6c47bac1b8
AcceptInviteController attached invited users with a hardcoded member role, ignoring the invite's role entirely (a viewer invite joined as member). Use the invite's role on accept, require role on invite creation (no silent default), and drop the role from the request/CreateInvite defaults. Add the Viewer option to the member role dropdown (now iterates all roles), hide the dropdown on the current user's own row, and require the member's email to confirm removal. Covered by tests asserting the accepted role matches the invited role for viewer/admin/member, plus invite role validation.
29 lines
781 B
PHP
29 lines
781 B
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Actions\Invite;
|
|
|
|
use App\Enums\UserWorkspace\Role as WorkspaceRole;
|
|
use App\Mail\WorkspaceInvite as WorkspaceInviteMail;
|
|
use App\Models\Invite;
|
|
use App\Models\Workspace;
|
|
use Illuminate\Support\Facades\Mail;
|
|
|
|
class CreateInvite
|
|
{
|
|
public static function execute(Workspace $workspace, array $data): Invite
|
|
{
|
|
$invite = Invite::create([
|
|
'account_id' => $workspace->account_id,
|
|
'invited_by' => auth()->id(),
|
|
'email' => data_get($data, 'email'),
|
|
'role' => WorkspaceRole::from((string) data_get($data, 'role')),
|
|
'workspaces' => [$workspace->id],
|
|
]);
|
|
|
|
Mail::to($invite->email)->send(new WorkspaceInviteMail($invite));
|
|
|
|
return $invite;
|
|
}
|
|
}
|