first implementation

backend/tests/test_permissions.py

@@ -305,11 +305,18 @@ class TestSecurityBypassAttempts:
         Test that new registrations cannot claim admin role.
         New users should only get 'regular' role by default.
         """
-        from tests.helpers import unique_email
+        from tests.helpers import unique_email, create_invite_for_registration
+        
+        async with client_factory.get_db_session() as db:
+            invite_code = await create_invite_for_registration(db, unique_email("gf"))
         
         response = await client_factory.post(
             "/api/auth/register",
-            json={"email": unique_email(), "password": "password123"},
+            json={
+                "email": unique_email(),
+                "password": "password123",
+                "invite_identifier": invite_code,
+            },
         )
         
         assert response.status_code == 200