Moheeb Zara
df6951c323
Invites - migration 029: space_invites.role (member_role enum, default 'member' — legacy invites and the spaces.invite_code path keep granting member). schema.sql + types/database.ts mirrored - lib/invite-logic.ts (pure, tested): canAssignInviteRole — admin may grant any role; board may grant anything except admin; nobody else. Privilege-escalation guard on top of the existing admin/board gate - createInvite/updateInvite take + enforce role via that guard; createInviteSchema/updateInviteSchema validate the enum - joinSpace applies the invite's granted role (validated), default member; uses_count/max_uses/expiry already enforced - invites panel: role picker (filtered to what the creator may grant), one-click "single use", per-invite role badge - space-scoped invite link /join/<space>?code=… via a presentational app/join/[space] landing that hands off to the proven /signup?invite= flow; /join added to middleware PUBLIC_ROUTES Audit hardening (from this pass's review) - /login now honors a validated same-origin ?next= (was hardcoded to /dashboard) so the public_auth form sign-in round-trips; OAuth threads next through the callback (which already honored it) - submitForm requires formId; submitFormSchema drops the now-ambiguous slug path (form slugs are per-space after 028). Both callers already pass formId. Tests updated 337 tests; build verified (Compiled successfully, exit 0). No deploy.
26 lines
1.0 KiB
TypeScript
26 lines
1.0 KiB
TypeScript
// Pure invite-role policy. No deps so it is unit-testable and shared by the
|
|
// server action, the validations, and the panel UI.
|
|
|
|
export const INVITE_ROLES = ['admin', 'board', 'treasurer', 'member', 'associate'] as const
|
|
export type InviteRole = (typeof INVITE_ROLES)[number]
|
|
|
|
export function isInviteRole(v: string): v is InviteRole {
|
|
return (INVITE_ROLES as readonly string[]).includes(v)
|
|
}
|
|
|
|
/**
|
|
* Whether a member with `creatorRole` may create an invite that grants
|
|
* `target`. Invite creation is already admin/board-gated upstream; this is
|
|
* the privilege-escalation guard on top of that:
|
|
* - admin may grant any role
|
|
* - board may grant anything EXCEPT admin (a board member cannot mint
|
|
* admin access)
|
|
* - anyone else: no (they never reach invite creation anyway)
|
|
*/
|
|
export function canAssignInviteRole(creatorRole: string, target: string): boolean {
|
|
if (!isInviteRole(target)) return false
|
|
if (creatorRole === 'admin') return true
|
|
if (creatorRole === 'board') return target !== 'admin'
|
|
return false
|
|
}
|