fix(webapp): don't apply an invite's role to an existing org member

`acceptInvite` looked up an existing OrgMember and skipped creating one when it
found one, but still passed the invite's `rbacRoleId` to `rbac.setUserRole`
regardless. For a user who was already a member that is a role *change*, not an
initial assignment, so accepting a long-pending invite that carries a lesser
role attempted to demote them — including demoting an org's sole Owner, which
the role layer then correctly refuses.

- `acceptInvite` now tracks whether this accept created the membership and only
  applies the invite's role in that case, following the rule `ensureOrgMember`
  already documents. A create that loses the unique-constraint race counts as
  pre-existing, since whichever flow won it owns that membership's role.
- `assignInviteRbacRole` classifies a refusal instead of logging every one at
  `error`: a `last_owner` code logs at `info`, matching the directory-sync role
  paths, and anything else — including a refusal that carries no code — logs at
  `warn`. The helper is best-effort and never throws, so it was logging an
  expected outcome at an inappropriate severity.
- `inviteMembers` skips emails that already belong to a member of the org. The
  invite table's unique constraint only dedupes pending invites, so nothing
  previously stopped an existing member being invited again. Skipped addresses
  are reported the same way an already-pending invite is: left out of the
  returned list.

Adds coverage for all three in apps/webapp/test/member.server.test.ts.

Author: claude

.server-changes/fix-invite-role-change-for-existing-members.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Accepting an old invitation could change the role of someone who was already in the organization. An invitation now leaves an existing member's role untouched, and people who are already in an organization are no longer sent invitations to it.

apps/webapp/app/models/member.server.ts

@@ -100,6 +100,24 @@ export async function inviteMembers({
     throw new Error("User does not have access to this organization");
   }
 
+  const uniqueEmails = new Set(emails);
+
+  // Emails that already belong to a member of this org. The unique constraint
+  // on the invite table dedupes against *pending invites* only, so nothing else
+  // stops an existing member being invited again — and accepting such an invite
+  // is a role change on an established membership, not a join (see
+  // `acceptInvite`). Skip those emails and report them exactly like an
+  // already-pending one: left out of the returned list, without failing the
+  // rest of the batch.
+  const existingMembers = await prisma.orgMember.findMany({
+    where: {
+      organizationId: org.id,
+      user: { email: { in: [...uniqueEmails] } },
+    },
+    select: { user: { select: { email: true } } },
+  });
+  const existingMemberEmails = new Set(existingMembers.map((member) => member.user.email));
+
   // Create one invite per unique email and return ONLY the invites actually
   // created by this call. A P2002 means the email is already invited to this org
   // (unique org+email) — skip it so one duplicate can't fail the batch, and
@@ -109,7 +127,11 @@ export async function inviteMembers({
     include: { organization: true; inviter: true };
   }>[] = [];
 
-  for (const email of new Set(emails)) {
+  for (const email of uniqueEmails) {
+    if (existingMemberEmails.has(email)) {
+      continue;
+    }
+
     try {
       const invite = await prisma.orgMemberInvite.create({
         data: {
@@ -276,12 +298,29 @@ async function assignInviteRbacRole({
       roleId: rbacRoleId,
     });
     if (!roleResult.ok) {
-      logger.error("acceptInvite: skipped RBAC role assignment", {
-        organizationId,
-        userId,
-        rbacRoleId,
-        reason: roleResult.error,
-      });
+      // An org must keep at least one Owner, so the plugin refuses a change
+      // that would remove the last one. That's expected, not a failure — the
+      // same outcome the directory-sync role paths log at info.
+      if (roleResult.code === "last_owner") {
+        logger.info("acceptInvite: kept last Owner, skipped RBAC role assignment", {
+          organizationId,
+          userId,
+          rbacRoleId,
+        });
+      } else {
+        // Any other refusal (plan gating, no plugin installed, a validation
+        // conflict) is a documented `{ok:false}` outcome of this contract, and
+        // this helper is best-effort and never throws — the membership stands
+        // either way. Log it and move on rather than treating it as an error.
+        // Unrecognised codes land here too, so a refusal that carries no code
+        // is still reported at a level that matches its impact.
+        logger.warn("acceptInvite: skipped RBAC role assignment", {
+          organizationId,
+          userId,
+          rbacRoleId,
+          reason: roleResult.error,
+        });
+      }
     }
   } catch (error) {
     logger.error("acceptInvite: RBAC role assignment threw", {
@@ -415,6 +454,13 @@ export async function acceptInvite({
     },
   });
 
+  // Whether this accept is what made the user a member. Only a membership
+  // created here gets the invite's RBAC role applied further down — for anyone
+  // who was already a member, applying it would be a role change rather than an
+  // initial assignment. A create that lost the P2002 race counts as existing
+  // too: whoever won it owns the role for that membership.
+  let membershipCreated = false;
+
   if (!member) {
     try {
       member = await prisma.orgMember.create({
@@ -424,6 +470,7 @@ export async function acceptInvite({
           role: invite.role,
         },
       });
+      membershipCreated = true;
     } catch (error) {
       if (
         error instanceof PrismaNamespace.PrismaClientKnownRequestError &&
@@ -473,12 +520,19 @@ export async function acceptInvite({
 
   const remainingInvites = await getUsersInvites({ email: user.email });
 
-  // If the invite carried an explicit RBAC role, assign it. Best-effort: the
-  // invite is already consumed and membership created above, so a failure here
-  // — a returned {ok:false} or a thrown error from the plugin — must not block
-  // joining the org. Swallow and log either way; without the catch a plugin
-  // throw escapes and turns the whole invite-accept into a 400.
-  if (invite.rbacRoleId) {
+  // If the invite carried an explicit RBAC role, assign it — but only to a
+  // membership this accept actually created. For someone who was already a
+  // member this is a role *change*, not an initial assignment: we do NOT touch
+  // the existing role to avoid demoting a member who has since been promoted
+  // (a long-pending invite can carry a lesser role than they now hold), the
+  // same rule `ensureOrgMember` follows.
+  //
+  // Best-effort for a new member: the invite is already consumed and membership
+  // created above, so a failure here — a returned {ok:false} or a thrown error
+  // from the plugin — must not block joining the org. Swallow and log either
+  // way; without the catch a plugin throw escapes and turns the whole
+  // invite-accept into a 400.
+  if (invite.rbacRoleId && membershipCreated) {
     await assignInviteRbacRole({
       userId: user.id,
       organizationId: invite.organization.id,

apps/webapp/test/member.server.test.ts

@@ -6,12 +6,28 @@ const prismaHolder = vi.hoisted(() => ({
   client: null as PrismaClient | null,
 }));
 
+type SetUserRoleParams = { userId: string; organizationId: string; roleId: string };
+type SetUserRoleResult = { ok: true } | { ok: false; error: string; code?: "last_owner" };
+
+const rbacHolder = vi.hoisted(() => ({
+  setUserRoleCalls: [] as SetUserRoleParams[],
+  setUserRoleResult: { ok: true } as SetUserRoleResult,
+}));
+
 vi.mock("~/services/rbac.server", () => ({
   rbac: {
-    setUserRole: async () => ({ ok: true as const }),
+    setUserRole: async (params: SetUserRoleParams) => {
+      rbacHolder.setUserRoleCalls.push(params);
+      return rbacHolder.setUserRoleResult;
+    },
   },
 }));
 
+function resetRbac(result: SetUserRoleResult = { ok: true }) {
+  rbacHolder.setUserRoleCalls.length = 0;
+  rbacHolder.setUserRoleResult = result;
+}
+
 vi.mock("~/db.server", () => ({
   get prisma() {
     if (!prismaHolder.client) {
@@ -39,7 +55,7 @@ function randomHex(len = 12): string {
 
 async function seedInviteFixture(
   prisma: PrismaClient,
-  opts: { activeProjectCount: number; deletedProjectCount?: number }
+  opts: { activeProjectCount: number; deletedProjectCount?: number; rbacRoleId?: string }
 ) {
   const suffix = randomHex(8);
   const inviter = await prisma.user.create({
@@ -99,6 +115,7 @@ async function seedInviteFixture(
       organizationId: organization.id,
       inviterId: inviter.id,
       role: "MEMBER",
+      rbacRoleId: opts.rbacRoleId ?? null,
     },
   });
 
@@ -253,6 +270,153 @@ describe("acceptInvite", () => {
       expect(member).toBeNull();
     }
   );
+
+  postgresTest(
+    "applies the invite RBAC role when it creates the membership",
+    { timeout: 60_000 },
+    async ({ prisma }) => {
+      prismaHolder.client = prisma;
+      resetRbac();
+      const { acceptInvite } = await import("../app/models/member.server");
+
+      const { invitee, organization, invite } = await seedInviteFixture(prisma, {
+        activeProjectCount: 1,
+        rbacRoleId: "role_admin",
+      });
+
+      await acceptInvite({
+        inviteId: invite.id,
+        organizationId: organization.id,
+        user: { id: invitee.id, email: invitee.email },
+      });
+
+      expect(rbacHolder.setUserRoleCalls).toEqual([
+        { userId: invitee.id, organizationId: organization.id, roleId: "role_admin" },
+      ]);
+    }
+  );
+
+  postgresTest(
+    "does not apply the invite RBAC role to a user who is already a member",
+    { timeout: 60_000 },
+    async ({ prisma }) => {
+      prismaHolder.client = prisma;
+      resetRbac();
+      const { acceptInvite } = await import("../app/models/member.server");
+
+      const { invitee, organization, invite } = await seedInviteFixture(prisma, {
+        activeProjectCount: 1,
+        rbacRoleId: "role_admin",
+      });
+
+      // The user is already in the org, so accepting the invite must not touch
+      // their role — it could be a demotion.
+      await prisma.orgMember.create({
+        data: {
+          organizationId: organization.id,
+          userId: invitee.id,
+          role: "MEMBER",
+        },
+      });
+
+      await acceptInvite({
+        inviteId: invite.id,
+        organizationId: organization.id,
+        user: { id: invitee.id, email: invitee.email },
+      });
+
+      expect(rbacHolder.setUserRoleCalls).toEqual([]);
+
+      // The invite is still consumed and the membership left intact.
+      const remainingInvite = await prisma.orgMemberInvite.findFirst({
+        where: { id: invite.id },
+      });
+      expect(remainingInvite).toBeNull();
+
+      const member = await prisma.orgMember.findFirst({
+        where: { userId: invitee.id, organizationId: organization.id },
+      });
+      expect(member).not.toBeNull();
+    }
+  );
+
+  postgresTest(
+    "still joins the org when the RBAC role assignment is refused",
+    { timeout: 60_000 },
+    async ({ prisma }) => {
+      prismaHolder.client = prisma;
+      resetRbac({
+        ok: false,
+        error: "An organisation must have at least one Owner",
+        code: "last_owner",
+      });
+      const { acceptInvite } = await import("../app/models/member.server");
+
+      const { invitee, organization, invite } = await seedInviteFixture(prisma, {
+        activeProjectCount: 1,
+        rbacRoleId: "role_admin",
+      });
+
+      const { organization: joinedOrg } = await acceptInvite({
+        inviteId: invite.id,
+        organizationId: organization.id,
+        user: { id: invitee.id, email: invitee.email },
+      });
+
+      expect(joinedOrg.id).toBe(organization.id);
+      expect(rbacHolder.setUserRoleCalls).toHaveLength(1);
+
+      const member = await prisma.orgMember.findFirst({
+        where: { userId: invitee.id, organizationId: organization.id },
+      });
+      expect(member).not.toBeNull();
+
+      resetRbac();
+    }
+  );
+});
+
+describe("inviteMembers", () => {
+  postgresTest(
+    "skips emails that already belong to a member of the org",
+    { timeout: 60_000 },
+    async ({ prisma }) => {
+      prismaHolder.client = prisma;
+      const { inviteMembers } = await import("../app/models/member.server");
+
+      const { inviter, invitee, organization, invite } = await seedInviteFixture(prisma, {
+        activeProjectCount: 0,
+      });
+
+      // Drop the seeded pending invite so the skip can only come from the
+      // membership check, not from the pending-invite dedupe.
+      await prisma.orgMemberInvite.delete({ where: { id: invite.id } });
+
+      await prisma.orgMember.create({
+        data: {
+          organizationId: organization.id,
+          userId: invitee.id,
+          role: "MEMBER",
+        },
+      });
+
+      const newcomerEmail = `newcomer-${randomHex(8)}@test.local`;
+
+      const created = await inviteMembers({
+        slug: organization.slug,
+        emails: [invitee.email, newcomerEmail],
+        userId: inviter.id,
+      });
+
+      expect(created.map((row) => row.email)).toEqual([newcomerEmail]);
+
+      const invites = await prisma.orgMemberInvite.findMany({
+        where: { organizationId: organization.id },
+        select: { email: true },
+      });
+      expect(invites.map((pending) => pending.email)).toEqual([newcomerEmail]);
+    }
+  );
 });
 
 describe("provisionMemberDevelopmentEnvironments", () => {