chore: import upstream snapshot with attribution

apps/sim/app/api/invitations/[id]/accept/route.ts

@@ -0,0 +1,85 @@
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
+import { createLogger } from '@sim/logger'
+import { type NextRequest, NextResponse } from 'next/server'
+import { acceptInvitationContract } from '@/lib/api/contracts/invitations'
+import { parseRequest } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { acceptInvitation } from '@/lib/invitations/core'
+
+const logger = createLogger('InvitationAcceptAPI')
+
+export const POST = withRouteHandler(
+  async (request: NextRequest, context: { params: Promise<{ id: string }> }) => {
+    const session = await getSession()
+
+    if (!session?.user?.id || !session.user.email) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseRequest(acceptInvitationContract, request, context)
+    if (!parsed.success) return parsed.response
+
+    const { id } = parsed.data.params
+
+    const result = await acceptInvitation({
+      userId: session.user.id,
+      userEmail: session.user.email,
+      invitationId: id,
+      token: parsed.data.body.token ?? null,
+    })
+
+    if (!result.success) {
+      const statusMap: Record<string, number> = {
+        'not-found': 404,
+        'invalid-token': 400,
+        'already-processed': 400,
+        expired: 400,
+        'email-mismatch': 403,
+        'already-in-organization': 409,
+        'no-seats-available': 400,
+        'upgrade-required': 402,
+        'server-error': 500,
+      }
+      const status = statusMap[result.kind] ?? 500
+      logger.warn('Invitation accept rejected', { invitationId: id, reason: result.kind })
+      return NextResponse.json({ error: result.kind }, { status })
+    }
+
+    const inv = result.invitation
+
+    recordAudit({
+      workspaceId: result.acceptedWorkspaceIds[0] ?? null,
+      actorId: session.user.id,
+      actorName: session.user.name ?? undefined,
+      actorEmail: session.user.email ?? undefined,
+      action:
+        inv.kind === 'workspace'
+          ? AuditAction.INVITATION_ACCEPTED
+          : AuditAction.ORG_INVITATION_ACCEPTED,
+      resourceType:
+        inv.kind === 'workspace' ? AuditResourceType.WORKSPACE : AuditResourceType.ORGANIZATION,
+      resourceId: inv.organizationId ?? result.acceptedWorkspaceIds[0] ?? inv.id,
+      description: `Accepted ${inv.kind} invitation for ${inv.email}`,
+      metadata: {
+        invitationId: inv.id,
+        targetEmail: inv.email,
+        targetRole: inv.role,
+        kind: inv.kind,
+        workspaceIds: result.acceptedWorkspaceIds,
+      },
+      request,
+    })
+
+    return NextResponse.json({
+      success: true,
+      redirectPath: result.redirectPath,
+      invitation: {
+        id: inv.id,
+        kind: inv.kind,
+        organizationId: inv.organizationId,
+        acceptedWorkspaceIds: result.acceptedWorkspaceIds,
+      },
+    })
+  }
+)

apps/sim/app/api/invitations/[id]/reject/route.ts

@@ -0,0 +1,70 @@
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
+import { createLogger } from '@sim/logger'
+import { type NextRequest, NextResponse } from 'next/server'
+import { rejectInvitationContract } from '@/lib/api/contracts/invitations'
+import { parseRequest } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { rejectInvitation } from '@/lib/invitations/core'
+
+const logger = createLogger('InvitationRejectAPI')
+
+export const POST = withRouteHandler(
+  async (request: NextRequest, context: { params: Promise<{ id: string }> }) => {
+    const session = await getSession()
+
+    if (!session?.user?.id || !session.user.email) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseRequest(rejectInvitationContract, request, context)
+    if (!parsed.success) return parsed.response
+
+    const { id } = parsed.data.params
+
+    const result = await rejectInvitation({
+      userId: session.user.id,
+      userEmail: session.user.email,
+      invitationId: id,
+      token: parsed.data.body.token ?? null,
+    })
+
+    if (!result.success) {
+      const statusMap: Record<string, number> = {
+        'not-found': 404,
+        'invalid-token': 400,
+        'already-processed': 400,
+        expired: 400,
+        'email-mismatch': 403,
+      }
+      const status = statusMap[result.kind] ?? 500
+      logger.warn('Invitation reject rejected', { invitationId: id, reason: result.kind })
+      return NextResponse.json({ error: result.kind }, { status })
+    }
+
+    const inv = result.invitation
+    recordAudit({
+      workspaceId: null,
+      actorId: session.user.id,
+      actorName: session.user.name ?? undefined,
+      actorEmail: session.user.email ?? undefined,
+      action:
+        inv.kind === 'workspace'
+          ? AuditAction.INVITATION_REJECTED
+          : AuditAction.ORG_INVITATION_REJECTED,
+      resourceType:
+        inv.kind === 'workspace' ? AuditResourceType.WORKSPACE : AuditResourceType.ORGANIZATION,
+      resourceId: inv.organizationId ?? inv.grants[0]?.workspaceId ?? inv.id,
+      description: `Rejected ${inv.kind} invitation for ${inv.email}`,
+      metadata: {
+        invitationId: inv.id,
+        targetEmail: inv.email,
+        targetRole: inv.role,
+        kind: inv.kind,
+      },
+      request,
+    })
+
+    return NextResponse.json({ success: true })
+  }
+)

apps/sim/app/api/invitations/[id]/resend/route.ts

@@ -0,0 +1,169 @@
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
+import { db } from '@sim/db'
+import { user } from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { eq } from 'drizzle-orm'
+import { type NextRequest, NextResponse } from 'next/server'
+import { invitationParamsSchema } from '@/lib/api/contracts/invitations'
+import { getValidationErrorMessage } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { getOrganizationSubscription } from '@/lib/billing/core/billing'
+import { isOrganizationOwnerOrAdmin } from '@/lib/billing/core/organization'
+import { isEnterprise, isTeam } from '@/lib/billing/plan-helpers'
+import { hasUsableSubscriptionStatus } from '@/lib/billing/subscriptions/utils'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { getInvitationById } from '@/lib/invitations/core'
+import {
+  persistInvitationResend,
+  prepareInvitationResend,
+  sendInvitationEmail,
+} from '@/lib/invitations/send'
+import { getWorkspaceWithOwner, hasWorkspaceAdminAccess } from '@/lib/workspaces/permissions/utils'
+import { getWorkspaceInvitePolicy } from '@/lib/workspaces/policy'
+
+const logger = createLogger('InvitationResendAPI')
+
+export const POST = withRouteHandler(
+  async (request: NextRequest, { params }: { params: Promise<{ id: string }> }) => {
+    const parsedParams = invitationParamsSchema.safeParse(await params)
+    if (!parsedParams.success) {
+      return NextResponse.json(
+        { error: getValidationErrorMessage(parsedParams.error) },
+        { status: 400 }
+      )
+    }
+    const { id } = parsedParams.data
+    const session = await getSession()
+
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    try {
+      const inv = await getInvitationById(id)
+      if (!inv) {
+        return NextResponse.json({ error: 'Invitation not found' }, { status: 404 })
+      }
+      if (inv.status !== 'pending') {
+        return NextResponse.json({ error: 'Can only resend pending invitations' }, { status: 400 })
+      }
+
+      let canResend = false
+      if (inv.organizationId) {
+        canResend = await isOrganizationOwnerOrAdmin(session.user.id, inv.organizationId)
+      }
+      if (!canResend && inv.grants.length > 0) {
+        const adminChecks = await Promise.all(
+          inv.grants.map((grant) => hasWorkspaceAdminAccess(session.user.id, grant.workspaceId))
+        )
+        canResend = adminChecks.some(Boolean)
+      }
+      if (!canResend) {
+        return NextResponse.json(
+          { error: 'Only an organization or workspace admin can resend this invitation' },
+          { status: 403 }
+        )
+      }
+
+      for (const grant of inv.grants) {
+        const workspaceDetails = await getWorkspaceWithOwner(grant.workspaceId)
+        if (!workspaceDetails) {
+          return NextResponse.json(
+            { error: 'Invitation references a workspace that no longer exists' },
+            { status: 409 }
+          )
+        }
+        const policy = await getWorkspaceInvitePolicy(workspaceDetails)
+        if (!policy.allowed) {
+          return NextResponse.json(
+            {
+              error: policy.reason ?? 'Invites are no longer allowed on this workspace',
+              upgradeRequired: policy.upgradeRequired,
+            },
+            { status: 403 }
+          )
+        }
+      }
+
+      if (inv.kind === 'organization' && inv.grants.length === 0 && inv.organizationId) {
+        const orgSubscription = await getOrganizationSubscription(inv.organizationId)
+        const orgOnTeamOrEnterprise =
+          !!orgSubscription &&
+          hasUsableSubscriptionStatus(orgSubscription.status) &&
+          (isTeam(orgSubscription.plan) || isEnterprise(orgSubscription.plan))
+        if (!orgOnTeamOrEnterprise) {
+          return NextResponse.json(
+            {
+              error: 'Invites are no longer allowed on this organization',
+              upgradeRequired: true,
+            },
+            { status: 403 }
+          )
+        }
+      }
+
+      const { tokenForEmail, nextToken, nextExpiresAt } = await prepareInvitationResend({
+        invitationId: id,
+        rotateToken: true,
+        currentToken: inv.token,
+      })
+
+      const [inviterRow] = await db
+        .select({ name: user.name, email: user.email })
+        .from(user)
+        .where(eq(user.id, session.user.id))
+        .limit(1)
+
+      const emailResult = await sendInvitationEmail({
+        invitationId: inv.id,
+        token: tokenForEmail,
+        kind: inv.kind,
+        email: inv.email,
+        inviterName: inviterRow?.name || inviterRow?.email || 'A user',
+        organizationId: inv.organizationId,
+        organizationRole: (inv.role as 'admin' | 'member') || 'member',
+        grants: inv.grants.map((grant) => ({
+          workspaceId: grant.workspaceId,
+          permission: grant.permission,
+        })),
+      })
+
+      if (!emailResult.success) {
+        return NextResponse.json(
+          { error: emailResult.error || 'Failed to send invitation email' },
+          { status: 502 }
+        )
+      }
+
+      await persistInvitationResend({ invitationId: id, nextToken, nextExpiresAt })
+
+      recordAudit({
+        workspaceId: inv.grants[0]?.workspaceId ?? null,
+        actorId: session.user.id,
+        actorName: session.user.name ?? undefined,
+        actorEmail: session.user.email ?? undefined,
+        action:
+          inv.kind === 'workspace'
+            ? AuditAction.INVITATION_RESENT
+            : AuditAction.ORG_INVITATION_RESENT,
+        resourceType:
+          inv.kind === 'workspace' ? AuditResourceType.WORKSPACE : AuditResourceType.ORGANIZATION,
+        resourceId: inv.organizationId ?? inv.grants[0]?.workspaceId ?? inv.id,
+        description: `Resent ${inv.kind} invitation to ${inv.email}`,
+        metadata: {
+          invitationId: inv.id,
+          targetEmail: inv.email,
+          targetRole: inv.role,
+          kind: inv.kind,
+          membershipIntent: inv.membershipIntent,
+        },
+        request,
+      })
+
+      return NextResponse.json({ success: true })
+    } catch (error) {
+      logger.error('Failed to resend invitation', { invitationId: id, error })
+      return NextResponse.json({ error: 'Failed to resend invitation' }, { status: 500 })
+    }
+  }
+)

apps/sim/app/api/invitations/[id]/route.ts

@@ -0,0 +1,277 @@
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
+import { db } from '@sim/db'
+import { invitation, invitationWorkspaceGrant } from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { normalizeEmail } from '@sim/utils/string'
+import { and, eq } from 'drizzle-orm'
+import { type NextRequest, NextResponse } from 'next/server'
+import {
+  getInvitationContract,
+  invitationParamsSchema,
+  updateInvitationContract,
+} from '@/lib/api/contracts/invitations'
+import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { isOrganizationOwnerOrAdmin } from '@/lib/billing/core/organization'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { cancelInvitation, getInvitationById } from '@/lib/invitations/core'
+import { hasWorkspaceAdminAccess } from '@/lib/workspaces/permissions/utils'
+
+const logger = createLogger('InvitationsAPI')
+
+export const GET = withRouteHandler(
+  async (request: NextRequest, context: { params: Promise<{ id: string }> }) => {
+    const session = await getSession()
+
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseRequest(getInvitationContract, request, context)
+    if (!parsed.success) return parsed.response
+
+    const { id } = parsed.data.params
+    const { token } = parsed.data.query
+
+    try {
+      const inv = await getInvitationById(id)
+      if (!inv) {
+        return NextResponse.json({ error: 'Invitation not found' }, { status: 404 })
+      }
+
+      const isInvitee = normalizeEmail(session.user.email || '') === normalizeEmail(inv.email)
+      const tokenMatches = !!token && token === inv.token
+
+      let hasAdminView = false
+      if (inv.organizationId) {
+        hasAdminView = await isOrganizationOwnerOrAdmin(session.user.id, inv.organizationId)
+      }
+      if (!hasAdminView && inv.grants.length > 0) {
+        const adminChecks = await Promise.all(
+          inv.grants.map((grant) => hasWorkspaceAdminAccess(session.user.id, grant.workspaceId))
+        )
+        hasAdminView = adminChecks.some(Boolean)
+      }
+
+      if (!isInvitee && !tokenMatches && !hasAdminView) {
+        return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+      }
+
+      return NextResponse.json({
+        invitation: {
+          id: inv.id,
+          kind: inv.kind,
+          email: inv.email,
+          organizationId: inv.organizationId,
+          organizationName: inv.organizationName,
+          membershipIntent: inv.membershipIntent,
+          role: inv.role,
+          status: inv.status,
+          expiresAt: inv.expiresAt,
+          createdAt: inv.createdAt,
+          inviterName: inv.inviterName,
+          inviterEmail: inv.inviterEmail,
+          grants: inv.grants.map((grant) => ({
+            workspaceId: grant.workspaceId,
+            workspaceName: grant.workspaceName,
+            permission: grant.permission,
+          })),
+        },
+      })
+    } catch (error) {
+      logger.error('Failed to fetch invitation', { invitationId: id, error })
+      return NextResponse.json({ error: 'Failed to fetch invitation' }, { status: 500 })
+    }
+  }
+)
+
+export const PATCH = withRouteHandler(
+  async (request: NextRequest, context: { params: Promise<{ id: string }> }) => {
+    const session = await getSession()
+
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseRequest(updateInvitationContract, request, context)
+    if (!parsed.success) return parsed.response
+
+    const { id } = parsed.data.params
+    const { role, grants } = parsed.data.body
+
+    try {
+      const inv = await getInvitationById(id)
+      if (!inv) {
+        return NextResponse.json({ error: 'Invitation not found' }, { status: 404 })
+      }
+
+      if (inv.status !== 'pending') {
+        return NextResponse.json({ error: 'Can only modify pending invitations' }, { status: 400 })
+      }
+
+      if (role !== undefined) {
+        if (inv.membershipIntent === 'external') {
+          return NextResponse.json(
+            { error: 'Role updates are not valid on external workspace invitations' },
+            { status: 400 }
+          )
+        }
+        if (!inv.organizationId) {
+          return NextResponse.json(
+            { error: 'Role updates are only valid on organization-scoped invitations' },
+            { status: 400 }
+          )
+        }
+        if (!(await isOrganizationOwnerOrAdmin(session.user.id, inv.organizationId))) {
+          return NextResponse.json(
+            { error: 'Only an organization owner or admin can change invitation roles' },
+            { status: 403 }
+          )
+        }
+      }
+
+      const grantsToApply = grants ?? []
+      for (const update of grantsToApply) {
+        const belongsToInvite = inv.grants.some((g) => g.workspaceId === update.workspaceId)
+        if (!belongsToInvite) {
+          return NextResponse.json(
+            { error: `Invitation does not grant access to workspace ${update.workspaceId}` },
+            { status: 400 }
+          )
+        }
+        if (!(await hasWorkspaceAdminAccess(session.user.id, update.workspaceId))) {
+          return NextResponse.json(
+            { error: 'Workspace admin access required to change grant permissions' },
+            { status: 403 }
+          )
+        }
+      }
+
+      await db.transaction(async (tx) => {
+        if (role !== undefined && role !== inv.role) {
+          await tx
+            .update(invitation)
+            .set({ role, updatedAt: new Date() })
+            .where(eq(invitation.id, id))
+        }
+        for (const update of grantsToApply) {
+          await tx
+            .update(invitationWorkspaceGrant)
+            .set({ permission: update.permission, updatedAt: new Date() })
+            .where(
+              and(
+                eq(invitationWorkspaceGrant.invitationId, id),
+                eq(invitationWorkspaceGrant.workspaceId, update.workspaceId)
+              )
+            )
+        }
+      })
+
+      const isOrgScoped = inv.kind === 'organization'
+      const primaryWorkspaceId = inv.grants[0]?.workspaceId ?? null
+      recordAudit({
+        workspaceId: isOrgScoped ? null : primaryWorkspaceId,
+        actorId: session.user.id,
+        actorName: session.user.name ?? undefined,
+        actorEmail: session.user.email ?? undefined,
+        action: isOrgScoped ? AuditAction.ORG_INVITATION_UPDATED : AuditAction.INVITATION_UPDATED,
+        resourceType: isOrgScoped ? AuditResourceType.ORGANIZATION : AuditResourceType.WORKSPACE,
+        resourceId: isOrgScoped ? (inv.organizationId ?? inv.id) : (primaryWorkspaceId ?? inv.id),
+        description: `Updated ${inv.kind} invitation for ${inv.email}`,
+        metadata: {
+          invitationId: id,
+          targetEmail: inv.email,
+          kind: inv.kind,
+          membershipIntent: inv.membershipIntent,
+          roleUpdate: role ?? null,
+          grantUpdates: grantsToApply,
+        },
+        request,
+      })
+
+      return NextResponse.json({ success: true })
+    } catch (error) {
+      logger.error('Failed to update invitation', { invitationId: id, error })
+      return NextResponse.json({ error: 'Failed to update invitation' }, { status: 500 })
+    }
+  }
+)
+
+export const DELETE = withRouteHandler(
+  async (request: NextRequest, { params }: { params: Promise<{ id: string }> }) => {
+    const parsedParams = invitationParamsSchema.safeParse(await params)
+    if (!parsedParams.success) {
+      return NextResponse.json(
+        { error: getValidationErrorMessage(parsedParams.error) },
+        { status: 400 }
+      )
+    }
+    const { id } = parsedParams.data
+    const session = await getSession()
+
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    try {
+      const inv = await getInvitationById(id)
+      if (!inv) {
+        return NextResponse.json({ error: 'Invitation not found' }, { status: 404 })
+      }
+
+      let canCancel = false
+      if (inv.organizationId) {
+        canCancel = await isOrganizationOwnerOrAdmin(session.user.id, inv.organizationId)
+      }
+      if (!canCancel && inv.grants.length > 0) {
+        const adminChecks = await Promise.all(
+          inv.grants.map((grant) => hasWorkspaceAdminAccess(session.user.id, grant.workspaceId))
+        )
+        canCancel = adminChecks.some(Boolean)
+      }
+
+      if (!canCancel) {
+        return NextResponse.json(
+          { error: 'Only an organization or workspace admin can cancel this invitation' },
+          { status: 403 }
+        )
+      }
+
+      if (inv.status !== 'pending') {
+        return NextResponse.json({ error: 'Can only cancel pending invitations' }, { status: 400 })
+      }
+
+      const cancelled = await cancelInvitation(id)
+      if (!cancelled) {
+        return NextResponse.json({ error: 'Invitation not cancellable' }, { status: 400 })
+      }
+
+      recordAudit({
+        workspaceId: inv.grants[0]?.workspaceId ?? null,
+        actorId: session.user.id,
+        actorName: session.user.name ?? undefined,
+        actorEmail: session.user.email ?? undefined,
+        action:
+          inv.kind === 'workspace'
+            ? AuditAction.INVITATION_REVOKED
+            : AuditAction.ORG_INVITATION_REVOKED,
+        resourceType:
+          inv.kind === 'workspace' ? AuditResourceType.WORKSPACE : AuditResourceType.ORGANIZATION,
+        resourceId: inv.organizationId ?? inv.grants[0]?.workspaceId ?? id,
+        description: `Cancelled ${inv.kind} invitation for ${inv.email}`,
+        metadata: {
+          invitationId: id,
+          targetEmail: inv.email,
+          targetRole: inv.role,
+          kind: inv.kind,
+        },
+        request,
+      })
+
+      return NextResponse.json({ success: true })
+    } catch (error) {
+      logger.error('Failed to cancel invitation', { invitationId: id, error })
+      return NextResponse.json({ error: 'Failed to cancel invitation' }, { status: 500 })
+    }
+  }
+)