fix(webapp): only email newly-created invites, report re-invites accurately

inviteMembers now creates one invite per email and returns ONLY the invites it
actually created (per-email create, P2002 = already invited → skipped), instead
of createMany + a broad findMany that returned pre-existing rows too. Callers
email exactly what they created, so re-inviting an already-pending address no
longer re-sends the invite email (re-sending is the dedicated resend flow). The
management API now reports { invited, alreadyInvited } and returns 201 only when
something was created (200 otherwise), and caps the emails array at 50.

Author: nicktrn

apps/webapp/app/models/member.server.ts

@@ -100,42 +100,44 @@ export async function inviteMembers({
     throw new Error("User does not have access to this organization");
   }
 
-  const invites = [...new Set(emails)].map(
-    (email) =>
-      ({
-        email,
-        token: tokenGenerator(),
-        organizationId: org.id,
-        inviterId: userId,
-        role: "MEMBER",
-        rbacRoleId: rbacRoleId ?? null,
-      }) satisfies Prisma.OrgMemberInviteCreateManyInput
-  );
-
-  // Skip already-invited emails (unique org+email) so re-inviting one address
-  // doesn't P2002 the whole batch.
-  await prisma.orgMemberInvite.createMany({
-    data: invites,
-    skipDuplicates: true,
-  });
+  // Create one invite per unique email and return ONLY the invites actually
+  // created by this call. A P2002 means the email is already invited to this org
+  // (unique org+email) — skip it so one duplicate can't fail the batch, and
+  // don't return it: callers email exactly what they created, and re-sending an
+  // already-pending invite is the dedicated resend flow's job (its own cooldown).
+  const created: Prisma.OrgMemberInviteGetPayload<{
+    include: { organization: true; inviter: true };
+  }>[] = [];
+
+  for (const email of new Set(emails)) {
+    try {
+      const invite = await prisma.orgMemberInvite.create({
+        data: {
+          email,
+          token: tokenGenerator(),
+          organizationId: org.id,
+          inviterId: userId,
+          role: "MEMBER",
+          rbacRoleId: rbacRoleId ?? null,
+        },
+        include: {
+          organization: true,
+          inviter: true,
+        },
+      });
+      created.push(invite);
+    } catch (error) {
+      if (
+        error instanceof PrismaNamespace.PrismaClientKnownRequestError &&
+        error.code === "P2002"
+      ) {
+        continue;
+      }
+      throw error;
+    }
+  }
 
-  // Return the invite for each submitted email scoped to the org, NOT to the
-  // current inviter: with skipDuplicates an email already invited by someone
-  // else is skipped, and filtering by inviterId here would drop it from the
-  // result — leaving the caller with a misleading empty list for an email that
-  // is in fact invited.
-  return await prisma.orgMemberInvite.findMany({
-    where: {
-      organizationId: org.id,
-      email: {
-        in: emails,
-      },
-    },
-    include: {
-      organization: true,
-      inviter: true,
-    },
-  });
+  return created;
 }
 
 export async function getInviteFromToken({ token }: { token: string }) {

apps/webapp/app/routes/api.v1.orgs.$orgParam.invites.ts

@@ -15,7 +15,12 @@ const ParamsSchema = z.object({
 });
 
 const InviteRequestBody = z.object({
-  emails: z.string().email().array().nonempty("At least one email is required"),
+  emails: z
+    .string()
+    .email()
+    .array()
+    .nonempty("At least one email is required")
+    .max(50, "At most 50 emails per request"),
 });
 
 export const action = createActionPATApiRoute(
@@ -52,16 +57,17 @@ export const action = createActionPATApiRoute(
       return json({ error: "Membership is managed by Directory Sync" }, { status: 403 });
     }
 
-    const invites = await inviteMembers({
+    // Returns only the invites created by this call; already-invited emails are
+    // skipped (re-sending is the dashboard's dedicated resend flow, not this).
+    const created = await inviteMembers({
       slug: organization.slug,
       emails: body.emails,
       userId: authentication.userId,
     });
 
-    // Send invite emails the same way the dashboard invite action does. A
-    // failed send must not fail the invite (the row already exists); in local
-    // dev with no SMTP config, scheduleEmail's transport logs instead.
-    for (const invite of invites) {
+    // Email only the newly-created invites. A failed send must not fail the
+    // request (the row exists); locally scheduleEmail's transport just logs.
+    for (const invite of created) {
       try {
         await scheduleEmail({
           email: "invite",
@@ -76,11 +82,20 @@ export const action = createActionPATApiRoute(
       }
     }
 
+    // Report per-email outcome so callers aren't misled by an empty list on
+    // re-invite. 201 when something was created, 200 when everything already
+    // existed.
+    const createdEmails = new Set(created.map((invite) => invite.email));
+    const alreadyInvited = [...new Set(body.emails)].filter(
+      (email) => !createdEmails.has(email)
+    );
+
     return json(
       {
-        invites: invites.map((invite) => ({ id: invite.id, email: invite.email })),
+        invited: created.map((invite) => ({ id: invite.id, email: invite.email })),
+        alreadyInvited,
       },
-      { status: 201 }
+      { status: created.length > 0 ? 201 : 200 }
     );
   }
 );

apps/webapp/test/auth-api.e2e.full.test.ts

@@ -3051,36 +3051,44 @@ describe("API", () => {
     });
   });
 
-  // Invites are idempotent per email: createMany uses skipDuplicates, so
-  // re-inviting an already-invited address returns success rather than a
-  // P2002-driven 500.
+  // Re-invite is idempotent: an already-invited email is skipped (not created,
+  // not re-emailed) and reported as alreadyInvited, so a repeat call neither
+  // 500s (P2002) nor sends a duplicate invite email.
   describe("Member invites — re-invite is idempotent", () => {
-    it("inviting the same email twice does not 500", async () => {
+    it("inviting the same email twice: 201 then 200, second reports alreadyInvited", async () => {
       const server = getTestServer();
       const { organization, pat } = await seedTestUserProject(server.prisma);
       const path = `/api/v1/orgs/${organization.id}/invites`;
+      const email = "dup-invite@example.com";
       const invite = () =>
         server.webapp.fetch(path, {
           method: "POST",
           headers: { Authorization: `Bearer ${pat.token}`, "Content-Type": "application/json" },
-          body: JSON.stringify({ emails: ["dup-invite@example.com"] }),
+          body: JSON.stringify({ emails: [email] }),
         });
 
       const first = await invite();
       expect(first.status).toBe(201);
+      const firstBody = (await first.json()) as { invited: { email: string }[] };
+      expect(firstBody.invited.map((i) => i.email)).toContain(email);
 
       const second = await invite();
-      expect(second.status).toBe(201);
-      expect(second.status).not.toBe(500);
+      expect(second.status).toBe(200);
+      const secondBody = (await second.json()) as {
+        invited: { email: string }[];
+        alreadyInvited: string[];
+      };
+      expect(secondBody.invited).toHaveLength(0);
+      expect(secondBody.alreadyInvited).toContain(email);
     });
 
-    it("re-inviting an email another org member already invited still returns it", async () => {
+    it("re-inviting an email another org member already invited reports alreadyInvited", async () => {
       const server = getTestServer();
       const { organization, pat } = await seedTestUserProject(server.prisma);
 
-      // A different user invited this email first; skipDuplicates will skip the
-      // re-insert, so the response must still surface the existing invite rather
-      // than an empty list scoped to the current caller.
+      // A different user invited this email first: the create hits P2002, so it's
+      // skipped (not re-created, not re-emailed) and surfaced as alreadyInvited
+      // rather than being reported as a fresh invite.
       const otherUser = await server.prisma.user.create({
         data: {
           email: `other_${organization.id}@example.com`,
@@ -3103,9 +3111,13 @@ describe("API", () => {
         headers: { Authorization: `Bearer ${pat.token}`, "Content-Type": "application/json" },
         body: JSON.stringify({ emails: [sharedEmail] }),
       });
-      expect(res.status).toBe(201);
-      const body = (await res.json()) as { invites: { email: string }[] };
-      expect(body.invites.map((i) => i.email)).toContain(sharedEmail);
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as {
+        invited: { email: string }[];
+        alreadyInvited: string[];
+      };
+      expect(body.invited).toHaveLength(0);
+      expect(body.alreadyInvited).toContain(sharedEmail);
     });
   });