From 9dbe45a730cc2e56daaffe139dccad3fef92a4c2 Mon Sep 17 00:00:00 2001
From: Sheen Capadngan <sheensantoscapadngan@gmail.com>
Date: Mon, 10 Mar 2025 19:53:46 +0800
Subject: [PATCH] misc: added privilege check for project user invite

---
 backend/src/services/org/org-service.ts | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/backend/src/services/org/org-service.ts b/backend/src/services/org/org-service.ts
index 182142e07..71e9930e9 100644
--- a/backend/src/services/org/org-service.ts
+++ b/backend/src/services/org/org-service.ts
@@ -24,6 +24,7 @@ import {
   OrgPermissionGroupActions,
   OrgPermissionSubjects
 } from "@app/ee/services/permission/org-permission";
+import { validatePrivilegeChangeOperation } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { ProjectPermissionMemberActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-dal";
@@ -872,6 +873,27 @@ export const orgServiceFactory = ({
           ProjectMembershipRole.Member
         ];
 
+        for await (const invitedRole of invitedProjectRoles) {
+          const { permission: rolePermission } = await permissionService.getProjectPermissionByRole(
+            invitedRole,
+            projectId
+          );
+
+          const permissionBoundary = validatePrivilegeChangeOperation(
+            ProjectPermissionMemberActions.ManagePrivileges,
+            ProjectPermissionSub.Member,
+            projectPermission,
+            rolePermission
+          );
+
+          if (!permissionBoundary.isValid)
+            throw new ForbiddenRequestError({
+              name: "PermissionBoundaryError",
+              message: "Failed to invite user to a more privileged role in the project",
+              details: { missingPermissions: permissionBoundary.missingPermissions }
+            });
+        }
+
         const customProjectRoles = invitedProjectRoles.filter(
           (role) => !Object.values(ProjectMembershipRole).includes(role as ProjectMembershipRole)
         );