Merge pull request #3921 from Infisical/misc/allow-users-with-create-identity-to-invite-no-access

misc: allow users with create permission to add identities with no access

backend/src/services/identity-project/identity-project-service.ts

@@ -93,6 +93,7 @@ export const identityProjectServiceFactory = ({
         projectId
       );
 
+      if (requestedRoleChange !== ProjectMembershipRole.NoAccess) {
         const permissionBoundary = validatePrivilegeChangeOperation(
           membership.shouldUseNewPrivilegeSystem,
           ProjectPermissionIdentityActions.GrantPrivileges,
@@ -111,6 +112,7 @@ export const identityProjectServiceFactory = ({
             details: { missingPermissions: permissionBoundary.missingPermissions }
           });
       }
+    }
 
     // validate custom roles input
     const customInputRoles = roles.filter(

backend/src/services/identity/identity-service.ts

@@ -69,6 +69,7 @@ export const identityServiceFactory = ({
       orgId
     );
     const isCustomRole = Boolean(customRole);
+    if (role !== OrgMembershipRole.NoAccess) {
       const permissionBoundary = validatePrivilegeChangeOperation(
         membership.shouldUseNewPrivilegeSystem,
         OrgPermissionIdentityActions.GrantPrivileges,
@@ -86,6 +87,7 @@ export const identityServiceFactory = ({
           ),
           details: { missingPermissions: permissionBoundary.missingPermissions }
         });
+    }
 
     const plan = await licenseService.getPlan(orgId);
 
@@ -187,6 +189,7 @@ export const identityServiceFactory = ({
           ),
           details: { missingPermissions: appliedRolePermissionBoundary.missingPermissions }
         });
+
       if (isCustomRole) customRole = customOrgRole;
     }