misc: added privilege check for project user invite

backend/src/services/org/org-service.ts

@@ -24,6 +24,7 @@ import {
   OrgPermissionGroupActions,
   OrgPermissionSubjects
 } from "@app/ee/services/permission/org-permission";
+import { validatePrivilegeChangeOperation } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { ProjectPermissionMemberActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-dal";
@@ -872,6 +873,27 @@ export const orgServiceFactory = ({
           ProjectMembershipRole.Member
         ];
 
+        for await (const invitedRole of invitedProjectRoles) {
+          const { permission: rolePermission } = await permissionService.getProjectPermissionByRole(
+            invitedRole,
+            projectId
+          );
+
+          const permissionBoundary = validatePrivilegeChangeOperation(
+            ProjectPermissionMemberActions.ManagePrivileges,
+            ProjectPermissionSub.Member,
+            projectPermission,
+            rolePermission
+          );
+
+          if (!permissionBoundary.isValid)
+            throw new ForbiddenRequestError({
+              name: "PermissionBoundaryError",
+              message: "Failed to invite user to a more privileged role in the project",
+              details: { missingPermissions: permissionBoundary.missingPermissions }
+            });
+        }
+
         const customProjectRoles = invitedProjectRoles.filter(
           (role) => !Object.values(ProjectMembershipRole).includes(role as ProjectMembershipRole)
         );