[Security] Cloud Function sendInviteEmail should enforce App Check

[CrowdTypical]

Severity: LOW

Description

The sendInviteEmail Cloud Function in functions/index.js uses invoker: "public", making the endpoint publicly accessible. The request.auth check inside compensates, but adding App Check verification to the Cloud Function would provide defense-in-depth against unauthorized callers.

Recommendation

• Add App Check enforcement to sendInviteEmail:

  exports.sendInviteEmail = onCall(
    { secrets: [smtpEmail, smtpPassword], invoker: "public", enforceAppCheck: true },
    async (request) => { ... }
  );

• Requires App Check to be enabled on the client side first (see related issue)

Files

• functions/index.js