1 files changed, 8 insertions, 6 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/groups.py b/packages/meshbay-hub/src/meshbay_hub/api/groups.py
index 15c7a5d..07d3ec0 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/groups.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/groups.py
@@ -586,14 +586,16 @@ async def update_group(
 async def add_group_member(
     group_id: str,
     username: str,
-    current_user: User = Depends(require_user_scope),
+    current_user: User = Depends(get_current_user),
     db: AsyncSession = Depends(get_db),
 ):
-    # `require_user_scope`, like every other mutating group endpoint: a
-    # node-scoped daemon token must not manage membership (NS7 — the operator
-    # manages groups from the browser). This was the one membership endpoint
-    # still on `get_current_user`, so a node token could add members to its
-    # operator's own groups.
+    # `get_current_user`, not `require_user_scope`: the node calls this after a
+    # CLI `member invite` so the group becomes visible in the invitee's SPA
+    # (commit 0443cf8). The node authenticates with a node-scoped token, and the
+    # `group.admin_id == current_user.id` check below is the real guard — a node
+    # can only touch its own operator's groups, adding an already-registered
+    # account. (Third-review M6 proposed tightening this to `require_user_scope`;
+    # that broke the CLI invite flow and was reverted — see the review doc.)
     group = await db.get(Group, group_id)
     if not group:
         raise HTTPException(status_code=404, detail="Group not found")