fix(invitations): gate all-stale member joins before disclosure and always refetch removal impact

The all-stale check for member-role org invites now runs before any
mutation and before the disclosure comparison, so an invite whose grants
all left the org fails with workspace-not-found instead of trapping
owners of personal workspaces in a disclosure-outdated retry loop. The
removal-impact query drops its stale window (staleTime 0): every dialog
open refetches while the confirm is held on isFetching.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: icecrasher321

apps/sim/hooks/queries/organization.ts

@@ -56,7 +56,12 @@ export const ORGANIZATION_SUBSCRIPTION_STALE_TIME = 30 * 1000
 export const ORGANIZATION_BILLING_STALE_TIME = 30 * 1000
 export const ORGANIZATION_MEMBERS_STALE_TIME = 30 * 1000
 export const ORGANIZATION_MEMBER_USAGE_LIMIT_STALE_TIME = 30 * 1000
-export const ORGANIZATION_REMOVAL_IMPACT_STALE_TIME = 30 * 1000
+/**
+ * Zero: removal impact is a consent disclosure, so every dialog open must
+ * refetch — a cached list may omit credentials added moments ago, and the
+ * dialog holds its confirm on `isFetching` until fresh data lands.
+ */
+export const ORGANIZATION_REMOVAL_IMPACT_STALE_TIME = 0
 
 type OrganizationSubscriptionCandidate = {
   id: string

apps/sim/lib/invitations/core.test.ts

@@ -692,12 +692,6 @@ describe('acceptInvitation', () => {
       workspaceMode: 'organization',
       billedAccountUserId: 'owner-1',
     })
-    mockEnsureTeamOrganizationForAcceptance.mockResolvedValueOnce({
-      success: true,
-      organizationId: 'org-1',
-      fixedSeats: false,
-    })
-
     queueWhereResponses([
       [
         {
@@ -727,14 +721,8 @@ describe('acceptInvitation', () => {
       [{ name: 'Owner', email: 'owner@example.com' }],
       // Invitee-owned personal workspaces for the acceptance lock plan.
       [],
-      // Post-join owned-set re-check under the billing-identity lock.
-      [],
-      // Grant-txn membership re-check under the lock: member still present.
-      [{ id: 'member-1' }],
-      // Invitation status update under the lock.
+      // Pre-join staleness gate: no grant workspace remains in the stamped org.
       [],
-      // The granted workspace left the stamped organization.
-      [{ organizationId: 'org-elsewhere' }],
     ])
 
     const result = await acceptInvitation({
@@ -745,6 +733,7 @@ describe('acceptInvitation', () => {
     })
 
     expect(result).toEqual({ success: false, kind: 'workspace-not-found' })
+    expect(mockEnsureUserInOrganization).not.toHaveBeenCalled()
     expect(auditMock.recordAudit).not.toHaveBeenCalled()
   })
 
@@ -986,6 +975,8 @@ describe('acceptInvitation', () => {
       [{ name: 'Owner', email: 'owner@example.com' }],
       // Invitee-owned personal workspaces for the acceptance lock plan.
       [],
+      // Pre-join staleness gate: the granted workspace is still in the org.
+      [{ id: 'workspace-1' }],
       // Post-join owned-set re-check under the billing-identity lock.
       [],
       // Grant-txn membership re-check under the lock: member still present.

apps/sim/lib/invitations/core.ts

@@ -710,6 +710,40 @@ async function acceptLockedInvitation(
     shouldJoinOrganization = false
   }
 
+  /**
+   * A member-role organization invite whose grants ALL left the stamped
+   * organization can never land its member anywhere — fail before any
+   * mutation. This must precede the disclosure check: the preview mirrors
+   * this gate with an empty disclosure, and rejecting on disclosure first
+   * would loop the client on disclosure-outdated instead of surfacing the
+   * real cause. The grant rows are advisory-locked, so this read cannot
+   * change for the rest of the transaction.
+   */
+  if (
+    shouldJoinOrganization &&
+    inv.kind === 'organization' &&
+    inv.organizationId &&
+    !isOrgAdminRole(inv.role) &&
+    inv.grants.length > 0
+  ) {
+    const [liveGrant] = await tx
+      .select({ id: workspace.id })
+      .from(workspace)
+      .where(
+        and(
+          inArray(
+            workspace.id,
+            inv.grants.map((grant) => grant.workspaceId)
+          ),
+          eq(workspace.organizationId, inv.organizationId)
+        )
+      )
+      .limit(1)
+    if (!liveGrant) {
+      return { success: false, kind: 'workspace-not-found' }
+    }
+  }
+
   let targetOrganizationId = workspaceOrganizationId
 
   if (shouldJoinOrganization) {