@jskit-ai/workspaces-core 0.2.4 → 0.2.6

package/src/server/workspacePendingInvitations/workspacePendingInvitationsService.js

@@ -1,45 +1,28 @@
 import { resolveInviteTokenHash } from "@jskit-ai/auth-core/server/inviteTokens";
 import { encodeInviteTokenHash } from "@jskit-ai/auth-core/shared/inviteTokens";
+import { returnJsonApiData } from "@jskit-ai/http-runtime/shared";
 import { AppError } from "@jskit-ai/kernel/server/runtime/errors";
-import { normalizeLowerText, normalizeText } from "@jskit-ai/kernel/shared/support/normalize";
-import { normalizeRecordId } from "@jskit-ai/kernel/shared/support/normalize";
-
-function createService({
-  workspaceInvitesRepository,
-  workspaceMembershipsRepository,
-  roleCatalog = null
-} = {}) {
-  if (!workspaceInvitesRepository || !workspaceMembershipsRepository) {
-    throw new Error("workspacePendingInvitationsService requires invite and membership repositories.");
-  }
-
-  let acceptanceParticipant = null;
-  let registrationClosed = false;
-
+import { normalizeLowerText, normalizeRecordId, normalizeText } from "@jskit-ai/kernel/shared/support/normalize";
+
+/**
+ * @param {object} dependencies
+ * @param {import("../types.js").WorkspaceInvitesRepository} dependencies.workspaceInvitesRepository
+ * @param {import("../types.js").WorkspaceMembershipsRepository} dependencies.workspaceMembershipsRepository
+ * @param {import("../types.js").WorkspaceRoleCatalog} dependencies.roleCatalog
+ * @param {import("../types.js").WorkspaceInviteAcceptanceParticipant} dependencies.acceptanceParticipant
+ */
+function createService({ workspaceInvitesRepository, workspaceMembershipsRepository, roleCatalog, acceptanceParticipant }) {
   function roleLabelMetadata(roleSid) {
-    const role = roleCatalog?.roles?.find((entry) => entry.id === (normalizeLowerText(roleSid || "member") || "member"));
+    const role = roleCatalog.roles.find((entry) => entry.id === (normalizeLowerText(roleSid || "member") || "member"));
     const label = typeof role?.label === "string" ? role.label.trim() : "";
     return label ? { roleLabel: label } : {};
   }
 
-  function registerAcceptanceParticipant(participant) {
-    if (typeof participant !== "function") {
-      throw new TypeError("Acceptance participant must be a function.");
-    }
-    if (acceptanceParticipant) {
-      throw new Error("An invitation acceptance participant is already registered.");
-    }
-    if (registrationClosed) {
-      throw new Error("Invitation acceptance participant registration is closed.");
-    }
-    acceptanceParticipant = participant;
-  }
-
   async function withInviteTransaction(user, token, options, work) {
+    // readable-check: allow required-collaborators - platform object: a Knex transaction, which acceptance and refusal open themselves
     if (options.trx) {
       throw new TypeError("Invitation acceptance/refusal owns its transaction; use the acceptance participant for related writes.");
     }
-    registrationClosed = true;
     // Locate outside the transaction to avoid a stale MySQL repeatable-read
     // snapshot. The callback validates again under the workspace/invite locks.
     const initial = await requirePendingInviteForUserByToken(user, token, options);
@@ -79,7 +62,7 @@ function createService({
     return tokenHash;
   }
 
-  function maskInviteEmail(email = "") {
+  function maskInviteEmail(email) {
     const normalizedEmail = normalizeLowerText(email);
     const [localPart = "", domain = ""] = normalizedEmail.split("@");
     if (!localPart || !domain) {
@@ -89,7 +72,7 @@ function createService({
     return `${visibleLocal}${"*".repeat(Math.max(localPart.length - visibleLocal.length, 1))}@${domain}`;
   }
 
-  function resolvePublicInviteStatus(invite = null) {
+  function resolvePublicInviteStatus(invite) {
     if (!invite) {
       return "not_found";
     }
@@ -103,7 +86,7 @@ function createService({
     return "pending";
   }
 
-  function mapResolvedInvite(invite = null, token = "") {
+  function mapResolvedInvite(invite, token) {
     const status = resolvePublicInviteStatus(invite);
     if (!invite) {
       return {
@@ -141,7 +124,7 @@ function createService({
     };
   }
 
-  function mapPendingInvite(invite = {}) {
+  function mapPendingInvite(invite) {
     const id = normalizeRecordId(invite.id, { fallback: null });
     const workspaceId = normalizeRecordId(invite.workspaceId, { fallback: null });
     const tokenHash = normalizeText(invite.tokenHash);
@@ -175,7 +158,7 @@ function createService({
       });
     }
 
-    if (normalizeLowerText(invite.email) !== normalizeLowerText(actor?.email)) {
+    if (normalizeLowerText(invite.email) !== normalizeLowerText(actor.email)) {
       throw new AppError(403, "Invitation email does not match authenticated user.", {
         code: "workspaces.invite.emailMismatchUser"
       });
@@ -189,26 +172,34 @@ function createService({
 
   async function listPendingInvitesForUser(user, options = {}) {
     const actor = requireAuthenticatedInviteUser(user);
-    const actorEmail = normalizeLowerText(actor?.email);
+    const actorEmail = normalizeLowerText(actor.email);
     if (!actorEmail) {
       return [];
     }
 
     const invites = await workspaceInvitesRepository.listPendingByEmail(actorEmail, options);
-    return invites.map((invite) => mapPendingInvite(invite)).filter(Boolean);
+    return invites.map(mapPendingInvite).filter(Boolean);
   }
 
-  async function resolveInviteByToken(token, options = {}) {
+  // The bootstrap reads the pending invitations as they are; the action answers
+  // with them as JSON:API data.
+  async function listPendingInvitesResponse(user, options = {}) {
+    return returnJsonApiData({ pendingInvites: await listPendingInvitesForUser(user, options) });
+  }
+
+  async function findInviteByToken(token, options = {}) {
     const tokenHash = requireInviteTokenHash(token);
-    const invite = typeof workspaceInvitesRepository.findByTokenHashWithWorkspace === "function"
-      ? await workspaceInvitesRepository.findByTokenHashWithWorkspace(tokenHash, options)
-      : await workspaceInvitesRepository.findPendingByTokenHash(tokenHash, options);
+    const invite = await workspaceInvitesRepository.findByTokenHashWithWorkspace(tokenHash, options);
 
     return mapResolvedInvite(invite, token);
   }
 
-  async function resolveInviteContextForAuth({ token, email } = {}, options = {}) {
-    const resolved = await resolveInviteByToken(token, options);
+  async function resolveInviteByToken(token, options = {}) {
+    return returnJsonApiData(await findInviteByToken(token, options));
+  }
+
+  async function resolveInviteContextForAuth({ token, email }, options = {}) {
+    const resolved = await findInviteByToken(token, options);
     if (resolved.status !== "pending") {
       throw new AppError(409, "Invitation is not available.", { code: "workspaces.invite.notAvailable" });
     }
@@ -229,15 +220,15 @@ function createService({
     };
   }
 
-  function requireWorkspaceIdFromInvite(invite, methodName = "workspacePendingInvitationsService") {
-    const workspaceId = normalizeRecordId(invite?.workspaceId, { fallback: null });
+  function requireWorkspaceIdFromInvite(invite, methodName) {
+    const workspaceId = normalizeRecordId(invite.workspaceId, { fallback: null });
     if (!workspaceId) {
       throw new Error(`${methodName} expected invite workspace id.`);
     }
     return workspaceId;
   }
 
-  async function resolveInviteActionInput(user, token, options = {}, methodName = "workspacePendingInvitationsService") {
+  async function resolveInviteActionInput(user, token, options, methodName) {
     const resolvedInvite = await requirePendingInviteForUserByToken(user, token, options);
     if (resolvedInvite.invite.expiresAt && new Date(resolvedInvite.invite.expiresAt).getTime() < Date.now()) {
       await workspaceInvitesRepository.revokeById(resolvedInvite.invite.id, options);
@@ -250,7 +241,7 @@ function createService({
     };
   }
 
-  async function acceptInviteByToken({ user, token } = {}, options = {}) {
+  async function acceptInviteByToken({ user, token }, options = {}) {
     return withInviteTransaction(user, token, options, async (transactionOptions) => {
       const resolved = await resolveInviteActionInput(
         user,
@@ -268,19 +259,17 @@ function createService({
         { roleSid: resolvedInvite.invite.roleSid, status: "active" },
         transactionOptions
       );
-      if (acceptanceParticipant) {
-        // Repository locking options stay internal to this service.
-        await acceptanceParticipant({
-          invite: Object.freeze({ ...resolvedInvite.invite }),
-          user: Object.freeze({ ...resolvedInvite.user })
-        }, Object.freeze({ ...options, trx: transactionOptions.trx }));
-      }
+      // Repository locking options stay internal to this service.
+      await acceptanceParticipant({
+        invite: Object.freeze({ ...resolvedInvite.invite }),
+        user: Object.freeze({ ...resolvedInvite.user })
+      }, Object.freeze({ ...options, trx: transactionOptions.trx }));
       await workspaceInvitesRepository.markAcceptedById(resolvedInvite.invite.id, transactionOptions);
       return { decision: "accepted", workspaceId };
     });
   }
 
-  async function refuseInviteByToken({ user, token } = {}, options = {}) {
+  async function refuseInviteByToken({ user, token }, options = {}) {
     return withInviteTransaction(user, token, options, async (transactionOptions) => {
       const resolved = await resolveInviteActionInput(
         user,
@@ -297,13 +286,21 @@ function createService({
     });
   }
 
+  // Accepts the invitation a token names when the user decided "accept", and refuses it otherwise.
+  async function redeemInviteByToken(user, { token, decision }, options = {}) {
+    return returnJsonApiData(decision === "accept"
+      ? await acceptInviteByToken({ user, token }, options)
+      : await refuseInviteByToken({ user, token }, options));
+  }
+
   return Object.freeze({
-    registerAcceptanceParticipant,
     resolveInviteByToken,
     resolveInviteContextForAuth,
     listPendingInvitesForUser,
+    listPendingInvitesResponse,
     acceptInviteByToken,
-    refuseInviteByToken
+    refuseInviteByToken,
+    redeemInviteByToken
   });
 }
 

package/src/server/workspaceSettings/workspaceSettingsActions.js

@@ -1,5 +1,4 @@
 import { composeSchemaDefinitions } from "@jskit-ai/kernel/shared/validators";
-import { returnJsonApiData } from "@jskit-ai/http-runtime/shared";
 import { workspaceSettingsResource } from "../../shared/resources/workspaceSettingsResource.js";
 import { workspaceSlugParamsValidator } from "../common/validators/routeParamsValidator.js";
 import { createWorkspaceEntityAndBootstrapEvents } from "../common/support/realtimeServiceEvents.js";
@@ -19,79 +18,60 @@ const workspaceSettingsUpdateInputValidator = composeSchemaDefinitions([
   context: "workspaceSettingsActions.workspaceSettingsUpdateInputValidator"
 });
 
-const workspaceSettingsActionSpecifications = Object.freeze([
-  {
-    id: "workspace.settings.read",
-    version: 1,
-    kind: "query",
-    channels: ["api", "automation", "internal"],
-    surfaces: ["*"],
-    permission: {
-      require: "any",
-      permissions: ["workspace.settings.view", "workspace.settings.update"]
-    },
-    input: workspaceSlugParamsValidator,
-    output: null,
-    extensions: {
-      assistant: {
-        description: "Read the active workspace appearance and invitation settings.",
-        output: workspaceSettingsResource.operations.view.output,
-        transformResult: (result) => result.value
-      }
-    },
-    idempotency: "none",
-    async run(workspaceSettingsService, input, context) {
-      const response = await workspaceSettingsService.getWorkspaceSettings(resolveWorkspace(context, input), {
-        context
-      });
-
-      return returnJsonApiData(response);
-    }
-  },
-  {
-    id: "workspace.settings.update",
-    version: 1,
-    kind: "command",
-    channels: ["api", "assistant_tool", "automation", "internal"],
-    surfaces: ["*"],
-    permission: {
-      require: "all",
-      permissions: ["workspace.settings.update"]
-    },
-    input: workspaceSettingsUpdateInputValidator,
-    output: null,
-    extensions: {
-      assistant: {
-        description: "Update the active workspace appearance and invitation settings.",
-        output: workspaceSettingsResource.operations.patch.output,
-        transformResult: (result) => result.value
-      }
-    },
-    idempotency: "optional",
-    events: WORKSPACE_SETTINGS_CHANGED_EVENTS,
-    async run(workspaceSettingsService, input, context) {
-      const { workspaceSlug, ...patch } = input;
-      const response = await workspaceSettingsService.updateWorkspaceSettings(
+/** @param {{ workspaceSettingsService: import("../types.js").WorkspaceSettingsService }} dependencies */
+function createWorkspaceSettingsActions({ workspaceSettingsService }) {
+  return Object.freeze([
+    Object.freeze({
+      id: "workspace.settings.read",
+      version: 1,
+      kind: "query",
+      channels: ["api", "automation", "internal"],
+      surfaces: ["*"],
+      permission: {
+        require: "any",
+        permissions: ["workspace.settings.view", "workspace.settings.update"]
+      },
+      input: workspaceSlugParamsValidator,
+      output: null,
+      extensions: {
+        assistant: {
+          description: "Read the active workspace appearance and invitation settings.",
+          output: workspaceSettingsResource.operations.view.output,
+          transformResult: (result) => result.value
+        }
+      },
+      execute: (input, context) => workspaceSettingsService.getWorkspaceSettings(
         resolveWorkspace(context, input),
-        patch,
-        {
-          context
+        { context }
+      )
+    }),
+    Object.freeze({
+      id: "workspace.settings.update",
+      version: 1,
+      kind: "command",
+      channels: ["api", "assistant_tool", "automation", "internal"],
+      surfaces: ["*"],
+      permission: {
+        require: "all",
+        permissions: ["workspace.settings.update"]
+      },
+      input: workspaceSettingsUpdateInputValidator,
+      output: null,
+      extensions: {
+        assistant: {
+          description: "Update the active workspace appearance and invitation settings.",
+          output: workspaceSettingsResource.operations.patch.output,
+          transformResult: (result) => result.value
         }
-      );
-
-      return returnJsonApiData(response);
-    }
-  }
-]);
-
-function buildWorkspaceSettingsActions({ workspaceSettingsService } = {}) {
-  if (!workspaceSettingsService) throw new TypeError("buildWorkspaceSettingsActions requires workspaceSettingsService.");
-  return workspaceSettingsActionSpecifications.map(({ run, ...definition }) => Object.freeze({
-    ...definition,
-    execute(input, context) {
-      return run(workspaceSettingsService, input, context);
-    }
-  }));
+      },
+      events: WORKSPACE_SETTINGS_CHANGED_EVENTS,
+      execute: (input, context) => workspaceSettingsService.updateWorkspaceSettings(
+        resolveWorkspace(context, input),
+        input,
+        { context }
+      )
+    })
+  ]);
 }
 
-export { workspaceSettingsActionSpecifications, buildWorkspaceSettingsActions };
+export { createWorkspaceSettingsActions };

package/src/server/workspaceSettings/workspaceSettingsRepository.js

@@ -1,17 +1,14 @@
-import {
-  normalizeRecordId,
-  isDuplicateEntryError,
-  retryDeadlocks
-} from "../common/repositories/repositoryUtils.js";
+import { isLostDuplicateInsertRace, resolveTransaction, retryDeadlocks } from "@jskit-ai/database-runtime/shared";
 import {
   createJsonRestContext,
   extractJsonRestCollectionRows
 } from "@jskit-ai/json-rest-api-core/server/jsonRestApiHost";
 import { pickOwnProperties } from "@jskit-ai/kernel/shared/support";
+import { normalizeRecordId } from "@jskit-ai/kernel/shared/support/normalize";
 import { WORKSPACE_SETTINGS_FIELD_KEYS } from "../../shared/resources/workspaceSettingsResource.js";
 import { resolveWorkspaceThemePalettes } from "../../shared/settings.js";
 
-function createDefaultWorkspaceSettingsCreatePayload(workspaceId, defaultInvitesEnabled, defaultColorSettings = {}) {
+function buildDefaultWorkspaceSettingsCreatePayload(workspaceId, defaultInvitesEnabled, defaultColorSettings) {
   const palettes = resolveWorkspaceThemePalettes(defaultColorSettings);
 
   return {
@@ -28,10 +25,13 @@ function createDefaultWorkspaceSettingsCreatePayload(workspaceId, defaultInvites
   };
 }
 
-function createRepository({ api, defaultInvitesEnabled = true, defaultColorSettings = {} } = {}) {
-  if (!api?.resources?.workspaceSettings) {
-    throw new TypeError("workspaceSettingsRepository requires json-rest-api workspaceSettings resource.");
-  }
+/**
+ * @param {object} dependencies
+ * @param {import("@jskit-ai/json-rest-api-core/server/types").RuntimeJsonRestApi} dependencies.api
+ * @param {boolean} dependencies.defaultInvitesEnabled
+ * @param {object} dependencies.defaultColorSettings The configured colors that replace the theme's.
+ */
+function createRepository({ api, defaultInvitesEnabled, defaultColorSettings }) {
   const withTransaction = (work) => retryDeadlocks(() => api.transaction(work));
 
   async function queryFirst(filters = {}, options = {}) {
@@ -41,10 +41,10 @@ function createRepository({ api, defaultInvitesEnabled = true, defaultColorSetti
           queryParams: {
             filters
           },
-          transaction: options?.trx || null,
+          transaction: resolveTransaction(options),
           format: "plain"
         },
-        createJsonRestContext(options?.context || null)
+        createJsonRestContext(options.context)
       )
     );
 
@@ -74,19 +74,19 @@ function createRepository({ api, defaultInvitesEnabled = true, defaultColorSetti
     try {
       await api.resources.workspaceSettings.post(
         {
-          data: createDefaultWorkspaceSettingsCreatePayload(
+          data: buildDefaultWorkspaceSettingsCreatePayload(
             normalizedWorkspaceId,
-            defaultInvitesEnabled === true,
+            defaultInvitesEnabled,
             defaultColorSettings
           ),
           format: "plain",
           returning: "full",
-          transaction: options?.trx || null
+          transaction: resolveTransaction(options)
         },
-        createJsonRestContext(options?.context || null)
+        createJsonRestContext(options.context)
       );
     } catch (error) {
-      if (options?.trx || error?.transactionOutcome !== "rolledBack" || !isDuplicateEntryError(error)) {
+      if (!isLostDuplicateInsertRace(error, options)) {
         throw error;
       }
     }
@@ -94,7 +94,7 @@ function createRepository({ api, defaultInvitesEnabled = true, defaultColorSetti
     return findByWorkspaceId(normalizedWorkspaceId, options);
   }
 
-  async function updateSettingsByWorkspaceId(workspaceId, patch = {}, options = {}) {
+  async function updateSettingsByWorkspaceId(workspaceId, patch, options = {}) {
     const normalizedWorkspaceId = normalizeRecordId(workspaceId, { fallback: null });
     if (!normalizedWorkspaceId) {
       throw new TypeError("workspaceSettingsRepository.updateSettingsByWorkspaceId requires a valid workspace id.");
@@ -117,9 +117,9 @@ function createRepository({ api, defaultInvitesEnabled = true, defaultColorSetti
         },
         format: "plain",
         returning: "full",
-        transaction: options?.trx || null
+        transaction: resolveTransaction(options)
       },
-      createJsonRestContext(options?.context || null)
+      createJsonRestContext(options.context)
     );
 
     return findByWorkspaceId(normalizedWorkspaceId, options);

package/src/server/workspaceSettings/{bootWorkspaceSettings.js → workspaceSettingsRoutes.js}

@@ -1,28 +1,16 @@
 import { createJsonApiResourceRouteContract } from "@jskit-ai/http-runtime/shared/validators/jsonApiRouteTransport";
 import { WORKSPACE_SETTINGS_TRANSPORT } from "../../shared/jsonApiTransports.js";
 import { workspaceSettingsResource } from "../../shared/resources/workspaceSettingsResource.js";
-import { resolveWorkspaceRoutePath } from "../common/support/workspaceRoutePaths.js";
+import { resolveWorkspaceRecordId } from "../common/support/workspaceRecordId.js";
+import { resolveWorkspaceRoutePath } from "../support/workspaceRoutePaths.js";
 import { workspaceSlugParamsValidator } from "../common/validators/routeParamsValidator.js";
 import { resolveDefaultWorkspaceRouteSurfaceIdFromAppConfig } from "../support/workspaceActionSurfaces.js";
 
-function resolveWorkspaceSettingsRecordId(record = {}, context = {}) {
-  const workspaceId = record?.workspace?.id;
-  if (workspaceId != null && String(workspaceId).trim()) {
-    return workspaceId;
-  }
-
-  const workspaceSlug = context?.request?.params?.workspaceSlug;
-  if (workspaceSlug != null && String(workspaceSlug).trim()) {
-    return workspaceSlug;
-  }
-
-  throw new Error("Workspace settings JSON:API response requires workspace id.");
-}
-
-function registerWorkspaceSettingsRoutes(router, { config = {} } = {}) {
-  if (!router || typeof router.register !== "function") {
-    throw new TypeError("registerWorkspaceSettingsRoutes requires router.register().");
-  }
+/**
+ * @param {import("@jskit-ai/kernel/server/types").RuntimeRouter} router
+ * @param {{ config: import("@jskit-ai/kernel/server/types").RuntimeConfig }} options
+ */
+function registerWorkspaceSettingsRoutes(router, { config }) {
   const workspaceRouteSurfaceId = resolveDefaultWorkspaceRouteSurfaceIdFromAppConfig(config);
 
   router.register(
@@ -41,7 +29,7 @@ function registerWorkspaceSettingsRoutes(router, { config = {} } = {}) {
         ...WORKSPACE_SETTINGS_TRANSPORT,
         output: workspaceSettingsResource.operations.view.output,
         outputKind: "record",
-        getRecordId: resolveWorkspaceSettingsRecordId
+        getRecordId: resolveWorkspaceRecordId
       })
     },
     async function (request, reply) {
@@ -72,7 +60,7 @@ function registerWorkspaceSettingsRoutes(router, { config = {} } = {}) {
         body: workspaceSettingsResource.operations.patch.body,
         output: workspaceSettingsResource.operations.patch.output,
         outputKind: "record",
-        getRecordId: resolveWorkspaceSettingsRecordId,
+        getRecordId: resolveWorkspaceRecordId,
         includeValidation400: true
       })
     },

package/src/server/workspaceSettings/workspaceSettingsService.js

@@ -1,23 +1,17 @@
 import { normalizeRecordId } from "@jskit-ai/kernel/shared/support/normalize";
-import { normalizeObjectInput } from "@jskit-ai/kernel/shared/validators/inputNormalization";
 import { pickOwnProperties } from "@jskit-ai/kernel/shared/support";
-import {
-  WORKSPACE_SETTINGS_FIELD_KEYS
-} from "../../shared/resources/workspaceSettingsResource.js";
-import { createWorkspaceRoleCatalog, cloneWorkspaceRoleCatalog } from "../../shared/roles.js";
-
-function createService({
-  workspaceSettingsRepository,
-  workspaceInvitationsEnabled = true,
-  roleCatalog = null
-} = {}) {
-  if (!workspaceSettingsRepository) {
-    throw new Error("workspaceSettingsService requires workspaceSettingsRepository.");
-  }
-  const resolvedRoleCatalog = roleCatalog && typeof roleCatalog === "object" ? roleCatalog : createWorkspaceRoleCatalog();
-  const invitesAvailable = workspaceInvitationsEnabled === true;
-
-  async function getWorkspaceSettings(workspace, options = {}) {
+import { returnJsonApiData } from "@jskit-ai/http-runtime/shared";
+import { WORKSPACE_SETTINGS_FIELD_KEYS } from "../../shared/resources/workspaceSettingsResource.js";
+import { cloneWorkspaceRoleCatalog } from "../../shared/roles.js";
+
+/**
+ * @param {object} dependencies
+ * @param {import("../types.js").WorkspaceSettingsRepository} dependencies.workspaceSettingsRepository
+ * @param {boolean} dependencies.workspaceInvitationsEnabled
+ * @param {import("../types.js").WorkspaceRoleCatalog} dependencies.roleCatalog
+ */
+function createService({ workspaceSettingsRepository, workspaceInvitationsEnabled, roleCatalog }) {
+  async function readWorkspaceSettings(workspace, options = {}) {
     const settingsRecord = await workspaceSettingsRepository.ensureForWorkspaceId(workspace.id, {
       ...options,
       workspace
@@ -26,10 +20,10 @@ function createService({
     for (const fieldKey of WORKSPACE_SETTINGS_FIELD_KEYS) {
       settings[fieldKey] = settingsRecord[fieldKey];
     }
-    const invitesEnabled = invitesAvailable && settings.invitesEnabled !== false;
+    const invitesEnabled = workspaceInvitationsEnabled && settings.invitesEnabled !== false;
     settings.invitesEnabled = invitesEnabled;
-    settings.invitesAvailable = invitesAvailable;
-    settings.invitesEffective = invitesAvailable && invitesEnabled;
+    settings.invitesAvailable = workspaceInvitationsEnabled;
+    settings.invitesEffective = invitesEnabled;
 
     return {
       workspace: {
@@ -38,13 +32,17 @@ function createService({
         ownerUserId: normalizeRecordId(workspace.ownerUserId, { fallback: "" })
       },
       settings,
-      roleCatalog: cloneWorkspaceRoleCatalog(resolvedRoleCatalog)
+      roleCatalog: cloneWorkspaceRoleCatalog(roleCatalog)
     };
   }
 
-  async function updateWorkspaceSettings(workspace, payload = {}, options = {}) {
-    const source = normalizeObjectInput(payload);
-    const settingsPatch = pickOwnProperties(source, WORKSPACE_SETTINGS_FIELD_KEYS);
+  async function getWorkspaceSettings(workspace, options = {}) {
+    return returnJsonApiData(await readWorkspaceSettings(workspace, options));
+  }
+
+  /** The action's validated input; only the settings fields go to the repository. */
+  async function updateWorkspaceSettings(workspace, input, options = {}) {
+    const settingsPatch = pickOwnProperties(input, WORKSPACE_SETTINGS_FIELD_KEYS);
 
     if (Object.keys(settingsPatch).length > 0) {
       await workspaceSettingsRepository.updateSettingsByWorkspaceId(workspace.id, settingsPatch, {
@@ -53,7 +51,7 @@ function createService({
       });
     }
 
-    return getWorkspaceSettings(workspace, options);
+    return returnJsonApiData(await readWorkspaceSettings(workspace, options));
   }
 
   return Object.freeze({