prevent self invite

This commit is contained in:
msukkari 2025-02-12 19:50:44 -08:00
parent 6caed350d3
commit 8ad6ba7ab0
3 changed files with 12 additions and 1 deletions

View file

@ -287,6 +287,15 @@ export const createInvite = async (email: string, userId: string, domain: string
withOrgMembership(session, domain, async (orgId) => { withOrgMembership(session, domain, async (orgId) => {
console.log("Creating invite for", email, userId, orgId); console.log("Creating invite for", email, userId, orgId);
if (email === session.user.email) {
console.error("User tried to invite themselves");
return {
statusCode: StatusCodes.BAD_REQUEST,
errorCode: ErrorCode.SELF_INVITE,
message: "❌ You can't invite yourself to an org",
} satisfies ServiceError;
}
try { try {
await prisma.invite.create({ await prisma.invite.create({
data: { data: {

View file

@ -9,6 +9,7 @@ import { useToast } from "@/components/hooks/use-toast";
import { createInvite } from "@/actions" import { createInvite } from "@/actions"
import { isServiceError } from "@/lib/utils"; import { isServiceError } from "@/lib/utils";
import { useDomain } from "@/hooks/useDomain"; import { useDomain } from "@/hooks/useDomain";
import { ErrorCode } from "@/lib/errorCodes";
const formSchema = z.object({ const formSchema = z.object({
email: z.string().min(2).max(40), email: z.string().min(2).max(40),
@ -29,7 +30,7 @@ export const MemberInviteForm = ({ userId }: { userId: string }) => {
const res = await createInvite(values.email, userId, domain); const res = await createInvite(values.email, userId, domain);
if (isServiceError(res)) { if (isServiceError(res)) {
toast({ toast({
description: `❌ Failed to create invite` description: res.errorCode == ErrorCode.SELF_INVITE ? res.message :`❌ Failed to create invite`
}); });
return; return;
} else { } else {

View file

@ -5,6 +5,7 @@ export enum ErrorCode {
REPOSITORY_NOT_FOUND = 'REPOSITORY_NOT_FOUND', REPOSITORY_NOT_FOUND = 'REPOSITORY_NOT_FOUND',
FILE_NOT_FOUND = 'FILE_NOT_FOUND', FILE_NOT_FOUND = 'FILE_NOT_FOUND',
INVALID_REQUEST_BODY = 'INVALID_REQUEST_BODY', INVALID_REQUEST_BODY = 'INVALID_REQUEST_BODY',
SELF_INVITE = 'SELF_INVITE',
NOT_AUTHENTICATED = 'NOT_AUTHENTICATED', NOT_AUTHENTICATED = 'NOT_AUTHENTICATED',
NOT_FOUND = 'NOT_FOUND', NOT_FOUND = 'NOT_FOUND',
CONNECTION_SYNC_ALREADY_SCHEDULED = 'CONNECTION_SYNC_ALREADY_SCHEDULED', CONNECTION_SYNC_ALREADY_SCHEDULED = 'CONNECTION_SYNC_ALREADY_SCHEDULED',