chore(core): Exposure of invite url configurable

[afitzek]

Summary

Introduces a new setting N8N_DISABLE_INVITE_LINK_EXPOSURE, which prevents the exposure of invite links to accounts that are allowed to create new users. This is a security hardening setting. Once SMTP settings are set up, this can be activated so that each new user receives their invite link only via email.

Related Linear tickets, Github issues, and Community forum posts

closes https://linear.app/n8n/issue/PAY-3966/zero-click-account-takeover

Review / Merge checklist

• PR title and summary are descriptive. (conventions)
• Docs updated or follow-up ticket created.
• Tests included.
• PR Labeled with release/backport (if the PR is an urgent fix that needs to be backported)

[cubic-dev-ai]

2 issues found across 3 files

Prompt for AI agents (all 2 issues)

Understand the root cause of the following 2 issues and fix them.


<file name="packages/cli/src/controllers/__tests__/users.controller.test.ts">

<violation number="1" location="packages/cli/src/controllers/__tests__/users.controller.test.ts:112">
Update the test to set `disableInviteLinkExposure` so it matches the controller logic and the intended configuration.</violation>

<violation number="2" location="packages/cli/src/controllers/__tests__/users.controller.test.ts:231">
Switch this assignment to `disableInviteLinkExposure` so the test actually toggles the flag consumed by the controller.</violation>
</file>

_{React with 👍 or 👎 to teach cubic. Mention @cubic-dev-ai to give feedback, ask questions, or re-run the review.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!