fix(invitations): close the two accept-disclosure gaps Bugbot found

Membership notice ignored the join preview. `buildMembershipNotice` keyed off
the invitation's sent `membershipIntent`, but acceptance resolves an internal
invite to external when the invitee already belongs to another organization, or
when the granted workspace changed organizations after the invite went out. The
screen therefore promised "you'll join as a member, which uses one of their
seats" to people who would neither join nor consume a seat. It now keys on the
preview's `willJoinOrganization` — the same signal the migration notice already
used — and falls back to the sent intent only when no preview could be computed.

In-app accept skipped the disclosure entirely. `useAcceptMyInvitation` posted an
empty body, so `disclosedWorkspaceIds` was absent and the server's consent guard
was skipped, and the pending-invitations modal never showed which owned
workspaces would move. Accepting from the workspace switcher (including the
desktop path) could silently sweep personal workspaces into the organization,
bypassing the consent model this PR adds on /invite. The list endpoint now
returns each invitation's join preview, the modal renders the same
membership/migration disclosure as /invite, and accept echoes
`disclosedWorkspaceIds` so the guard applies on both paths.

Both notices moved into lib/invitations/disclosure-copy.ts and are consumed by
/invite and the modal, so the two accept surfaces cannot drift into disclosing
different outcomes for the same invitation — which is how this gap arose.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: icecrasher321

apps/sim/app/api/invitations/route.ts

@@ -1,9 +1,9 @@
 import { createLogger } from '@sim/logger'
 import { NextResponse } from 'next/server'
-import type { InvitationDetails } from '@/lib/api/contracts/invitations'
+import type { MyInvitation } from '@/lib/api/contracts/invitations'
 import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { listPendingInvitationsForEmail } from '@/lib/invitations/core'
+import { getInvitationJoinPreview, listPendingInvitationsForEmail } from '@/lib/invitations/core'
 
 const logger = createLogger('MyInvitationsAPI')
 
@@ -22,9 +22,30 @@ export const GET = withRouteHandler(async () => {
   try {
     const invitations = await listPendingInvitationsForEmail(session.user.email)
 
+    /**
+     * Each row carries what accepting it will actually do, so the in-app list
+     * can disclose the workspace migration and echo `disclosedWorkspaceIds` on
+     * accept — the same consent contract the emailed `/invite` page honours.
+     * Disclosure-only, so a preview failure degrades to `null` (the client
+     * shows a generic notice) rather than hiding the invitation.
+     */
+    const previews = await Promise.all(
+      invitations.map(async (inv) => {
+        try {
+          return await getInvitationJoinPreview(session.user.id, inv)
+        } catch (previewError) {
+          logger.warn('Failed to compute join preview for pending invitation', {
+            invitationId: inv.id,
+            error: previewError,
+          })
+          return null
+        }
+      })
+    )
+
     return NextResponse.json({
       invitations: invitations.map(
-        (inv) =>
+        (inv, index) =>
           ({
             id: inv.id,
             kind: inv.kind,
@@ -43,7 +64,8 @@ export const GET = withRouteHandler(async () => {
               workspaceName: grant.workspaceName,
               permission: grant.permission,
             })),
-          }) satisfies InvitationDetails
+            joinPreview: previews[index],
+          }) satisfies MyInvitation
       ),
     })
   } catch (error) {

apps/sim/app/invite/[id]/invite.tsx

@@ -9,11 +9,13 @@ import { useQueryClient } from '@tanstack/react-query'
 import { useParams, useRouter, useSearchParams } from 'next/navigation'
 import { ApiClientError } from '@/lib/api/client/errors'
 import { requestJson } from '@/lib/api/client/request'
-import {
-  acceptInvitationContract,
-  type InvitationJoinPreview,
-} from '@/lib/api/contracts/invitations'
+import { acceptInvitationContract } from '@/lib/api/contracts/invitations'
 import { client, useSession } from '@/lib/auth/auth-client'
+import {
+  buildMembershipNotice,
+  buildWorkspaceMigrationNotice,
+  MAX_LISTED_WORKSPACE_NAMES,
+} from '@/lib/invitations/disclosure-copy'
 import { InviteLayout, InviteStatusCard } from '@/app/invite/components'
 import { useInvitationDetails } from '@/hooks/queries/invitations'
 import { organizationKeys } from '@/hooks/queries/organization'
@@ -172,53 +174,6 @@ function getInviteError(code: string): InviteError {
   )
 }
 
-const MAX_LISTED_WORKSPACE_NAMES = 3
-
-/**
- * Disclosure appended to the accept copy when accepting moves the invitee's
- * own workspaces into the organization — said where the decision happens, so
- * accepting never silently changes who controls their work.
- */
-function buildWorkspaceMigrationNotice(
-  joinPreview: InvitationJoinPreview | null,
-  organizationLabel: string
-): string {
-  if (!joinPreview?.willJoinOrganization || joinPreview.workspacesToMove.length === 0) {
-    return ''
-  }
-
-  const names = joinPreview.workspacesToMove
-  const nameList = formatQuotedNameList(names, MAX_LISTED_WORKSPACE_NAMES)
-  const single = names.length === 1
-
-  return ` Accepting also moves your ${single ? 'workspace' : 'workspaces'} ${nameList} into ${organizationLabel}: its admins get full access, and ${single ? 'it stays' : 'they stay'} with the organization if you leave.`
-}
-
-/**
- * States what the invitee becomes, so the seat consequence is disclosed to the
- * person it applies to rather than only to the inviter. Said unconditionally
- * for membership invites — the migration notice is empty for an invitee who
- * owns no workspaces, and joining is the larger consequence either way.
- */
-function buildMembershipNotice(
-  membershipIntent: 'internal' | 'external' | undefined,
-  organizationRole: string | undefined,
-  organizationLabel: string,
-  isOrganizationScoped: boolean
-): string {
-  if (!isOrganizationScoped || !membershipIntent) return ''
-
-  if (membershipIntent === 'external') {
-    return ` You'll join as an external collaborator: you get access to the ${
-      organizationLabel === 'the organization' ? 'invited' : `${organizationLabel}`
-    } workspaces only, you don't take one of their seats, and everything you own stays yours.`
-  }
-
-  return ` You'll join ${organizationLabel} as ${
-    organizationRole && isOrgAdminRole(organizationRole) ? 'an admin' : 'a member'
-  }, which uses one of their seats.`
-}
-
 function codeFromStatus(status: number): InviteErrorCode {
   if (status === 401) return 'unauthorized'
   if (status === 403) return 'forbidden'
@@ -547,20 +502,23 @@ export default function Invite() {
    * migration notice for membership invites — a missing preview must never
    * read as "nothing moves".
    */
-  const migrationNotice =
-    joinPreviewUnavailable && invitation?.membershipIntent !== 'external'
-      ? ` If you own personal workspaces, accepting membership moves them into ${organizationLabel}: its admins get full access, and they stay with the organization if you leave.`
-      : buildWorkspaceMigrationNotice(joinPreview, organizationLabel)
+  const migrationNotice = buildWorkspaceMigrationNotice({
+    joinPreview,
+    joinPreviewUnavailable,
+    membershipIntent: invitation?.membershipIntent,
+    organizationLabel,
+  })
   /**
    * Only disclosed when the invitation actually carries organization standing —
    * a personal-workspace invite has no seat or membership to explain.
    */
-  const membershipNotice = buildMembershipNotice(
-    invitation?.membershipIntent,
-    invitation?.role,
+  const membershipNotice = buildMembershipNotice({
+    joinPreview,
+    membershipIntent: invitation?.membershipIntent,
+    isOrganizationAdminRole: Boolean(invitation?.role && isOrgAdminRole(invitation.role)),
     organizationLabel,
-    Boolean(invitation?.organizationId || joinPreview?.organizationName)
-  )
+    isOrganizationScoped: Boolean(invitation?.organizationId || joinPreview?.organizationName),
+  })
 
   return (
     <InviteLayout>

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/pending-invitations/view-invitations-modal.tsx

@@ -2,9 +2,14 @@
 
 import { Chip, ChipModal, ChipModalBody, ChipModalFooter, ChipModalHeader, toast } from '@sim/emcn'
 import { createLogger } from '@sim/logger'
+import { isOrgAdminRole } from '@sim/platform-authz/workspace'
 import { getErrorMessage } from '@sim/utils/errors'
 import { useRouter } from 'next/navigation'
-import type { InvitationDetails } from '@/lib/api/contracts/invitations'
+import type { MyInvitation } from '@/lib/api/contracts/invitations'
+import {
+  buildMembershipNotice,
+  buildWorkspaceMigrationNotice,
+} from '@/lib/invitations/disclosure-copy'
 import { getInvitationErrorMessage } from '@/lib/invitations/error-messages'
 import {
   useAcceptMyInvitation,
@@ -19,7 +24,7 @@ const logger = createLogger('ViewInvitationsModal')
  * invites are labeled by the org (even when workspace grants ride along);
  * workspace invites by their workspace(s).
  */
-function invitationLabel(inv: InvitationDetails): string {
+function invitationLabel(inv: MyInvitation): string {
   if (inv.kind === 'organization') {
     return inv.organizationName ?? 'Organization'
   }
@@ -32,12 +37,37 @@ function invitationLabel(inv: InvitationDetails): string {
 }
 
 /** Secondary line: who invited, plus role (org) or permission (workspace). */
-function invitationSubLabel(inv: InvitationDetails): string {
+function invitationSubLabel(inv: MyInvitation): string {
   const invitedBy = inv.inviterName ? `Invited by ${inv.inviterName}` : 'Invited'
   const detail = inv.kind === 'organization' ? inv.role : inv.grants[0]?.permission
   return detail ? `${invitedBy} · ${detail}` : invitedBy
 }
 
+/**
+ * What accepting will do to the invitee's own account: the seat/membership
+ * consequence and any workspaces that will move into the organization. Built
+ * from the same copy as the emailed `/invite` page so the two accept surfaces
+ * can never disclose different outcomes.
+ */
+function invitationDisclosure(inv: MyInvitation): string {
+  const organizationLabel =
+    inv.joinPreview?.organizationName ?? inv.organizationName ?? 'the organization'
+  const membership = buildMembershipNotice({
+    joinPreview: inv.joinPreview,
+    membershipIntent: inv.membershipIntent,
+    isOrganizationAdminRole: isOrgAdminRole(inv.role),
+    organizationLabel,
+    isOrganizationScoped: Boolean(inv.organizationId || inv.joinPreview?.organizationName),
+  })
+  const migration = buildWorkspaceMigrationNotice({
+    joinPreview: inv.joinPreview,
+    joinPreviewUnavailable: inv.joinPreview === null,
+    membershipIntent: inv.membershipIntent,
+    organizationLabel,
+  })
+  return `${membership}${migration}`.trim()
+}
+
 interface ViewInvitationsModalProps {
   open: boolean
   onOpenChange: (open: boolean) => void
@@ -58,9 +88,12 @@ export function ViewInvitationsModal({ open, onOpenChange }: ViewInvitationsModa
 
   const isBusy = acceptInvitation.isPending || declineInvitation.isPending
 
-  const handleAccept = async (inv: InvitationDetails) => {
+  const handleAccept = async (inv: MyInvitation) => {
     try {
-      const result = await acceptInvitation.mutateAsync({ invitationId: inv.id })
+      const result = await acceptInvitation.mutateAsync({
+        invitationId: inv.id,
+        disclosedWorkspaceIds: inv.joinPreview?.workspaceIdsToMove,
+      })
       toast.success(`Joined ${invitationLabel(inv)}`)
       onOpenChange(false)
       router.push(result.redirectPath)
@@ -75,7 +108,7 @@ export function ViewInvitationsModal({ open, onOpenChange }: ViewInvitationsModa
     }
   }
 
-  const handleDecline = async (inv: InvitationDetails) => {
+  const handleDecline = async (inv: MyInvitation) => {
     try {
       await declineInvitation.mutateAsync({ invitationId: inv.id })
     } catch (error) {
@@ -93,32 +126,38 @@ export function ViewInvitationsModal({ open, onOpenChange }: ViewInvitationsModa
         {!invitations || invitations.length === 0 ? (
           <p className='px-2 text-[var(--text-muted)] text-sm'>No pending invitations.</p>
         ) : (
-          invitations.map((inv) => (
-            <div key={inv.id} className='flex items-center gap-2 px-2'>
-              <div className='min-w-0 flex-1'>
-                <p className='truncate text-[var(--text-body)] text-sm'>{invitationLabel(inv)}</p>
-                <p className='truncate text-[var(--text-muted)] text-caption'>
-                  {invitationSubLabel(inv)}
-                </p>
+          invitations.map((inv) => {
+            const disclosure = invitationDisclosure(inv)
+            return (
+              <div key={inv.id} className='flex items-start gap-2 px-2'>
+                <div className='min-w-0 flex-1'>
+                  <p className='truncate text-[var(--text-body)] text-sm'>{invitationLabel(inv)}</p>
+                  <p className='truncate text-[var(--text-muted)] text-caption'>
+                    {invitationSubLabel(inv)}
+                  </p>
+                  {disclosure ? (
+                    <p className='mt-1 text-[var(--text-muted)] text-caption'>{disclosure}</p>
+                  ) : null}
+                </div>
+                <Chip
+                  variant='primary'
+                  disabled={isBusy}
+                  onClick={() => void handleAccept(inv)}
+                  className='flex-shrink-0'
+                >
+                  Accept
+                </Chip>
+                <Chip
+                  disabled={isBusy}
+                  onClick={() => void handleDecline(inv)}
+                  aria-label={`Decline invitation to ${invitationLabel(inv)}`}
+                  className='flex-shrink-0'
+                >
+                  Decline
+                </Chip>
               </div>
-              <Chip
-                variant='primary'
-                disabled={isBusy}
-                onClick={() => void handleAccept(inv)}
-                className='flex-shrink-0'
-              >
-                Accept
-              </Chip>
-              <Chip
-                disabled={isBusy}
-                onClick={() => void handleDecline(inv)}
-                aria-label={`Decline invitation to ${invitationLabel(inv)}`}
-                className='flex-shrink-0'
-              >
-                Decline
-              </Chip>
-            </div>
-          ))
+            )
+          })
         )}
       </ChipModalBody>
       <ChipModalFooter

apps/sim/hooks/queries/invitations.ts

@@ -7,9 +7,9 @@ import {
   batchWorkspaceInvitationsContract,
   cancelInvitationContract,
   getInvitationContract,
-  type InvitationDetails,
   listMyInvitationsContract,
   listWorkspaceInvitationsContract,
+  type MyInvitation,
   type PendingInvitationRow,
   rejectInvitationContract,
   removeWorkspaceMemberContract,
@@ -121,7 +121,7 @@ export function usePendingInvitations(workspaceId: string | undefined) {
 
 export const MY_INVITATIONS_STALE_TIME = 30 * 1000
 
-async function fetchMyPendingInvitations(signal?: AbortSignal): Promise<InvitationDetails[]> {
+async function fetchMyPendingInvitations(signal?: AbortSignal): Promise<MyInvitation[]> {
   const data = await requestJson(listMyInvitationsContract, { signal })
   return data.invitations
 }
@@ -157,8 +157,23 @@ export function useAcceptMyInvitation() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ invitationId }: { invitationId: string }) =>
-      requestJson(acceptInvitationContract, { params: { id: invitationId }, body: {} }),
+    /**
+     * `disclosedWorkspaceIds` echoes the migration the caller actually showed the
+     * invitee, so acceptance rejects if the sweep set changed since. Omitting it
+     * would silently skip that guard — the in-app path must supply it for the
+     * same reason the emailed `/invite` page does.
+     */
+    mutationFn: async ({
+      invitationId,
+      disclosedWorkspaceIds,
+    }: {
+      invitationId: string
+      disclosedWorkspaceIds?: string[]
+    }) =>
+      requestJson(acceptInvitationContract, {
+        params: { id: invitationId },
+        body: { disclosedWorkspaceIds },
+      }),
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: workspaceKeys.lists() })
       queryClient.invalidateQueries({ queryKey: organizationKeys.all })

apps/sim/lib/api/contracts/invitations.ts

@@ -217,13 +217,27 @@ export const getInvitationContract = defineRouteContract({
   },
 })
 
+/**
+ * A pending invitation plus what accepting it will actually do. The preview
+ * rides along so the in-app list can disclose the workspace migration and echo
+ * `disclosedWorkspaceIds` on accept, exactly like the emailed `/invite` page —
+ * an accept surface without it would sweep workspaces without consent. `null`
+ * when the preview could not be computed; the client then shows the generic
+ * notice rather than treating it as "nothing moves".
+ */
+export const myInvitationSchema = invitationDetailsSchema.extend({
+  joinPreview: invitationJoinPreviewSchema.nullable(),
+})
+
+export type MyInvitation = z.output<typeof myInvitationSchema>
+
 export const listMyInvitationsContract = defineRouteContract({
   method: 'GET',
   path: '/api/invitations',
   response: {
     mode: 'json',
     schema: z.object({
-      invitations: z.array(invitationDetailsSchema),
+      invitations: z.array(myInvitationSchema),
     }),
   },
 })