fix(invitations): let billing-disabled personal invites be accepted

The consent guard derived "a membership will be created" from
`shouldJoinOrganization`, which is still true at that point — it is only cleared
much later, after provisioning fails to yield a target organization. With billing
disabled and no organization on the workspace there is nothing to provision and
nothing to join, so the preview correctly reports `external` while the guard
computed `will-join`, rejecting every personal and grandfathered workspace invite
as `disclosure-outdated`. The retry rendered the same preview, so those invites
could not be accepted at all on billing-disabled deployments.

The predicate now mirrors the preview's own condition, so the two cannot drift.
Regression test asserts acceptance succeeds with billing off; it fails with
`disclosure-outdated` against the previous predicate.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: icecrasher321

apps/sim/lib/invitations/core.test.ts

@@ -399,6 +399,70 @@ describe('acceptInvitation', () => {
     )
   })
 
+  it('accepts a personal-workspace invite on a billing-disabled deployment', async () => {
+    /**
+     * With billing off and no organization on the workspace there is nothing to
+     * provision and nothing to join, so the preview reports `external`. The
+     * consent guard must agree: `shouldJoinOrganization` is still true at that
+     * point (it is only cleared much later), so deriving the predicate from it
+     * alone rejected every self-hosted personal invite as `disclosure-outdated`,
+     * with a retry that rendered the same preview.
+     */
+    setEnvFlags({ isBillingEnabled: false })
+    mockGetWorkspaceWithOwner.mockResolvedValue({
+      id: 'workspace-1',
+      name: 'Workspace',
+      ownerId: 'owner-1',
+      organizationId: null,
+      workspaceMode: 'personal',
+      billedAccountUserId: 'owner-1',
+    })
+    queueWhereResponses([
+      [
+        {
+          id: 'inv-1',
+          kind: 'workspace',
+          email: 'invitee@example.com',
+          organizationId: null,
+          membershipIntent: 'internal',
+          inviterId: 'owner-1',
+          role: 'member',
+          status: 'pending',
+          token: 'tok-1',
+          expiresAt: new Date(Date.now() + 60_000),
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ],
+      [
+        {
+          id: 'grant-1',
+          workspaceId: 'workspace-1',
+          permission: 'write',
+          workspaceName: 'Workspace',
+        },
+      ],
+      [],
+      [{ name: 'Owner', email: 'owner@example.com' }],
+      [],
+      [],
+      [{ variables: {} }],
+    ])
+
+    const result = await acceptInvitation({
+      userId: 'invitee-user',
+      userEmail: 'invitee@example.com',
+      invitationId: 'inv-1',
+      token: 'tok-1',
+      disclosedWorkspaceIds: [],
+      disclosedOutcome: 'external',
+      request: new Request('http://localhost/api/invitations/inv-1/accept'),
+    })
+
+    expect(result.success ? 'ok' : result.kind).toBe('ok')
+    expect(mockEnsureUserInOrganization).not.toHaveBeenCalled()
+  })
+
   it('preserves a personal workspace organization null for external invitations', async () => {
     mockGetWorkspaceWithOwner.mockResolvedValue({
       id: 'workspace-1',

apps/sim/lib/invitations/core.ts

@@ -793,7 +793,22 @@ async function acceptLockedInvitation(
    *
    * Runs before any write, so a plain failure return needs no rollback.
    */
-  const willCreateMembership = shouldJoinOrganization && !alreadyMemberOfTargetOrganization
+  /**
+   * Whether acceptance will actually create a member row, decided from the same
+   * conditions the join block below uses — `shouldJoinOrganization` alone is not
+   * enough here, because it is only cleared much later (after provisioning fails
+   * to yield a target organization), by which point a write has happened.
+   *
+   * The last term mirrors the preview: with no organization on the workspace and
+   * billing disabled there is nothing to provision and nothing to join, so a
+   * personal or grandfathered workspace invite creates no membership. Omitting it
+   * rejected every such acceptance as `disclosure-outdated` on billing-disabled
+   * deployments, with a retry that rendered the same preview.
+   */
+  const willCreateMembership =
+    shouldJoinOrganization &&
+    !alreadyMemberOfTargetOrganization &&
+    (!!workspaceOrganizationId || isBillingEnabled)
   if (input.disclosedOutcome !== undefined && input.disclosedOutcome !== 'blocked') {
     if ((input.disclosedOutcome === 'will-join') !== willCreateMembership) {
       return { success: false, kind: 'disclosure-outdated' }