fix(invitations): restore the invite admin gate, hedge an unknown outcome

Consolidating the modals dropped a permission check. The old workspace-header
modal derived `canInviteMembers` from `userPermissions.canAdmin` internally and
disabled its field and button; the shared modal takes `canInvite` as a prop that
defaults to true, and no call site passed it. Non-admins therefore saw a fully
enabled invite form and only learned otherwise when the server refused the send.
All three entry points now supply it: workspace admin for the header, the
existing `canManage` for the workspace Teammates page, and organization
owner/admin for organization settings.

When the join preview cannot be computed the outcome is unknown, and the callers
send no disclosure token — so acceptance runs without the consent guards. The
membership notice nevertheless asserted a seat-taking join from the sent intent,
which acceptance may resolve to external, already-a-member, or a failure. It is
conditional now ("If you're added to X as a member, that uses one of their
seats"), so the consequence is still disclosed without being claimed as settled.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: icecrasher321

apps/sim/app/workspace/[workspaceId]/settings/components/team-management/team-management.tsx

@@ -349,6 +349,7 @@ export function TeamManagement({
           open={inviteModalOpen}
           onOpenChange={setInviteModalOpen}
           organizationId={displayOrganization.id}
+          canInvite={adminOrOwner}
         />
       )}
 

apps/sim/app/workspace/[workspaceId]/settings/components/teammates/teammates.tsx

@@ -320,6 +320,7 @@ export function Teammates() {
           workspaceName={activeWorkspace?.name ?? 'Workspace'}
           inviteDisabledReason={inviteDisabledReason}
           organizationId={activeWorkspace?.organizationId ?? null}
+          canInvite={canManage}
         />
       )}
     </>

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/workspace-header.tsx

@@ -25,6 +25,7 @@ import { MoreHorizontal, Search } from 'lucide-react'
 import { useActiveOrganization } from '@/lib/auth/auth-client'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
 import { InviteModal } from '@/app/workspace/[workspaceId]/components/invite-modal'
+import { useWorkspacePermissionsContext } from '@/app/workspace/[workspaceId]/providers/workspace-permissions-provider'
 import { ContextMenu } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/workflow-list/components/context-menu/context-menu'
 import { DeleteModal } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/workflow-list/components/delete-modal/delete-modal'
 import {
@@ -244,6 +245,13 @@ function WorkspaceHeaderImpl({
   const createWorkspaceDisabledReason =
     workspaceCreationPolicy?.canCreate === false ? workspaceCreationPolicy.reason : null
   const { isInvitationsDisabled: isInvitationsDisabledByConfig } = usePermissionConfig()
+  /**
+   * Only workspace admins can invite. The modal takes this as a prop, so each
+   * entry point supplies it — the pre-consolidation modal derived it internally,
+   * and omitting it here left the form fully enabled for non-admins until the
+   * server refused the send.
+   */
+  const { userPermissions } = useWorkspacePermissionsContext()
   const inviteDisabledReason = activeWorkspaceFull?.inviteDisabledReason ?? null
   const isInvitationsDisabled = isInvitationsDisabledByConfig || inviteDisabledReason !== null
   const createWorkspaceTarget: CreateWorkspaceTarget =
@@ -871,6 +879,7 @@ function WorkspaceHeaderImpl({
         workspaceName={activeWorkspace?.name || 'Workspace'}
         inviteDisabledReason={inviteDisabledReason}
         organizationId={activeWorkspaceFull?.organizationId ?? null}
+        canInvite={userPermissions.canAdmin}
       />
       <ViewInvitationsModal open={isViewInvitationsOpen} onOpenChange={setIsViewInvitationsOpen} />
       <DeleteModal

apps/sim/lib/invitations/disclosure-copy.test.ts

@@ -78,7 +78,11 @@ describe('buildMembershipNotice', () => {
     expect(notice).not.toContain('uses one of their seats')
   })
 
-  it('falls back to the sent intent when no preview could be computed', () => {
+  /**
+   * With no preview the outcome is unknown and acceptance runs without the consent
+   * guards, so the copy must not assert a settled outcome.
+   */
+  it('hedges when no preview could be computed', () => {
     expect(
       buildMembershipNotice({
         joinPreview: null,
@@ -87,7 +91,17 @@ describe('buildMembershipNotice', () => {
         organizationLabel: 'Acme',
         isOrganizationScoped: true,
       })
-    ).toContain('uses one of their seats')
+    ).toContain("If you're added")
+
+    expect(
+      buildMembershipNotice({
+        joinPreview: null,
+        membershipIntent: 'internal',
+        isOrganizationAdminRole: false,
+        organizationLabel: 'Acme',
+        isOrganizationScoped: true,
+      })
+    ).not.toContain("You'll join Acme as")
 
     expect(
       buildMembershipNotice({

apps/sim/lib/invitations/disclosure-copy.ts

@@ -75,11 +75,20 @@ export function buildMembershipNotice({
   if (!isOrganizationScoped || !membershipIntent) return ''
 
   /**
-   * No preview: fall back to the invitation's sent intent, which is the only
-   * signal available.
+   * No preview means the outcome is genuinely unknown, and the callers also send
+   * no disclosure token, so acceptance runs without the consent guards. Asserting
+   * a seat-taking join here would be a promise nothing verifies — acceptance may
+   * resolve to external, already-a-member, or a failure. The copy is conditional
+   * instead: the consequence is still disclosed, without claiming it as settled.
    */
-  const outcome =
-    joinPreview?.outcome ?? (membershipIntent === 'external' ? 'external' : 'will-join')
+  if (!joinPreview) {
+    if (membershipIntent === 'external') {
+      return ` You'll join as an external collaborator: you get access to the invited workspaces only, and you don't take one of their seats.`
+    }
+    return ` If you're added to ${organizationLabel} as a member, that uses one of their seats.`
+  }
+
+  const outcome = joinPreview.outcome
 
   switch (outcome) {
     /**