fix(invitations): carry the membership outcome in the disclosure token

Empty disclosure skipped membership consent. The token was only the
workspace-id list, so a no-join preview and a will-join preview for someone who
owns nothing both echoed `[]`. Neither guard could tell those apart: the forward
check compares sweep sets, and the reverse check required a non-empty disclosed
set. An invitee who left their other organization between preview and accept
would therefore be silently made a seat-consuming member after being told they
would stay external, and the mirror case could silently demote a promised join.

The accept body now also carries `disclosedWillJoinOrganization`, compared
against the resolved outcome before any write, so consent covers the membership
decision and not just the migration. Both accept surfaces send it.

This was widened by the previous commit: keying the membership notice on the
preview made the screen promise a join outcome the token never verified.

In-app accept errors lacked copy. `getInvitationErrorMessage` omitted
`external-requires-paid-plan`, `disclosure-outdated`, and
`workspace-not-found`, so those failures fell through to the generic "may have
expired" fallback. `disclosure-outdated` became newly reachable in-app the moment
that path started sending the token, so the gap arrived with the fix for it.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: icecrasher321

apps/sim/app/api/invitations/[id]/accept/route.ts

@@ -28,6 +28,7 @@ export const POST = withRouteHandler(
       invitationId: id,
       token: parsed.data.body.token ?? null,
       disclosedWorkspaceIds: parsed.data.body.disclosedWorkspaceIds,
+      disclosedWillJoinOrganization: parsed.data.body.disclosedWillJoinOrganization,
       request,
     })
 

apps/sim/app/invite/[id]/invite.tsx

@@ -266,6 +266,7 @@ export default function Invite() {
            * must also conflict if acceptance would sweep anything.
            */
           disclosedWorkspaceIds: joinPreview ? joinPreview.workspaceIdsToMove : undefined,
+          disclosedWillJoinOrganization: joinPreview ? joinPreview.willJoinOrganization : undefined,
         },
       })
 

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/pending-invitations/view-invitations-modal.tsx

@@ -93,6 +93,7 @@ export function ViewInvitationsModal({ open, onOpenChange }: ViewInvitationsModa
       const result = await acceptInvitation.mutateAsync({
         invitationId: inv.id,
         disclosedWorkspaceIds: inv.joinPreview?.workspaceIdsToMove,
+        disclosedWillJoinOrganization: inv.joinPreview?.willJoinOrganization,
       })
       toast.success(`Joined ${invitationLabel(inv)}`)
       onOpenChange(false)

apps/sim/hooks/queries/invitations.ts

@@ -166,13 +166,15 @@ export function useAcceptMyInvitation() {
     mutationFn: async ({
       invitationId,
       disclosedWorkspaceIds,
+      disclosedWillJoinOrganization,
     }: {
       invitationId: string
       disclosedWorkspaceIds?: string[]
+      disclosedWillJoinOrganization?: boolean
     }) =>
       requestJson(acceptInvitationContract, {
         params: { id: invitationId },
-        body: { disclosedWorkspaceIds },
+        body: { disclosedWorkspaceIds, disclosedWillJoinOrganization },
       }),
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: workspaceKeys.lists() })

apps/sim/lib/api/contracts/invitations.ts

@@ -107,6 +107,13 @@ export const invitationActionBodySchema = z.object({
    * set the user saw.
    */
   disclosedWorkspaceIds: z.array(z.string()).max(DISCLOSED_WORKSPACE_ID_LIMIT).optional(),
+  /**
+   * The membership outcome the accept screen disclosed. The workspace-id list
+   * alone cannot express it — a no-join preview and a will-join preview for
+   * someone who owns nothing both disclose `[]` — so consent to becoming a
+   * seat-consuming member is carried explicitly.
+   */
+  disclosedWillJoinOrganization: z.boolean().optional(),
 })
 
 export const invitationDetailsSchema = z.object({

apps/sim/lib/invitations/core.test.ts

@@ -147,6 +147,65 @@ describe('acceptInvitation', () => {
     })
   })
 
+  it('rejects when the disclosed join outcome no longer matches (empty sweep set)', async () => {
+    /**
+     * The workspace-id token cannot express this: the invitee owns nothing, so
+     * both a no-join and a will-join preview disclose []. Without the explicit
+     * membership half of the token, leaving another org between preview and
+     * accept would silently create a seat-consuming membership the screen said
+     * would stay external.
+     */
+    queueWhereResponses([
+      [
+        {
+          id: 'inv-1',
+          kind: 'workspace',
+          email: 'invitee@example.com',
+          organizationId: 'org-1',
+          membershipIntent: 'internal',
+          inviterId: 'inviter-1',
+          role: 'member',
+          status: 'pending',
+          token: 'tok-1',
+          expiresAt: new Date(Date.now() + 60_000),
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ],
+      [
+        {
+          id: 'grant-1',
+          workspaceId: 'workspace-1',
+          permission: 'write',
+          workspaceName: 'Workspace',
+        },
+      ],
+      [{ name: 'Acme' }],
+      [{ name: 'Inviter', email: 'inviter@example.com' }],
+      [],
+      [],
+      [{ variables: {} }],
+    ])
+
+    const result = await acceptInvitation({
+      userId: 'invitee-user',
+      userEmail: 'invitee@example.com',
+      invitationId: 'inv-1',
+      token: 'tok-1',
+      actorName: 'Invitee',
+      // The screen promised "you will not join" — acceptance resolves to a join.
+      disclosedWorkspaceIds: [],
+      disclosedWillJoinOrganization: false,
+      request: new Request('http://localhost/api/invitations/inv-1/accept'),
+    })
+
+    expect(result.success).toBe(false)
+    if (!result.success) {
+      expect(result.kind).toBe('disclosure-outdated')
+    }
+    expect(mockEnsureUserInOrganization).not.toHaveBeenCalled()
+  })
+
   it('accepts a forced-external invitation from a free invitee already in another org', async () => {
     /**
      * Cross-org invitees are stamped external regardless of the inviter's

apps/sim/lib/invitations/core.ts

@@ -396,6 +396,13 @@ export interface AcceptInvitationInput {
    * differs — the user must see the refreshed notice before consenting.
    */
   disclosedWorkspaceIds?: string[]
+  /**
+   * Whether the accept screen told the invitee they would join the
+   * organization. Verified against the resolved outcome so a membership the
+   * user was never shown can never be created, and a membership they were
+   * promised can never be silently downgraded.
+   */
+  disclosedWillJoinOrganization?: boolean
   request?: { headers: { get(name: string): string | null } }
 }
 
@@ -719,6 +726,22 @@ async function acceptLockedInvitation(
     return { success: false, kind: 'external-requires-paid-plan' }
   }
 
+  /**
+   * Membership consent guard. The workspace-id token cannot distinguish "you
+   * will join, and nothing of yours moves" from "you will not join at all" —
+   * both disclose an empty set — so the disclosed join outcome is compared
+   * directly. Catches an invitee who left their other organization between
+   * preview and accept (promised external, would now consume a seat) and the
+   * mirror case (promised membership, would now be external). Runs before any
+   * write, so a plain failure return needs no rollback.
+   */
+  if (
+    input.disclosedWillJoinOrganization !== undefined &&
+    input.disclosedWillJoinOrganization !== shouldJoinOrganization
+  ) {
+    return { success: false, kind: 'disclosure-outdated' }
+  }
+
   /**
    * A member-role organization invite whose grants ALL left the stamped
    * organization can never land its member anywhere — fail before any

apps/sim/lib/invitations/error-messages.ts

@@ -19,6 +19,11 @@ const INVITATION_ERROR_MESSAGES: Record<string, string> = {
     'This organization has reached its seat limit. Ask an admin to add seats, then try again.',
   'upgrade-required':
     'The workspace owner needs an active paid plan before you can join. Ask them to update it, then try again.',
+  'external-requires-paid-plan':
+    'External collaborators need their own paid Sim plan. Upgrade your plan, or ask the organization to re-invite you as a member — that uses one of their seats instead.',
+  'disclosure-outdated':
+    'What accepting does changed since this list loaded. Reopen your invitations to see the updated details, then accept again.',
+  'workspace-not-found': 'The workspace this invitation points at could not be found.',
   'server-error': 'Something went wrong processing the invitation. Please try again.',
 }