@fonderie/workspaces 6.0.2 → 6.0.3

package/dist/index.cjs

@@ -1255,6 +1255,18 @@ async function cancelInvitation(invitationId, workspaceId, store) {
     [invitationId, workspaceId]
   );
 }
+async function assertRoleAssignable(roleId, workspaceId, store) {
+  const rows = await store.query(
+    `SELECT id FROM fonderie_roles
+		 WHERE id = $1
+		   AND (
+		     (workspace_id = $2 AND is_system = false)
+		     OR (is_system = true AND name = 'GUEST')
+		   )`,
+    [roleId, workspaceId]
+  );
+  if (rows.length === 0) throw new Error("Invitation role is no longer assignable");
+}
 async function acceptInvitationByPin(opts, store) {
   const [inv] = await store.query(
     `SELECT id, workspace_id AS "workspaceId", role_id AS "roleId", expires_at AS "expiresAt"
@@ -1264,6 +1276,7 @@ async function acceptInvitationByPin(opts, store) {
   );
   if (!inv) throw new Error("Invalid PIN");
   if (/* @__PURE__ */ new Date() > new Date(inv.expiresAt)) throw new Error("Invitation expired");
+  await assertRoleAssignable(inv.roleId, inv.workspaceId, store);
   await store.transaction(async (tx) => {
     await Promise.all([
       tx.query(
@@ -1289,6 +1302,7 @@ async function acceptInvitationByToken(token, userId, store) {
   );
   if (!inv) throw new Error("Invalid token");
   if (/* @__PURE__ */ new Date() > new Date(inv.expiresAt)) throw new Error("Invitation expired");
+  await assertRoleAssignable(inv.roleId, inv.workspaceId, store);
   await store.transaction(async (tx) => {
     await Promise.all([
       tx.query(