Andrey Antukh 5efd9cc3c5

🐛 Prevent admins from granting owner role in team invitations (#11099) ...

Add role-ceiling check to create-team-invitations and
update-team-invitation-role methods. These RPC methods allowed
team admins to grant or elevate invitations to :owner role,
bypassing the protection that exists in update-team-member-role.

The fix replicates the existing check from update-team-member-role:
reject promotion to :owner when the caller is not an owner.

Closes #11098

AI-assisted-by: qwen3.7-plus

2026-08-17 11:37:51 +02:00

..

backend_tests

🐛 Prevent admins from granting owner role in team invitations (#11099)

2026-08-17 11:37:51 +02:00

e2e

✨ Add Node.js E2E API tests for backend (#10787)

2026-08-05 10:15:41 +02:00