address comments

Author: icecrasher321

apps/docs/content/docs/en/platform/permissions.mdx

@@ -85,7 +85,7 @@ External workspace members still receive a workspace permission level — Read,
 
 Accepting an invite that makes you an **internal member** does more than grant access — it brings your work under the organization:
 
-- **Your workspaces move with you.** Every personal workspace you own, archived ones included, becomes an organization workspace. The accept screen lists exactly which workspaces will move before you accept.
+- **Your workspaces move with you.** Every personal workspace you own, archived ones included, becomes an organization workspace. The accept screen names the workspaces that will move before you accept.
 - **You keep Admin on them.** You remain their administrator; organization Owners and Admins also gain Admin access through the normal [role inheritance](#how-roles-inherit), and usage in those workspaces is billed to the organization from then on.
 - **Your collaborators are not pulled in.** Anyone you had shared those workspaces with keeps their access as an **external member** — they never join the organization or consume a seat as a side effect of your joining.
 - **The workspaces stay if you leave.** If you later leave or are removed from the organization, workspaces you brought in remain with the organization.
@@ -234,8 +234,8 @@ import { FAQ } from '@/components/ui/faq'
 
 <FAQ items={[
   { question: "What is the difference between organization roles and workspace permissions?", answer: "Organization roles (Owner, Admin, or Member) control who can manage the organization itself, including inviting people, creating shared workspaces, and handling billing. Workspace permissions (Read, Write, Admin) control what a user can do within a specific workspace, such as viewing, editing, or managing workflows. Internal members need both an organization role and a workspace permission to work within a shared workspace. External workspace members do not have an organization role in your org; they only have workspace-level access." },
-  { question: "What happens to my personal workspaces when I join an organization?", answer: "They move into the organization when you accept the invite — archived workspaces included. The accept screen lists exactly which workspaces will move before you accept. You stay their Admin, organization Owners and Admins gain Admin access through role inheritance, and usage in them is billed to the organization from then on. People you had shared them with keep access as external members. If you later leave the organization, those workspaces stay with it. Accepting an external invite never moves anything — everything you own stays yours." },
-  { question: "What happens when a member is removed from the organization?", answer: "Their workspace access is revoked and workflows they created are reassigned so deployed automations keep running. Credentials backed by their personal identity — OAuth connections and personal environment keys they own — stop working until another member reconnects them; the removal dialog lists exactly which credentials are affected before you confirm. Workspaces they brought into the organization stay with the organization." },
+  { question: "What happens to my personal workspaces when I join an organization?", answer: "They move into the organization when you accept the invite — archived workspaces included. The accept screen names the workspaces that will move before you accept. You stay their Admin, organization Owners and Admins gain Admin access through role inheritance, and usage in them is billed to the organization from then on. People you had shared them with keep access as external members. If you later leave the organization, those workspaces stay with it. Accepting an external invite never moves anything — everything you own stays yours." },
+  { question: "What happens when a member is removed from the organization?", answer: "Their workspace access is revoked and workflows they created are reassigned so deployed automations keep running. Credentials backed by their personal identity — OAuth connections and personal environment keys they own — stop working until another member reconnects them; the removal dialog names the affected credentials before you confirm. Workspaces they brought into the organization stay with the organization." },
   { question: "What happens to my shared workspaces if I cancel or downgrade my Team plan?", answer: "Existing shared workspaces remain accessible to current members, but new invitations are disabled until you upgrade back to a Team or Enterprise plan. No workspaces or members are deleted — the organization is simply dormant until billing is re-enabled." },
   { question: "Can I restrict which integrations or model providers a team member can use?", answer: "Yes, on Enterprise-entitled organizations. Any organization owner or admin can create permission groups with fine-grained controls, including restricting allowed integrations and allowed model providers to specific lists. You can also disable access to MCP tools, custom tools, skills, and various platform features like the knowledge base, API keys, or Copilot on a per-group basis. Permission groups are scoped to the organization and can govern either all workspaces or a specific subset — a user can belong to multiple groups but is governed by exactly one group in any given workspace." },
   { question: "What happens when a personal environment variable has the same name as a workspace variable?", answer: "The workspace variable wins. When a workflow runs, the resolver checks workspace variables first and falls back to a personal variable only when no workspace variable shares that name. This keeps shared, team-managed values authoritative in production workflows." },

apps/docs/content/docs/en/platform/workspaces.mdx

@@ -66,7 +66,7 @@ Members join with one of three **permission levels**: **Read**, **Write**, or **
 
 Most workspaces are one of two kinds.
 
-A **personal workspace** lives under your own account. Use it for experimentation and individual work. Your plan sets how many you can create. When you join an organization as an internal member, personal workspaces you own move into it — the accept screen shows exactly which ones before you accept.
+A **personal workspace** lives under your own account. Use it for experimentation and individual work. Your plan sets how many you can create. When you join an organization as an internal member, personal workspaces you own move into it — the accept screen names them before you accept.
 
 An **organization workspace** (also called a shared workspace) lives under an organization, available on Team and Enterprise plans. You invite members, each with a permission level. Internal members join the organization, count toward its seat total, and bring their own workspaces with them. External members stay outside the organization — no seat, and everything they own stays theirs — that's how partners and clients get access. For agencies and enterprises, this is the workspace you hand to the customer: the app they use, own, and maintain.
 

apps/sim/app/api/organizations/route.test.ts

@@ -96,7 +96,6 @@ describe('POST /api/organizations', () => {
     expect(mockAttachOwnedWorkspacesToOrganization).toHaveBeenCalledWith({
       ownerUserId: 'user-1',
       organizationId: 'legacy-org-id',
-      externalMemberPolicy: 'keep-external',
       includeArchived: true,
     })
     expect(mockCreateOrganizationForTeamPlan).not.toHaveBeenCalled()

apps/sim/app/api/organizations/route.ts

@@ -187,15 +187,16 @@ export const POST = withRouteHandler(async (request: Request) => {
 
       if (activeOrgSubscription.referenceId === organizationId) {
         /**
-         * keep-external, matching the Pro→Team conversion: different-org
-         * collaborators (including ones on archived workspaces the sweep now
-         * covers) stay external workspace members instead of aborting the
-         * whole org recovery with a conflict.
+         * Keeps the default `reject` policy: manual organization creation
+         * surfaces a different-org collaborator as an explicit conflict (409
+         * with actionable copy) rather than silently demoting them to an
+         * external member. Safe alongside `includeArchived` because the attach
+         * only enumerates collaborators of ACTIVE workspaces, so sweeping
+         * archived rows cannot manufacture a conflict.
          */
         await attachOwnedWorkspacesToOrganization({
           ownerUserId: user.id,
           organizationId,
-          externalMemberPolicy: 'keep-external',
           includeArchived: true,
         })
       } else {

apps/sim/app/api/workspaces/route.ts

@@ -151,6 +151,7 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
       organizationId: creationPolicy.organizationId,
       workspaceMode: creationPolicy.workspaceMode,
       billedAccountUserId: creationPolicy.billedAccountUserId,
+      observedOrganizationId: creationPolicy.observedOrganizationId,
     })
 
     captureServerEvent(
@@ -210,6 +211,7 @@ async function createDefaultWorkspace(
     organizationId: string | null
     workspaceMode: WorkspaceMode
     billedAccountUserId: string
+    observedOrganizationId: string | null
   }
 ) {
   const firstName = userName?.split(' ')[0] || null
@@ -220,11 +222,14 @@ async function createDefaultWorkspace(
     organizationId: creationPolicy.organizationId,
     workspaceMode: creationPolicy.workspaceMode,
     billedAccountUserId: creationPolicy.billedAccountUserId,
+    observedOrganizationId: creationPolicy.observedOrganizationId,
   })
 }
 
 interface CreateWorkspaceParams {
   userId: string
+  /** Membership the creation policy observed; see WorkspaceCreationPolicy. */
+  observedOrganizationId: string | null
   name: string
   skipDefaultWorkflow?: boolean
   explicitColor?: string
@@ -235,6 +240,7 @@ interface CreateWorkspaceParams {
 
 async function createWorkspace({
   userId,
+  observedOrganizationId,
   name,
   skipDefaultWorkflow = false,
   explicitColor,
@@ -259,12 +265,19 @@ async function createWorkspace({
        */
       if (!organizationId) {
         await acquireUserBillingIdentityLock(tx, userId)
-        const [existingMembership] = await tx
-          .select({ id: member.id })
+        const [currentMembership] = await tx
+          .select({ organizationId: member.organizationId })
           .from(member)
           .where(eq(member.userId, userId))
           .limit(1)
-        if (existingMembership) {
+        /**
+         * Only a CHANGE since the policy read means the decision is stale. An
+         * unchanged membership is legitimately personal — the policy returns
+         * a personal decision for members whose organization has no usable
+         * Team/Enterprise plan (a dormant org), and those users must still be
+         * able to create workspaces.
+         */
+        if ((currentMembership?.organizationId ?? null) !== observedOrganizationId) {
           throw new PersonalWorkspaceCreationRacedError()
         }
       }

apps/sim/app/invite/[id]/invite.tsx

@@ -240,7 +240,7 @@ export default function Invite() {
     }
   }, [searchParams, inviteId, inviteTokenStorageKey])
 
-  const invitationQuery = useInvitationDetails(inviteId, token, {
+  const invitationQuery = useInvitationDetails(inviteId, token, session?.user?.id ?? null, {
     enabled: Boolean(session?.user),
   })
   const invitation = invitationQuery.data?.invitation ?? null
@@ -492,7 +492,13 @@ export default function Invite() {
   }
 
   const isOrg = invitation?.kind === 'organization'
-  const organizationLabel = invitation?.organizationName || 'the organization'
+  /**
+   * Prefer the preview's organization (the one acceptance will really join)
+   * over the invitation's stamped name — a granted workspace may have moved
+   * organizations since the invite was sent.
+   */
+  const organizationLabel =
+    joinPreview?.organizationName || invitation?.organizationName || 'the organization'
   /**
    * When the server could not compute the preview, fall back to a generic
    * migration notice for membership invites — a missing preview must never

apps/sim/app/workspace/[workspaceId]/settings/components/team-management/components/remove-member-dialog/remove-member-dialog.tsx

@@ -86,12 +86,21 @@ export function RemoveMemberDialog({
       confirm={{
         label: isSelfRemoval ? 'Leave Organization' : 'Remove',
         onClick: () => onConfirmRemove(),
-        pending: isSubmitting || credentialImpactPending,
-        pendingLabel:
-          credentialImpactPending && !isSubmitting ? 'Checking credentials…' : undefined,
+        pending: isSubmitting,
+        /**
+         * `disabled`, not `pending`: the impact check is a precondition, and
+         * `pending` means "the confirm is in flight" — the primitive also
+         * disables the dismiss button while pending, which must stay available
+         * while we are merely loading the disclosure.
+         */
+        disabled: credentialImpactPending,
       }}
     >
-      {credentialWarning ? (
+      {credentialImpactPending ? (
+        <p className='mt-1 px-2 text-[var(--text-muted)] text-caption'>
+          Checking which connected credentials this affects…
+        </p>
+      ) : credentialWarning ? (
         <p className='mt-1 px-2 text-[var(--text-muted)] text-caption'>{credentialWarning}</p>
       ) : null}
       {errorMessage ? (

apps/sim/app/workspace/page.tsx

@@ -16,6 +16,9 @@ import { useWorkspacesWithMetadata } from '@/hooks/queries/workspace'
 
 const logger = createLogger('WorkspacePage')
 
+/** Bounds the one-shot reload after a creation-vs-membership 409. */
+const WORKSPACE_RACE_RETRY_KEY = 'workspaceRaceRetry'
+
 /**
  * A 401 while the session claims we're authenticated means the auth cookies
  * are stale or inconsistent (e.g. after an impersonation session expired or
@@ -130,7 +133,7 @@ export default function WorkspacePage() {
         return
       }
       hasRedirectedRef.current = true
-      handleNoWorkspaces(router)
+      handleNoWorkspaces(router, () => setRecoveryFailed(true))
       return
     }
 
@@ -171,7 +174,7 @@ export default function WorkspacePage() {
         description={
           blockedPolicy.workspaceMode === 'organization'
             ? "Your account is linked to an organization, but you don't have access to any of its workspaces. Ask an organization admin for workspace access, then check again — or sign out and back in if you recently left the organization."
-            : 'All of your workspaces are archived and your plan has reached its workspace limit. Unarchive a workspace or upgrade your plan to continue.'
+            : 'Your plan has reached its workspace limit and none of your workspaces are active. Upgrade your plan to create another workspace, or contact support to restore an archived one.'
         }
         primaryLabel='Check again'
         onPrimary={() => window.location.reload()}
@@ -232,26 +235,39 @@ async function handleWorkflowRedirect(
   router.replace(`/workspace/${fallbackWorkspaceId}/home`)
 }
 
-async function handleNoWorkspaces(router: ReturnType<typeof useRouter>): Promise<void> {
+async function handleNoWorkspaces(
+  router: ReturnType<typeof useRouter>,
+  onUnrecoverable: () => void
+): Promise<void> {
   logger.warn('No workspaces found, creating default workspace')
   try {
     const data = await requestJson(createWorkspaceContract, {
       body: { name: 'My Workspace' },
     })
     if (data.workspace?.id) {
       logger.info(`Created default workspace: ${data.workspace.id}`)
+      sessionStorage.removeItem(WORKSPACE_RACE_RETRY_KEY)
       router.replace(`/workspace/${data.workspace.id}/home`)
       return
     }
     logger.error('Failed to create default workspace')
   } catch (error) {
     /**
-     * 409 means the user joined an organization while the default workspace
-     * was being created — they are still authenticated and likely have org
-     * workspaces now, so re-resolve instead of falling into the login path.
+     * 409 means the caller's organization membership changed while the
+     * default workspace was being created — they are still authenticated and
+     * their workspaces likely exist now, so re-resolve ONCE. A second 409
+     * means something other than a race, so surface the error card instead of
+     * reloading forever.
      */
     if (isApiClientError(error) && error.status === 409) {
-      logger.info('Default workspace creation raced an organization join; re-resolving')
+      if (sessionStorage.getItem(WORKSPACE_RACE_RETRY_KEY)) {
+        logger.error('Default workspace creation kept conflicting after a retry')
+        sessionStorage.removeItem(WORKSPACE_RACE_RETRY_KEY)
+        onUnrecoverable()
+        return
+      }
+      sessionStorage.setItem(WORKSPACE_RACE_RETRY_KEY, '1')
+      logger.info('Default workspace creation raced an organization change; re-resolving')
       window.location.reload()
       return
     }

apps/sim/hooks/queries/invitations.ts

@@ -21,8 +21,15 @@ export const invitationKeys = {
   lists: () => [...invitationKeys.all, 'list'] as const,
   list: (workspaceId: string) => [...invitationKeys.lists(), workspaceId] as const,
   details: () => [...invitationKeys.all, 'detail'] as const,
-  detail: (invitationId: string, token: string | null) =>
-    [...invitationKeys.details(), invitationId, token ?? ''] as const,
+  /**
+   * Scoped by viewer: the response is viewer-dependent (the join preview is
+   * invitee-only, and authorization differs per account), so a cached entry
+   * must never be reused across a sign-out/sign-in on the same invite link —
+   * doing so would let a stale "nothing moves" preview become the disclosure
+   * basis for a different user.
+   */
+  detail: (invitationId: string, token: string | null, viewerId: string | null) =>
+    [...invitationKeys.details(), invitationId, token ?? '', viewerId ?? ''] as const,
 }
 
 export const WORKSPACE_INVITATION_LIST_STALE_TIME = 30 * 1000
@@ -48,10 +55,11 @@ async function fetchInvitationDetails(
 export function useInvitationDetails(
   invitationId: string | undefined,
   token: string | null,
+  viewerId: string | null,
   options?: { enabled?: boolean }
 ) {
   return useQuery({
-    queryKey: invitationKeys.detail(invitationId ?? '', token),
+    queryKey: invitationKeys.detail(invitationId ?? '', token, viewerId),
     queryFn: ({ signal }) => fetchInvitationDetails(invitationId as string, token, signal),
     enabled: Boolean(invitationId) && (options?.enabled ?? true),
     staleTime: INVITATION_DETAILS_STALE_TIME,

apps/sim/lib/api/contracts/invitations.ts

@@ -2,6 +2,13 @@ import { z } from 'zod'
 import { defineRouteContract } from '@/lib/api/contracts/types'
 import { workspacePermissionSchema } from '@/lib/api/contracts/workspaces'
 
+/**
+ * Shared cap for the disclosure token: the preview's id list and the accept
+ * body's echo of it must agree, or a large owned-workspace set would produce a
+ * preview the accept endpoint rejects as over-long.
+ */
+export const DISCLOSED_WORKSPACE_ID_LIMIT = 500
+
 export const invitationParamsSchema = z.object({
   id: z.string({ error: 'Invitation ID is required' }).min(1, 'Invitation ID is required'),
 })
@@ -80,7 +87,7 @@ export const invitationActionBodySchema = z.object({
    * the set it would actually sweep differs — consent is only valid for the
    * set the user saw.
    */
-  disclosedWorkspaceIds: z.array(z.string()).max(200).optional(),
+  disclosedWorkspaceIds: z.array(z.string()).max(DISCLOSED_WORKSPACE_ID_LIMIT).optional(),
 })
 
 export const invitationDetailsSchema = z.object({
@@ -107,13 +114,17 @@ export const invitationDetailsSchema = z.object({
 
 export const invitationJoinPreviewSchema = z.object({
   willJoinOrganization: z.boolean(),
-  workspacesToMove: z.array(z.string()),
+  /** Name of the organization acceptance will actually join. */
+  organizationName: z.string().nullable(),
+  workspacesToMove: z.array(z.string()).max(DISCLOSED_WORKSPACE_ID_LIMIT),
   /**
    * Stable ids behind `workspacesToMove`, echoed back on accept as the
    * disclosure token: acceptance rejects when the set it would sweep no
-   * longer matches what this preview disclosed.
+   * longer matches what this preview disclosed. Capped at the same limit as
+   * the accept body's echo so a large owned set can never render an invite
+   * permanently un-acceptable.
    */
-  workspaceIdsToMove: z.array(z.string()),
+  workspaceIdsToMove: z.array(z.string()).max(DISCLOSED_WORKSPACE_ID_LIMIT),
 })
 
 export const acceptInvitationResponseSchema = z.object({