@fonderie/workspaces 6.0.1 → 6.0.3

package/dist/index.cjs

@@ -1255,6 +1255,18 @@ async function cancelInvitation(invitationId, workspaceId, store) {
     [invitationId, workspaceId]
   );
 }
+async function assertRoleAssignable(roleId, workspaceId, store) {
+  const rows = await store.query(
+    `SELECT id FROM fonderie_roles
+		 WHERE id = $1
+		   AND (
+		     (workspace_id = $2 AND is_system = false)
+		     OR (is_system = true AND name = 'GUEST')
+		   )`,
+    [roleId, workspaceId]
+  );
+  if (rows.length === 0) throw new Error("Invitation role is no longer assignable");
+}
 async function acceptInvitationByPin(opts, store) {
   const [inv] = await store.query(
     `SELECT id, workspace_id AS "workspaceId", role_id AS "roleId", expires_at AS "expiresAt"
@@ -1264,6 +1276,7 @@ async function acceptInvitationByPin(opts, store) {
   );
   if (!inv) throw new Error("Invalid PIN");
   if (/* @__PURE__ */ new Date() > new Date(inv.expiresAt)) throw new Error("Invitation expired");
+  await assertRoleAssignable(inv.roleId, inv.workspaceId, store);
   await store.transaction(async (tx) => {
     await Promise.all([
       tx.query(
@@ -1289,6 +1302,7 @@ async function acceptInvitationByToken(token, userId, store) {
   );
   if (!inv) throw new Error("Invalid token");
   if (/* @__PURE__ */ new Date() > new Date(inv.expiresAt)) throw new Error("Invitation expired");
+  await assertRoleAssignable(inv.roleId, inv.workspaceId, store);
   await store.transaction(async (tx) => {
     await Promise.all([
       tx.query(
@@ -1396,6 +1410,25 @@ function invitationController(store, ttl, bus) {
           return (0, import_core6.setApiResponse)(import_core6.HTTP.SERVER_ERROR, "SERVER_ERROR", "Default role not found");
         }
       }
+      const explicitRoleIds = [...new Set(
+        entries.map((e) => e["roleId"]).filter((r) => typeof r === "string")
+      )];
+      if (explicitRoleIds.length > 0) {
+        const rows = await store.query(
+          `SELECT id FROM fonderie_roles
+					 WHERE id = ANY($1) AND workspace_id = $2 AND is_system = false`,
+          [explicitRoleIds, ctx.workspace.id]
+        );
+        const assignable = new Set(rows.map((r) => r.id));
+        const bad = explicitRoleIds.find((id) => !assignable.has(id));
+        if (bad) {
+          return (0, import_core6.setApiResponse)(
+            import_core6.HTTP.UNPROCESSABLE,
+            "INVALID_ROLE",
+            "Role is not assignable in this workspace."
+          );
+        }
+      }
       const results = await Promise.all(
         entries.map(async (entry) => {
           const email2 = entry["email"];