fix(webapp): don't apply an invite's role to an existing org member (#4409)

<!-- ccr-slack-attribution -->
_Requested via [Slack
thread](https://triggerdotdev.slack.com/archives/C097ZHVKZFA/p1785249693523749)_

## Summary

Accepting an old invitation could change the role of someone who was
already in the organization. A long-pending invite can carry a lower
role than the member has since been promoted to, so accepting it was a
silent demotion. When the accepting user was the organization's only
Owner, the role layer refused that demotion, and the refusal (an
expected, protective outcome) was logged as an error.

An invitation now only sets a role on a membership the accept actually
created, and people who are already in an organization are skipped when
invitations are sent.

## How

`acceptInvite` already skipped the `OrgMember` create when it found an
existing membership, but the `rbac.setUserRole` call below it was gated
only on `invite.rbacRoleId`. It now also tracks whether this accept
created the membership. A create that loses the unique-constraint race
counts as pre-existing, since whichever flow won it owns that
membership's role.

Skipping existing members outright would regress one case: a member with
no RBAC role at all would never receive the invitation's role.
`ensureOrgMember` handles that with `healMissingRoleAssignment`, which
fills in a null role but never overwrites a real one, so
`assignInviteRbacRole` takes the same gate. An established role is never
touched; an absent one is filled in.

`assignInviteRbacRole` branches on the result's machine-readable `code`
instead of logging every refusal at `error`. `last_owner` goes to
`logger.info`, matching the two directory-sync role paths; everything
else, including a refusal that carries no code, goes to `logger.warn`.
The helper is best-effort and never throws, so no outcome it produces
warrants `error`. No string matching on the error text is involved.

`inviteMembers` resolves the organization's members by email and skips
those addresses before creating invites. The invite table's
`@@unique([organizationId, email])` only dedupes *pending invites*, so
it could never catch this.

## Invite surfaces

Skipping addresses means a batch can now come back empty, and neither
caller handled that:

- The dashboard action built its redirect from
`invites[0].organization`, so a batch where every address was skipped
threw a `TypeError` that reached the admin as a raw error string. It
also reported the submitted count rather than the created one. It now
names what it skipped ("No invitations sent: 1 already a member of this
organization") and counts what it actually created.
- The invites API derived `alreadyInvited` as "everything not created",
so an existing member was reported as though they had already been
invited. `inviteMembers` now returns the two groups separately and the
endpoint reports `alreadyMembers` alongside `alreadyInvited`.

## Testing

`apps/webapp/test/member.server.test.ts` passes 16/16 locally, up from
12.

Getting there needed a harness fix. The `~/db.server` mock did not
export `Prisma`, so any code reaching
`PrismaNamespace.PrismaClientKnownRequestError` threw before it could
branch, leaving every duplicate-key path in `member.server.ts`
unreachable from tests. The mock now re-exports the real `Prisma`, and
there is a case covering the pending-invite skip.

New cases: the invite role is applied when the accept creates the
membership; it is not applied when the member already has a role; it is
applied when an existing member has no role assigned; the organization
is still joined when the assignment is refused with `last_owner`; and
`inviteMembers` reports members separately from pending invites. Forcing
the gate off fails exactly the "already has a role" case, so the
coverage is load-bearing.

`pnpm run typecheck --filter webapp` and `oxfmt --check` both pass.

## Changelog

Accepting an old invitation could change the role of someone who was
already in the organization. An invitation now leaves an existing
member's role untouched, people who are already in an organization are
no longer sent invitations to it, and the invite form says which
addresses it skipped instead of failing with an unhelpful error.

---

## ✅ Checklist

- [x] I have followed every step in the [contributing
guide](https://github.com/triggerdotdev/trigger.dev/blob/main/CONTRIBUTING.md)
- [x] The PR title follows the convention.
- [x] I ran and tested the code works.

## Screenshots

No visual changes. The invite form's toast copy changes, as described
above.

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Matt Aitken <matt@mattaitken.com>

Author: 3 people

.server-changes/fix-invite-role-change-for-existing-members.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Accepting an old invitation could change the role of someone who was already in the organization. An invitation now leaves an existing member's role untouched, people who are already in an organization are no longer sent invitations to it, and the invite form now says which addresses it skipped instead of failing with an unhelpful error.

apps/webapp/app/models/member.server.ts

@@ -100,6 +100,17 @@ export async function inviteMembers({
     throw new Error("User does not have access to this organization");
   }
 
+  const uniqueEmails = new Set(emails);
+
+  const existingMembers = await prisma.orgMember.findMany({
+    where: {
+      organizationId: org.id,
+      user: { email: { in: [...uniqueEmails] } },
+    },
+    select: { user: { select: { email: true } } },
+  });
+  const existingMemberEmails = new Set(existingMembers.map((member) => member.user.email));
+
   // Create one invite per unique email and return ONLY the invites actually
   // created by this call. A P2002 means the email is already invited to this org
   // (unique org+email) — skip it so one duplicate can't fail the batch, and
@@ -108,8 +119,15 @@ export async function inviteMembers({
   const created: Prisma.OrgMemberInviteGetPayload<{
     include: { organization: true; inviter: true };
   }>[] = [];
+  const alreadyMembers: string[] = [];
+  const alreadyInvited: string[] = [];
+
+  for (const email of uniqueEmails) {
+    if (existingMemberEmails.has(email)) {
+      alreadyMembers.push(email);
+      continue;
+    }
 
-  for (const email of new Set(emails)) {
     try {
       const invite = await prisma.orgMemberInvite.create({
         data: {
@@ -131,13 +149,14 @@ export async function inviteMembers({
         error instanceof PrismaNamespace.PrismaClientKnownRequestError &&
         error.code === "P2002"
       ) {
+        alreadyInvited.push(email);
         continue;
       }
       throw error;
     }
   }
 
-  return created;
+  return { created, alreadyMembers, alreadyInvited };
 }
 
 export async function getInviteFromToken({ token }: { token: string }) {
@@ -264,24 +283,41 @@ async function assignInviteRbacRole({
   userId,
   organizationId,
   rbacRoleId,
+  onlyWhenUnassigned,
 }: {
   userId: string;
   organizationId: string;
   rbacRoleId: string;
+  onlyWhenUnassigned: boolean;
 }) {
   try {
+    if (onlyWhenUnassigned) {
+      const currentRole = await rbac.getUserRole({ userId, organizationId });
+      if (currentRole !== null) {
+        return;
+      }
+    }
+
     const roleResult = await rbac.setUserRole({
       userId,
       organizationId,
       roleId: rbacRoleId,
     });
     if (!roleResult.ok) {
-      logger.error("acceptInvite: skipped RBAC role assignment", {
-        organizationId,
-        userId,
-        rbacRoleId,
-        reason: roleResult.error,
-      });
+      if (roleResult.code === "last_owner") {
+        logger.info("acceptInvite: kept last Owner, skipped RBAC role assignment", {
+          organizationId,
+          userId,
+          rbacRoleId,
+        });
+      } else {
+        logger.warn("acceptInvite: skipped RBAC role assignment", {
+          organizationId,
+          userId,
+          rbacRoleId,
+          reason: roleResult.error,
+        });
+      }
     }
   } catch (error) {
     logger.error("acceptInvite: RBAC role assignment threw", {
@@ -415,6 +451,8 @@ export async function acceptInvite({
     },
   });
 
+  let membershipCreated = false;
+
   if (!member) {
     try {
       member = await prisma.orgMember.create({
@@ -424,6 +462,7 @@ export async function acceptInvite({
           role: invite.role,
         },
       });
+      membershipCreated = true;
     } catch (error) {
       if (
         error instanceof PrismaNamespace.PrismaClientKnownRequestError &&
@@ -473,16 +512,12 @@ export async function acceptInvite({
 
   const remainingInvites = await getUsersInvites({ email: user.email });
 
-  // If the invite carried an explicit RBAC role, assign it. Best-effort: the
-  // invite is already consumed and membership created above, so a failure here
-  // — a returned {ok:false} or a thrown error from the plugin — must not block
-  // joining the org. Swallow and log either way; without the catch a plugin
-  // throw escapes and turns the whole invite-accept into a 400.
   if (invite.rbacRoleId) {
     await assignInviteRbacRole({
       userId: user.id,
       organizationId: invite.organization.id,
       rbacRoleId: invite.rbacRoleId,
+      onlyWhenUnassigned: !membershipCreated,
     });
   }
 

apps/webapp/app/routes/_app.orgs.$organizationSlug.invite/route.tsx

@@ -28,7 +28,7 @@ import { $replica } from "~/db.server";
 import { env } from "~/env.server";
 import { useOrganization } from "~/hooks/useOrganizations";
 import { inviteMembers } from "~/models/member.server";
-import { redirectWithSuccessMessage } from "~/models/message.server";
+import { redirectWithErrorMessage, redirectWithSuccessMessage } from "~/models/message.server";
 import { resolveOrgIdFromSlug } from "~/models/organization.server";
 import { TeamPresenter } from "~/presenters/TeamPresenter.server";
 import { scheduleEmail } from "~/services/scheduleEmail.server";
@@ -127,6 +127,20 @@ const schema = z.object({
   rbacRoleId: z.string().optional(),
 });
 
+function describeSkippedInvites(alreadyMembers: string[], alreadyInvited: string[]) {
+  const parts: string[] = [];
+
+  if (alreadyMembers.length > 0) {
+    parts.push(simplur`${alreadyMembers.length} already [a member|members] of this organization`);
+  }
+
+  if (alreadyInvited.length > 0) {
+    parts.push(simplur`${alreadyInvited.length} already invited`);
+  }
+
+  return parts.join(" and ");
+}
+
 export const action = dashboardAction(
   {
     params: Params,
@@ -201,7 +215,11 @@ export const action = dashboardAction(
     }
 
     try {
-      const invites = await inviteMembers({
+      const {
+        created: invites,
+        alreadyMembers,
+        alreadyInvited,
+      } = await inviteMembers({
         slug: organizationSlug,
         emails: submission.value.emails,
         userId,
@@ -224,10 +242,19 @@ export const action = dashboardAction(
         }
       }
 
+      const teamPath = organizationTeamPath({ slug: organizationSlug });
+      const skipped = describeSkippedInvites(alreadyMembers, alreadyInvited);
+
+      if (invites.length === 0) {
+        return redirectWithErrorMessage(teamPath, request, `No invitations sent: ${skipped}.`);
+      }
+
       return redirectWithSuccessMessage(
-        organizationTeamPath(invites[0].organization),
+        teamPath,
         request,
-        simplur`${submission.value.emails.length} member[|s] invited`
+        skipped
+          ? simplur`${invites.length} member[|s] invited. Skipped ${skipped}.`
+          : simplur`${invites.length} member[|s] invited`
       );
     } catch (error: any) {
       return json({ errors: { body: error.message } }, { status: 400 });

apps/webapp/app/routes/api.v1.orgs.$orgParam.invites.ts

@@ -57,9 +57,7 @@ export const action = createActionPATApiRoute(
       return json({ error: "Membership is managed by Directory Sync" }, { status: 403 });
     }
 
-    // Returns only the invites created by this call; already-invited emails are
-    // skipped (re-sending is the dashboard's dedicated resend flow, not this).
-    const created = await inviteMembers({
+    const { created, alreadyMembers, alreadyInvited } = await inviteMembers({
       slug: organization.slug,
       emails: body.emails,
       userId: authentication.userId,
@@ -85,13 +83,11 @@ export const action = createActionPATApiRoute(
     // Report per-email outcome so callers aren't misled by an empty list on
     // re-invite. 201 when something was created, 200 when everything already
     // existed.
-    const createdEmails = new Set(created.map((invite) => invite.email));
-    const alreadyInvited = [...new Set(body.emails)].filter((email) => !createdEmails.has(email));
-
     return json(
       {
         invited: created.map((invite) => ({ id: invite.id, email: invite.email })),
         alreadyInvited,
+        alreadyMembers,
       },
       { status: created.length > 0 ? 201 : 200 }
     );