hotfix(seo): crawl-allow /invite?invited_by= like /invite?code=

[0xkkonrad]

What

Adds /invite?invited_by= to GOOGLE_DEINDEX_CRAWL_ALLOW_PATHS next to /invite?code=, with tests.

Why

peanut-ui emits /invite?invited_by=<username> once #2828 lands (?code= stays a permanent read alias). This policy is main-only, so #2828 can't touch it. Without it, prod robots.txt is Allow: /invite?code= / Disallow: /invite: the new URL shape is crawl-blocked, Google can't read its X-Robots-Tag: noindex, and shared links get indexed as URL-only entries — the problem this exception was added for.

X-Robots-Tag itself already covers both shapes (prefix-based; checked on prod).

Tests

seo-route-policy.test.ts + robots.test.ts green locally.

Summary by CodeRabbit

• Bug Fixes
  • Updated search engine handling for invite links using the invited_by query parameter.
  • Invite links with valid tracking parameters can now be crawled appropriately, while protected routes remain excluded from indexing.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
peanut-wallet	Ready	Preview	Aug 26, 2026 5:43pm

[github-actions]

Code-analysis diff

Painscore total: 7332.15 → 7332.15 (0)
Findings: 0 net (+0 new, -0 resolved)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: bd602eec-f41e-4731-84a1-f65a3ebebbf5

📥 Commits

Reviewing files that changed from the base of the PR and between d4bd3ab and 750d789.

📒 Files selected for processing (2)

• src/constants/__tests__/seo-route-policy.test.ts
• src/constants/seo-route-policy.js

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The SEO route policy now allows /invite?invited_by= in the Google deindex crawl exceptions. Tests cover this query variant and retain existing protected-route assertions.

Changes

SEO route policy

Layer / File(s)	Summary
Invite crawl exception policy and coverage src/constants/seo-route-policy.js, src/constants/__tests__/seo-route-policy.test.ts	The allowlist includes /invite?invited_by=. Documentation identifies ?code= as the legacy alias. Tests validate invite route matching and crawl exceptions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🔵 Low · up to 750d7

The PR updates crawl permissions for the new invite URL format. If Google does not interpret the query-specific rule as intended, those links may remain crawl-blocked and indexing behavior may not change, so the change is mergeable with explicit owner awareness of that matching contract.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: allowing Google to crawl /invite?invited_by= under the SEO route policy, matching the existing /invite?code= exception.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch hotfix/invite-invited-by-crawl-allow

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🧪 UI test report — ✅ all green

Suites

• ✅ unit: 3491 ran, 0 failed, 0 skipped, 57.9s

📊 Coverage (unit)

metric	%
statements	68.7%
branches	53.7%
functions	59.9%
lines	69.5%

⏱ 10 slowest test cases

time	test
4.0s	src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts › never places two stickers in heavy overlap (broad seed sweep)
1.0s	src/hooks/query/__tests__/user.test.tsx › does NOT clear a token that rotated mid-request (stale 401 racing a fresh login)
0.8s	src/utils/__tests__/demo-api.test.ts › isDemoMode() is false when not running under Capacitor
0.8s	src/utils/__tests__/crisp.test.ts › retries configuration on the next open after a failure
0.5s	src/utils/__tests__/crisp.test.ts › resets the native session on logout once support has been opened
0.5s	src/utils/__tests__/crisp.test.ts › settles, and hands back a usable plugin, against a real-shaped plugin proxy
0.5s	src/utils/__tests__/sentry.utils.test.ts › defaults to the client budget under a browser global
0.4s	src/utils/__tests__/crisp.test.ts › configures once across repeated support opens
0.3s	src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts › every sticker stays within canvas at any count
0.3s	src/utils/__tests__/auth-token.test.ts › authReady does not park — hydrates the plain token without an unlock

_{📍 Inline annotations are in the **Unit test report** check above. Coverage artifact: `coverage-unit`. Generated by `.github/workflows/tests.yml`.}

[chip-peanut-bot]

Chip review: Review clean

Clean review. The new invite query shape receives the same narrow crawl exception as the legacy alias while retaining the existing noindex response header.

Checked clean

• Verified the detached worktree head, trusted PR metadata, exact base SHA, and merge-base-to-head two-file diff.
• Traced GOOGLE_DEINDEX_CRAWL_ALLOW_PATHS into the Googlebot and generic robots groups; the new query-specific allow remains narrower than the /invite disallow.
• Verified /invite?invited_by= receives X-Robots-Tag: noindex, nofollow through the shared Next header rules and focused route-matching test.
• Checked the related invite-link emitter shape: generated links place invited_by first, matching the robots allow prefix.
• Reviewed correctness, security, adversarial cases, and slop; descendant invite paths remain blocked and no broader trust boundary changes.
• Exact-head CI is green for unit, typecheck, eslint, format, e2e, CodeQL, and preview deployment checks.

Second opinion by moonshotai/kimi-k3: 0 finding(s), marked with the model name. It reads the diff only, so treat its findings as advice.

Exact head: 750d789fb5d6 · Context: repo