Feature/disable user role invites for adminn

apps/backend/src/api/routes/settings.controller.ts

@@ -1,12 +1,13 @@
 import { Body, Controller, Delete, Get, Param, Post } from '@nestjs/common';
 import { GetOrgFromRequest } from '@gitroom/nestjs-libraries/user/org.from.request';
-import { Organization } from '@prisma/client';
+import { Organization, User } from '@prisma/client';
 import { StarsService } from '@gitroom/nestjs-libraries/database/prisma/stars/stars.service';
 import { CheckPolicies } from '@gitroom/backend/services/auth/permissions/permissions.ability';
 import { OrganizationService } from '@gitroom/nestjs-libraries/database/prisma/organizations/organization.service';
 import { AddTeamMemberDto } from '@gitroom/nestjs-libraries/dtos/settings/add.team.member.dto';
 import { ApiTags } from '@nestjs/swagger';
 import { AuthorizationActions, Sections } from '@gitroom/backend/services/auth/permissions/permission.exception.class';
+import { GetUserFromRequest } from '@gitroom/nestjs-libraries/user/user.from.request';
 
 @ApiTags('Settings')
 @Controller('/settings')
@@ -116,9 +117,15 @@ export class SettingsController {
     [AuthorizationActions.Create, Sections.ADMIN]
   )
   async inviteTeamMember(
+    @GetUserFromRequest() user: User,
     @GetOrgFromRequest() org: Organization,
     @Body() body: AddTeamMemberDto
   ) {
+    const thisOrg = await this._organizationService.getTeam(org.id);
+    const loggedInUserRole = thisOrg.users.find((u) => user.id == u.user.id).role
+     if (loggedInUserRole === 'USER' && body.role !== 'USER') {
+      throw new Error('You are not authorized to invite users as an Admin');
+    }
     return this._organizationService.inviteTeamMember(org.id, body);
   }
 

apps/frontend/src/components/settings/teams.component.tsx

@@ -71,6 +71,9 @@ export const AddMember = () => {
 
   const t = useT();
 
+  const user = useUser();
+  const isUser = user?.role === 'USER';
+
   return (
     <FormProvider {...form}>
       <form onSubmit={form.handleSubmit(submit)}>
@@ -106,11 +109,13 @@ export const AddMember = () => {
           )}
           <Select label="Role" name="role">
             <option value="">{t('select_role', 'Select Role')}</option>
-            {roles.map((role) => (
-              <option key={role.value} value={role.value}>
-                {role.name}
-              </option>
-            ))}
+            {roles
+              .filter((role) => (isUser ? role.value === 'USER' : true))
+              .map((role) => (
+                <option key={role.value} value={role.value}>
+                  {role.name}
+                </option>
+              ))}
           </Select>
           <div className="flex gap-[5px]">
             <div>