Function acceptOrganizationInvite

apps/web/src/lib/organizations/organizations.ts:615–795

(
  userId: User['id'],
  inviteToken: string,
  authentication: InvitationAuthenticationContext = {}
)

    if (policy.status === 'misconfigured') {
      throw new Error('Organization SSO policy is misconfigured');
    }

    let authenticationRequirement: 'default' | 'workos' = 'default';
    let ssoSourceOrganizationId: string | null = null;
    const emailDomain = getLowerDomainFromEmail(email);
    if (policy.status === 'required' && emailDomain === policy.domain) {
      if (policy.source === 'self') {
        throw new Error('User must join this organization through SSO');
      }
      authenticationRequirement = 'workos';
      ssoSourceOrganizationId = policy.sourceOrganizationId;
    }

    const existingInvitation = await tx
      .select()
      .from(organization_invitations)
      .where(
        and(
          eq(organization_invitations.organization_id, organizationId),
          eq(organization_invitations.email, email),
          isNull(organization_invitations.accepted_at),
          gt(organization_invitations.expires_at, sql`NOW()`)
        )
      )
      .limit(1);

    if (existingInvitation.length > 0) {
      throw new Error('User already has a pending invitation');
    }

    const existingMember = await tx
      .select()
      .from(organization_memberships)
      .innerJoin(kilocode_users, eq(kilocode_users.id, organization_memberships.kilo_user_id))
      .where(
        and(
          eq(organization_memberships.organization_id, organizationId),
          eq(kilocode_users.google_user_email, email)
        )
      )
      .limit(1);

    if (existingMember.length > 0) {
      throw new Error('User is already a member of this organization');
    }

    const [invitation] = await tx
      .insert(organization_invitations)
      .values({
        organization_id: organizationId,
        email,
        role,
        invited_by: invitingUserId,
        token: randomUUID(),
        expires_at: sql`NOW() + INTERVAL '7 days'`,
        authentication_requirement: authenticationRequirement,
        sso_source_organization_id: ssoSourceOrganizationId,
      })