feat(workspaces): invite people; they join when they accept (D4)

[huyplb]

D4 of the workspaces plan. Stacked on #493 (D3) → #492 (D5) → #491 (D1).

What changes

• Invite by email with a role (Workspace settings). The invitee sees Invitations in the profile menu: Accept joins with the invited role and switches there; Decline drops it. Invites never add anyone by themselves. 14-day expiry; a new invite replaces a pending one; owners see pending invites and revoke them.
• Everyone may invite into their own workspace, whatever its role there (your request: "each user has own workspace can invite other users"). Elsewhere it needs workspace.members (owner by default).
• Emails with no account (D4): only admins by default; inviting one makes a viewer account. The admin can tick Workspace owners can invite new people on App users.
• Security: only an admin gets the new account's one-time code back. For anyone else it is emailed, or an admin passes it on with Resend invite. Otherwise an owner could invite ceo@company.com, redeem the code and hold an account under that address.
• Routes /api/workspaces/invites[/:id/accept|decline], /api/workspaces/:id/invites[/:inviteId] (contract table 127 → 133).

Tests

• workspace-invites.service.test.ts (11): ask-not-add + role on accept, decline, only for the invitee, expiry, replace, already a member, workspace.members needed, own-workspace rule, new-account gate + setting, input checks. A/B: invite-adds, anyone-makes-accounts and no-own-workspace-rule each fail.
• workspaces.routes.test.ts: the code goes back to an admin and never to anyone else (A/B checked).
• Component tests: invitations accept/decline, invite form + new-account notice, who sees the form.
• e2e workspaces.test.ts (6/6 against the dev server): an admin invites a throwaway account through settings; that account, in its own browser, is refused before accepting, accepts from its menu, lands in the workspace as editor and sees the shared connection.
• Full suite 6014 passed.

Review

Fixed: the new-account code reaching non-admin inviters. Left: revoking an invite does not remove the account it created; invites to existing accounts are not emailed (shown in the menu only).

🤖 Generated with Claude Code

---

Note

Medium Risk
Touches membership, user provisioning, and admin policy with deliberate code-redaction rules; mistakes could leak invite codes or grant workspace access incorrectly.

Overview
Adds workspace invitations: invite by email with a role from workspace settings, pending invites in the profile menu (accept joins with that role and switches workspace; decline removes it), and owner-side list/revoke. Membership is opt-in only (14-day expiry; a new invite replaces a pending one).

Extends who can invite: shared workspaces need workspace.members (owners); personal workspaces let the owner manage invites/member roles regardless of workspace role. New emails without accounts can only be invited by admins unless Workspace owners can invite new people is enabled in admin policy; that path creates a viewer account. One-time account codes are returned only to admins on the invite API; non-admins get delivery status only so they cannot claim accounts under arbitrary addresses.

Ships six new workspace invite API routes, frontend API/UI wiring, admin policy toggle, generated test IDs, and server/component/e2e tests.

^{Reviewed by Cursor Bugbot for commit cd337da. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 29fcafef-fee5-4d20-b552-d494b43b3e52)

[github-actions]

Test IDs

Added (14)

• admin-policy-owners-invite-new
• workspace-invite-email
• workspace-invite-form
• workspace-invite-new-account
• workspace-invite-new-account-code
• workspace-invite-revoke-{…}
• workspace-invite-role
• workspace-invite-submit
• workspace-invite-{…}
• workspace-invites
• workspace-menu-invite-accept-{…}
• workspace-menu-invite-decline-{…}
• workspace-menu-invite-{…}
• workspace-menu-invites

{…} is a part filled in at run time. The full tree: docs/testing/TEST_IDS.md.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: ceb8d7f1-a1cc-4248-a99c-c9508bc05e18)