boringstack-xyz
diff --git a/‎.github/workflows/apps-docs-linkcheck.yml‎
Lines changed: 33 additions & 8 deletions b/‎.github/workflows/apps-docs-linkcheck.yml‎
Lines changed: 33 additions & 8 deletions
diff --git a/‎.github/workflows/apps-ui-bundle-diff.yml‎
Lines changed: 36 additions & 36 deletions b/‎.github/workflows/apps-ui-bundle-diff.yml‎
Lines changed: 36 additions & 36 deletions
diff --git a/‎apps/ui/src/features/accounts/components/InvitationsPage/InvitationsPage.hooks.test.tsx‎
Lines changed: 27 additions & 5 deletions b/‎apps/ui/src/features/accounts/components/InvitationsPage/InvitationsPage.hooks.test.tsx‎
Lines changed: 27 additions & 5 deletions
diff --git a/‎apps/ui/src/features/accounts/components/InvitationsPage/InvitationsPage.hooks.ts‎
Lines changed: 17 additions & 2 deletions b/‎apps/ui/src/features/accounts/components/InvitationsPage/InvitationsPage.hooks.ts‎
Lines changed: 17 additions & 2 deletions
diff --git a/‎apps/ui/src/features/accounts/components/InvitationsPage/InvitationsPage.test.tsx‎
Lines changed: 17 additions & 2 deletions b/‎apps/ui/src/features/accounts/components/InvitationsPage/InvitationsPage.test.tsx‎
Lines changed: 17 additions & 2 deletions
@@ -15,14 +15,14 @@ on:
       - "apps/docs/package.json"
       - "apps/docs/bun.lock"
       - ".github/workflows/apps-docs-linkcheck.yml"
-  pull_request:
-    paths:
-      - "apps/docs/src/**"
-      - "apps/docs/scripts/**"
-      - "apps/docs/astro.config.mjs"
-      - "apps/docs/package.json"
-      - "apps/docs/bun.lock"
-      - ".github/workflows/apps-docs-linkcheck.yml"
+  # PR trigger has NO `paths:` filter — the `linkcheck` check is in
+  # branch protection's required-checks list, so the workflow must run
+  # on every PR or branch protection will wait forever for a status
+  # that never comes ("Expected — Waiting for status to be reported").
+  # The expensive build + lychee steps are gated on the internal
+  # paths-filter below, so PRs that don't touch docs report green
+  # without doing any real work.
+  pull_request: {}
   workflow_dispatch:
 
 permissions:
@@ -41,34 +41,58 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Detect docs changes
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        id: filter
+        with:
+          filters: |
+            docs:
+              - 'apps/docs/src/**'
+              - 'apps/docs/scripts/**'
+              - 'apps/docs/astro.config.mjs'
+              - 'apps/docs/package.json'
+              - 'apps/docs/bun.lock'
+              - '.github/workflows/apps-docs-linkcheck.yml'
+
+      - name: No-op notice for non-docs PRs
+        if: steps.filter.outputs.docs != 'true'
+        run: echo "No docs files changed in this PR — link check skipped."
+
       - uses: oven-sh/setup-bun@v2
+        if: steps.filter.outputs.docs == 'true'
         with:
           bun-version: 1.3.14
 
       - name: Install docs deps
+        if: steps.filter.outputs.docs == 'true'
         run: bun install --frozen-lockfile
 
       - name: Install apps/ui deps for lint-meta export
+        if: steps.filter.outputs.docs == 'true'
         working-directory: apps/ui
         run: bun install --frozen-lockfile
 
       - name: Install apps/api deps for lint-meta export
+        if: steps.filter.outputs.docs == 'true'
         working-directory: apps/api
         run: bun install --frozen-lockfile
 
       - name: Verify generated docs data
+        if: steps.filter.outputs.docs == 'true'
         env:
           BORINGSTACK_UI_DIR: ${{ github.workspace }}/apps/ui
           BORINGSTACK_API_DIR: ${{ github.workspace }}/apps/api
         run: bun run check:docs-data
 
       - name: Build docs site
+        if: steps.filter.outputs.docs == 'true'
         env:
           BORINGSTACK_UI_DIR: ${{ github.workspace }}/apps/ui
           BORINGSTACK_API_DIR: ${{ github.workspace }}/apps/api
         run: bun run build:ci
 
       - name: Internal link check (fail on broken)
+        if: steps.filter.outputs.docs == 'true'
         uses: lycheeverse/lychee-action@v2
         with:
           args: >-
@@ -79,6 +103,7 @@ jobs:
           fail: true
 
       - name: External link check (warning only)
+        if: steps.filter.outputs.docs == 'true'
         uses: lycheeverse/lychee-action@v2
         continue-on-error: true
         with:
 
@@ -1,77 +1,77 @@
 name: bundle-diff
 
 on:
+  # No top-level `paths:` filter — the `size-diff` check is in branch
+  # protection's required-checks list, so the workflow must report a
+  # status on every PR or branch protection sits in "Expected — Waiting"
+  # forever. The expensive build + size-limit steps are gated on the
+  # internal paths-filter below, so PRs that don't touch the UI bundle
+  # report green without doing real work.
   pull_request:
     branches: [main]
-    paths:
-      - "apps/ui/src/**"
-      - "apps/ui/package.json"
-      - "apps/ui/bun.lock"
-      - "apps/ui/vite.config.ts"
-      - "apps/ui/.size-limit.json"
-      - ".github/workflows/apps-ui-bundle-diff.yml"
 
 concurrency:
   group: apps-ui-bundle-diff-${{ github.ref }}
+  cancel-in-progress: true
 
 permissions:
   contents: read
   pull-requests: write
 
 jobs:
+  # Build apps/ui with bun (matching local dev), then enforce the
+  # `.size-limit.json` budgets with `bunx size-limit`. size-limit exits
+  # non-zero when any chunk exceeds its `limit:` value, so this job is a
+  # hard gate against bundle bloat. The full table prints in the job log
+  # so reviewers can scan deltas.
+  #
+  # Why a hand-rolled workflow instead of `andresz1/size-limit-action`:
+  # the action's npm-based install is incompatible with apps/ui's eslint
+  # peerDep tree (bun resolves leniently, npm 7+ does not), and patching
+  # around its install/exec quirks burned through three CI cycles. Going
+  # straight bun keeps the toolchain consistent with local dev.
   size-diff:
-    # Dependabot PRs run with a read-only GITHUB_TOKEN, so the size-limit-action
-    # can't post the comparison comment and fails with "Parameter token or
-    # opts.auth is required". The comment isn't useful on bot bumps anyway.
     if: github.actor != 'dependabot[bot]'
-    defaults:
-      run:
-        working-directory: apps/ui
     runs-on: ubuntu-latest
     timeout-minutes: 8
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Detect relevant changes
+      - name: Detect UI bundle changes
         uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: filter
         with:
           filters: |
-            code:
+            ui:
               - 'apps/ui/src/**'
               - 'apps/ui/package.json'
               - 'apps/ui/bun.lock'
               - 'apps/ui/vite.config.ts'
               - 'apps/ui/.size-limit.json'
               - '.github/workflows/apps-ui-bundle-diff.yml'
 
+      - name: No-op notice for non-UI PRs
+        if: steps.filter.outputs.ui != 'true'
+        run: echo "No UI bundle inputs changed in this PR — size check skipped."
+
       - name: Set up Bun
-        if: steps.filter.outputs.code == 'true'
+        if: steps.filter.outputs.ui == 'true'
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: 1.3.14
 
       - name: Install
-        if: steps.filter.outputs.code == 'true'
+        if: steps.filter.outputs.ui == 'true'
+        working-directory: apps/ui
         run: bun install --frozen-lockfile
 
-      # size-limit-action runs install + build on both branches internally
-      # unless skip_step is set. We pre-install with bun and use npm as the
-      # runner because bun's node_modules layout is npm-compatible.
-      - name: Comment with bundle-size diff
-        if: steps.filter.outputs.code == 'true'
-        uses: andresz1/size-limit-action@94bc357df29c36c8f8d50ea497c3e225c3c95d1d # v1.8.0
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          # v1.8.0 doesn't reliably fall back to env GITHUB_TOKEN — it
-          # initialises Octokit before reading the env, so the token must
-          # be passed explicitly as a `with:` input. Without this, every
-          # PR run fails with "Parameter token or opts.auth is required"
-          # even though the env was set. Keeping the env: line above as
-          # belt-and-braces for any future action version that flips back.
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          package_manager: npm
-          script: build
-          skip_step: install
+      - name: Build
+        if: steps.filter.outputs.ui == 'true'
+        working-directory: apps/ui
+        run: bun run build
+
+      - name: Enforce bundle-size budgets
+        if: steps.filter.outputs.ui == 'true'
+        working-directory: apps/ui
+        run: bunx size-limit
@@ -36,7 +36,10 @@ function makeWrapper() {
   return { Wrapper };
 }
 
-function mockMe(canInvite: boolean): void {
+function mockMe(
+  canInvite: boolean,
+  role: "owner" | "admin" | "member" | "viewer" = "owner"
+): void {
   apiMock.GET.mockImplementation((path: string) => {
     if (path === "/api/v1/users/me") {
       return Promise.resolve({
@@ -47,7 +50,8 @@ function mockMe(canInvite: boolean): void {
             firstName: "",
             lastName: ""
           },
-          account: { id: "acc-1", name: "P", role: "owner" },
+          account: { id: "acc-1", name: "P" },
+          role,
           memberships: [],
           features: { can_invite_team: canInvite },
           capabilities: {
@@ -70,7 +74,7 @@ beforeEach(() => {
 });
 
 describe("useInvitationsPage", () => {
-  it("returns canInvite=false when the feature is not granted", async () => {
+  it("returns canInvite=false + lockedReason='feature' when can_invite_team is off", async () => {
     mockMe(false);
 
     const { Wrapper } = makeWrapper();
@@ -79,11 +83,28 @@ describe("useInvitationsPage", () => {
     });
 
     await waitFor(() => {
-      expect(result.current.canInvite).toBe(false);
+      expect(result.current.lockedReason).toBe("feature");
     });
+
+    expect(result.current.canInvite).toBe(false);
+  });
+
+  it("returns canInvite=false + lockedReason='role' when feature is on but role can't invite", async () => {
+    mockMe(true, "viewer");
+
+    const { Wrapper } = makeWrapper();
+    const { result } = renderHook(() => useInvitationsPage(), {
+      wrapper: Wrapper
+    });
+
+    await waitFor(() => {
+      expect(result.current.lockedReason).toBe("role");
+    });
+
+    expect(result.current.canInvite).toBe(false);
   });
 
-  it("returns canInvite=true + the accountId once /me resolves with the feature", async () => {
+  it("returns canInvite=true + the accountId once /me resolves with feature + owner role", async () => {
     mockMe(true);
 
     const { Wrapper } = makeWrapper();
@@ -95,6 +116,7 @@ describe("useInvitationsPage", () => {
       expect(result.current.canInvite).toBe(true);
     });
 
+    expect(result.current.lockedReason).toBeNull();
     expect(result.current.accountId).toBe("acc-1");
   });
 
 
@@ -17,13 +17,27 @@ import {
   useResendInvitation,
   useRevokeInvitation
 } from "../../Invitations.mutations";
-import type { IInvitationsPageView } from "./InvitationsPage.types";
+import type {
+  IInvitationsLockedReason,
+  IInvitationsPageView
+} from "./InvitationsPage.types";
 
 export function useInvitationsPage(): IInvitationsPageView {
   const { t } = useTranslation();
   const me = useMe();
   const accountId = me.data?.account.id;
-  const canInvite = me.data?.features.can_invite_team === true;
+
+  let lockedReason: IInvitationsLockedReason = null;
+
+  if (me.data != null) {
+    if (!me.data.features.can_invite_team) {
+      lockedReason = "feature";
+    } else if (me.data.role !== ROLE.owner && me.data.role !== ROLE.admin) {
+      lockedReason = "role";
+    }
+  }
+
+  const canInvite = me.data != null && lockedReason === null;
 
   const invitations = useInvitations(accountId);
   const inviteMutation = useInviteMember(accountId);
@@ -73,6 +87,7 @@ export function useInvitationsPage(): IInvitationsPageView {
 
   return {
     canInvite,
+    lockedReason,
     accountId,
     isLoading: me.isPending || invitations.isPending,
     invitations: invitations.data ?? [],
 
@@ -110,7 +110,7 @@ describe("InvitationsPage", () => {
     expect(screen.getByTestId("invite-submit")).toBeInTheDocument();
   });
 
-  it("hides the invite form when can_invite_team is false (feature gate)", () => {
+  it("renders the upgrade prompt when can_invite_team is false (feature gate)", () => {
     renderPage(
       buildMe({
         features: {
@@ -122,12 +122,27 @@ describe("InvitationsPage", () => {
     );
 
     expect(screen.queryByTestId("invite-submit")).toBeNull();
+    expect(screen.getByTestId("invite-locked-feature")).toBeInTheDocument();
+    expect(screen.getByRole("link", { name: /view plans/i })).toHaveAttribute(
+      "href",
+      "/account/billing"
+    );
+    expect(screen.queryByTestId("invite-locked-role")).toBeNull();
   });
 
-  it("hides the invite form for viewer role even when the feature is on", () => {
+  it("renders the role-locked explainer for viewer role when the feature is on", () => {
     renderPage(buildMe({ role: "viewer" }));
 
     expect(screen.queryByTestId("invite-submit")).toBeNull();
+    expect(screen.getByTestId("invite-locked-role")).toBeInTheDocument();
+    expect(screen.queryByTestId("invite-locked-feature")).toBeNull();
+  });
+
+  it("renders the role-locked explainer for member role when the feature is on", () => {
+    renderPage(buildMe({ role: "member" }));
+
+    expect(screen.queryByTestId("invite-submit")).toBeNull();
+    expect(screen.getByTestId("invite-locked-role")).toBeInTheDocument();
   });
 
   it("renders the empty state when there are no pending invitations", () => {