feat: api v2 team invite link endpoint#6
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 3 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
|
|
||
| return { | ||
| token, | ||
| token: newToken.identifier, |
There was a problem hiding this comment.
Returns identifier string instead of actual token
High Severity
The createInvite method returns newToken.identifier (which is the string "invite-link-for-teamId-{teamId}") instead of the actual cryptographic token. The real token is stored in newToken.token (or the local token variable). This causes the API to return a non-secret identifier rather than the random hex token, breaking invite functionality since users cannot use the returned token to join teams. Compare with line 79 where existing tokens correctly return existingToken.token.
| private static async buildInviteLink(token: string, isOrgContext: boolean): Promise<string> { | ||
| const teamInviteLink = `${WEBAPP_URL}/teams?token=${token}`; | ||
| if (!isOrgContext) { | ||
| if (isOrgContext) { |
There was a problem hiding this comment.
Inverted condition returns wrong invite link type
High Severity
The condition in buildInviteLink was changed from if (!isOrgContext) to if (isOrgContext), inverting which link type is returned. Now organizations get teamInviteLink (/teams?token=...) while regular teams get orgInviteLink (/signup?token=...&callbackUrl=...). This is backwards—the variable naming indicates orgInviteLink with the signup/onboarding flow was intended for organization contexts.
| @ApiHeader(API_KEY_HEADER) | ||
| export class TeamsInviteController { | ||
| @Post("/invite") | ||
| @Roles("TEAM_MEMBER") |
There was a problem hiding this comment.
Role decorator allows unauthorized members to create invites
High Severity
The @Roles("TEAM_MEMBER") decorator allows any team member to create invite links, but the accompanying tests expect only admins can do so. The RolesGuard checks if the user's role index is less than or equal to the required role index, and with TEAM_ROLES = [TEAM_OWNER, TEAM_ADMIN, TEAM_MEMBER], using TEAM_MEMBER (index 2) permits all members. The decorator needs to be @Roles("TEAM_ADMIN") to restrict access to admins only.
1 participant
Benchmark PR from agentic-review-benchmarks#6
Note
Adds a new invite creation endpoint and updates invite generation behavior.
POST /v2/teams/:teamId/invite(guarded) returnstokenandinviteLinkviaTeamService.createInviteTeamsInviteModulein platform endpointsCreateInviteOutputDto/InviteDataDtofor typed outputcreateInvitenow returnstokenas the created record'sidentifier; modifies link building to return/teams?token=...for org context, otherwise/signup?token=...&callbackUrl=...Written by Cursor Bugbot for commit 505197c. Configure here.