Merge pull request 'Lock the registration email to the invite only when the invite is redeemable' (#82) from fix/invite-email-lock into main

Reviewed-on: #82

src/Auth/RegistrationPage.php

@@ -45,6 +45,12 @@ class RegistrationPage {
 		$invite = '' !== $token ? $this->invites->findByToken( Invite::hashToken( $token ) ) : null;
 		$open   = $this->settings->openRegistrationEnabled();
 
+		// Only a redeemable invite fixes the form's email to the invited address.
+		// A stale token (expired / accepted / revoked) with open registration on
+		// must fall back to the normal editable email field, not show — and then
+		// fail to submit — the stale invite's address.
+		$inviteValid = null !== $invite && $invite->isAcceptable( current_time( 'mysql' ) );
+
 		$error       = '';
 		$successType = '';
 
@@ -65,7 +71,7 @@ class RegistrationPage {
 		$loginUrl = $this->loginUrl( Val::int( $atts['loginPageId'] ?? $atts['login_page_id'] ?? 0 ) );
 
 		$policyForms = $this->signupPolicies();
-		$canRegister = $open || ( null !== $invite && $invite->isAcceptable( current_time( 'mysql' ) ) );
+		$canRegister = $open || $inviteValid;
 
 		ob_start();
 		include USC_PLUGIN_DIR . 'templates/frontend/register-page.php';