fix(invitations): serialize the join-preview reads, revert the removal refetch

Two corrections to this branch's own review fixes.

The pending-invitations list computed each row's join preview with Promise.all.
Every preview issues several queries, and the endpoint is hit whenever the
workspace switcher opens, so that held one pooled connection per pending
invitation for as long as the slowest one took. The loop is sequential now; the
list is a handful of rows, so the latency is not worth the pool pressure.

The removal-impact refetch on confirm is reverted. It changed behaviour — a
click could silently do nothing — and it did not actually close the window it
targeted: the credential set can still change between the refetch and the
independent DELETE, because the removal endpoint neither receives nor
revalidates the disclosed set. Closing that properly means passing the
disclosure to the endpoint and revalidating there, which is a feature rather
than a review fix, so the prior behaviour stands until it is done deliberately.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: icecrasher321

apps/sim/app/api/invitations/route.ts

@@ -28,20 +28,25 @@ export const GET = withRouteHandler(async () => {
      * accept — the same consent contract the emailed `/invite` page honours.
      * Disclosure-only, so a preview failure degrades to `null` (the client
      * shows a generic notice) rather than hiding the invitation.
+     *
+     * Sequential on purpose: each preview issues several queries, and this
+     * endpoint is hit whenever the workspace switcher opens. Fanning them out
+     * with `Promise.all` would hold one pooled connection per pending
+     * invitation for the length of the slowest one. The list is a handful of
+     * rows, so the added latency is not worth the pool pressure.
      */
-    const previews = await Promise.all(
-      invitations.map(async (inv) => {
-        try {
-          return await getInvitationJoinPreview(session.user.id, inv)
-        } catch (previewError) {
-          logger.warn('Failed to compute join preview for pending invitation', {
-            invitationId: inv.id,
-            error: previewError,
-          })
-          return null
-        }
-      })
-    )
+    const previews: Array<Awaited<ReturnType<typeof getInvitationJoinPreview>> | null> = []
+    for (const inv of invitations) {
+      try {
+        previews.push(await getInvitationJoinPreview(session.user.id, inv))
+      } catch (previewError) {
+        logger.warn('Failed to compute join preview for pending invitation', {
+          invitationId: inv.id,
+          error: previewError,
+        })
+        previews.push(null)
+      }
+    }
 
     return NextResponse.json({
       invitations: invitations.map(

apps/sim/app/workspace/[workspaceId]/settings/components/team-management/team-management.tsx

@@ -87,7 +87,6 @@ export function TeamManagement({
     data: removalImpactCredentials,
     isFetching: isRemovalImpactFetching,
     isError: isRemovalImpactError,
-    refetch: refetchRemovalImpact,
   } = useMemberRemovalImpact(organizationId, removeMemberDialog.memberId, {
     enabled: removeMemberDialog.open,
   })
@@ -179,25 +178,6 @@ export function TeamManagement({
     if (!session?.user || !memberId) return
 
     try {
-      /**
-       * Re-verify the disclosure at the moment of confirmation. `isFetching`
-       * holds the button only while a request is in flight; a credential the
-       * member gained after the fetch settled would otherwise be removed
-       * without ever having been disclosed. On a change the dialog stays open
-       * showing the refreshed warning, so the admin confirms against what is
-       * actually true — the same consent contract the invite flow uses.
-       */
-      const refreshed = await refetchRemovalImpact()
-      if (refreshed.data) {
-        const current = [...new Set(refreshed.data.map((credential) => credential.displayName))]
-        if (
-          current.length !== disclosedBreakingCredentials.length ||
-          current.some((name) => !disclosedBreakingCredentials.includes(name))
-        ) {
-          return
-        }
-      }
-
       await removeMemberMutation.mutateAsync({
         memberId,
         orgId: organizationId,
@@ -219,7 +199,6 @@ export function TeamManagement({
   }, [
     removeMemberDialog.memberId,
     removeMemberDialog.isSelfRemoval,
-    disclosedBreakingCredentials,
     session?.user?.id,
     organizationId,
     removeMemberMutation,