@fonderie/workspaces 6.0.1 → 6.0.2

package/dist/index.js

@@ -1358,6 +1358,25 @@ function invitationController(store, ttl, bus) {
           return setApiResponse6(HTTP6.SERVER_ERROR, "SERVER_ERROR", "Default role not found");
         }
       }
+      const explicitRoleIds = [...new Set(
+        entries.map((e) => e["roleId"]).filter((r) => typeof r === "string")
+      )];
+      if (explicitRoleIds.length > 0) {
+        const rows = await store.query(
+          `SELECT id FROM fonderie_roles
+					 WHERE id = ANY($1) AND workspace_id = $2 AND is_system = false`,
+          [explicitRoleIds, ctx.workspace.id]
+        );
+        const assignable = new Set(rows.map((r) => r.id));
+        const bad = explicitRoleIds.find((id) => !assignable.has(id));
+        if (bad) {
+          return setApiResponse6(
+            HTTP6.UNPROCESSABLE,
+            "INVALID_ROLE",
+            "Role is not assignable in this workspace."
+          );
+        }
+      }
       const results = await Promise.all(
         entries.map(async (entry) => {
           const email2 = entry["email"];