Function joinOrganization

packages/web/src/app/invite/actions.ts:16–72

(inviteLinkId?: string)

// eslint-disable-next-line authz/require-auth-wrapper -- runs pre-org-membership; uses getAuthenticatedUser() directly since withAuth requires a user-to-org link this call is establishing
export const joinOrganization = async (inviteLinkId?: string) => sew(async () => {
    const authResult = await getAuthenticatedUser();
    if (!authResult) {
        return notAuthenticated();
    }

    const { user } = authResult;

    const org = await __unsafePrisma.org.findUnique({
        where: {
            id: SINGLE_TENANT_ORG_ID,
        },
    });

    if (!org) {
        return orgNotFound();
    }


    // If member approval is required we must be using a valid invite link
    if (isMemberApprovalRequired(org)) {
        if (!org.inviteLinkEnabled) {
            return {
                statusCode: StatusCodes.BAD_REQUEST,
                errorCode: ErrorCode.INVITE_LINK_NOT_ENABLED,
                message: "Invite link is not enabled.",
            } satisfies ServiceError;
        }

        if (org.inviteLinkId !== inviteLinkId) {
            return {
                statusCode: StatusCodes.BAD_REQUEST,
                errorCode: ErrorCode.INVALID_INVITE_LINK,
                message: "Invalid invite link.",
            } satisfies ServiceError;
        }
    }

    const addUserToOrgRes = await addUserToOrganization(user.id, org.id);
    if (isServiceError(addUserToOrgRes)) {
        return addUserToOrgRes;
    }

    await createAudit({
        action: "org.member_added",
        actor: { id: user.id, type: "user" },
        target: { id: user.id, type: "user" },
        orgId: org.id,
        metadata: {
            message: `${user.id} joined the organization via invite link`,
        },
    });

    return {
        success: true,
    }
});