Skip to content

improvement(governance): workspace-org invitation system consolidation #4230

Merged
icecrasher321 merged 17 commits intostagingfrom
feat/org-improv-big
Apr 20, 2026
Merged

improvement(governance): workspace-org invitation system consolidation #4230
icecrasher321 merged 17 commits intostagingfrom
feat/org-improv-big

Conversation

@icecrasher321
Copy link
Copy Markdown
Collaborator

Summary

Organization - Workspace consolidation for UX improvement. Adds functionality like ownership transferring, billing improvements, ux improvements, etc.

Type of Change

  • Other: UX Improvement

Testing

Tested manually

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Resolve conflicts from staging's test-mock centralization and @sim/utils
extraction:

- Keep ours for invitation unification: organizations/[id]/invitations,
  members, and workspaces/invitations routes use @/lib/invitations/send +
  @/lib/invitations/core helpers (staging still referenced the dropped
  workspaceInvitation table and inline sendEmail).
- Keep ours for the deleted /api/organizations/[id]/invitations/[invitationId]
  and /api/workspaces/invitations/[invitationId] endpoints, replaced by
  the unified /api/invitations/[id]/... routes.
- Keep ours for ownership transfer infra in lib/billing/organization.ts
  (attachOwnedWorkspacesToOrganization import) and
  lib/billing/organizations/membership.ts (revokeWorkspaceCredentialMemberships,
  transferOrganizationOwnership, isSoleOwnerOfPaidOrganization,
  removeUserFromOrganization rewrite).
- Take staging for users/me/subscription/transfer imports (already had
  @sim/utils/errors) and v1/admin/organizations.
- Take staging's version of lib/workspaces/lifecycle.test.ts to adopt
  the new centralized schemaMock pattern.

Test pattern migration:
- Add @sim/utils to apps/sim/package.json dependencies so
  generateId/toError resolve via workspace link.
- Swap @/lib/core/utils/uuid imports to @sim/utils/id across
  invitations/core, invitations/send, billing/organizations/*, and
  workspaces/organization-workspaces (uuid.ts was deleted on staging).
- Extend packages/testing/src/mocks/schema.mock.ts to expose the
  post-unification schema: invitationKindEnum, invitationStatusEnum,
  updated invitation (kind/token/updatedAt), invitationWorkspaceGrant,
  workspaceModeEnum, and workspace.organizationId + workspace.workspaceMode.
- Migrate our authored tests to centralized mocks per sim-testing.mdc:
  - schemaMock for @sim/db/schema (drops per-test local schema defs)
  - authMock + authMockFns for @/lib/auth in the invitations route test
  - permissionsMock + permissionsMockFns for getWorkspaceWithOwner
  - auditMock for @/lib/audit/log
  - Drop redundant drizzle-orm and @sim/logger local mocks (globally
    mocked via vitest.setup.ts)

All 5326 tests across 308 files pass, typecheck clean, biome clean.

Made-with: Cursor
@vercel
Copy link
Copy Markdown

vercel bot commented Apr 19, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
docs Ready Ready Preview, Comment Apr 20, 2026 9:37pm

Request Review

@cursor
Copy link
Copy Markdown

cursor bot commented Apr 19, 2026

PR Summary

Medium Risk
Modifies invitation, organization, and session activation flows that affect access control and billing seat enforcement; mistakes could block invites or mis-assign org/workspace access. Changes are fairly contained with new/updated tests, but touch critical governance paths.

Overview
Consolidates organization + workspace invitation handling into a unified invitation API. Adds new invitations routes to fetch/update/cancel, accept/reject, and resend invites with token rotation, permission checks (org owner/admin or workspace admin), workspace-invite policy enforcement, and audit logging.

Refactors org invite creation to use shared invitation/email helpers (deduping emails, validating org-owned workspaces for batch grants, rolling back pending invites on email failure, and returning partial-failure responses), and removes the legacy per-invitation org route and the legacy workspace invitation route/tests.

Tightens governance and billing behavior. Blocks unsafe Better Auth org-mutation endpoints, adds a dedicated ownership-transfer endpoint (plus admin equivalent) and prevents setting owner via the generic member-role endpoint, clears activeOrganizationId on self-removal, counts pending invites as occupied seats when reducing seat count, and disallows changing billedAccountUserId on organization workspaces.

Improves post-upgrade session behavior by attempting to set an active organization after subscription upgrades when missing, with safer cancellation handling and logging.

Also updates docs and pricing copy to clarify personal vs shared workspace limits and org/workspace role semantics.

Reviewed by Cursor Bugbot for commit 4222529. Configure here.

Comment thread apps/sim/app/api/invitations/[id]/route.ts Outdated
Comment thread apps/sim/app/api/invitations/[id]/reject/route.ts
Comment thread apps/sim/app/api/invitations/[id]/route.ts Outdated
@icecrasher321
Copy link
Copy Markdown
Collaborator Author

bugbot run

Comment thread apps/sim/app/api/invitations/[id]/resend/route.ts
Comment thread apps/sim/app/api/organizations/[id]/members/[memberId]/route.ts
@icecrasher321
Copy link
Copy Markdown
Collaborator Author

bugbot run

Comment thread apps/sim/app/api/organizations/[id]/invitations/route.ts Outdated
Comment thread apps/sim/app/api/invitations/[id]/route.ts
@icecrasher321
Copy link
Copy Markdown
Collaborator Author

bugbot run

Copy link
Copy Markdown

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 4222529. Configure here.

Comment thread apps/sim/app/api/v1/admin/organizations/[id]/members/route.ts
@icecrasher321 icecrasher321 merged commit d9209f9 into staging Apr 20, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant