Require valid invitation to start sign-up process

app/controllers/invitations_controller.rb

@@ -1,11 +1,26 @@
 class InvitationsController < ApplicationController
-  before_action :require_user_signed_in
+  before_action :require_user_signed_in, except: ["show"]
+  before_action :require_user_signed_out, only: ["show"]
+
+  layout "signup", only: ["show"]
 
   # GET /invitations
   def index
     @invitations = current_user.invitations
   end
 
+  # GET /invitations/a-random-invitation-token
+  def show
+    token = session[:invitation_token] = params[:id]
+
+    if Invitation.where(token: token, used_at: nil).exists?
+      redirect_to signup_path and return
+    else
+      flash.now[:alert] = "This invitation either doesn't exist or has already been used."
+      http_status :unauthorized
+    end
+  end
+
   # POST /invitations
   def create
     @invitation = Invitation.new(user: current_user)