feat(invites): explicit external members

Author: icecrasher321

apps/sim/app/api/invitations/[id]/route.ts

@@ -2,6 +2,7 @@ import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
 import { invitation, invitationWorkspaceGrant } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
+import { isOrgAdminRole } from '@sim/platform-authz/workspace'
 import { normalizeEmail } from '@sim/utils/string'
 import { and, eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
@@ -14,7 +15,12 @@ import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { isOrganizationOwnerOrAdmin } from '@/lib/billing/core/organization'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { cancelInvitation, getInvitationById } from '@/lib/invitations/core'
+import {
+  cancelInvitation,
+  getInvitationById,
+  getInvitationJoinPreview,
+  isInvitationExpired,
+} from '@/lib/invitations/core'
 import { hasWorkspaceAdminAccess } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('InvitationsAPI')
@@ -42,22 +48,41 @@ export const GET = withRouteHandler(
       const isInvitee = normalizeEmail(session.user.email || '') === normalizeEmail(inv.email)
       const tokenMatches = !!token && token === inv.token
 
-      let hasAdminView = false
-      if (inv.organizationId) {
-        hasAdminView = await isOrganizationOwnerOrAdmin(session.user.id, inv.organizationId)
-      }
-      if (!hasAdminView && inv.grants.length > 0) {
-        const adminChecks = await Promise.all(
-          inv.grants.map((grant) => hasWorkspaceAdminAccess(session.user.id, grant.workspaceId))
-        )
-        hasAdminView = adminChecks.some(Boolean)
+      if (!isInvitee && !tokenMatches) {
+        let hasAdminView = false
+        if (inv.organizationId) {
+          hasAdminView = await isOrganizationOwnerOrAdmin(session.user.id, inv.organizationId)
+        }
+        if (!hasAdminView && inv.grants.length > 0) {
+          const adminChecks = await Promise.all(
+            inv.grants.map((grant) => hasWorkspaceAdminAccess(session.user.id, grant.workspaceId))
+          )
+          hasAdminView = adminChecks.some(Boolean)
+        }
+        if (!hasAdminView) {
+          return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+        }
       }
 
-      if (!isInvitee && !tokenMatches && !hasAdminView) {
-        return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+      /**
+       * Disclosure-only: a preview failure must never block viewing or
+       * accepting the invitation itself. Expired-but-still-pending rows get
+       * no preview — acceptance deterministically rejects them.
+       */
+      let joinPreview = null
+      if (isInvitee && inv.status === 'pending' && !isInvitationExpired(inv)) {
+        try {
+          joinPreview = await getInvitationJoinPreview(session.user.id, inv)
+        } catch (previewError) {
+          logger.warn('Failed to compute invitation join preview', {
+            invitationId: id,
+            error: previewError,
+          })
+        }
       }
 
       return NextResponse.json({
+        joinPreview,
         invitation: {
           id: inv.id,
           kind: inv.kind,
@@ -128,6 +153,20 @@ export const PATCH = withRouteHandler(
             { status: 403 }
           )
         }
+        /**
+         * A member-role invite without workspace grants would leave the
+         * invitee workspace-less after accepting (admins derive access to
+         * every organization workspace; members do not).
+         */
+        if (!isOrgAdminRole(role) && inv.grants.length === 0) {
+          return NextResponse.json(
+            {
+              error:
+                'Member invitations must include at least one workspace. Keep the admin role or send a new invitation with workspace access.',
+            },
+            { status: 400 }
+          )
+        }
       }
 
       const grantsToApply = grants ?? []

apps/sim/app/api/organizations/[id]/invitations/route.test.ts

@@ -112,7 +112,7 @@ describe('POST /api/organizations/[id]/invitations', () => {
     const response = await POST(
       createMockRequest(
         'POST',
-        { emails: ['invitee@example.com'] },
+        { emails: ['invitee@example.com'], role: 'admin' },
         {},
         'http://localhost/api/organizations/org-1/invitations'
       ),
@@ -125,7 +125,7 @@ describe('POST /api/organizations/[id]/invitations', () => {
         kind: 'organization',
         email: 'invitee@example.com',
         organizationId: 'org-1',
-        role: 'member',
+        role: 'admin',
         grants: [],
       })
     )
@@ -135,6 +135,28 @@ describe('POST /api/organizations/[id]/invitations', () => {
     expect(mockCancelPendingInvitation).not.toHaveBeenCalled()
   })
 
+  it('rejects grant-less member-role invitations on the non-batch path', async () => {
+    mockGetSession.mockResolvedValue(
+      createSession({ userId: 'user-1', email: 'owner@example.com', name: 'Owner' })
+    )
+    queueOwnerAndOrg()
+
+    const response = await POST(
+      createMockRequest(
+        'POST',
+        { emails: ['invitee@example.com'] },
+        {},
+        'http://localhost/api/organizations/org-1/invitations'
+      ),
+      { params: Promise.resolve({ id: 'org-1' }) }
+    )
+
+    expect(response.status).toBe(400)
+    const body = await response.json()
+    expect(body.error).toContain('Member invitations must include at least one workspace')
+    expect(mockCreatePendingInvitation).not.toHaveBeenCalled()
+  })
+
   it('adds an existing member directly to selected workspaces they lack (no invitation/email)', async () => {
     mockGetSession.mockResolvedValue(
       createSession({ userId: 'user-1', email: 'owner@example.com', name: 'Owner' })
@@ -356,7 +378,7 @@ describe('POST /api/organizations/[id]/invitations', () => {
     const response = await POST(
       createMockRequest(
         'POST',
-        { emails: ['member@example.com'] },
+        { emails: ['member@example.com'], role: 'admin' },
         {},
         'http://localhost/api/organizations/org-1/invitations'
       ),
@@ -385,7 +407,7 @@ describe('POST /api/organizations/[id]/invitations', () => {
     const response = await POST(
       createMockRequest(
         'POST',
-        { emails: ['invitee@example.com'] },
+        { emails: ['invitee@example.com'], role: 'admin' },
         {},
         'http://localhost/api/organizations/org-1/invitations'
       ),

apps/sim/app/api/organizations/[id]/invitations/route.ts

@@ -155,6 +155,31 @@ export const POST = withRouteHandler(
         return NextResponse.json({ error: 'Forbidden - Admin access required' }, { status: 403 })
       }
 
+      /**
+       * Member-role invites must carry workspace access so the invitee has a
+       * workspace to land in after accepting — a member with no workspace
+       * grants (and no admin-derived access) would hit a workspace-less dead
+       * end. Admin invites are exempt: admins derive access to every
+       * organization workspace. Both checks run before the validate-only path
+       * so validation never approves a request the send would reject; the
+       * domain-layer backstop lives in createPendingInvitation.
+       */
+      if (!isBatch && !isOrgAdminRole(role)) {
+        return NextResponse.json(
+          {
+            error:
+              'Member invitations must include at least one workspace. Send batch=true with workspaceInvitations so the invitee has a workspace to land in.',
+          },
+          { status: 400 }
+        )
+      }
+      if (isBatch && (!Array.isArray(workspaceInvitations) || workspaceInvitations.length === 0)) {
+        return NextResponse.json(
+          { error: 'Select at least one organization workspace for this invitation.' },
+          { status: 400 }
+        )
+      }
+
       if (validateOnly) {
         const validationResult = await validateBulkInvitations(organizationId, invitationEmails)
         return NextResponse.json({
@@ -192,14 +217,7 @@ export const POST = withRouteHandler(
 
       const validGrants: WorkspaceGrantPayload[] = []
       const workspaceNameById = new Map<string, string>()
-      if (isBatch) {
-        if (!Array.isArray(workspaceInvitations) || workspaceInvitations.length === 0) {
-          return NextResponse.json(
-            { error: 'Select at least one organization workspace for this invitation.' },
-            { status: 400 }
-          )
-        }
-
+      if (isBatch && Array.isArray(workspaceInvitations)) {
         for (const wsInvitation of workspaceInvitations) {
           if (validGrants.some((grant) => grant.workspaceId === wsInvitation.workspaceId)) {
             continue

apps/sim/app/api/organizations/[id]/members/route.ts

@@ -210,7 +210,7 @@ export const POST = withRouteHandler(
 
       await validateInvitationsAllowed(session.user.id, { organizationId })
 
-      const { email, role = 'member' } = parsed.data.body
+      const { email, role } = parsed.data.body
 
       // Validate and normalize email
       const normalizedEmail = normalizeEmail(email)
@@ -240,6 +240,23 @@ export const POST = withRouteHandler(
         return NextResponse.json({ error: 'Forbidden - Admin access required' }, { status: 403 })
       }
 
+      /**
+       * Member-role invites must carry workspace access so the invitee has a
+       * workspace to land in after accepting — a member with no workspace
+       * grants (and no admin-derived access) would hit a workspace-less dead
+       * end. Admin invites are exempt: admins derive access to every
+       * organization workspace.
+       */
+      if (!isOrgAdminRole(role)) {
+        return NextResponse.json(
+          {
+            error:
+              'Member invitations must include at least one workspace. Use the invitations endpoint with workspaceInvitations so the invitee has a workspace to land in.',
+          },
+          { status: 400 }
+        )
+      }
+
       // Check seat availability
       const seatValidation = await validateSeatAvailability(organizationId, 1)
       if (!seatValidation.canInvite) {

apps/sim/app/api/organizations/[id]/removal-impact/route.ts

@@ -0,0 +1,52 @@
+import { createLogger } from '@sim/logger'
+import { type NextRequest, NextResponse } from 'next/server'
+import { getMemberRemovalImpactContract } from '@/lib/api/contracts/organization'
+import { parseRequest } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { isOrganizationOwnerOrAdmin } from '@/lib/billing/core/organization'
+import { getOrganizationTransferCredentialDependencies } from '@/lib/billing/organizations/membership'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+const logger = createLogger('OrganizationRemovalImpactAPI')
+
+/**
+ * Identity-bound credentials the target user owns in this organization's
+ * workspaces — the set that stops working when their workspace access is
+ * revoked. Readable by org admins (removing someone) and by the user
+ * themself (leaving).
+ */
+export const GET = withRouteHandler(
+  async (request: NextRequest, context: { params: Promise<{ id: string }> }) => {
+    const session = await getSession()
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseRequest(getMemberRemovalImpactContract, request, context)
+    if (!parsed.success) return parsed.response
+
+    const { id: organizationId } = parsed.data.params
+    const { userId: targetUserId } = parsed.data.query
+
+    try {
+      const isSelf = targetUserId === session.user.id
+      if (!isSelf && !(await isOrganizationOwnerOrAdmin(session.user.id, organizationId))) {
+        return NextResponse.json({ error: 'Forbidden - Admin access required' }, { status: 403 })
+      }
+
+      const credentials = await getOrganizationTransferCredentialDependencies(
+        targetUserId,
+        organizationId
+      )
+
+      return NextResponse.json({ credentials })
+    } catch (error) {
+      logger.error('Failed to compute member removal impact', {
+        organizationId,
+        targetUserId,
+        error,
+      })
+      return NextResponse.json({ error: 'Failed to compute removal impact' }, { status: 500 })
+    }
+  }
+)

apps/sim/app/api/v1/admin/organizations/[id]/members/route.ts

@@ -42,6 +42,7 @@ import { getOrgMemberLedgerByUser } from '@/lib/billing/core/organization'
 import { addUserToOrganization } from '@/lib/billing/organizations/membership'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { attachOwnedWorkspacesToOrganization } from '@/lib/workspaces/organization-workspaces'
 import { withAdminAuthParams } from '@/app/api/v1/admin/middleware'
 import {
   adminInvalidJsonResponse,
@@ -264,6 +265,33 @@ export const POST = withRouteHandler(
         return badRequestResponse(result.error || 'Failed to add member')
       }
 
+      /**
+       * A new member's owned personal workspaces follow them into the org
+       * (collaborators stay external). Best-effort: membership is already
+       * committed, and an attach failure leaves the pre-join status quo.
+       */
+      try {
+        const attach = await attachOwnedWorkspacesToOrganization({
+          ownerUserId: userId,
+          organizationId,
+          externalMemberPolicy: 'external-all',
+          includeArchived: true,
+        })
+        if (attach.attachedWorkspaceIds.length > 0) {
+          logger.info('Attached new member workspaces to organization', {
+            userId,
+            organizationId,
+            attachedWorkspaceCount: attach.attachedWorkspaceIds.length,
+          })
+        }
+      } catch (attachError) {
+        logger.error('Failed to attach new member workspaces to organization', {
+          userId,
+          organizationId,
+          error: attachError,
+        })
+      }
+
       const data: AdminMember = {
         id: result.memberId!,
         userId,

apps/sim/app/api/workspaces/invitations/batch/route.ts

@@ -82,6 +82,7 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
           context,
           email: item.email,
           permission: item.permission,
+          membershipIntent: body.membershipIntent,
           request: req,
         })
         if (invitation.instantAdd) {