fix(webapp): fold case when detecting existing members and pending invites

Canonicalising submitted addresses to lowercase meant inviteMembers' exact
comparisons stopped matching a stored member or invite whose address differs
only by case, so an admin re-entering that address got a redundant invite
emailed to someone already in the org.

Fold both sides of the member lookup, and check for a pending invite the same
way rather than leaning on the case-sensitive org+email constraint alone.

Also normalise addresses in the PAT invite API so both entry points agree.

Author: isshaddad

apps/webapp/app/models/member.server.ts

@@ -135,11 +135,25 @@ export async function inviteMembers({
   const existingMembers = await prisma.orgMember.findMany({
     where: {
       organizationId: org.id,
-      user: { email: { in: boundedIn([...uniqueEmails]) } },
+      user: { email: { in: boundedIn([...uniqueEmails]), mode: "insensitive" } },
     },
     select: { user: { select: { email: true } } },
   });
-  const existingMemberEmails = new Set(existingMembers.map((member) => member.user.email));
+  // Compare folded: stored account emails and invite rows can both carry
+  // casing the caller didn't type, and the unique org+email constraint the
+  // P2002 below relies on is itself case-sensitive.
+  const existingMemberEmails = new Set(
+    existingMembers.map((member) => member.user.email.toLowerCase())
+  );
+
+  const pendingInvites = await prisma.orgMemberInvite.findMany({
+    where: {
+      organizationId: org.id,
+      email: { in: boundedIn([...uniqueEmails]), mode: "insensitive" },
+    },
+    select: { email: true },
+  });
+  const pendingInviteEmails = new Set(pendingInvites.map((invite) => invite.email.toLowerCase()));
 
   // Create one invite per unique email and return ONLY the invites actually
   // created by this call. A P2002 means the email is already invited to this org
@@ -153,11 +167,18 @@ export async function inviteMembers({
   const alreadyInvited: string[] = [];
 
   for (const email of uniqueEmails) {
-    if (existingMemberEmails.has(email)) {
+    const folded = email.toLowerCase();
+
+    if (existingMemberEmails.has(folded)) {
       alreadyMembers.push(email);
       continue;
     }
 
+    if (pendingInviteEmails.has(folded)) {
+      alreadyInvited.push(email);
+      continue;
+    }
+
     try {
       const invite = await prisma.orgMemberInvite.create({
         data: {

apps/webapp/app/routes/api.v1.orgs.$orgParam.invites.ts

@@ -18,6 +18,8 @@ const ParamsSchema = z.object({
 const InviteRequestBody = z.object({
   emails: z
     .string()
+    .trim()
+    .toLowerCase()
     .email()
     .array()
     .nonempty("At least one email is required")

apps/webapp/test/inviteEmailCase.test.ts

@@ -167,4 +167,74 @@ describe("invite email casing", () => {
       expect(stillThere).not.toBeNull();
     }
   );
+  postgresTest(
+    "inviteMembers does not re-invite a member whose account email differs only by case",
+    { timeout: 60_000 },
+    async ({ prisma }) => {
+      prismaHolder.client = prisma;
+      const { inviteMembers } = await import("../app/models/member.server");
+
+      const suffix = randomHex(8);
+      const owner = await prisma.user.create({
+        data: { email: `owner-${suffix}@example.test`, authenticationMethod: "MAGIC_LINK" },
+      });
+      const member = await prisma.user.create({
+        data: { email: `Member-${suffix}@Example.test`, authenticationMethod: "MAGIC_LINK" },
+      });
+      const organization = await prisma.organization.create({
+        data: {
+          title: `invite-dupe-org-${suffix}`,
+          slug: `invite-dupe-org-${suffix}`,
+          isActivated: true,
+          members: {
+            create: [
+              { userId: owner.id, role: "ADMIN" },
+              { userId: member.id, role: "MEMBER" },
+            ],
+          },
+        },
+      });
+
+      // Both entry points fold the address before it reaches inviteMembers, so
+      // this is what an admin typing the member's own address actually sends.
+      const result = await inviteMembers({
+        slug: organization.slug,
+        emails: [`member-${suffix}@example.test`],
+        userId: owner.id,
+      });
+
+      expect(result.created).toHaveLength(0);
+      expect(result.alreadyMembers).toHaveLength(1);
+    }
+  );
+
+  postgresTest(
+    "inviteMembers does not duplicate a pending invite that differs only by case",
+    { timeout: 60_000 },
+    async ({ prisma }) => {
+      prismaHolder.client = prisma;
+      const { inviteMembers } = await import("../app/models/member.server");
+
+      const { organization, inviter, invitee, accountEmail } = await seedMixedCaseInvite(prisma);
+      void invitee;
+
+      const before = await prisma.orgMemberInvite.count({
+        where: { organizationId: organization.id },
+      });
+
+      const result = await inviteMembers({
+        slug: organization.slug,
+        emails: [accountEmail],
+        userId: inviter.id,
+      });
+
+      expect(result.created).toHaveLength(0);
+      expect(result.alreadyInvited).toHaveLength(1);
+
+      const after = await prisma.orgMemberInvite.count({
+        where: { organizationId: organization.id },
+      });
+      expect(after).toBe(before);
+    }
+  );
 });