only allow users with an invite to create accounts

app/controllers/user_controller.rb

@@ -1,16 +1,20 @@
 class UserController < ApplicationController
 
-  skip_before_action :login_required, :only => [:new, :create]
+  skip_before_action :login_required, :only => [:new, :create, :join]
   skip_before_action :verified_email_required, :only => [:edit, :update, :verify]
 
   def new
+    @user_invite = UserInvite.active.find_by!(:uuid => params[:invite_token])
     @user = User.new
+    @user.email_address = @user_invite.email_address
     render :layout => 'sub'
   end
 
   def create
+    @user_invite = UserInvite.active.find_by!(:uuid => params[:invite_token])
     @user = User.new(params.require(:user).permit(:first_name, :last_name, :email_address, :password, :password_confirmation))
     if @user.save
+      @user_invite.accept(@user)
       AppMailer.new_user(@user).deliver
       self.current_user = @user
       redirect_to verify_path(:return_to => params[:return_to])
@@ -21,14 +25,18 @@ class UserController < ApplicationController
 
   def join
     if @invite = UserInvite.where(:uuid => params[:token]).where("expires_at > ?", Time.now).first
-      if request.post?
-        @invite.accept(current_user)
-        redirect_to_with_json root_path(:nrd => 1), :notice => "Invitation has been accepted successfully. You now have access to this organization."
-      elsif request.delete?
-        @invite.reject
-        redirect_to_with_json root_path(:nrd => 1), :notice => "Invitation has been rejected successfully."
+      if logged_in?
+        if request.post?
+          @invite.accept(current_user)
+          redirect_to_with_json root_path(:nrd => 1), :notice => "Invitation has been accepted successfully. You now have access to this organization."
+        elsif request.delete?
+          @invite.reject
+          redirect_to_with_json root_path(:nrd => 1), :notice => "Invitation has been rejected successfully."
+        else
+          @organizations = @invite.organizations.order(:name).to_a
+        end
       else
-        @organizations = @invite.organizations.order(:name).to_a
+        redirect_to new_signup_path(params[:token])
       end
     else
       redirect_to_with_json root_path(:nrd => 1), :alert => "The invite URL you have has expired. Please ask the person who invited you to re-send your invitation."