Reject empty invite payloads in DM invite parsing

src/invite/signed-invite.ts

@@ -91,6 +91,11 @@ export function parseInviteSlug(slugOrUrl: string): ParsedInvite {
   const bytes = decodeFromSlug(slug);
   const signedInvite = decodeSignedInvite(bytes);
   const payload = decodeInvitePayload(signedInvite.payload);
+  const creatorInboxId = bytesToHex(payload.creatorInboxId);
+
+  if (!creatorInboxId || !payload.tag || payload.conversationToken.length === 0) {
+    throw new Error("Invalid invite payload");
+  }
 
   const now = BigInt(Math.floor(Date.now() / 1000));
   const isExpired = payload.expiresAtUnix !== undefined && payload.expiresAtUnix < now;
@@ -100,7 +105,7 @@ export function parseInviteSlug(slugOrUrl: string): ParsedInvite {
   return {
     signedInvite,
     payload,
-    creatorInboxId: bytesToHex(payload.creatorInboxId),
+    creatorInboxId,
     isExpired,
     isConversationExpired,
   };

tests/invite/signed-invite.test.ts

@@ -109,6 +109,11 @@ describe("signedInvite", () => {
       const parsed = parseInviteSlug(url);
       expect(parsed.payload.tag).toBe(testTag);
     });
+
+    it("should reject invite-like strings that decode to an empty payload", () => {
+      expect(() => parseInviteSlug("8118")).toThrow("Invalid invite payload");
+      expect(() => parseInviteSlug("6018")).toThrow("Invalid invite payload");
+    });
   });
 
   describe("verifyInvite", () => {