You deleted the thing that checks that the user has Manage Server permissions and you didn't put it back.
This is fine and doesn't need changing (apart from making the status code 400, please)
When creating a new variable, it ought to be declared with let or const. Please use `const here.
Please use server = mxid.match(/:(.*)/)?.[1] (see utils.js line 168) which is short enough that it can be used inline without needing to be extracted to a function. So please delete the function getHSOfUser and just do the operation inline where needed.
Looks good. Please address the invididual comments (or ask me to do it for you). Then I can do a final coverage check and merge this. Thanks for your patience!
This condition can't happen, because it's always possible to extract a via from the user who sent the invite. Remove the if statement and just always use the more detailed error message.