fix(invitations): make the join preview a discriminated outcome

The preview returned one no-join shape for five different results — external
intent, already a member, a membership in another organization, a dead-grant
rejection, and a billing rejection. Two accumulating booleans could not separate
them, and the accept screen rendered the external copy for all of them: it told
people whose acceptance would fail with `upgrade-required` or
`workspace-not-found` that they were getting workspace access without a seat.

It now reports one `outcome`: `will-join` (a seat is taken), `already-member`
(only workspace access changes), `external` (never a seat), or `blocked`
(acceptance fails, so nothing is promised). `blocked` renders no membership
notice — silence is accurate where the external claim was false. The accept
button is deliberately left enabled: those cases already fail closed with the
correct error, and choosing what to actively tell someone whose organization's
payment lapsed is a product decision, not a review fix.

This also fixes a live mis-attribution the previous commit's guard introduced.
The consent check ran before the gates that produce the real cause, so a blocked
invitation returned `disclosure-outdated` — and the retry re-rendered the same
preview, leaving the invitee looping with no explanation. The guard now sits
after the dead-grant gate, and a disclosed `blocked` skips the comparison so the
billing gate below can surface `upgrade-required` instead.

The accept body carries `disclosedOutcome` in place of the boolean; the
membership comparison is unchanged (`will-join` versus a new membership being
created), so no acceptance that previously succeeded now fails.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: icecrasher321

apps/sim/app/api/invitations/[id]/accept/route.ts

@@ -28,7 +28,7 @@ export const POST = withRouteHandler(
       invitationId: id,
       token: parsed.data.body.token ?? null,
       disclosedWorkspaceIds: parsed.data.body.disclosedWorkspaceIds,
-      disclosedWillJoinOrganization: parsed.data.body.disclosedWillJoinOrganization,
+      disclosedOutcome: parsed.data.body.disclosedOutcome,
       request,
     })
 

apps/sim/app/invite/[id]/invite.tsx

@@ -266,7 +266,7 @@ export default function Invite() {
            * must also conflict if acceptance would sweep anything.
            */
           disclosedWorkspaceIds: joinPreview ? joinPreview.workspaceIdsToMove : undefined,
-          disclosedWillJoinOrganization: joinPreview ? joinPreview.willJoinOrganization : undefined,
+          disclosedOutcome: joinPreview?.outcome,
         },
       })
 
@@ -521,14 +521,14 @@ export default function Invite() {
     /**
      * A personal-workspace invite has no organization id and no organization
      * name yet — acceptance creates one by converting the billed owner's Pro to
-     * Team — so `willJoinOrganization` is the authoritative signal that a
+     * Team — so a `will-join` outcome is the authoritative signal that a
      * membership and seat are involved. Gating on the ids alone silenced the
      * disclosure for exactly the case that creates the membership.
      */
     isOrganizationScoped: Boolean(
       invitation?.organizationId ||
         joinPreview?.organizationName ||
-        joinPreview?.willJoinOrganization
+        joinPreview?.outcome === 'will-join'
     ),
   })
 

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/pending-invitations/view-invitations-modal.tsx

@@ -57,12 +57,12 @@ function invitationDisclosure(inv: MyInvitation): string {
     membershipIntent: inv.membershipIntent,
     isOrganizationAdminRole: isOrgAdminRole(inv.role),
     organizationLabel,
-    /** `willJoinOrganization` also covers a personal-workspace invite, which has
+    /** A `will-join` outcome also covers a personal-workspace invite, which has
      * no organization id or name until acceptance creates one. */
     isOrganizationScoped: Boolean(
       inv.organizationId ||
         inv.joinPreview?.organizationName ||
-        inv.joinPreview?.willJoinOrganization
+        inv.joinPreview?.outcome === 'will-join'
     ),
   })
   const migration = buildWorkspaceMigrationNotice({
@@ -99,7 +99,7 @@ export function ViewInvitationsModal({ open, onOpenChange }: ViewInvitationsModa
       const result = await acceptInvitation.mutateAsync({
         invitationId: inv.id,
         disclosedWorkspaceIds: inv.joinPreview?.workspaceIdsToMove,
-        disclosedWillJoinOrganization: inv.joinPreview?.willJoinOrganization,
+        disclosedOutcome: inv.joinPreview?.outcome,
       })
       toast.success(`Joined ${invitationLabel(inv)}`)
       onOpenChange(false)

apps/sim/hooks/queries/invitations.ts

@@ -7,6 +7,7 @@ import {
   batchWorkspaceInvitationsContract,
   cancelInvitationContract,
   getInvitationContract,
+  type InvitationJoinOutcome,
   listMyInvitationsContract,
   listWorkspaceInvitationsContract,
   type MyInvitation,
@@ -166,15 +167,15 @@ export function useAcceptMyInvitation() {
     mutationFn: async ({
       invitationId,
       disclosedWorkspaceIds,
-      disclosedWillJoinOrganization,
+      disclosedOutcome,
     }: {
       invitationId: string
       disclosedWorkspaceIds?: string[]
-      disclosedWillJoinOrganization?: boolean
+      disclosedOutcome?: InvitationJoinOutcome
     }) =>
       requestJson(acceptInvitationContract, {
         params: { id: invitationId },
-        body: { disclosedWorkspaceIds, disclosedWillJoinOrganization },
+        body: { disclosedWorkspaceIds, disclosedOutcome },
       }),
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: workspaceKeys.lists() })

apps/sim/lib/api/contracts/invitations.ts

@@ -98,6 +98,21 @@ export const invitationActionParamsSchema = z.object({
   id: z.string({ error: 'Invitation ID is required' }).min(1, 'Invitation ID is required'),
 })
 
+/**
+ * What accepting an invitation will actually do. Four outcomes rather than a
+ * boolean, because each needs different disclosure: `will-join` takes a seat,
+ * `already-member` changes nothing but workspace access, `external` never takes
+ * a seat, and `blocked` means acceptance fails so nothing is promised.
+ */
+export const invitationJoinOutcomeSchema = z.enum([
+  'will-join',
+  'already-member',
+  'external',
+  'blocked',
+])
+
+export type InvitationJoinOutcome = z.output<typeof invitationJoinOutcomeSchema>
+
 export const invitationActionBodySchema = z.object({
   token: z.string().min(1).optional(),
   /**
@@ -108,12 +123,14 @@ export const invitationActionBodySchema = z.object({
    */
   disclosedWorkspaceIds: z.array(z.string()).max(DISCLOSED_WORKSPACE_ID_LIMIT).optional(),
   /**
-   * The membership outcome the accept screen disclosed. The workspace-id list
-   * alone cannot express it — a no-join preview and a will-join preview for
-   * someone who owns nothing both disclose `[]` — so consent to becoming a
-   * seat-consuming member is carried explicitly.
+   * The outcome the accept screen disclosed. The workspace-id list alone cannot
+   * express it — a no-join preview and a will-join preview for someone who owns
+   * nothing both disclose `[]` — so consent to becoming a seat-consuming member
+   * is carried explicitly. Sending `blocked` tells acceptance the screen already
+   * said this would fail, so it should surface the real cause rather than a
+   * consent mismatch.
    */
-  disclosedWillJoinOrganization: z.boolean().optional(),
+  disclosedOutcome: invitationJoinOutcomeSchema.optional(),
 })
 
 export const invitationDetailsSchema = z.object({
@@ -139,14 +156,7 @@ export const invitationDetailsSchema = z.object({
 })
 
 export const invitationJoinPreviewSchema = z.object({
-  willJoinOrganization: z.boolean(),
-  /**
-   * The invitee is already a member of the organization acceptance lands in, so
-   * only workspace access changes. Reported separately because it shares
-   * `willJoinOrganization: false` with the external case, which means something
-   * different to the person accepting.
-   */
-  alreadyMemberOfOrganization: z.boolean(),
+  outcome: invitationJoinOutcomeSchema,
   /** Name of the organization acceptance will actually join. */
   organizationName: z.string().nullable(),
   workspacesToMove: z.array(z.string()).max(DISCLOSED_WORKSPACE_ID_LIMIT),

apps/sim/lib/invitations/core.test.ts

@@ -195,7 +195,7 @@ describe('acceptInvitation', () => {
       actorName: 'Invitee',
       // The screen promised "you will not join" — acceptance resolves to a join.
       disclosedWorkspaceIds: [],
-      disclosedWillJoinOrganization: false,
+      disclosedOutcome: 'external' as const,
       request: new Request('http://localhost/api/invitations/inv-1/accept'),
     })
 
@@ -940,6 +940,65 @@ describe('acceptInvitation', () => {
     expect(mockSyncUsageLimitsFromSubscription).toHaveBeenCalledWith('invitee-user')
   })
 
+  it('surfaces the real cause, not a consent mismatch, when the disclosure said blocked', async () => {
+    /**
+     * The preview reports `blocked` for dead grants, so the screen promised
+     * nothing. Acceptance must return the real cause (`workspace-not-found`)
+     * rather than `disclosure-outdated` — the latter renders the same preview on
+     * retry, so the invitee would loop with no explanation.
+     */
+    mockGetWorkspaceWithOwner.mockResolvedValue({
+      id: 'workspace-1',
+      name: 'Workspace',
+      ownerId: 'owner-1',
+      organizationId: 'org-1',
+      workspaceMode: 'organization',
+      billedAccountUserId: 'owner-1',
+    })
+    queueWhereResponses([
+      [
+        {
+          id: 'inv-1',
+          kind: 'organization',
+          email: 'invitee@example.com',
+          organizationId: 'org-1',
+          membershipIntent: 'internal',
+          inviterId: 'owner-1',
+          role: 'member',
+          status: 'pending',
+          token: 'tok-1',
+          expiresAt: new Date(Date.now() + 60_000),
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ],
+      [
+        {
+          id: 'grant-1',
+          workspaceId: 'workspace-1',
+          permission: 'write',
+          workspaceName: 'Workspace',
+        },
+      ],
+      [{ name: 'Acme' }],
+      [{ name: 'Owner', email: 'owner@example.com' }],
+      [],
+      [],
+    ])
+
+    const result = await acceptInvitation({
+      userId: 'invitee-user',
+      userEmail: 'invitee@example.com',
+      invitationId: 'inv-1',
+      token: 'tok-1',
+      disclosedWorkspaceIds: [],
+      disclosedOutcome: 'blocked',
+    })
+
+    expect(result).toEqual({ success: false, kind: 'workspace-not-found' })
+    expect(mockEnsureUserInOrganization).not.toHaveBeenCalled()
+  })
+
   it('rolls back a member-role org acceptance when every grant turned stale', async () => {
     mockGetWorkspaceWithOwner.mockResolvedValue({
       id: 'workspace-1',
@@ -1457,7 +1516,7 @@ describe('acceptInvitation', () => {
       invitationId: 'inv-1',
       token: 'tok-1',
       disclosedWorkspaceIds: [],
-      disclosedWillJoinOrganization: false,
+      disclosedOutcome: 'external' as const,
     })
 
     expect(result.success ? 'ok' : result.kind).toBe('ok')