github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-08 21:59:09 -05:00
Code Issues 564 Packages Projects Releases 72 Wiki Activity

[GH-ISSUE #1355] Invitation not accepted/denied for member users (internal) #1872

New Issue
Closed
opened 2026-04-16 08:43:43 -05:00 by GiteaMirror · 20 comments
GiteaMirror commented 2026-04-16 08:43:43 -05:00
Owner
Copy Link

Originally created by @TomErnst1972 on GitHub (Aug 26, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1355

Hi,

whatever I do, accepting an invitation which i received via email results in an error.

config.yml:

gerbil:
    start_port: 51820
    base_endpoint: "aaa.bbb.ccc"

app:
    dashboard_url: "https://aaa.bbb.ccc"
    log_level: "info"
    save_logs: true
    log_failed_attempts: true
    telemetry:
        anonymous_usage: false

domains:
    domain1:
        base_domain: "bbb.ccc"
        cert_resolver: "letsencrypt"

server:
    secret: "4BW4Rycaaa.bbb.cccaaa.bbb.cccaaa.bbb.cccUHu4"
    cors:
        origins: ["https://aaa.bbb.ccc"]
        methods: ["GET", "POST", "PUT", "DELETE", "PATCH"]
        allowed_headers: ["X-CSRF-Token", "Content-Type"]
        credentials: false

email:
    smtp_host: "1.asdasdasd242"
    smtp_port: 25
    smtp_user: ""
    smtp_pass: ""
    smtp_secure: false
    no_reply: "no-reply@aaa.bbb.ccc"
    smtp_tls_reject_unauthorized: false

flags:
    require_email_verification: false
    disable_signup_without_invite: true
    disable_user_create_org: true
    allow_raw_resources: true

created invitation, was successful
Image

Image

received the email:

Image

clicked the link within Mail app on iphone:

Image

regardless what end device, the error message is always the same. tried different browsers/emails.

any suggestions?

Originally created by @TomErnst1972 on GitHub (Aug 26, 2025). Original GitHub issue: https://github.com/fosrl/pangolin/issues/1355 Hi, whatever I do, accepting an invitation which i received via email results in an error. config.yml: ``` gerbil: start_port: 51820 base_endpoint: "aaa.bbb.ccc" app: dashboard_url: "https://aaa.bbb.ccc" log_level: "info" save_logs: true log_failed_attempts: true telemetry: anonymous_usage: false domains: domain1: base_domain: "bbb.ccc" cert_resolver: "letsencrypt" server: secret: "4BW4Rycaaa.bbb.cccaaa.bbb.cccaaa.bbb.cccUHu4" cors: origins: ["https://aaa.bbb.ccc"] methods: ["GET", "POST", "PUT", "DELETE", "PATCH"] allowed_headers: ["X-CSRF-Token", "Content-Type"] credentials: false email: smtp_host: "1.asdasdasd242" smtp_port: 25 smtp_user: "" smtp_pass: "" smtp_secure: false no_reply: "no-reply@aaa.bbb.ccc" smtp_tls_reject_unauthorized: false flags: require_email_verification: false disable_signup_without_invite: true disable_user_create_org: true allow_raw_resources: true ``` created invitation, was successful <img width="911" height="702" alt="Image" src="https://github.com/user-attachments/assets/a17e577a-c0c8-46a8-82fe-f3f3b93dd6f5" /> <img width="1053" height="453" alt="Image" src="https://github.com/user-attachments/assets/33b1741e-4988-4b2e-8a6e-7c1a88bf0aec" /> received the email: ![Image](https://github.com/user-attachments/assets/5908c411-9bc9-4a1f-9342-cee46a88fb23) clicked the link within Mail app on iphone: ![Image](https://github.com/user-attachments/assets/15b5b5ac-b8c6-4432-8f86-757501b79fcb) regardless what end device, the error message is always the same. tried different browsers/emails. any suggestions?
GiteaMirror commented 2026-04-16 08:43:45 -05:00
Author
Owner
Copy Link

@Esa-mimbias commented on GitHub (Aug 27, 2025):

Hi

looks like you met the same issue than me : https://github.com/fosrl/pangolin/issues/1337

is it related to 1.8->1.9 migration ?

check Owen's answer

I could recreate my whole setup so I closed my issue, maybe you can't so it's worth investigating.

<!-- gh-comment-id:3227199640 --> @Esa-mimbias commented on GitHub (Aug 27, 2025): Hi looks like you met the same issue than me : https://github.com/fosrl/pangolin/issues/1337 is it related to 1.8->1.9 migration ? check Owen's answer I could recreate my whole setup so I closed my issue, maybe you can't so it's worth investigating.
GiteaMirror commented 2026-04-16 08:43:45 -05:00
Author
Owner
Copy Link

@PottiMc commented on GitHub (Aug 27, 2025):

Same issue here.
I don't want to recreate everything from scratch.

I am opening the link in a new private tab from my (Firefox) browser.

<!-- gh-comment-id:3228276918 --> @PottiMc commented on GitHub (Aug 27, 2025): Same issue here. I don't want to recreate everything from scratch. I am opening the link in a new private tab from my (Firefox) browser.
GiteaMirror commented 2026-04-16 08:43:46 -05:00
Author
Owner
Copy Link

@TomErnst1972 commented on GitHub (Aug 27, 2025):

looks like you met the same issue than me : #1337
is it related to 1.8->1.9 migration ?

unfortunately, no, it's a complete freshly installed version. tried also across different platforms/browsers/ip addresses

<!-- gh-comment-id:3228298004 --> @TomErnst1972 commented on GitHub (Aug 27, 2025): > looks like you met the same issue than me : [#1337](https://github.com/fosrl/pangolin/issues/1337) > is it related to 1.8->1.9 migration ? unfortunately, no, it's a complete freshly installed version. tried also across different platforms/browsers/ip addresses
GiteaMirror commented 2026-04-16 08:43:47 -05:00
Author
Owner
Copy Link

@adrianeastles commented on GitHub (Aug 27, 2025):

Looks like the invite link is broken when sending via email, will create a patch for this asap.

<!-- gh-comment-id:3228312337 --> @adrianeastles commented on GitHub (Aug 27, 2025): Looks like the invite link is broken when sending via email, will create a patch for this asap.
GiteaMirror commented 2026-04-16 08:43:47 -05:00
Author
Owner
Copy Link

@adrianeastles commented on GitHub (Aug 27, 2025):

Does the url look like https://pangolin.domain.tld/invite?token=x4j23kh3k24-3472938479832479832749283&email=test%40example.com @TomErnst1972 ?

<!-- gh-comment-id:3228396942 --> @adrianeastles commented on GitHub (Aug 27, 2025): Does the url look like https://pangolin.domain.tld/invite?token=x4j23kh3k24-3472938479832479832749283&email=test%40example.com @TomErnst1972 ?
GiteaMirror commented 2026-04-16 08:43:48 -05:00
Author
Owner
Copy Link

@PottiMc commented on GitHub (Aug 27, 2025):

@adrianeastles
Yes. It looks like this:
https://pangolin.XXXX.de/invite?token=EhEBKMJJoz-I7UCUsyPybXXXXXr4gyDoeo01ixDn3hf&email=info%40XXXXX.de

<!-- gh-comment-id:3228405014 --> @PottiMc commented on GitHub (Aug 27, 2025): @adrianeastles Yes. It looks like this: https://pangolin.XXXX.de/invite?token=EhEBKMJJoz-I7UCUsyPybXXXXXr4gyDoeo01ixDn3hf&email=info%40XXXXX.de
GiteaMirror commented 2026-04-16 08:43:49 -05:00
Author
Owner
Copy Link

@TomErnst1972 commented on GitHub (Aug 27, 2025):

it's like this

https://pangolin.website.com/invite?token=rrrrdfwfwfwf-asdasdasewrewrgefgqertqh&email=recipient%40email.com
<!-- gh-comment-id:3228427540 --> @TomErnst1972 commented on GitHub (Aug 27, 2025): it's like this ``` https://pangolin.website.com/invite?token=rrrrdfwfwfwf-asdasdasewrewrgefgqertqh&email=recipient%40email.com ```
GiteaMirror commented 2026-04-16 08:43:49 -05:00
Author
Owner
Copy Link

@TomErnst1972 commented on GitHub (Aug 27, 2025):

Does the url look like https://pangolin.domain.tld/invite?token=x4j23kh3k24-3472938479832479832749283&email=test%40example.com
yes.

<!-- gh-comment-id:3228430421 --> @TomErnst1972 commented on GitHub (Aug 27, 2025): > Does the url look like https://pangolin.domain.tld/invite?token=x4j23kh3k24-3472938479832479832749283&email=test%40example.com yes.
GiteaMirror commented 2026-04-16 08:43:49 -05:00
Author
Owner
Copy Link

@adrianeastles commented on GitHub (Aug 27, 2025):

When you select the invite button via the email, does the link redirect you to?

http://localhost:3002/auth/signup?redirect=/invite?token=43kj5hk4j35h-jk4r3jr3kj4n3rk4jrn3kj4nkn34jkn4rk&email=test2%40example.com

<!-- gh-comment-id:3228470125 --> @adrianeastles commented on GitHub (Aug 27, 2025): When you select the invite button via the email, does the link redirect you to? http://localhost:3002/auth/signup?redirect=/invite?token=43kj5hk4j35h-jk4r3jr3kj4n3rk4jrn3kj4nkn34jkn4rk&email=test2%40example.com
GiteaMirror commented 2026-04-16 08:43:50 -05:00
Author
Owner
Copy Link

@PottiMc commented on GitHub (Aug 27, 2025):

No, it's still
https://pangolin.xxxxxx.de/invite?token=FtdlsSBNcW-7GXXXXXRSoImf6c5lVWJ7ViQvma4kZUy&email=info%40XXXX.de

No localhost

<!-- gh-comment-id:3228493732 --> @PottiMc commented on GitHub (Aug 27, 2025): No, it's still https://pangolin.xxxxxx.de/invite?token=FtdlsSBNcW-7GXXXXXRSoImf6c5lVWJ7ViQvma4kZUy&email=info%40XXXX.de No localhost
GiteaMirror commented 2026-04-16 08:43:51 -05:00
Author
Owner
Copy Link

@adrianeastles commented on GitHub (Aug 27, 2025):

If you copy the invite link via the GUI, and paste that into a private browser does it work?

Image

Also, are you able to check to see if you get this shown in the logs for pangolin?
Image

Debug Mode: https://docs.digpangolin.com/self-host/advanced/config-file

<!-- gh-comment-id:3228510370 --> @adrianeastles commented on GitHub (Aug 27, 2025): If you copy the invite link via the GUI, and paste that into a private browser does it work? <img width="1530" height="479" alt="Image" src="https://github.com/user-attachments/assets/45df016d-4482-449a-b086-bc487bec9a3e" /> Also, are you able to check to see if you get this shown in the logs for pangolin? <img width="961" height="61" alt="Image" src="https://github.com/user-attachments/assets/17bd4326-6036-465b-b41b-23fa4a5997c1" /> Debug Mode: https://docs.digpangolin.com/self-host/advanced/config-file
GiteaMirror commented 2026-04-16 08:43:51 -05:00
Author
Owner
Copy Link

@PottiMc commented on GitHub (Aug 27, 2025):

As far as I can see this is all that is in the logs:

2025-08-27T15:02:09.080Z [^[[34mdebug^[[39m]: GET /api/v1/user
2025-08-27T15:02:09.088Z [^[[34mdebug^[[39m]: POST /api/v1/invite/accept
<!-- gh-comment-id:3228579706 --> @PottiMc commented on GitHub (Aug 27, 2025): As far as I can see this is all that is in the logs: ``` 2025-08-27T15:02:09.080Z [^[[34mdebug^[[39m]: GET /api/v1/user 2025-08-27T15:02:09.088Z [^[[34mdebug^[[39m]: POST /api/v1/invite/accept ```
GiteaMirror commented 2026-04-16 08:43:51 -05:00
Author
Owner
Copy Link

@joe-cole1 commented on GitHub (Aug 29, 2025):

I have this same issue. New user gets the "Invitation not accepted" screen no matter what I set for "Valid for" or other settings in user creating.

Happens both with the email link and manually pasting the invitation link. The link is formatted like: https://pangolin.domain.com/invite?token=xxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&email=address%40gmail.com

Same logs... all I have is this:

2025-08-29T20:14:59.765Z [debug]: POST /api/v1/invite/acc

I disabled the following flags in my config to see if it was related. These settings did not make a difference if set to true or false

require_email_verification: false
disable_signup_without_invite: false
<!-- gh-comment-id:3238081695 --> @joe-cole1 commented on GitHub (Aug 29, 2025): I have this same issue. New user gets the "Invitation not accepted" screen no matter what I set for "Valid for" or other settings in user creating. Happens both with the email link and manually pasting the invitation link. The link is formatted like: https://pangolin.domain.com/invite?token=xxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&email=address%40gmail.com Same logs... all I have is this: ``` 2025-08-29T20:14:59.765Z [debug]: POST /api/v1/invite/acc ``` I disabled the following flags in my config to see if it was related. These settings did not make a difference if set to true or false ``` require_email_verification: false disable_signup_without_invite: false ```
GiteaMirror commented 2026-04-16 08:43:52 -05:00
Author
Owner
Copy Link

@IngeborgBorg commented on GitHub (Aug 31, 2025):

I have the sam issue. After a fresh install via installer, invitations can not be completed. When i open the invitation link, i get the message that the link is either invalid or has already expired.
Logs from container start, invite new user and open invitation link:

2025-08-31T20:12:39.866Z [info]: Started offline checker interval
2025-08-31T20:12:39.879Z [warn]: Email SMTP configuration is missing. Emails will not be sent.
2025-08-31T20:12:39.970Z [warn]: Server admin exists. Setup token generation skipped.
2025-08-31T20:12:39.973Z [info]: Pangolin now gathers anonymous usage data to help us better understand how the software is used and guide future improvements and feature development. You can find more details, including instructions for opting out of this anonymous data collection, at: https://docs.digpangolin.com/telemetry
2025-08-31T20:12:39.976Z [debug]: Using CORS options {"origin":["https://pangolin.xxx.yyy.de"],"methods":["GET","POST","PUT","DELETE","PATCH"],"allowedHeaders":["X-CSRF-Token","Content-Type"],"credentials":false}
2025-08-31T20:12:40.532Z [info]: API server is running on http://localhost:3000
2025-08-31T20:12:40.533Z [info]: Internal server is running on http://localhost:3001
2025-08-31T20:12:42.366Z [info]: Next.js server is running on http://localhost:3002
2025-08-31T20:12:46.255Z [info]: Updated exit node
2025-08-31T20:12:46.259Z [debug]: Sending config:  {"listenPort":51820,"ipAddress":"100.89.128.1/24","peers":[{"publicKey":"tqyoIkMle5Rrr+2VVSSm+2g5seumfHUJMnw/MAHUWww=","allowedIps":["100.89.128.8/30"]}]}
2025-08-31T20:12:46.305Z [debug]: Returning mappings for 0 endpoints
2025-08-31T20:12:50.138Z [debug]: POST /api/v1/auth/newt/get-token
2025-08-31T20:12:50.275Z [info]: Establishing websocket connection
2025-08-31T20:12:50.277Z [info]: Client added to tracking - NEWT ID: ysm9h3pw5wo0g0a, Connection ID: 0c030f0a-91ff-4175-a45c-c45a04ddd296, Total connections: 1
2025-08-31T20:12:50.277Z [info]: WebSocket connection established - NEWT ID: ysm9h3pw5wo0g0a
2025-08-31T20:12:50.291Z [debug]: Handling register newt message!
2025-08-31T20:12:50.292Z [debug]: Backwards compatible mode detecting - not sending connect message and waiting for ping response.
2025-08-31T20:13:57.415Z [debug]: GET /api/v1/org/o1/roles
2025-08-31T20:13:57.441Z [debug]: GET /api/v1/idp
2025-08-31T20:14:07.768Z [debug]: POST /api/v1/org/o1/create-invite
2025-08-31T20:14:12.450Z [debug]: GET /api/v1/user
2025-08-31T20:14:12.524Z [debug]: GET /api/v1/org/o1/users
2025-08-31T20:14:12.537Z [debug]: GET /api/v1/org/o1/invitations?limit=1&offset=0
2025-08-31T20:14:12.552Z [debug]: GET /api/v1/org/o1
2025-08-31T20:14:26.730Z [debug]: GET /api/v1/user
2025-08-31T20:14:26.754Z [debug]: POST /api/v1/invite/accept

Let me know if i can provide more information.

<!-- gh-comment-id:3240389461 --> @IngeborgBorg commented on GitHub (Aug 31, 2025): I have the sam issue. After a fresh install via installer, invitations can not be completed. When i open the invitation link, i get the message that the link is either invalid or has already expired. Logs from container start, invite new user and open invitation link: ``` 2025-08-31T20:12:39.866Z [info]: Started offline checker interval 2025-08-31T20:12:39.879Z [warn]: Email SMTP configuration is missing. Emails will not be sent. 2025-08-31T20:12:39.970Z [warn]: Server admin exists. Setup token generation skipped. 2025-08-31T20:12:39.973Z [info]: Pangolin now gathers anonymous usage data to help us better understand how the software is used and guide future improvements and feature development. You can find more details, including instructions for opting out of this anonymous data collection, at: https://docs.digpangolin.com/telemetry 2025-08-31T20:12:39.976Z [debug]: Using CORS options {"origin":["https://pangolin.xxx.yyy.de"],"methods":["GET","POST","PUT","DELETE","PATCH"],"allowedHeaders":["X-CSRF-Token","Content-Type"],"credentials":false} 2025-08-31T20:12:40.532Z [info]: API server is running on http://localhost:3000 2025-08-31T20:12:40.533Z [info]: Internal server is running on http://localhost:3001 2025-08-31T20:12:42.366Z [info]: Next.js server is running on http://localhost:3002 2025-08-31T20:12:46.255Z [info]: Updated exit node 2025-08-31T20:12:46.259Z [debug]: Sending config: {"listenPort":51820,"ipAddress":"100.89.128.1/24","peers":[{"publicKey":"tqyoIkMle5Rrr+2VVSSm+2g5seumfHUJMnw/MAHUWww=","allowedIps":["100.89.128.8/30"]}]} 2025-08-31T20:12:46.305Z [debug]: Returning mappings for 0 endpoints 2025-08-31T20:12:50.138Z [debug]: POST /api/v1/auth/newt/get-token 2025-08-31T20:12:50.275Z [info]: Establishing websocket connection 2025-08-31T20:12:50.277Z [info]: Client added to tracking - NEWT ID: ysm9h3pw5wo0g0a, Connection ID: 0c030f0a-91ff-4175-a45c-c45a04ddd296, Total connections: 1 2025-08-31T20:12:50.277Z [info]: WebSocket connection established - NEWT ID: ysm9h3pw5wo0g0a 2025-08-31T20:12:50.291Z [debug]: Handling register newt message! 2025-08-31T20:12:50.292Z [debug]: Backwards compatible mode detecting - not sending connect message and waiting for ping response. 2025-08-31T20:13:57.415Z [debug]: GET /api/v1/org/o1/roles 2025-08-31T20:13:57.441Z [debug]: GET /api/v1/idp 2025-08-31T20:14:07.768Z [debug]: POST /api/v1/org/o1/create-invite 2025-08-31T20:14:12.450Z [debug]: GET /api/v1/user 2025-08-31T20:14:12.524Z [debug]: GET /api/v1/org/o1/users 2025-08-31T20:14:12.537Z [debug]: GET /api/v1/org/o1/invitations?limit=1&offset=0 2025-08-31T20:14:12.552Z [debug]: GET /api/v1/org/o1 2025-08-31T20:14:26.730Z [debug]: GET /api/v1/user 2025-08-31T20:14:26.754Z [debug]: POST /api/v1/invite/accept ``` Let me know if i can provide more information.
GiteaMirror commented 2026-04-16 08:43:53 -05:00
Author
Owner
Copy Link

@oschwartz10612 commented on GitHub (Aug 31, 2025):

Trying to diagnose this use!

It looks like the invite is actually accepted once the user creates the account because if they go into the dashboard and click the drop down it appears there. Question is why is it displaying incorrectly and not redirecting once accepted.

Looking into it more! Hope to get this in the next patch to release tonight.

<!-- gh-comment-id:3240428390 --> @oschwartz10612 commented on GitHub (Aug 31, 2025): Trying to diagnose this use! It looks like the invite is actually accepted once the user creates the account because if they go into the dashboard and click the drop down it appears there. Question is why is it displaying incorrectly and not redirecting once accepted. Looking into it more! Hope to get this in the next patch to release tonight.
GiteaMirror commented 2026-04-16 08:43:53 -05:00
Author
Owner
Copy Link

@joe-cole1 commented on GitHub (Sep 1, 2025):

Trying to diagnose this use!

It looks like the invite is actually accepted once the user creates the account because if they go into the dashboard and click the drop down it appears there. Question is why is it displaying incorrectly and not redirecting once accepted.

Looking into it more! Hope to get this in the next patch to release tonight.

Not sure what you mean by "is actually accepted once the user creates the account"

My user I'm trying to add never gets to account creation. The only screen they ever see is the error, and the invitation stays in the Invitation tab on Pangolin.

I've tried regenerating the invitation, sending it via text instead of email, and even having them create an account using the same email but from the account creation page instead of the invitation link.

<!-- gh-comment-id:3240570973 --> @joe-cole1 commented on GitHub (Sep 1, 2025): > Trying to diagnose this use! > > It looks like the invite is actually accepted once the user creates the account because if they go into the dashboard and click the drop down it appears there. Question is why is it displaying incorrectly and not redirecting once accepted. > > Looking into it more! Hope to get this in the next patch to release tonight. Not sure what you mean by "is actually accepted once the user creates the account" My user I'm trying to add never gets to account creation. The only screen they ever see is the error, and the invitation stays in the Invitation tab on Pangolin. I've tried regenerating the invitation, sending it via text instead of email, and even having them create an account using the same email but from the account creation page instead of the invitation link.
GiteaMirror commented 2026-04-16 08:43:54 -05:00
Author
Owner
Copy Link

@oschwartz10612 commented on GitHub (Sep 1, 2025):

Will be fixed in the next release. I think it was due to translations being in the server component then me fooling myself with react components laoding twice in dev because react & Vercel 🙄

<!-- gh-comment-id:3240787336 --> @oschwartz10612 commented on GitHub (Sep 1, 2025): Will be fixed in the next release. I think it was due to translations being in the server component then me fooling myself with react components laoding twice in dev because react & Vercel 🙄
GiteaMirror commented 2026-04-16 08:43:54 -05:00
Author
Owner
Copy Link

@oschwartz10612 commented on GitHub (Sep 1, 2025):

Fixed in 1.9.3

<!-- gh-comment-id:3240799048 --> @oschwartz10612 commented on GitHub (Sep 1, 2025): Fixed in 1.9.3
GiteaMirror commented 2026-04-16 08:43:55 -05:00
Author
Owner
Copy Link

@TomErnst1972 commented on GitHub (Sep 1, 2025):

confirmed, works now.

<!-- gh-comment-id:3241505424 --> @TomErnst1972 commented on GitHub (Sep 1, 2025): confirmed, works now.
GiteaMirror commented 2026-04-16 08:43:55 -05:00
Author
Owner
Copy Link

@Esa-mimbias commented on GitHub (Sep 1, 2025):

works now too ...
got an issue a little further in the process, gonna check and open an issue accordingly if needed.

<!-- gh-comment-id:3241565396 --> @Esa-mimbias commented on GitHub (Sep 1, 2025): works now too ... got an issue a little further in the process, gonna check and open an issue accordingly if needed.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#1872
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?