From d634c3d6bdd58b0cd802630b65830654031cb703 Mon Sep 17 00:00:00 2001
From: Brian O'Kelley <bokelley@scope3.com>
Date: Sun, 26 Apr 2026 10:53:48 -0400
Subject: [PATCH 1/3] feat(team): self-serve member admin UI + admins can
 change roles
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes the self-service gap left after #3235. The team page now does the
full add/promote/invite flow without anyone filing an escalation, and
org admins can manage member ↔ admin roles directly.

Backend:
- POST /api/organizations/:orgId/members/by-email accepts optional
  seat_type and persists it via invitation_seat_types for Path 1 (invite)
  and Path 2 (direct add). Path 2 clears any stale (org, email) staging
  row before writing, so a prior failed attempt can't leak seat_type to
  a later invite. Path 3 (role update) blocks self-role-change to mirror
  the existing PATCH endpoint.
- PATCH /:orgId/members/:membershipId and /members/by-email Path 3 allow
  admins to change member ↔ admin. Admins cannot assign owner or change
  an existing owner's role; owners and AAO super-admins are unrestricted.
- PATCH /:orgId/settings restricts auto_provision_verified_domain to
  owners (and AAO super-admins) — turning it on widens org membership in
  a way admins shouldn't be able to do unilaterally given the new
  role-cap policy.
- GET /:orgId/domains returns auto_provision_verified_domain alongside
  the domain list so the toggle UI renders state in one round trip.

UI (server/public/team.html):
- Replaces "+ Invite Member" with "+ Add member"; the modal calls the
  unified by-email endpoint instead of /invitations.
- Adds an auto-provision toggle inside the Verified Domains card,
  visible only to owners and only when at least one domain is verified.

Tests: server/tests/integration/member-by-email-policy.test.ts (16 tests)
covers role-cap branches, self-role-change blocking, seat_type
propagation, and the owner-only toggle.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .changeset/team-self-serve-member-admin.md    |  17 +
 server/public/team.html                       |  95 +++-
 server/src/routes/organizations.ts            | 180 ++++++-
 .../member-by-email-policy.test.ts            | 460 ++++++++++++++++++
 4 files changed, 720 insertions(+), 32 deletions(-)
 create mode 100644 .changeset/team-self-serve-member-admin.md
 create mode 100644 server/tests/integration/member-by-email-policy.test.ts

diff --git a/.changeset/team-self-serve-member-admin.md b/.changeset/team-self-serve-member-admin.md
new file mode 100644
index 0000000000..4e394df093
--- /dev/null
+++ b/.changeset/team-self-serve-member-admin.md
@@ -0,0 +1,17 @@
+---
+---
+
+feat(team): self-serve member admin in team.html, admins can change roles
+
+Closes the self-service gap left after #3235 — an org owner can now do everything from the team UI without filing an escalation.
+
+## What changed
+
+- **Team UI consolidates "invite" and "promote" into one "Add member" flow** (`server/public/team.html`). The modal posts to the unified `POST /api/organizations/:orgId/members/by-email` endpoint that walks the four-state machine (invite / create / update / no-op). The same modal handles adding a new teammate and promoting an existing member.
+- **Auto-provision toggle in the Verified Domains card** — owners can flip `auto_provision_verified_domain` per org via the existing `PATCH /api/organizations/:orgId/settings`. Hidden when no verified domain exists. Owner-only (admins shouldn't be able to widen org membership unilaterally, especially now that admins can promote auto-joined members to admin).
+- **Admins can change member roles** — `PATCH /api/organizations/:orgId/members/:membershipId` and Path 3 of `/members/by-email` now allow org admins to promote `member ↔ admin`. Caps in place: admins can't assign `owner`, can't change a current owner's role, and (matching the existing PATCH endpoint) no caller of either endpoint can change their own role. Owners and AAO super-admins are unrestricted.
+- **`/members/by-email` accepts `seat_type`** — the unified endpoint is now a true superset of `/invitations`. seat_type is staged via `invitation_seat_types` for both Path 1 (invite) and Path 2 (direct add) so the `organization_membership.created` webhook hands the right seat_type to the local cache. Path 2 clears any stale staging rows for the same `(org, email)` pair before staging, so a prior failed direct-add can't pollute a later invite.
+
+## Tests
+
+- New `server/tests/integration/member-by-email-policy.test.ts` (16 tests) covers all role-cap branches, self-role-change blocking on both endpoints, seat_type propagation, and the owner-only auto-provision toggle.
diff --git a/server/public/team.html b/server/public/team.html
index 4698ed3276..2ee1d9de1f 100644
--- a/server/public/team.html
+++ b/server/public/team.html
@@ -270,16 +270,16 @@
   <script src="/nav.js"></script>
   <script src="/dashboard-nav.js"></script>
 
-  <!-- Invite Modal -->
+  <!-- Add Member Modal -->
   <div id="inviteModal" class="modal-overlay">
     <div class="modal">
-      <h2>Invite Team Member</h2>
+      <h2>Add team member</h2>
       <div id="inviteError" class="error-message" style="display: none;"></div>
       <form id="inviteForm">
         <div class="form-group">
-          <label for="inviteEmail">Email Address</label>
+          <label for="inviteEmail">Email address</label>
           <input type="email" id="inviteEmail" placeholder="colleague@company.com" required>
-          <p class="form-help">An invitation email will be sent to this address</p>
+          <p class="form-help">If they already have an account, they're added directly. If not, an invitation is sent. If they're already a member, their role is updated.</p>
         </div>
         <div class="form-group">
           <label for="inviteRole">Role</label>
@@ -298,7 +298,7 @@ <h2>Invite Team Member</h2>
         </div>
         <div class="modal-buttons">
           <button type="button" class="btn btn-secondary" onclick="closeInviteModal()">Cancel</button>
-          <button type="submit" class="btn btn-primary">Send Invitation</button>
+          <button type="submit" class="btn btn-primary">Add member</button>
         </div>
       </form>
     </div>
@@ -386,7 +386,7 @@ <h1>Team Management</h1>
       <div class="card">
         <h2>
           <span>Team Members</span>
-          <button id="inviteBtn" class="btn btn-primary" onclick="openInviteModal()">+ Invite Member</button>
+          <button id="inviteBtn" class="btn btn-primary" onclick="openInviteModal()">+ Add member</button>
         </h2>
 
         <div id="seatUsageSummary" style="display: none; margin-bottom: var(--space-4);"></div>
@@ -476,6 +476,18 @@ <h2>Verified Domains</h2>
         <div id="domainsContent">
           <div style="text-align: center; padding: 20px; color: var(--color-text-secondary);">Loading domains...</div>
         </div>
+        <div id="autoProvisionRow" style="display: none; margin-top: var(--space-4); padding-top: var(--space-4); border-top: var(--border-1) solid var(--color-gray-100);">
+          <label style="display: flex; align-items: flex-start; gap: var(--space-3); cursor: pointer;">
+            <input type="checkbox" id="autoProvisionToggle" style="margin-top: 4px;">
+            <span>
+              <strong style="display: block; color: var(--color-text-heading); margin-bottom: var(--space-1);">Auto-add verified-domain employees</strong>
+              <span style="color: var(--color-text-secondary); font-size: var(--text-sm);">
+                When on (default), anyone who signs in with an email at one of your verified domains is automatically added as a member. Turn off to require explicit invites only.
+              </span>
+            </span>
+          </label>
+          <div id="autoProvisionStatus" style="display: none; margin-top: var(--space-2); font-size: var(--text-sm);"></div>
+        </div>
         <div style="margin-top: 16px;">
           <button class="btn btn-secondary" onclick="openDomainVerification()">Manage Domains</button>
         </div>
@@ -985,7 +997,10 @@ <h2>
       const seat_type = document.getElementById('inviteSeatType').value;
 
       try {
-        const response = await fetch(`/api/organizations/${currentOrg}/invitations`, {
+        // Unified state-machine endpoint: invites if the user has no account,
+        // creates a membership if they have an account but aren't in the org,
+        // updates their role if they're already a member.
+        const response = await fetch(`/api/organizations/${currentOrg}/members/by-email`, {
           method: 'POST',
           headers: { 'Content-Type': 'application/json' },
           body: JSON.stringify({ email, role, seat_type }),
@@ -994,7 +1009,7 @@ <h2>
         const data = await response.json();
 
         if (!response.ok) {
-          document.getElementById('inviteError').textContent = data.message || 'Failed to send invitation';
+          document.getElementById('inviteError').textContent = data.message || 'Failed to add member';
           document.getElementById('inviteError').style.display = 'block';
           return;
         }
@@ -1002,8 +1017,8 @@ <h2>
         closeInviteModal();
         loadTeamMembers();
       } catch (error) {
-        console.error('Error sending invitation:', error);
-        document.getElementById('inviteError').textContent = 'Failed to send invitation. Please try again.';
+        console.error('Error adding member:', error);
+        document.getElementById('inviteError').textContent = 'Failed to add member. Please try again.';
         document.getElementById('inviteError').style.display = 'block';
       }
     });
@@ -1224,6 +1239,11 @@ <h2>
             </p>
           `;
         }
+
+        // Render the auto-provision toggle whenever there is at least one
+        // verified domain. With no verified domain the toggle is a no-op
+        // (autoLinkByVerifiedDomain has nothing to match), so we hide it.
+        renderAutoProvisionToggle(orgId, data);
       } catch (error) {
         console.error('Error loading domains:', error);
         domainsContent.innerHTML = `
@@ -1234,6 +1254,61 @@ <h2>
       }
     }
 
+    function renderAutoProvisionToggle(orgId, data) {
+      const row = document.getElementById('autoProvisionRow');
+      const toggle = document.getElementById('autoProvisionToggle');
+      const status = document.getElementById('autoProvisionStatus');
+      const hasVerified = (data.domains || []).some(d => d.verified);
+      // Owner-only: turning auto-provision on widens org membership in a way
+      // an admin shouldn't be able to do unilaterally (admins can promote
+      // auto-joined members to admin under the new role-cap policy). The
+      // backend enforces the same restriction; the UI mirrors it.
+      const isOwner = currentUserRole === 'owner';
+
+      if (!hasVerified || !isOwner) {
+        row.style.display = 'none';
+        return;
+      }
+
+      row.style.display = 'block';
+      toggle.checked = data.auto_provision_verified_domain !== false;
+      status.style.display = 'none';
+      status.textContent = '';
+
+      // Replace any prior listener by cloning the node
+      const fresh = toggle.cloneNode(true);
+      toggle.parentNode.replaceChild(fresh, toggle);
+      fresh.addEventListener('change', async (e) => {
+        const desired = e.target.checked;
+        e.target.disabled = true;
+        try {
+          const response = await fetch(`/api/organizations/${orgId}/settings`, {
+            method: 'PATCH',
+            headers: { 'Content-Type': 'application/json' },
+            credentials: 'include',
+            body: JSON.stringify({ auto_provision_verified_domain: desired }),
+          });
+          if (!response.ok) {
+            const errBody = await response.json().catch(() => ({}));
+            throw new Error(errBody.message || 'Failed to update setting');
+          }
+          status.style.display = 'block';
+          status.style.color = 'var(--color-success-700)';
+          status.textContent = desired
+            ? 'Auto-add is on. Verified-domain sign-ins will join automatically.'
+            : 'Auto-add is off. Members must be invited explicitly.';
+        } catch (err) {
+          console.error('Error updating auto_provision_verified_domain:', err);
+          e.target.checked = !desired;
+          status.style.display = 'block';
+          status.style.color = 'var(--color-danger-700)';
+          status.textContent = 'Could not update — please try again.';
+        } finally {
+          e.target.disabled = false;
+        }
+      });
+    }
+
     // Store domain users for batch add
     let domainUsersList = [];
 
diff --git a/server/src/routes/organizations.ts b/server/src/routes/organizations.ts
index 509d727555..b6acd21f2c 100644
--- a/server/src/routes/organizations.ts
+++ b/server/src/routes/organizations.ts
@@ -570,22 +570,31 @@ export function createOrganizationsRouter(): Router {
         });
       }
 
-      // Get domains from database
+      // Get domains and the auto-provision setting in a single round trip.
+      // Surfacing the setting here means the team UI can render the toggle
+      // alongside the verified-domain list without a second request.
       const pool = getPool();
-      const result = await pool.query(
-        `SELECT domain, verified, is_primary
-         FROM organization_domains
-         WHERE workos_organization_id = $1
-         ORDER BY is_primary DESC, domain ASC`,
-        [orgId]
-      );
+      const [domainsResult, settingResult] = await Promise.all([
+        pool.query(
+          `SELECT domain, verified, is_primary
+           FROM organization_domains
+           WHERE workos_organization_id = $1
+           ORDER BY is_primary DESC, domain ASC`,
+          [orgId]
+        ),
+        pool.query<{ auto_provision_verified_domain: boolean }>(
+          `SELECT auto_provision_verified_domain FROM organizations WHERE workos_organization_id = $1`,
+          [orgId]
+        ),
+      ]);
 
       res.json({
-        domains: result.rows.map(r => ({
+        domains: domainsResult.rows.map(r => ({
           domain: r.domain,
           verified: r.verified,
           is_primary: r.is_primary,
         })),
+        auto_provision_verified_domain: settingResult.rows[0]?.auto_provision_verified_domain ?? true,
       });
     } catch (error) {
       logger.error({ err: error }, 'Get org domains error:');
@@ -1639,6 +1648,20 @@ export function createOrganizationsRouter(): Router {
         });
       }
 
+      // auto_provision_verified_domain is a privilege grant — turning it on
+      // means any verified-domain email auto-joins as a member, which an admin
+      // could then promote to admin. Restrict to owner-only to keep admins
+      // from quietly widening org membership without owner consent.
+      if (auto_provision_verified_domain !== undefined && userRole !== 'owner') {
+        const isAAOAdmin = await isWebUserAAOAdmin(user.id);
+        if (!isAAOAdmin) {
+          return res.status(403).json({
+            error: 'Insufficient permissions',
+            message: 'Only owners can change the auto-provision setting',
+          });
+        }
+      }
+
       // Build updates object with properly typed values
       const updates: {
         company_type?: CompanyType | null;
@@ -2627,6 +2650,7 @@ export function createOrganizationsRouter(): Router {
     const body = (req.body ?? {}) as Record<string, unknown>;
     const email = body.email;
     const requestedRole = body.role ?? 'member';
+    const requestedSeatType = body.seat_type;
 
     if (typeof email !== 'string') {
       return res.status(400).json({ error: 'Missing required field', message: 'email is required' });
@@ -2645,6 +2669,20 @@ export function createOrganizationsRouter(): Router {
     }
     const role = requestedRole as 'owner' | 'admin' | 'member';
 
+    // seat_type is optional. When omitted, inherit the existing /invitations
+    // default of 'community_only' so callers don't accidentally consume a
+    // contributor seat without asking for one.
+    let seatType: 'contributor' | 'community_only' = 'community_only';
+    if (requestedSeatType !== undefined) {
+      if (requestedSeatType !== 'contributor' && requestedSeatType !== 'community_only') {
+        return res.status(400).json({
+          error: 'Invalid seat type',
+          message: 'seat_type must be one of: contributor, community_only',
+        });
+      }
+      seatType = requestedSeatType;
+    }
+
     const normalizedEmail = email.trim().toLowerCase();
 
     try {
@@ -2701,7 +2739,7 @@ export function createOrganizationsRouter(): Router {
       // acceptance — same discipline as routes/invites.ts uses on the AAO-internal
       // accept flow.
       if (!workosUser) {
-        const seatCheck = await canAddSeat(orgId, 'community_only');
+        const seatCheck = await canAddSeat(orgId, seatType);
         if (!seatCheck.allowed) {
           return res.status(403).json({ error: 'Seat limit reached', message: seatCheck.reason });
         }
@@ -2713,6 +2751,15 @@ export function createOrganizationsRouter(): Router {
           roleSlug: 'member',
         });
 
+        // Persist seat_type intent so the webhook handler picks it up when the
+        // invitee accepts (mirrors the existing /invitations endpoint).
+        await query(
+          `INSERT INTO invitation_seat_types (workos_invitation_id, workos_organization_id, email, seat_type)
+           VALUES ($1, $2, $3, $4)
+           ON CONFLICT (workos_invitation_id) DO UPDATE SET seat_type = EXCLUDED.seat_type`,
+          [invitation.id, orgId, normalizedEmail, seatType],
+        );
+
         await orgDb.recordAuditLog({
           workos_organization_id: orgId,
           workos_user_id: user.id,
@@ -2723,13 +2770,14 @@ export function createOrganizationsRouter(): Router {
             email: normalizedEmail,
             requested_role: role,
             invited_role: 'member',
+            seat_type: seatType,
             inviter_email: user.email,
             via: 'by_email',
           },
         });
 
         logger.info(
-          { orgId, email: normalizedEmail, requestedRole: role, inviterId: user.id },
+          { orgId, email: normalizedEmail, requestedRole: role, seatType, inviterId: user.id },
           'Invited member by email (no WorkOS account yet)',
         );
 
@@ -2742,10 +2790,13 @@ export function createOrganizationsRouter(): Router {
           message: `Invitation sent to ${normalizedEmail} as member.${promoteHint}`,
           invited_role: 'member',
           requested_role: role,
+          seat_type: seatType,
           invitation: {
             id: invitation.id,
             email: invitation.email,
             state: invitation.state,
+            expires_at: invitation.expiresAt,
+            accept_invitation_url: invitation.acceptInvitationUrl,
           },
         });
       }
@@ -2765,11 +2816,31 @@ export function createOrganizationsRouter(): Router {
 
       // Path 2: user exists but is not yet a member — create membership
       if (existingRow.rows.length === 0) {
-        const seatCheck = await canAddSeat(orgId, 'community_only');
+        const seatCheck = await canAddSeat(orgId, seatType);
         if (!seatCheck.allowed) {
           return res.status(403).json({ error: 'Seat limit reached', message: seatCheck.reason });
         }
 
+        // Stage seat_type for the membership.created webhook handler to consume.
+        //
+        // consumeInvitationSeatType matches by (organization_id, lower(email)),
+        // ignoring workos_invitation_id, so any prior stale row for this
+        // (org, email) pair would also be consumed by the next webhook. Clear
+        // those first so the seat_type the webhook reads is the one this caller
+        // requested, not a leftover from a previous failed attempt or a
+        // separate invitation that wasn't consumed yet.
+        await query(
+          'DELETE FROM invitation_seat_types WHERE workos_organization_id = $1 AND lower(email) = lower($2)',
+          [orgId, normalizedEmail],
+        );
+        const stagingKey = `direct_${orgId}_${targetUserId}`;
+        await query(
+          `INSERT INTO invitation_seat_types (workos_invitation_id, workos_organization_id, email, seat_type)
+           VALUES ($1, $2, $3, $4)
+           ON CONFLICT (workos_invitation_id) DO UPDATE SET seat_type = EXCLUDED.seat_type`,
+          [stagingKey, orgId, normalizedEmail, seatType],
+        );
+
         let membership;
         try {
           membership = await workos!.userManagement.createOrganizationMembership({
@@ -2778,6 +2849,21 @@ export function createOrganizationsRouter(): Router {
             roleSlug: role,
           });
         } catch (createErr) {
+          // Roll back the seat_type stage row on failure. If the rollback DELETE
+          // itself fails (DB blip), log loudly so an operator can clean it up —
+          // but don't swallow silently, since a stale row would be consumed by
+          // the next /invitations webhook for the same (org, email) pair.
+          try {
+            await query(
+              'DELETE FROM invitation_seat_types WHERE workos_invitation_id = $1',
+              [stagingKey],
+            );
+          } catch (rollbackErr) {
+            logger.error(
+              { err: rollbackErr, orgId, email: normalizedEmail, stagingKey },
+              'CRITICAL: failed to rollback invitation_seat_types staging row after createOrganizationMembership failure — manually delete row to avoid seat_type leak',
+            );
+          }
           const code = (createErr as { code?: string }).code;
           if (code === 'organization_membership_already_exists') {
             return res.status(409).json({
@@ -2798,13 +2884,14 @@ export function createOrganizationsRouter(): Router {
             target_user_id: targetUserId,
             target_email: normalizedEmail,
             role,
+            seat_type: seatType,
             actor_email: user.email,
             via: 'by_email',
           },
         });
 
         logger.info(
-          { orgId, targetUserId, email: normalizedEmail, role, actorId: user.id },
+          { orgId, targetUserId, email: normalizedEmail, role, seatType, actorId: user.id },
           'Added member by email',
         );
 
@@ -2814,10 +2901,26 @@ export function createOrganizationsRouter(): Router {
           message: `Added ${normalizedEmail} to the organization as ${role}.`,
           user_id: targetUserId,
           role,
+          seat_type: seatType,
         });
       }
 
       // Path 3: user is already a member — update role if it differs.
+      //
+      // Self-role-change is blocked here even when the caller is the owner.
+      // Without this guard, an owner who hits this endpoint with their own
+      // email could demote themselves to member, leaving the org without an
+      // owner. PATCH /:orgId/members/:membershipId enforces the same rule;
+      // mirroring it here closes the parallel path. AAO super-admins are
+      // permitted to act on themselves only when they're not also an org
+      // member of this org (handled by the org-member check above).
+      if (targetUserId === user.id) {
+        return res.status(400).json({
+          error: 'Cannot change own role',
+          message: 'You cannot change your own role',
+        });
+      }
+
       // Treat NULL local role the same as 'member' for comparison, but log the
       // raw value in the audit row so a NULL doesn't get silently rewritten as
       // 'member' in the trail.
@@ -2833,13 +2936,26 @@ export function createOrganizationsRouter(): Router {
         });
       }
 
-      // Role-update authorization: only owner or AAO super-admin (matches the
-      // existing PATCH /:orgId/members/:membershipId endpoint policy).
+      // Role-change authorization (parallel to PATCH /:orgId/members/:membershipId):
+      //   - Owner / AAO super-admin: can change any role to any role
+      //   - Org admin: can change member ↔ admin only; cannot promote anyone
+      //     to owner, and cannot change a current owner's role
+      //   - Anyone else: blocked
+      const targetIsOwner = effectiveCurrentRole === 'owner';
       if (!isAAOAdmin && !isOrgOwner) {
-        return res.status(403).json({
-          error: 'Insufficient permissions',
-          message: "Only owners can change existing members' roles",
-        });
+        if (!isOrgAdminOrOwner) {
+          return res.status(403).json({
+            error: 'Insufficient permissions',
+            message: 'Only owners and admins can change member roles',
+          });
+        }
+        if (targetIsOwner) {
+          return res.status(403).json({
+            error: 'Insufficient permissions',
+            message: 'Only owners can change another owner\'s role',
+          });
+        }
+        // role === 'owner' is already blocked earlier (line ~2691) for non-owner non-AAO callers
       }
 
       // Resolve membership ID (backfill from WorkOS if local cache is missing it)
@@ -2969,12 +3085,13 @@ export function createOrganizationsRouter(): Router {
         });
       }
 
-      // Check user's role - only owners can change roles, admins can change seat types
+      // Check caller's role first. Detailed role-change caps for admins are
+      // applied below once we have the target membership in hand.
       const userRole = resolveUserRole(userMemberships.data);
-      if (role && userRole !== 'owner') {
+      if (role && userRole !== 'owner' && userRole !== 'admin') {
         return res.status(403).json({
           error: 'Insufficient permissions',
-          message: 'Only owners can change member roles',
+          message: 'Only owners and admins can change member roles',
         });
       }
       if (seat_type && userRole !== 'owner' && userRole !== 'admin') {
@@ -3001,6 +3118,25 @@ export function createOrganizationsRouter(): Router {
         });
       }
 
+      // Admin role-change caps: an org admin (non-owner) cannot promote anyone
+      // to owner, and cannot change the role of an existing owner. Owners and
+      // AAO super-admins are unrestricted.
+      if (role && userRole === 'admin') {
+        if (role === 'owner') {
+          return res.status(403).json({
+            error: 'Insufficient permissions',
+            message: 'Only owners can assign the owner role',
+          });
+        }
+        const targetCurrentRole = membership.role?.slug || 'member';
+        if (targetCurrentRole === 'owner') {
+          return res.status(403).json({
+            error: 'Insufficient permissions',
+            message: "Only owners can change another owner's role",
+          });
+        }
+      }
+
       // If upgrading to contributor, enforce seat limits
       if (seat_type === 'contributor') {
         const currentSeatType = await getUserSeatType(membership.userId);
diff --git a/server/tests/integration/member-by-email-policy.test.ts b/server/tests/integration/member-by-email-policy.test.ts
new file mode 100644
index 0000000000..20774e15bb
--- /dev/null
+++ b/server/tests/integration/member-by-email-policy.test.ts
@@ -0,0 +1,460 @@
+/**
+ * Role-cap policy tests for the unified member management endpoints.
+ *
+ * Covers the rules introduced when admins were given the ability to change
+ * other members' roles:
+ *   - Admins can promote member ↔ admin
+ *   - Admins cannot assign owner
+ *   - Admins cannot change a current owner's role
+ *   - Owners are unrestricted
+ *
+ * Both POST /members/by-email (Path 3) and PATCH /members/:membershipId
+ * share the same caps; tests cover both endpoints because they enforce the
+ * caps independently and a regression in one would not surface in the other.
+ */
+
+import { describe, it, expect, beforeAll, afterAll, beforeEach, vi } from 'vitest';
+
+// vi.hoisted runs before vi.mock factories, letting test constants and the
+// per-test mock state be referenced inside the (also-hoisted) mock factories.
+const {
+  TEST_ORG_ID,
+  CALLER_USER_ID,
+  TARGET_MEMBER_USER_ID,
+  TARGET_OWNER_USER_ID,
+  TARGET_MEMBERSHIP_ID,
+  TARGET_OWNER_MEMBERSHIP_ID,
+  mockState,
+} = vi.hoisted(() => {
+  // Set placeholder WorkOS env vars before any module that calls `new WorkOS()`
+  // at import time (e.g. middleware/auth.ts) loads. Real network calls go
+  // through the mocks below, so the values just need to satisfy the constructor.
+  process.env.WORKOS_API_KEY ||= 'sk_test_dummy_for_unit_tests';
+  process.env.WORKOS_CLIENT_ID ||= 'client_test_dummy_for_unit_tests';
+  process.env.WORKOS_COOKIE_PASSWORD ||= 'test-cookie-password-32chars-min-len-1234';
+  return {
+    TEST_ORG_ID: 'org_role_policy_test',
+    CALLER_USER_ID: 'user_caller_test',
+    TARGET_MEMBER_USER_ID: 'user_target_member_test',
+    TARGET_OWNER_USER_ID: 'user_target_owner_test',
+    TARGET_MEMBERSHIP_ID: 'om_target_member',
+    TARGET_OWNER_MEMBERSHIP_ID: 'om_target_owner',
+    mockState: {
+      callerRole: 'admin' as 'owner' | 'admin' | 'member',
+      targetMemberCurrentRole: 'member' as 'owner' | 'admin' | 'member',
+      isCallerAAOAdmin: false,
+    },
+  };
+});
+
+// organizations.ts and other route modules construct their own WorkOS instance
+// via `new WorkOS(...)`. Mocking the package directly intercepts those.
+vi.mock('@workos-inc/node', () => {
+  class MockWorkOS {
+    userManagement: any;
+    organizations: any;
+    portal: any;
+    webhooks: any;
+    constructor() {
+      this.userManagement = {
+        listOrganizationMemberships: vi.fn().mockImplementation(({ userId, organizationId }) => {
+          if (userId === CALLER_USER_ID && organizationId === TEST_ORG_ID) {
+            return Promise.resolve({
+              data: [{
+                id: 'om_caller',
+                userId: CALLER_USER_ID,
+                organizationId: TEST_ORG_ID,
+                role: { slug: mockState.callerRole },
+                status: 'active',
+              }],
+            });
+          }
+          return Promise.resolve({ data: [] });
+        }),
+        listUsers: vi.fn().mockImplementation(({ email }) => {
+          const e = String(email).toLowerCase();
+          if (e === 'target-member@example.com') {
+            return Promise.resolve({
+              data: [{ id: TARGET_MEMBER_USER_ID, email: 'target-member@example.com' }],
+            });
+          }
+          if (e === 'target-owner@example.com') {
+            return Promise.resolve({
+              data: [{ id: TARGET_OWNER_USER_ID, email: 'target-owner@example.com' }],
+            });
+          }
+          if (e === 'caller@example.com') {
+            return Promise.resolve({
+              data: [{ id: CALLER_USER_ID, email: 'caller@example.com' }],
+            });
+          }
+          return Promise.resolve({ data: [] });
+        }),
+        getOrganizationMembership: vi.fn().mockImplementation((membershipId) => {
+          if (membershipId === TARGET_MEMBERSHIP_ID) {
+            return Promise.resolve({
+              id: TARGET_MEMBERSHIP_ID,
+              userId: TARGET_MEMBER_USER_ID,
+              organizationId: TEST_ORG_ID,
+              role: { slug: mockState.targetMemberCurrentRole },
+              status: 'active',
+            });
+          }
+          if (membershipId === TARGET_OWNER_MEMBERSHIP_ID) {
+            return Promise.resolve({
+              id: TARGET_OWNER_MEMBERSHIP_ID,
+              userId: TARGET_OWNER_USER_ID,
+              organizationId: TEST_ORG_ID,
+              role: { slug: 'owner' },
+              status: 'active',
+            });
+          }
+          return Promise.reject(new Error('Membership not found'));
+        }),
+        updateOrganizationMembership: vi.fn().mockImplementation((id, opts) =>
+          Promise.resolve({ id, role: { slug: opts.roleSlug } }),
+        ),
+        createOrganizationMembership: vi.fn().mockResolvedValue({ id: 'om_new_test' }),
+        sendInvitation: vi.fn().mockResolvedValue({
+          id: 'inv_test',
+          email: 'new-invitee@example.com',
+          state: 'pending',
+          expiresAt: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
+          acceptInvitationUrl: 'https://test.workos.com/accept/abc',
+        }),
+        getUser: vi.fn().mockResolvedValue({ id: 'user_x', email: 'x@example.com' }),
+        authenticateWithSessionCookie: vi.fn().mockResolvedValue({ authenticated: false }),
+      };
+      this.organizations = {
+        getOrganization: vi.fn().mockResolvedValue({ id: TEST_ORG_ID, name: 'Test Org' }),
+        listOrganizationRoles: vi.fn().mockResolvedValue({
+          data: [{ slug: 'owner' }, { slug: 'admin' }, { slug: 'member' }],
+        }),
+      };
+      this.portal = { generateLink: vi.fn().mockResolvedValue({ link: 'https://portal.test/' }) };
+      this.webhooks = { constructEvent: vi.fn() };
+    }
+  }
+  return { WorkOS: MockWorkOS };
+});
+
+// auth/workos-client exports are sometimes called via getWorkos(). Return the
+// same MockWorkOS shape so all paths see consistent mocks.
+vi.mock('../../src/auth/workos-client.js', async () => {
+  const { WorkOS } = await import('@workos-inc/node');
+  const instance = new WorkOS();
+  return {
+    workos: instance,
+    getWorkos: () => instance,
+  };
+});
+
+vi.mock('../../src/middleware/auth.js', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../src/middleware/auth.js')>();
+  return {
+    ...actual,
+    requireAuth: (req: any, _res: any, next: any) => {
+      req.user = {
+        id: CALLER_USER_ID,
+        email: 'caller@example.com',
+        firstName: 'Caller',
+        lastName: 'Test',
+        is_admin: false,
+      };
+      next();
+    },
+    requireAdmin: (_req: any, res: any) => res.status(403).json({ error: 'Admin required' }),
+    optionalAuth: (req: any, _res: any, next: any) => {
+      req.user = {
+        id: CALLER_USER_ID,
+        email: 'caller@example.com',
+      };
+      next();
+    },
+  };
+});
+
+vi.mock('../../src/middleware/csrf.js', () => ({
+  csrfProtection: (_req: any, _res: any, next: any) => next(),
+}));
+
+vi.mock('../../src/billing/stripe-client.js', () => ({
+  stripe: null,
+  getSubscriptionInfo: vi.fn().mockResolvedValue(null),
+  createStripeCustomer: vi.fn().mockResolvedValue(null),
+  createCustomerSession: vi.fn().mockResolvedValue(null),
+  createBillingPortalSession: vi.fn().mockResolvedValue(null),
+}));
+
+vi.mock('../../src/addie/mcp/admin-tools.js', () => ({
+  isWebUserAAOAdmin: vi.fn().mockImplementation(() => Promise.resolve(mockState.isCallerAAOAdmin)),
+}));
+
+import { HTTPServer } from '../../src/http.js';
+import request from 'supertest';
+import { getPool, initializeDatabase, closeDatabase } from '../../src/db/client.js';
+import { runMigrations } from '../../src/db/migrate.js';
+import type { Pool } from 'pg';
+
+describe('Member role-cap policy (POST /members/by-email + PATCH /members/:membershipId)', () => {
+  let server: HTTPServer;
+  let app: any;
+  let pool: Pool;
+
+  beforeAll(async () => {
+    pool = initializeDatabase({
+      connectionString: process.env.DATABASE_URL || 'postgresql://adcp:localdev@localhost:5432/adcp_test',
+    });
+    await runMigrations();
+
+    server = new HTTPServer();
+    await server.start(0);
+    app = server.app;
+  }, 60000);
+
+  afterAll(async () => {
+    await pool.query('DELETE FROM organization_memberships WHERE workos_organization_id = $1', [TEST_ORG_ID]);
+    await pool.query('DELETE FROM invitation_seat_types WHERE workos_organization_id = $1', [TEST_ORG_ID]);
+    await pool.query('DELETE FROM organizations WHERE workos_organization_id = $1', [TEST_ORG_ID]);
+    await server?.stop();
+    await closeDatabase();
+  });
+
+  beforeEach(async () => {
+    mockState.callerRole = 'admin';
+    mockState.targetMemberCurrentRole = 'member';
+    mockState.isCallerAAOAdmin = false;
+
+    await pool.query(
+      `INSERT INTO organizations (workos_organization_id, name, is_personal, subscription_status, membership_tier, created_at, updated_at)
+       VALUES ($1, 'Test Org', false, 'active', 'company_standard', NOW(), NOW())
+       ON CONFLICT (workos_organization_id) DO UPDATE SET is_personal = false, subscription_status = 'active', subscription_canceled_at = NULL, membership_tier = 'company_standard'`,
+      [TEST_ORG_ID],
+    );
+    await pool.query('DELETE FROM organization_memberships WHERE workos_organization_id = $1', [TEST_ORG_ID]);
+    await pool.query('DELETE FROM invitation_seat_types WHERE workos_organization_id = $1', [TEST_ORG_ID]);
+
+    // Seat the target member and target owner in the local cache so Path 3 fires.
+    await pool.query(
+      `INSERT INTO organization_memberships
+       (workos_user_id, workos_organization_id, workos_membership_id, email, role, seat_type, created_at, updated_at, synced_at)
+       VALUES
+       ($1, $3, $4, 'target-member@example.com', 'member', 'community_only', NOW(), NOW(), NOW()),
+       ($2, $3, $5, 'target-owner@example.com', 'owner', 'contributor', NOW(), NOW(), NOW())`,
+      [TARGET_MEMBER_USER_ID, TARGET_OWNER_USER_ID, TEST_ORG_ID, TARGET_MEMBERSHIP_ID, TARGET_OWNER_MEMBERSHIP_ID],
+    );
+  });
+
+  describe('POST /members/by-email — Path 3 role updates', () => {
+    it('admin can promote a member to admin', async () => {
+      mockState.callerRole = 'admin';
+
+      const response = await request(app)
+        .post(`/api/organizations/${TEST_ORG_ID}/members/by-email`)
+        .send({ email: 'target-member@example.com', role: 'admin' })
+        .expect(200);
+
+      expect(response.body.action).toBe('role_updated');
+      expect(response.body.role).toBe('admin');
+      expect(response.body.previous_role).toBe('member');
+    });
+
+    it('admin cannot assign owner role', async () => {
+      mockState.callerRole = 'admin';
+
+      const response = await request(app)
+        .post(`/api/organizations/${TEST_ORG_ID}/members/by-email`)
+        .send({ email: 'target-member@example.com', role: 'owner' })
+        .expect(403);
+
+      expect(response.body.error).toBe('Insufficient permissions');
+      expect(response.body.message).toMatch(/owner/i);
+    });
+
+    it("admin cannot change an owner's role", async () => {
+      mockState.callerRole = 'admin';
+
+      const response = await request(app)
+        .post(`/api/organizations/${TEST_ORG_ID}/members/by-email`)
+        .send({ email: 'target-owner@example.com', role: 'admin' })
+        .expect(403);
+
+      expect(response.body.error).toBe('Insufficient permissions');
+      expect(response.body.message).toMatch(/owner/i);
+    });
+
+    it('owner can promote a member to admin', async () => {
+      mockState.callerRole = 'owner';
+
+      const response = await request(app)
+        .post(`/api/organizations/${TEST_ORG_ID}/members/by-email`)
+        .send({ email: 'target-member@example.com', role: 'admin' })
+        .expect(200);
+
+      expect(response.body.action).toBe('role_updated');
+    });
+
+    it('owner can change another owner\'s role', async () => {
+      mockState.callerRole = 'owner';
+
+      const response = await request(app)
+        .post(`/api/organizations/${TEST_ORG_ID}/members/by-email`)
+        .send({ email: 'target-owner@example.com', role: 'admin' })
+        .expect(200);
+
+      expect(response.body.action).toBe('role_updated');
+      expect(response.body.role).toBe('admin');
+    });
+  });
+
+  describe('POST /members/by-email — seat_type propagation', () => {
+    it('persists seat_type into invitation_seat_types on Path 1 (invite)', async () => {
+      mockState.callerRole = 'admin';
+
+      const response = await request(app)
+        .post(`/api/organizations/${TEST_ORG_ID}/members/by-email`)
+        .send({ email: 'new-invitee@example.com', role: 'member', seat_type: 'contributor' })
+        .expect(201);
+
+      expect(response.body.action).toBe('invited');
+      expect(response.body.seat_type).toBe('contributor');
+      expect(response.body.invitation.accept_invitation_url).toBeDefined();
+
+      const stored = await pool.query<{ seat_type: string }>(
+        'SELECT seat_type FROM invitation_seat_types WHERE workos_invitation_id = $1',
+        ['inv_test'],
+      );
+      expect(stored.rows[0]?.seat_type).toBe('contributor');
+    });
+
+    it('rejects an unknown seat_type', async () => {
+      mockState.callerRole = 'admin';
+
+      const response = await request(app)
+        .post(`/api/organizations/${TEST_ORG_ID}/members/by-email`)
+        .send({ email: 'new-invitee@example.com', role: 'member', seat_type: 'gold_tier' })
+        .expect(400);
+
+      expect(response.body.error).toBe('Invalid seat type');
+    });
+  });
+
+  describe('PATCH /members/:membershipId — role-cap parity', () => {
+    it('admin can promote a member to admin via PATCH', async () => {
+      mockState.callerRole = 'admin';
+
+      const response = await request(app)
+        .patch(`/api/organizations/${TEST_ORG_ID}/members/${TARGET_MEMBERSHIP_ID}`)
+        .send({ role: 'admin' })
+        .expect(200);
+
+      expect(response.body.success).toBe(true);
+    });
+
+    it('admin cannot assign owner via PATCH', async () => {
+      mockState.callerRole = 'admin';
+
+      const response = await request(app)
+        .patch(`/api/organizations/${TEST_ORG_ID}/members/${TARGET_MEMBERSHIP_ID}`)
+        .send({ role: 'owner' })
+        .expect(403);
+
+      expect(response.body.message).toMatch(/owner/i);
+    });
+
+    it("admin cannot change an owner's role via PATCH", async () => {
+      mockState.callerRole = 'admin';
+
+      const response = await request(app)
+        .patch(`/api/organizations/${TEST_ORG_ID}/members/${TARGET_OWNER_MEMBERSHIP_ID}`)
+        .send({ role: 'member' })
+        .expect(403);
+
+      expect(response.body.message).toMatch(/owner/i);
+    });
+
+    it('owner can change owner\'s role via PATCH', async () => {
+      mockState.callerRole = 'owner';
+
+      const response = await request(app)
+        .patch(`/api/organizations/${TEST_ORG_ID}/members/${TARGET_OWNER_MEMBERSHIP_ID}`)
+        .send({ role: 'member' })
+        .expect(200);
+
+      expect(response.body.success).toBe(true);
+    });
+
+    it('member (non-admin, non-owner) cannot change roles via PATCH', async () => {
+      mockState.callerRole = 'member';
+
+      const response = await request(app)
+        .patch(`/api/organizations/${TEST_ORG_ID}/members/${TARGET_MEMBERSHIP_ID}`)
+        .send({ role: 'admin' })
+        .expect(403);
+
+      // Specific message confirms we hit the role-cap branch rather than an
+      // earlier short-circuit; if the route ever drops the early "Only owners
+      // and admins" check, this assertion still fails the test.
+      expect(response.body.message).toBe('Only owners and admins can change member roles');
+    });
+
+    it('admin can demote another admin to member', async () => {
+      mockState.callerRole = 'admin';
+      mockState.targetMemberCurrentRole = 'admin';
+
+      const response = await request(app)
+        .patch(`/api/organizations/${TEST_ORG_ID}/members/${TARGET_MEMBERSHIP_ID}`)
+        .send({ role: 'member' })
+        .expect(200);
+
+      expect(response.body.success).toBe(true);
+    });
+  });
+
+  describe('Self-role-change is blocked', () => {
+    it('Path 3 of /members/by-email rejects an owner trying to demote themselves', async () => {
+      mockState.callerRole = 'owner';
+
+      // Seed a local membership row for the caller so Path 3 fires (caller's
+      // email resolves to CALLER_USER_ID via the listUsers mock).
+      await pool.query(
+        `INSERT INTO organization_memberships
+         (workos_user_id, workos_organization_id, workos_membership_id, email, role, seat_type, created_at, updated_at, synced_at)
+         VALUES ($1, $2, 'om_caller_seed', 'caller@example.com', 'owner', 'contributor', NOW(), NOW(), NOW())
+         ON CONFLICT (workos_user_id, workos_organization_id) DO UPDATE SET role = 'owner'`,
+        [CALLER_USER_ID, TEST_ORG_ID],
+      );
+
+      const response = await request(app)
+        .post(`/api/organizations/${TEST_ORG_ID}/members/by-email`)
+        .send({ email: 'caller@example.com', role: 'member' })
+        .expect(400);
+
+      expect(response.body.error).toBe('Cannot change own role');
+    });
+  });
+
+  describe('PATCH /:orgId/settings — auto_provision toggle is owner-only', () => {
+    it('owner can flip auto_provision_verified_domain', async () => {
+      mockState.callerRole = 'owner';
+
+      const response = await request(app)
+        .patch(`/api/organizations/${TEST_ORG_ID}/settings`)
+        .send({ auto_provision_verified_domain: false })
+        .expect(200);
+
+      expect(response.body.auto_provision_verified_domain).toBe(false);
+    });
+
+    it('admin cannot flip auto_provision_verified_domain', async () => {
+      mockState.callerRole = 'admin';
+
+      const response = await request(app)
+        .patch(`/api/organizations/${TEST_ORG_ID}/settings`)
+        .send({ auto_provision_verified_domain: false })
+        .expect(403);
+
+      expect(response.body.message).toMatch(/owner/i);
+    });
+  });
+});

From 07721ace390307f081b9e22c81de9d5ab8cdc459 Mon Sep 17 00:00:00 2001
From: Brian O'Kelley <bokelley@scope3.com>
Date: Sun, 26 Apr 2026 11:17:01 -0400
Subject: [PATCH 2/3] fix(team): remove unused getPool import flagged by CodeQL

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server/tests/integration/member-by-email-policy.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/tests/integration/member-by-email-policy.test.ts b/server/tests/integration/member-by-email-policy.test.ts
index 20774e15bb..e764afb9c2 100644
--- a/server/tests/integration/member-by-email-policy.test.ts
+++ b/server/tests/integration/member-by-email-policy.test.ts
@@ -192,7 +192,7 @@ vi.mock('../../src/addie/mcp/admin-tools.js', () => ({
 
 import { HTTPServer } from '../../src/http.js';
 import request from 'supertest';
-import { getPool, initializeDatabase, closeDatabase } from '../../src/db/client.js';
+import { initializeDatabase, closeDatabase } from '../../src/db/client.js';
 import { runMigrations } from '../../src/db/migrate.js';
 import type { Pool } from 'pg';
 

From 98764827e53a986c1b4cfcc95897b71a7f750c87 Mon Sep 17 00:00:00 2001
From: Brian O'Kelley <bokelley@scope3.com>
Date: Sun, 26 Apr 2026 11:44:46 -0400
Subject: [PATCH 3/3] fix(nav): suppress marketing opt-in overlay on localhost

The overlay intercepts clicks during automated UI tests and isn't
relevant for dev-mode users (whose preferences are always null). This
keeps it hidden when running against http://localhost (also 127.0.0.1
and ::1) so dev-mode and Playwright runs aren't blocked from
interacting with the page underneath.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server/public/nav.js | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/server/public/nav.js b/server/public/nav.js
index f8f1a13ad8..17d2c32dc3 100644
--- a/server/public/nav.js
+++ b/server/public/nav.js
@@ -1530,6 +1530,16 @@
   function checkMarketingOptIn() {
     if (sessionStorage.getItem('mkt_optin_dismissed_v1')) return;
     if (currentPath.startsWith('/onboarding')) return;
+    // Dev-mode users always have null preferences and aren't the audience for
+    // marketing nudges. Skipping on localhost also keeps the overlay from
+    // intercepting clicks during automated UI tests.
+    if (typeof window !== 'undefined' && window.location && (
+      window.location.hostname === 'localhost' ||
+      window.location.hostname === '127.0.0.1' ||
+      window.location.hostname === '::1'
+    )) {
+      return;
+    }
 
     fetch(apiBaseUrl + '/api/email-preferences', { credentials: 'include' })
       .then((res) => res.ok ? res.json() : null)