, setResending] = useState(false);
   const { login } = useAuth();
   const { t } = useLanguage();
+  const { registrationMode } = useBranding();
   const navigate = useNavigate();
 
   useEffect(() => {
@@ -152,12 +154,14 @@ export default function Login() {
             </div>
           )}
 
-          <p className="mt-6 text-center text-sm text-th-text-s">
-            {t('auth.noAccount')}{' '}
-            <Link to="/register" className="text-th-accent hover:underline font-medium">
-              {t('auth.signUpNow')}
-            </Link>
-          </p>
+          {registrationMode !== 'invite' && (
+            <p className="mt-6 text-center text-sm text-th-text-s">
+              {t('auth.noAccount')}{' '}
+              <Link to="/register" className="text-th-accent hover:underline font-medium">
+                {t('auth.signUpNow')}
+              </Link>
+            </p>
+          )}
 
           <Link to="/" className="block mt-4 text-center text-sm text-th-text-s hover:text-th-text transition-colors">
             {t('auth.backToHome')}

src/pages/Register.jsx

@@ -1,12 +1,15 @@
 import { useState } from 'react';
-import { Link, useNavigate } from 'react-router-dom';
+import { Link, useNavigate, useSearchParams } from 'react-router-dom';
 import { useAuth } from '../contexts/AuthContext';
 import { useLanguage } from '../contexts/LanguageContext';
-import { Mail, Lock, User, ArrowRight, Loader2, CheckCircle } from 'lucide-react';
+import { useBranding } from '../contexts/BrandingContext';
+import { Mail, Lock, User, ArrowRight, Loader2, CheckCircle, ShieldAlert } from 'lucide-react';
 import BrandLogo from '../components/BrandLogo';
 import toast from 'react-hot-toast';
 
 export default function Register() {
+  const [searchParams] = useSearchParams();
+  const inviteToken = searchParams.get('invite') || '';
   const [username, setUsername] = useState('');
   const [displayName, setDisplayName] = useState('');
   const [email, setEmail] = useState('');
@@ -16,8 +19,12 @@ export default function Register() {
   const [needsVerification, setNeedsVerification] = useState(false);
   const { register } = useAuth();
   const { t } = useLanguage();
+  const { registrationMode } = useBranding();
   const navigate = useNavigate();
 
+  // Invite-only mode without a token → show blocked message
+  const isBlocked = registrationMode === 'invite' && !inviteToken;
+
   const handleSubmit = async (e) => {
     e.preventDefault();
 
@@ -33,7 +40,7 @@ export default function Register() {
 
     setLoading(true);
     try {
-      const result = await register(username, displayName, email, password);
+      const result = await register(username, displayName, email, password, inviteToken);
       if (result?.needsVerification) {
         setNeedsVerification(true);
         toast.success(t('auth.verificationSent'));
@@ -77,6 +84,15 @@ export default function Register() {
                 {t('auth.login')}
               </Link>
             </div>
+          ) : isBlocked ? (
+            <div className="text-center space-y-4">
+              <ShieldAlert size={48} className="mx-auto text-amber-400" />
+              <h2 className="text-2xl font-bold text-th-text">{t('auth.inviteOnly')}</h2>
+              <p className="text-th-text-s">{t('auth.inviteOnlyDesc')}</p>
+              <Link to="/login" className="btn-primary inline-flex items-center gap-2 mt-4">
+                {t('auth.login')}
+              </Link>
+            </div>
           ) : (
             <>
           <div className="mb-8">