From 824d0654d904d13d6f15ba80406c7cd64d35fe30 Mon Sep 17 00:00:00 2001
From: Niilo Vuokila <59707802+niilovuo@users.noreply.github.com>
Date: Sat, 22 Aug 2026 00:19:32 +0300
Subject: [PATCH 1/2] fix: make invite code lifecycle actions admin-only

---
 .../web/api/enrollment/views.py                | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/src/rasenmaeher_api/web/api/enrollment/views.py b/src/rasenmaeher_api/web/api/enrollment/views.py
index 9f4636f3..4117b4a2 100644
--- a/src/rasenmaeher_api/web/api/enrollment/views.py
+++ b/src/rasenmaeher_api/web/api/enrollment/views.py
@@ -481,7 +481,11 @@ async def post_invite_code(request: Request) -> EnrollmentInviteCodeCreateOut:
     return EnrollmentInviteCodeCreateOut(invite_code=pool.invitecode)
 
 
-@ENROLLMENT_ROUTER.put("/invitecode/activate", response_model=OperationResultResponse)
+@ENROLLMENT_ROUTER.put(
+    "/invitecode/activate",
+    response_model=OperationResultResponse,
+    dependencies=[Depends(ValidUser(auto_error=True, require_roles=["admin"]))],
+)
 async def put_activate_invite_code(
     request: Request,
     request_in: EnrollmentInviteCodeActivateIn = Body(),
@@ -533,7 +537,11 @@ async def put_activate_invite_code(
     raise HTTPException(status_code=500, detail=_reason)
 
 
-@ENROLLMENT_ROUTER.put("/invitecode/deactivate", response_model=OperationResultResponse)
+@ENROLLMENT_ROUTER.put(
+    "/invitecode/deactivate",
+    response_model=OperationResultResponse,
+    dependencies=[Depends(ValidUser(auto_error=True, require_roles=["admin"]))],
+)
 async def put_deactivate_invite_code(
     request: Request,
     request_in: EnrollmentInviteCodeDeactivateIn = Body(),
@@ -585,7 +593,11 @@ async def put_deactivate_invite_code(
     raise HTTPException(status_code=500, detail=_reason)
 
 
-@ENROLLMENT_ROUTER.delete("/invitecode/{invite_code}", response_model=OperationResultResponse)
+@ENROLLMENT_ROUTER.delete(
+    "/invitecode/{invite_code}",
+    response_model=OperationResultResponse,
+    dependencies=[Depends(ValidUser(auto_error=True, require_roles=["admin"]))],
+)
 async def delete_invite_code(
     request: Request,
     invite_code: str,

From 0955c55753329b1b2c0886183807f1ed5423b096 Mon Sep 17 00:00:00 2001
From: Niilo Vuokila <59707802+niilovuo@users.noreply.github.com>
Date: Sat, 22 Aug 2026 00:32:44 +0300
Subject: [PATCH 2/2] chore: bump version to 1.18.3+260822

---
 .bumpversion.toml               | 2 +-
 pyproject.toml                  | 2 +-
 src/rasenmaeher_api/__init__.py | 2 +-
 tests/test_rasenmaeher_api.py   | 2 +-
 uv.lock                         | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.bumpversion.toml b/.bumpversion.toml
index 64064407..053f2ebb 100644
--- a/.bumpversion.toml
+++ b/.bumpversion.toml
@@ -1,5 +1,5 @@
 [tool.bumpversion]
-current_version = "1.18.2+260805"
+current_version = "1.18.3+260822"
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)\\+(?P<build>\\d+)"
 serialize = ["{major}.{minor}.{patch}+{build}"]
 search = "{current_version}"
diff --git a/pyproject.toml b/pyproject.toml
index f80ec725..ec4d3ea2 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "rasenmaeher_api"
-version = "1.18.2+260805"
+version = "1.18.3+260822"
 description = "python-rasenmaeher-api"
 authors = [
     { name = "Aciid", email = "703382+Aciid@users.noreply.github.com" },
diff --git a/src/rasenmaeher_api/__init__.py b/src/rasenmaeher_api/__init__.py
index 707f8470..2a3fd7fc 100644
--- a/src/rasenmaeher_api/__init__.py
+++ b/src/rasenmaeher_api/__init__.py
@@ -1,3 +1,3 @@
 """python-rasenmaeher-api"""
 
-__version__ = "1.18.2+260805"  # NOTE Use `bump-my-version` to bump versions correctly
+__version__ = "1.18.3+260822"  # NOTE Use `bump-my-version` to bump versions correctly
diff --git a/tests/test_rasenmaeher_api.py b/tests/test_rasenmaeher_api.py
index a3b2c0b0..c8270359 100644
--- a/tests/test_rasenmaeher_api.py
+++ b/tests/test_rasenmaeher_api.py
@@ -15,7 +15,7 @@
 
 def test_version() -> None:
     """Make sure version matches expected"""
-    assert __version__ == "1.18.2+260805"
+    assert __version__ == "1.18.3+260822"
 
 
 @pytest.mark.asyncio(loop_scope="session")
diff --git a/uv.lock b/uv.lock
index 40d1d618..85f2e548 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1965,7 +1965,7 @@ wheels = [
 
 [[package]]
 name = "rasenmaeher-api"
-version = "1.18.2+260805"
+version = "1.18.3+260822"
 source = { editable = "." }
 dependencies = [
     { name = "aiodns" },