The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Review	Updated (UTC)
docs	Skipped		Jan 13, 2026 3:17am

Greptile Overview

Greptile Summary

Overview

This PR adds comprehensive invitation control features through three mechanisms:

1. Global Feature Flag (DISABLE_INVITATIONS) - Server and client-side environment variables to disable invitations globally
2. Permission Group Control (disableInvitations) - Fine-grained control per permission group for enterprise customers
3. Admin API Endpoints - New workspace member management endpoints as a workaround when invitations are disabled

Key Changes

Backend

• Added isInvitationsDisabled feature flag to feature-flags.ts and environment configuration
• Added disableInvitations property to PermissionGroupConfig with proper default (false)
• Implemented validateInvitationsAllowed() function checking both feature flag and permission group config
• Added validation to organization and workspace invitation POST endpoints with proper 403 error handling
• Created new admin API endpoints:
  • GET/POST/DELETE /api/v1/admin/workspaces/[id]/members - List, add, remove workspace members
  • GET/PATCH/DELETE /api/v1/admin/workspaces/[id]/members/[memberId] - Individual member operations

Frontend

• Added isInvitationsDisabled to usePermissionConfig() hook combining feature flag and permission group settings
• Updated UI components to conditionally hide invitation elements:
  • Team management invitation card
  • Workspace header "Invite" badge
  • Context menu "Invite to Workspace" option
• Added "Invitations" toggle to Access Control permission group configuration UI

Documentation & Deployment

• Updated enterprise documentation with DISABLE_INVITATIONS feature and Admin API examples
• Added environment variables to Helm values.yaml
• Translated documentation to 5 additional languages (de, es, fr, ja, zh)

Implementation Quality

Strengths

• Defense in depth: Combines UI hiding, API validation, and permission checks
• Consistent error handling: Uses proper HTTP 403 status with InvitationsNotAllowedError
• Admin workaround: Provides Admin API as an alternative when invitations are disabled
• Proper separation: Feature flag for global disable, permission groups for per-user control
• Complete feature: All invitation entry points are covered (org invitations, workspace invitations, context menu, headers)
• Documentation: Well-documented with clear examples for self-hosted deployments

Architecture

The implementation follows established patterns in the codebase:

• Uses existing permission group infrastructure
• Follows Admin API authentication patterns with withAdminAuthParams middleware
• Consistent with other feature flags (SSO, access control, organizations)
• Proper React hooks usage with memoization

Testing Considerations

While the PR mentions "Tested manually", automated tests would be valuable for:

• Invitation validation when feature flag is enabled
• Invitation validation when permission group disables invitations
• Admin API workspace member CRUD operations
• UI conditional rendering based on isInvitationsDisabled

Security Analysis

• Admin API endpoints properly authenticated with ADMIN_API_KEY
• Uses constant-time comparison for API key validation
• Permission checks happen at multiple layers (UI, API, database)
• No SQL injection risks (uses Drizzle ORM with parameterized queries)
• Input validation present in admin endpoints (permissions type checking, user/workspace existence)

Confidence Score: 5/5

• This PR is safe to merge with minimal risk - well-architected feature with proper validation and error handling
• Score reflects the high quality implementation: comprehensive feature coverage across frontend and backend, proper security validation at multiple layers, consistent error handling with appropriate HTTP status codes, well-documented Admin API workaround, follows established codebase patterns, and includes documentation updates. No logic errors, security vulnerabilities, or architectural concerns identified during thorough review.
• No files require special attention - all implementations follow best practices and existing patterns

Important Files Changed

File Analysis

Sequence Diagram

sequenceDiagram
    participant User
    participant Frontend
    participant API
    participant PermissionCheck
    participant FeatureFlags
    participant PermissionGroup
    participant DB

    Note over User,DB: Invitation Disabled via Feature Flag
    User->>Frontend: Attempt to send invitation
    Frontend->>Frontend: Check usePermissionConfig()
    Frontend->>FeatureFlags: getEnv('NEXT_PUBLIC_DISABLE_INVITATIONS')
    FeatureFlags-->>Frontend: isInvitationsDisabled=true
    Frontend->>User: Hide invitation UI elements

    Note over User,DB: Invitation Disabled via Permission Group
    User->>Frontend: Attempt to send invitation (UI visible)
    Frontend->>API: POST /api/organizations/[id]/invitations
    API->>PermissionCheck: validateInvitationsAllowed(userId)
    PermissionCheck->>FeatureFlags: Check isInvitationsDisabled
    FeatureFlags-->>PermissionCheck: false (FF not set)
    PermissionCheck->>DB: getUserPermissionConfig(userId)
    DB->>PermissionGroup: Get user's permission group
    PermissionGroup-->>DB: config.disableInvitations=true
    DB-->>PermissionCheck: Permission config
    PermissionCheck-->>API: Throw InvitationsNotAllowedError
    API-->>Frontend: 403 Forbidden
    Frontend-->>User: Error: Invitations not allowed

    Note over User,DB: Admin API Workaround
    User->>Frontend: Use Admin API (invitations disabled)
    Frontend->>API: POST /api/v1/admin/workspaces/[id]/members
    API->>API: Authenticate with x-admin-key
    API->>DB: Insert workspace permission
    DB-->>API: Success
    API-->>Frontend: Member added
    Frontend-->>User: Success