fix(invitations): allow External with billing off, mark cross-org org invites blocked

The External paid-plan requirement is seat economics — an external collaborator
takes no seat, so somebody else must be paying for them. With billing disabled
there are no seats and no subscription rows at all, so every account resolves as
`free` and choosing External failed at send time and would have failed at accept.
Member and Admin still worked, so a self-hosted deployment had no way to grant
workspace-only access without an organization join and a workspace sweep. Both the
invite-time and accept-time gates now short-circuit when billing is off.

A route test asserted that rejection without setting `isBillingEnabled`, which
the shared mock defaults to false — it passed only because the gate ignored the
flag. It now opts in explicitly, since the rule it covers is billing-only.

Separately, the preview reported `external` for any invitee already in a
different organization, but acceptance only downgrades a workspace-kind invite
with live grants; an organization-kind invite hard-fails with
`already-in-organization`. Those now report `blocked`, so the screen stops
promising external access that acceptance can never grant. Legacy
organization-kind rows still exist and coalescing preserves that kind, so this is
reachable.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: icecrasher321

apps/sim/app/api/workspaces/invitations/route.test.ts

@@ -10,7 +10,9 @@ import {
   posthogServerMock,
   queueTableRows,
   resetDbChainMock,
+  resetEnvFlagsMock,
   schemaMock,
+  setEnvFlags,
 } from '@sim/testing'
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
@@ -91,6 +93,8 @@ const mockGetWorkspaceWithOwner = permissionsMockFns.mockGetWorkspaceWithOwner
 import { UPGRADE_TO_INVITE_REASON } from '@/lib/workspaces/policy-constants'
 import { POST } from '@/app/api/workspaces/invitations/batch/route'
 
+afterAll(resetEnvFlagsMock)
+
 describe('POST /api/workspaces/invitations/batch', () => {
   beforeEach(() => {
     vi.clearAllMocks()
@@ -404,6 +408,12 @@ describe('POST /api/workspaces/invitations/batch', () => {
       organizationId: 'org-1',
       upgradeRequired: false,
     })
+    /**
+     * The paid-plan requirement is a billing rule, so it only applies when
+     * billing is on — with billing off there are no seats to protect and every
+     * account reads as free.
+     */
+    setEnvFlags({ isBillingEnabled: true })
     queueTableRows(schemaMock.user, [{ id: 'free-user', email: 'free@example.com' }])
     mockGetUserOrganization.mockResolvedValueOnce(null)
     mockGetInvitePlanCategoryForUser.mockResolvedValueOnce('free')

apps/sim/lib/invitations/core.ts

@@ -300,7 +300,14 @@ export async function getInvitationJoinPreview(
      */
     const inTargetOrganization =
       !!workspaceOrganizationId && existingMembership.organizationId === workspaceOrganizationId
-    return withOutcome(inTargetOrganization ? 'already-member' : 'external')
+    if (inTargetOrganization) return withOutcome('already-member')
+    /**
+     * In a DIFFERENT organization. Acceptance only downgrades a workspace-kind
+     * invite with live grants to external; an organization-kind invite (or one
+     * with no grants) hard-fails with `already-in-organization`, so promising
+     * external access there would be a disclosure the accept can never honour.
+     */
+    return withOutcome(inv.kind === 'workspace' && inv.grants.length > 0 ? 'external' : 'blocked')
   }
 
   if (!(await stampedOrganizationAllowsEscalation(inv, workspaceOrganizationId)))
@@ -742,6 +749,7 @@ async function acceptLockedInvitation(
    * workspaces because sharing a personal workspace has no seat economics.
    */
   if (
+    isBillingEnabled &&
     inv.membershipIntent === 'external' &&
     !inviteeAlreadyInDifferentOrg &&
     workspaceOrganizationId &&

apps/sim/lib/invitations/workspace-invitations.test.ts

@@ -1,8 +1,15 @@
 /**
  * @vitest-environment node
  */
-import { auditMock, createMockRequest, dbChainMockFns, resetDbChainMock } from '@sim/testing'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  auditMock,
+  createMockRequest,
+  dbChainMockFns,
+  resetDbChainMock,
+  resetEnvFlagsMock,
+  setEnvFlags,
+} from '@sim/testing'
+import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
   mockGetUserOrganization,
@@ -125,10 +132,14 @@ const request = createMockRequest(
   'http://localhost/api/workspaces/invitations/batch'
 )
 
+afterAll(resetEnvFlagsMock)
+
 describe('createWorkspaceInvitation', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     resetDbChainMock()
+    /** Production default; the billing-disabled case opts out explicitly. */
+    setEnvFlags({ isBillingEnabled: true })
     mockGrantWorkspaceAccessDirectly.mockResolvedValue({ outcome: 'added', permission: 'write' })
     mockCreatePendingInvitation.mockResolvedValue({
       invitationId: 'inv-1',
@@ -259,6 +270,31 @@ describe('createWorkspaceInvitation', () => {
     )
   })
 
+  it('allows an external invite with billing disabled, where nobody has a plan', async () => {
+    /**
+     * The paid-plan requirement is seat economics: an external collaborator takes
+     * no seat, so somebody else must be paying for them. With billing off there
+     * are no seats and no subscriptions, so every account reads as free —
+     * enforcing it would leave a self-hosted deployment no way to grant
+     * workspace-only access without an organization join and a workspace sweep.
+     */
+    setEnvFlags({ isBillingEnabled: false })
+    queueWhereResponses([[{ id: 'user-9', email: 'selfhost@example.com' }], []])
+    mockGetUserOrganization.mockResolvedValueOnce(null)
+
+    const result = await createWorkspaceInvitation({
+      context: makeContext(),
+      email: 'selfhost@example.com',
+      permission: 'write',
+      membership: 'external',
+      request,
+    })
+
+    expect(result.membershipIntent).toBe('external')
+    /** Short-circuits before the plan lookup — there is nothing to look up. */
+    expect(mockGetInvitePlanCategoryForUser).not.toHaveBeenCalled()
+  })
+
   it('rejects an explicit external invite for an invitee with no paid plan', async () => {
     queueWhereResponses([[{ id: 'user-5', email: 'free@example.com' }], []])
     mockGetUserOrganization.mockResolvedValueOnce(null)

apps/sim/lib/invitations/workspace-invitations.ts

@@ -6,6 +6,7 @@ import { and, eq, inArray, sql } from 'drizzle-orm'
 import type { NextRequest } from 'next/server'
 import { getUserOrganization } from '@/lib/billing/organizations/membership'
 import { validateSeatAvailability } from '@/lib/billing/validation/seat-management'
+import { isBillingEnabled } from '@/lib/core/config/env-flags'
 import { PlatformEvents } from '@/lib/core/telemetry'
 import {
   type DirectGrantOutcome,
@@ -183,6 +184,14 @@ async function assertSeatAvailable(organizationId: string, email: string): Promi
  * they must be invited as a Member or Admin instead.
  */
 async function inviteeCanBeExternal(userId: string | undefined): Promise<boolean> {
+  /**
+   * The requirement exists because an external collaborator consumes no seat, so
+   * somebody else must be paying for them. With billing disabled there are no
+   * seats and no subscriptions at all — every account resolves as `free` — so
+   * enforcing it would leave a self-hosted deployment no way to grant
+   * workspace-only access without an organization join and a workspace sweep.
+   */
+  if (!isBillingEnabled) return true
   if (!userId) return false
   return (await getInvitePlanCategoryForUser(userId)) !== 'free'
 }