From 93f02ea0b4e1701d42829556bfa022b4eeb54fc9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mar=C3=ADa=20Valderrama?= Date: Wed, 12 Aug 2026 16:55:20 +0200 Subject: [PATCH] :bug: Fix send-invitations policy not enforced in backend RPC (#11206) --- .../src/app/rpc/commands/teams_invitations.clj | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/backend/src/app/rpc/commands/teams_invitations.clj b/backend/src/app/rpc/commands/teams_invitations.clj index 0ba235a444..93b15df5c2 100644 --- a/backend/src/app/rpc/commands/teams_invitations.clj +++ b/backend/src/app/rpc/commands/teams_invitations.clj @@ -460,6 +460,10 @@ [cfg {:keys [::rpc/profile-id team-id role emails] :as params}] (let [perms (teams/get-permissions cfg profile-id team-id) profile (db/get-by-id cfg :profile profile-id) + team (db/get-by-id cfg :team team-id) + team-with-org (when (contains? cf/flags :admin-console) + (nitrate/add-organization-info-to-team cfg team {})) + organization (:organization team-with-org) ;; Determine which format is being used using-emails-format? (and emails role) ;; Handle both parameter formats @@ -475,6 +479,17 @@ (ex/raise :type :validation :code :insufficient-permissions)) + (when (and (contains? cf/flags :admin-console) + organization + (not (cto/allowed? :send-invitations + {:organization-perms {:owner-id (:owner-id organization) + :permissions (:permissions organization)} + :profile-id profile-id + :team-perms perms}))) + (ex/raise :type :validation + :code :insufficient-permissions + :hint "Organization policy does not allow you to send invitations")) + (when (> invitation-count max-invitations-by-request-threshold) (ex/raise :type :validation :code :max-invitations-by-request