fix(invitations): require org admin to grant org Admin, and two disclosure gaps

Privilege escalation. `createWorkspaceInvitation` stamped organization role
`admin` whenever the caller passed `membership: 'admin'`, but authorization only
checked workspace admin access — and unifying the invite modals exposed the Admin
option to any workspace admin, where it had previously been reachable only from
organization settings. A workspace-scoped administrator could therefore invite
someone who joins as an organization Admin, gaining admin on every workspace the
organization owns plus member and billing management. The inviter must now already
hold organization owner/admin, checked server-side because the batch endpoint is
reachable without the modal, and the modal no longer offers Admin to anyone else.

The preview promised external access without mirroring acceptance's
`external-requires-paid-plan` gate, so a free invitee — one who cancelled Pro, or
left the organization that forced the external invite — was told they had
workspace access and then refused. It now mirrors that gate, including its
exemptions (billing on, organization-owned workspace, externality not imposed),
and reports `blocked`.

The modal's Enterprise seat check counted every non-External email as a seat. The
server does not: an existing organization member is granted access directly, and
an invitee already in another organization is forced external. The hard block
refused batches the API would have accepted, so it is advisory now — per-email
failures already come back with reasons.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: icecrasher321

apps/sim/app/workspace/[workspaceId]/components/invite-modal/invite-modal.tsx

@@ -137,6 +137,19 @@ export function InviteModal({
    * is actually hosted by.
    */
   const hostContext = useWorkspaceHostContext()
+  /**
+   * Organization Admin is an organization-level grant — it carries admin on every
+   * workspace the org owns plus member and billing management — so it is only
+   * offered to someone who already holds it. The batch endpoint enforces the same
+   * rule; this only keeps the UI from presenting an option that would be refused.
+   */
+  const canGrantOrganizationAdmin =
+    isOrganizationInvite &&
+    hostContext.hostOrganizationId === organizationId &&
+    hostContext.viewer.isHostOrganizationAdmin
+  const membershipOptions = canGrantOrganizationAdmin
+    ? MEMBERSHIP_OPTIONS
+    : MEMBERSHIP_OPTIONS.filter((option) => option.value !== 'admin')
   const canViewOrganizationBilling =
     isOrganizationInvite &&
     hostContext.hostOrganizationId === organizationId &&
@@ -155,10 +168,17 @@ export function InviteModal({
    */
   const isEnterpriseOrg = isEnterprise(organizationBillingData?.data?.subscriptionPlan)
   const hasSeatData = canViewOrganizationBilling && isEnterpriseOrg && totalSeats > 0
-  const exceedsSeatCapacity =
+  /**
+   * Advisory only. The server decides per email and does not charge a seat for
+   * everyone: an existing organization member is granted access directly, and an
+   * invitee who already belongs to another organization is forced external. A
+   * hard block here refused batches the API would have accepted, so this warns
+   * and lets the send proceed — per-email failures come back with reasons.
+   */
+  const mayExceedSeatCapacity =
     hasSeatData && membership !== 'external' && emails.length > availableSeats
-  const seatLimitReason = exceedsSeatCapacity
-    ? `Only ${availableSeats} seat${availableSeats === 1 ? '' : 's'} available. External collaborators do not use seats.`
+  const seatLimitReason = mayExceedSeatCapacity
+    ? `Only ${availableSeats} seat${availableSeats === 1 ? '' : 's'} available — invites beyond that may fail. External collaborators and existing members do not use seats.`
     : null
 
   const validateEmail = useCallback(
@@ -242,8 +262,7 @@ export function InviteModal({
     Boolean(inviteDisabledReason) ||
     isSubmitting ||
     emails.length === 0 ||
-    selectedWorkspaceIds.length === 0 ||
-    exceedsSeatCapacity
+    selectedWorkspaceIds.length === 0
 
   return (
     <ChipModal
@@ -296,7 +315,7 @@ export function InviteModal({
           <ChipModalField
             type='dropdown'
             title='Membership'
-            options={MEMBERSHIP_OPTIONS}
+            options={membershipOptions}
             value={membership}
             placeholder='Select membership'
             align='start'

apps/sim/lib/invitations/core.ts

@@ -266,7 +266,6 @@ export async function getInvitationJoinPreview(
     workspacesToMove: [],
     workspaceIdsToMove: [],
   })
-  if (inv.membershipIntent === 'external') return withOutcome('external')
 
   let workspaceOrganizationId = inv.organizationId
   let billedAccountUserId: string | null = null
@@ -292,15 +291,36 @@ export async function getInvitationJoinPreview(
    * one (acceptance downgrades to external or rejects).
    */
   const existingMembership = await getUserOrganization(inviteeUserId)
+  const inDifferentOrganization =
+    !!existingMembership &&
+    (workspaceOrganizationId ? existingMembership.organizationId !== workspaceOrganizationId : true)
+
+  if (inv.membershipIntent === 'external') {
+    /**
+     * Mirrors acceptance's `external-requires-paid-plan` gate, including its
+     * exemptions: it only applies with billing on, to an organization-owned
+     * workspace, and not when externality was imposed because the invitee already
+     * belongs to another organization. Without this the screen promised external
+     * access that acceptance would refuse.
+     */
+    if (
+      isBillingEnabled &&
+      !inDifferentOrganization &&
+      workspaceOrganizationId &&
+      (await getInvitePlanCategoryForUser(inviteeUserId)) === 'free'
+    ) {
+      return withOutcome('blocked')
+    }
+    return withOutcome('external')
+  }
+
   if (existingMembership) {
     /**
      * Already in the organization acceptance lands in: nothing about their
      * standing changes. A membership in a DIFFERENT organization is the
      * external case — acceptance downgrades — so it keeps the plain shape.
      */
-    const inTargetOrganization =
-      !!workspaceOrganizationId && existingMembership.organizationId === workspaceOrganizationId
-    if (inTargetOrganization) return withOutcome('already-member')
+    if (!inDifferentOrganization) return withOutcome('already-member')
     /**
      * In a DIFFERENT organization. Acceptance only downgrades a workspace-kind
      * invite with live grants to external; an organization-kind invite (or one

apps/sim/lib/invitations/workspace-invitations.test.ts

@@ -21,6 +21,7 @@ const {
   mockRevertPendingInvitationGrants,
   mockFindPendingGrantWorkspaceIds,
   mockGetInvitePlanCategoryForUser,
+  mockIsOrganizationOwnerOrAdmin,
   mockWorkspaceMemberInvited,
   mockCaptureServerEvent,
 } = vi.hoisted(() => ({
@@ -33,6 +34,7 @@ const {
   mockRevertPendingInvitationGrants: vi.fn(),
   mockFindPendingGrantWorkspaceIds: vi.fn(),
   mockGetInvitePlanCategoryForUser: vi.fn(),
+  mockIsOrganizationOwnerOrAdmin: vi.fn(),
   mockWorkspaceMemberInvited: vi.fn(),
   mockCaptureServerEvent: vi.fn(),
 }))
@@ -71,6 +73,10 @@ vi.mock('@/lib/workspaces/permissions/utils', () => ({
   getWorkspaceWithOwner: vi.fn(),
 }))
 
+vi.mock('@/lib/billing/core/organization', () => ({
+  isOrganizationOwnerOrAdmin: mockIsOrganizationOwnerOrAdmin,
+}))
+
 vi.mock('@/lib/workspaces/policy', () => ({
   getWorkspaceInvitePolicy: vi.fn(),
   getInvitePlanCategoryForUser: mockGetInvitePlanCategoryForUser,
@@ -140,6 +146,7 @@ describe('createWorkspaceInvitation', () => {
     resetDbChainMock()
     /** Production default; the billing-disabled case opts out explicitly. */
     setEnvFlags({ isBillingEnabled: true })
+    mockIsOrganizationOwnerOrAdmin.mockResolvedValue(false)
     mockGrantWorkspaceAccessDirectly.mockResolvedValue({ outcome: 'added', permission: 'write' })
     mockCreatePendingInvitation.mockResolvedValue({
       invitationId: 'inv-1',
@@ -254,7 +261,8 @@ describe('createWorkspaceInvitation', () => {
     )
   })
 
-  it('stamps an admin organization role when the inviter picks Admin membership', async () => {
+  it('stamps an admin organization role when an org admin picks Admin membership', async () => {
+    mockIsOrganizationOwnerOrAdmin.mockResolvedValue(true)
     queueWhereResponses([[]])
 
     await createWorkspaceInvitation({
@@ -295,6 +303,29 @@ describe('createWorkspaceInvitation', () => {
     expect(mockGetInvitePlanCategoryForUser).not.toHaveBeenCalled()
   })
 
+  it('refuses to grant organization Admin to a workspace-only administrator', async () => {
+    /**
+     * Organization Admin carries admin on every workspace the org owns plus
+     * member and billing management, so workspace-scoped authority must not
+     * escalate into it. Enforced server-side because the batch endpoint is
+     * reachable without the modal.
+     */
+    mockIsOrganizationOwnerOrAdmin.mockResolvedValue(false)
+    queueWhereResponses([[]])
+
+    await expect(
+      createWorkspaceInvitation({
+        context: makeContext(),
+        email: 'new@example.com',
+        permission: 'write',
+        membership: 'admin',
+        request,
+      })
+    ).rejects.toThrow('Only an organization owner or admin')
+
+    expect(mockCreatePendingInvitation).not.toHaveBeenCalled()
+  })
+
   it('rejects an explicit external invite for an invitee with no paid plan', async () => {
     queueWhereResponses([[{ id: 'user-5', email: 'free@example.com' }], []])
     mockGetUserOrganization.mockResolvedValueOnce(null)

apps/sim/lib/invitations/workspace-invitations.ts

@@ -4,6 +4,7 @@ import { type InvitationMembershipIntent, permissions, user } from '@sim/db/sche
 import { normalizeEmail } from '@sim/utils/string'
 import { and, eq, inArray, sql } from 'drizzle-orm'
 import type { NextRequest } from 'next/server'
+import { isOrganizationOwnerOrAdmin } from '@/lib/billing/core/organization'
 import { getUserOrganization } from '@/lib/billing/organizations/membership'
 import { validateSeatAvailability } from '@/lib/billing/validation/seat-management'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
@@ -337,6 +338,24 @@ export async function createWorkspaceInvitation({
     membershipIntent = 'external'
   }
 
+  /**
+   * Granting organization Admin is an organization-level act: an org admin holds
+   * admin on every workspace the org owns and can manage members, roles, and
+   * billing. Workspace admin authority must not escalate into it, so the inviter
+   * has to already hold it. Checked here rather than in the modal because the
+   * modal is only the UI — the batch endpoint is reachable directly.
+   */
+  if (membershipIntent === 'internal' && membership === 'admin') {
+    if (!organizationId || !(await isOrganizationOwnerOrAdmin(context.inviterId, organizationId))) {
+      throw new WorkspaceInvitationError({
+        message:
+          'Only an organization owner or admin can invite someone as an organization admin. Invite them as a Member instead.',
+        status: 403,
+        email: normalizedEmail,
+      })
+    }
+  }
+
   const role: 'admin' | 'member' =
     membershipIntent === 'internal' && membership === 'admin' ? 'admin' : 'member'