frontend/src/pages/ClubSettings/MembershipTab/index.js:133 handles direct member invites by calling POST /c/cbmemb/inv/:cid with a list of user IDs.
The invite overview reuses GET /c/cbboard/invlist/:cid (see backend/r/cbs.js:208) and filters rows client-side to show pending, accepted or expired states.
Suspension/ban toggles call the respective REST endpoints defined around backend/r/cbs.js:243 (/c/cbmemb/ban/:cid/:uid), :255 (/c/cbmemb/susp/:cid/:uid) and :264 (/c/cbmemb/suspbanrem/:cid/:uid).
Lists of banned and suspended members are provided by GET /c/cbmemb/banlist/:cid and GET /c/cbmemb/susplist/:cid, both consumed by the Membership tab to populate moderation drawers.
Access to each action is gated by RBAC flags delivered alongside the settings payload. The view hides controls when canSee_membership or canSee_clubinvite is false, preventing accidental API calls.
Backend middleware checks that presidents or board members making a request still hold the necessary privileges before applying changes.