From d48bb910fa6843e13b9839f602ca67105ba9c542 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:11:18 +0400
Subject: [PATCH 01/29] JWT invite lifetime (1 day)

---
 backend/src/lib/config/env.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/backend/src/lib/config/env.ts b/backend/src/lib/config/env.ts
index 8a2b961e9..dea905aa2 100644
--- a/backend/src/lib/config/env.ts
+++ b/backend/src/lib/config/env.ts
@@ -74,6 +74,7 @@ const envSchema = z
     JWT_AUTH_LIFETIME: zpStr(z.string().default("10d")),
     JWT_SIGNUP_LIFETIME: zpStr(z.string().default("15m")),
     JWT_REFRESH_LIFETIME: zpStr(z.string().default("90d")),
+    JWT_INVITE_LIFETIME: zpStr(z.string().default("1d")),
     JWT_MFA_LIFETIME: zpStr(z.string().default("5m")),
     JWT_PROVIDER_AUTH_LIFETIME: zpStr(z.string().default("15m")),
     // Oauth

From e231c531a60bbdd0b6c41e86be73ccb996659173 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:11:29 +0400
Subject: [PATCH 02/29] Update index.ts

---
 backend/src/server/routes/index.ts | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts
index 2454e92cb..d1ce11db1 100644
--- a/backend/src/server/routes/index.ts
+++ b/backend/src/server/routes/index.ts
@@ -477,9 +477,12 @@ export const registerRoutes = async (
     orgRoleDAL,
     permissionService,
     orgDAL,
+    userGroupMembershipDAL,
+    projectBotDAL,
     incidentContactDAL,
     tokenService,
     projectUserAdditionalPrivilegeDAL,
+    projectUserMembershipRoleDAL,
     projectDAL,
     projectMembershipDAL,
     orgMembershipDAL,
@@ -499,6 +502,8 @@ export const registerRoutes = async (
     projectDAL,
     projectBotDAL,
     groupProjectDAL,
+    projectMembershipDAL,
+    projectUserMembershipRoleDAL,
     orgDAL,
     orgService,
     licenseService

From 60df59c7f090fbb244b9fb572b913a4d5ba2155e Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:11:48 +0400
Subject: [PATCH 03/29] Multi-user organization invites structure

---
 .../src/server/routes/v1/invite-org-router.ts | 29 ++++++++++++++-----
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/backend/src/server/routes/v1/invite-org-router.ts b/backend/src/server/routes/v1/invite-org-router.ts
index 873710f10..be9fdbf74 100644
--- a/backend/src/server/routes/v1/invite-org-router.ts
+++ b/backend/src/server/routes/v1/invite-org-router.ts
@@ -16,23 +16,35 @@ export const registerInviteOrgRouter = async (server: FastifyZodProvider) => {
     method: "POST",
     schema: {
       body: z.object({
-        inviteeEmail: z.string().trim().email(),
-        organizationId: z.string().trim()
+        inviteeEmails: z.array(z.string().trim().email()),
+        organizationId: z.string().trim(),
+        projectIds: z.array(z.string().trim()).optional(),
+        organizationRoleSlug: z.string().trim().optional()
       }),
       response: {
         200: z.object({
           message: z.string(),
-          completeInviteLink: z.string().optional()
+          completeInviteLinks: z
+            .array(
+              z.object({
+                email: z.string(),
+                link: z.string()
+              })
+            )
+            .optional()
         })
       }
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
       if (req.auth.actor !== ActorType.USER) return;
-      const completeInviteLink = await server.services.org.inviteUserToOrganization({
+
+      const completeInviteLinks = await server.services.org.inviteUserToOrganization({
         orgId: req.body.organizationId,
         userId: req.permission.id,
-        inviteeEmail: req.body.inviteeEmail,
+        inviteeEmails: req.body.inviteeEmails,
+        projectIds: req.body.projectIds,
+        organizationRoleSlug: req.body.organizationRoleSlug,
         actorAuthMethod: req.permission.authMethod,
         actorOrgId: req.permission.orgId
       });
@@ -41,14 +53,15 @@ export const registerInviteOrgRouter = async (server: FastifyZodProvider) => {
         event: PostHogEventTypes.UserOrgInvitation,
         distinctId: getTelemetryDistinctId(req),
         properties: {
-          inviteeEmail: req.body.inviteeEmail,
+          inviteeEmails: req.body.inviteeEmails,
+          organizationRoleSlug: req.body.organizationRoleSlug,
           ...req.auditLogInfo
         }
       });
 
       return {
-        completeInviteLink,
-        message: `Send an invite link to ${req.body.inviteeEmail}`
+        completeInviteLinks,
+        message: `Send an invite link to ${req.body.inviteeEmails.join(", ")}`
       };
     }
   });

From 8ca70eec44d5e928e81760e3eee03e9a8996c3bd Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:12:23 +0400
Subject: [PATCH 04/29] Refactor add users to org handlers

---
 .../OrgMembersSection/OrgMembersTable.tsx        | 16 ++++++++--------
 .../UserPage/components/UserDetailsSection.tsx   | 10 +++++-----
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersTable.tsx b/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersTable.tsx
index 6c0c7566a..e5a67548b 100644
--- a/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersTable.tsx
+++ b/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersTable.tsx
@@ -33,7 +33,7 @@ import {
   useUser
 } from "@app/context";
 import {
-  useAddUserToOrg,
+  useAddUsersToOrg,
   useFetchServerStatus,
   useGetOrgRoles,
   useGetOrgUsers,
@@ -50,10 +50,10 @@ type Props = {
       description?: string;
     }
   ) => void;
-  setCompleteInviteLink: (link: string) => void;
+  setCompleteInviteLinks: (links: Array<{ email: string; link: string }> | null) => void;
 };
 
-export const OrgMembersTable = ({ handlePopUpOpen, setCompleteInviteLink }: Props) => {
+export const OrgMembersTable = ({ handlePopUpOpen, setCompleteInviteLinks }: Props) => {
   const router = useRouter();
   const { subscription } = useSubscription();
   const { currentOrg } = useOrganization();
@@ -68,7 +68,7 @@ export const OrgMembersTable = ({ handlePopUpOpen, setCompleteInviteLink }: Prop
   const { data: serverDetails } = useFetchServerStatus();
   const { data: members, isLoading: isMembersLoading } = useGetOrgUsers(orgId);
 
-  const { mutateAsync: addUserMutateAsync } = useAddUserToOrg();
+  const { mutateAsync: addUsersMutateAsync } = useAddUsersToOrg();
   const { mutateAsync: updateOrgMembership } = useUpdateOrgMembership();
 
   const onRoleChange = async (membershipId: string, role: string) => {
@@ -106,14 +106,14 @@ export const OrgMembersTable = ({ handlePopUpOpen, setCompleteInviteLink }: Prop
 
   const onResendInvite = async (email: string) => {
     try {
-      const { data } = await addUserMutateAsync({
+      const { data } = await addUsersMutateAsync({
         organizationId: orgId,
-        inviteeEmail: email
+        inviteeEmails: [email]
       });
 
-      setCompleteInviteLink(data?.completeInviteLink || "");
+      setCompleteInviteLinks(data?.completeInviteLinks || null);
 
-      if (!data.completeInviteLink) {
+      if (!data.completeInviteLinks) {
         createNotification({
           text: `Successfully resent invite to ${email}`,
           type: "success"
diff --git a/frontend/src/views/Org/UserPage/components/UserDetailsSection.tsx b/frontend/src/views/Org/UserPage/components/UserDetailsSection.tsx
index 4311a48bb..cd886728c 100644
--- a/frontend/src/views/Org/UserPage/components/UserDetailsSection.tsx
+++ b/frontend/src/views/Org/UserPage/components/UserDetailsSection.tsx
@@ -18,7 +18,7 @@ import {
 } from "@app/context";
 import { useTimedReset } from "@app/hooks";
 import {
-  useAddUserToOrg,
+  useAddUsersToOrg,
   useFetchServerStatus,
   useGetOrgMembership,
   useGetOrgRoles
@@ -44,18 +44,18 @@ export const UserDetailsSection = ({ membershipId, handlePopUpOpen }: Props) =>
   const { data: roles } = useGetOrgRoles(orgId);
   const { data: serverDetails } = useFetchServerStatus();
   const { data: membership } = useGetOrgMembership(orgId, membershipId);
-  const { mutateAsync: inviteUser, isLoading } = useAddUserToOrg();
+  const { mutateAsync: inviteUsers, isLoading } = useAddUsersToOrg();
 
   const onResendInvite = async (email: string) => {
     try {
-      const { data } = await inviteUser({
+      const { data } = await inviteUsers({
         organizationId: orgId,
-        inviteeEmail: email
+        inviteeEmails: [email]
       });
 
       //   setCompleteInviteLink(data?.completeInviteLink || "");
 
-      if (!data.completeInviteLink) {
+      if (!data.completeInviteLinks) {
         createNotification({
           text: `Successfully resent invite to ${email}`,
           type: "success"

From 8dfcef39004ea8037886db81898f417685a3caa9 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:12:40 +0400
Subject: [PATCH 05/29] Seperate component for Org Invite Links

---
 .../OrgMembersSection/OrgInviteLink.tsx       | 49 +++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/OrgInviteLink.tsx

diff --git a/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/OrgInviteLink.tsx b/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/OrgInviteLink.tsx
new file mode 100644
index 000000000..1c0980e18
--- /dev/null
+++ b/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/OrgInviteLink.tsx
@@ -0,0 +1,49 @@
+import { faCheck, faCopy } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { createNotification } from "@app/components/notifications";
+import { IconButton, Tooltip } from "@app/components/v2";
+import { useToggle } from "@app/hooks";
+
+type Props = {
+  invite: { email: string; link: string };
+};
+
+export const OrgInviteLink = ({ invite }: Props) => {
+  const [isInviteLinkCopied, setInviteLinkCopied] = useToggle(false);
+
+  const copyTokenToClipboard = () => {
+    if (isInviteLinkCopied) return;
+
+    navigator.clipboard.writeText(invite.link);
+    setInviteLinkCopied.timedToggle();
+
+    createNotification({
+      type: "info",
+      text: "Copied invitation link to clipboard"
+    });
+  };
+
+  return (
+    <div key={`invite-${invite.email}`}>
+      <p className="text-sm text-mineshaft-400">
+        Invite for <span className="font-medium">{invite.email}</span>
+      </p>
+      <div className="flex flex-col gap-1 rounded-md bg-white/[0.04] p-2 text-base text-gray-400">
+        <p className="line-clamp-1 mr-4 overflow-hidden text-ellipsis whitespace-nowrap	">
+          {invite.link}
+        </p>
+        <Tooltip content={`Copy invitation link for ${invite.email}`}>
+          <IconButton
+            ariaLabel="copy icon"
+            colorSchema="secondary"
+            className="group relative"
+            onClick={() => copyTokenToClipboard()}
+          >
+            <FontAwesomeIcon icon={isInviteLinkCopied ? faCheck : faCopy} />
+          </IconButton>
+        </Tooltip>
+      </div>
+    </div>
+  );
+};

From 2ab59326931dd3efbf956b9156101035cd5fd150 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:12:50 +0400
Subject: [PATCH 06/29] Update OrgMembersSection.tsx

---
 .../OrgMembersSection/OrgMembersSection.tsx           | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersSection.tsx b/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersSection.tsx
index c272145d5..a7d73345f 100644
--- a/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersSection.tsx
+++ b/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersSection.tsx
@@ -27,7 +27,10 @@ export const OrgMembersSection = () => {
   const { currentOrg } = useOrganization();
   const orgId = currentOrg?.id ?? "";
 
-  const [completeInviteLink, setCompleteInviteLink] = useState<string>("");
+  const [completeInviteLinks, setCompleteInviteLinks] = useState<Array<{
+    email: string;
+    link: string;
+  }> | null>(null);
 
   const { popUp, handlePopUpOpen, handlePopUpClose, handlePopUpToggle } = usePopUp([
     "addMember",
@@ -132,13 +135,13 @@ export const OrgMembersSection = () => {
       </div>
       <OrgMembersTable
         handlePopUpOpen={handlePopUpOpen}
-        setCompleteInviteLink={setCompleteInviteLink}
+        setCompleteInviteLinks={setCompleteInviteLinks}
       />
       <AddOrgMemberModal
         popUp={popUp}
         handlePopUpToggle={handlePopUpToggle}
-        completeInviteLink={completeInviteLink}
-        setCompleteInviteLink={setCompleteInviteLink}
+        completeInviteLinks={completeInviteLinks}
+        setCompleteInviteLinks={setCompleteInviteLinks}
       />
       <DeleteActionModal
         isOpen={popUp.removeMember.isOpen}

From 59b16f647eec128e1f029450c8078694644d45ce Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:12:59 +0400
Subject: [PATCH 07/29] Update AddOrgMemberModal.tsx

---
 .../OrgMembersSection/AddOrgMemberModal.tsx   | 252 ++++++++++++++----
 1 file changed, 198 insertions(+), 54 deletions(-)

diff --git a/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/AddOrgMemberModal.tsx b/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/AddOrgMemberModal.tsx
index aedeb369a..f0dfe5b77 100644
--- a/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/AddOrgMemberModal.tsx
+++ b/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/AddOrgMemberModal.tsx
@@ -1,65 +1,112 @@
 import { Controller, useForm } from "react-hook-form";
-import { faCheck, faCopy } from "@fortawesome/free-solid-svg-icons";
+import { faCheckCircle, faChevronDown } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { yupResolver } from "@hookform/resolvers/yup";
-import * as yup from "yup";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
-import { Button, FormControl, IconButton, Input, Modal, ModalContent } from "@app/components/v2";
+import {
+  Button,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  FormControl,
+  Modal,
+  ModalContent,
+  Select,
+  SelectItem,
+  TextArea
+} from "@app/components/v2";
 import { useOrganization } from "@app/context";
-import { useToggle } from "@app/hooks";
-import { useAddUserToOrg, useFetchServerStatus } from "@app/hooks/api";
+import {
+  useAddUsersToOrg,
+  useFetchServerStatus,
+  useGetOrgRoles,
+  useGetUserWorkspaces
+} from "@app/hooks/api";
 import { UsePopUpState } from "@app/hooks/usePopUp";
 
-const addMemberFormSchema = yup.object({
-  email: yup.string().email().required().label("Email").trim().lowercase()
+import { OrgInviteLink } from "./OrgInviteLink";
+
+const DEFAULT_ORG_MEMBER_ROLE_SLUG = "member";
+
+const EmailSchema = z.string().email().min(1).trim().toLowerCase();
+
+const addMemberFormSchema = z.object({
+  emails: z.string().min(1).trim().toLowerCase(),
+  projectIds: z.array(z.string().min(1).trim().toLowerCase()).default([]),
+  organizationRoleSlug: z.string().min(1).default(DEFAULT_ORG_MEMBER_ROLE_SLUG)
 });
 
-type TAddMemberForm = yup.InferType<typeof addMemberFormSchema>;
+type TAddMemberForm = z.infer<typeof addMemberFormSchema>;
 
 type Props = {
   popUp: UsePopUpState<["addMember"]>;
   handlePopUpToggle: (popUpName: keyof UsePopUpState<["addMember"]>, state?: boolean) => void;
-  completeInviteLink: string;
-  setCompleteInviteLink: (link: string) => void;
+  completeInviteLinks: Array<{
+    email: string;
+    link: string;
+  }> | null;
+  setCompleteInviteLinks: (links: Array<{ email: string; link: string }> | null) => void;
 };
 
 export const AddOrgMemberModal = ({
   popUp,
   handlePopUpToggle,
-  completeInviteLink,
-  setCompleteInviteLink
+  completeInviteLinks,
+  setCompleteInviteLinks
 }: Props) => {
-  
   const { currentOrg } = useOrganization();
 
+  const { data: organizationRoles } = useGetOrgRoles(currentOrg?.id ?? "");
   const { data: serverDetails } = useFetchServerStatus();
-  const { mutateAsync: addUserMutateAsync } = useAddUserToOrg();
-
-  const [isInviteLinkCopied, setInviteLinkCopied] = useToggle(false);
+  const { mutateAsync: addUsersMutateAsync } = useAddUsersToOrg();
 
   const {
     control,
     handleSubmit,
+    watch,
     reset,
     formState: { isSubmitting }
-  } = useForm<TAddMemberForm>({ resolver: yupResolver(addMemberFormSchema) });
+  } = useForm<TAddMemberForm>({ resolver: zodResolver(addMemberFormSchema) });
 
-  const onAddMember = async ({ email }: TAddMemberForm) => {
+  const onAddMembers = async ({ emails, organizationRoleSlug, projectIds }: TAddMemberForm) => {
     if (!currentOrg?.id) return;
 
     try {
-      const { data } = await addUserMutateAsync({
+      const parsedEmails = emails
+        .replace(/\s/g, "")
+        .split(",")
+        .map((email) => {
+          if (EmailSchema.safeParse(email).success) {
+            return email.trim();
+          }
+
+          return null;
+        });
+
+      if (parsedEmails.includes(null)) {
+        createNotification({
+          text: "Invalid email addresses provided.",
+          type: "error"
+        });
+        return;
+      }
+
+      const { data } = await addUsersMutateAsync({
         organizationId: currentOrg?.id,
-        inviteeEmail: email
+        inviteeEmails: emails.split(",").map((email) => email.trim()),
+        organizationRoleSlug,
+        projectIds
       });
 
-      setCompleteInviteLink(data?.completeInviteLink ?? "");
+      setCompleteInviteLinks(data?.completeInviteLinks ?? null);
 
       // only show this notification when email is configured.
       // A [completeInviteLink] will not be sent if smtp is configured
 
-      if (!data.completeInviteLink) {
+      if (!data.completeInviteLinks) {
         createNotification({
           text: "Successfully invited user to the organization.",
           type: "success"
@@ -80,47 +127,153 @@ export const AddOrgMemberModal = ({
     reset();
   };
 
-  const copyTokenToClipboard = () => {
-    navigator.clipboard.writeText(completeInviteLink as string);
-    setInviteLinkCopied.on();
-  };
+  const projectIds = watch("projectIds", []);
+  const { data: projects } = useGetUserWorkspaces();
 
   return (
     <Modal
       isOpen={popUp?.addMember?.isOpen}
       onOpenChange={(isOpen) => {
         handlePopUpToggle("addMember", isOpen);
-        setCompleteInviteLink("");
+        setCompleteInviteLinks(null);
       }}
     >
       <ModalContent
         title={`Invite others to ${currentOrg?.name}`}
         subTitle={
           <div>
-            {!completeInviteLink && (
-              <div>
-                An invite is specific to an email address and expires after 1 day.
-                <br />
-                For security reasons, you will need to separately add members to projects.
-              </div>
+            {!completeInviteLinks && (
+              <div>An invite is specific to an email address and expires after 1 day.</div>
             )}
-            {completeInviteLink &&
+            {completeInviteLinks &&
               "This Infisical instance does not have a email provider setup. Please share this invite link with the invitee manually"}
           </div>
         }
       >
-        {!completeInviteLink && (
-          <form onSubmit={handleSubmit(onAddMember)}>
+        {!completeInviteLinks && (
+          <form onSubmit={handleSubmit(onAddMembers)}>
             <Controller
               control={control}
-              defaultValue=""
-              name="email"
+              name="emails"
               render={({ field, fieldState: { error } }) => (
                 <FormControl label="Email" isError={Boolean(error)} errorText={error?.message}>
-                  <Input {...field} />
+                  <TextArea
+                    {...field}
+                    className="mt-1 h-20 w-full min-w-[30rem] rounded-md border border-mineshaft-500 bg-mineshaft-900/70 py-1 px-2 text-sm text-bunker-300 outline-none ring-primary-800 ring-opacity-70 transition-all placeholder:text-bunker-400 focus:ring-2"
+                    placeholder="email@example.com, email2@example.com..."
+                  />
                 </FormControl>
               )}
             />
+
+            <div>
+              <Controller
+                control={control}
+                name="organizationRoleSlug"
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    tooltipText="Select which organization role you want to assign to the user."
+                    label="Assign organization role"
+                    isError={Boolean(error)}
+                    errorText={error?.message}
+                  >
+                    <div>
+                      <Select
+                        defaultValue={DEFAULT_ORG_MEMBER_ROLE_SLUG}
+                        {...field}
+                        onValueChange={(val) => field.onChange(val)}
+                      >
+                        {organizationRoles?.map((role) => (
+                          <SelectItem key={role.id} value={role.slug}>
+                            {role.name}
+                          </SelectItem>
+                        ))}
+                      </Select>
+                    </div>
+                  </FormControl>
+                )}
+              />
+            </div>
+
+            <div className="-space-y-3">
+              <Controller
+                control={control}
+                name="projectIds"
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    label="Add user to projects"
+                    isError={Boolean(error?.message)}
+                    errorText={error?.message}
+                  >
+                    <DropdownMenu>
+                      <DropdownMenuTrigger asChild>
+                        {projects && projects.length > 0 ? (
+                          <div className="inline-flex w-full cursor-pointer items-center justify-between rounded-md border border-mineshaft-600 bg-mineshaft-900 px-3 py-2 font-inter text-sm font-normal text-bunker-200 outline-none data-[placeholder]:text-mineshaft-200">
+                            {projectIds.length === 1
+                              ? projects.find((project) => project.id === projectIds[0])?.name
+                              : `${projectIds.length} projects selected`}
+                            <FontAwesomeIcon icon={faChevronDown} className="text-xs" />
+                          </div>
+                        ) : (
+                          <div className="inline-flex w-full cursor-default items-center justify-between rounded-md border border-mineshaft-600 bg-mineshaft-900 px-3 py-2 font-inter text-sm font-normal text-bunker-200 outline-none data-[placeholder]:text-mineshaft-200">
+                            No projects found
+                          </div>
+                        )}
+                      </DropdownMenuTrigger>
+                      <DropdownMenuContent
+                        align="start"
+                        className="thin-scrollbar z-[100] max-h-80"
+                      >
+                        {projects && projects.length > 0 ? (
+                          projects.map((project) => {
+                            const isSelected = projectIds.includes(String(project.id));
+
+                            return (
+                              <DropdownMenuItem
+                                onSelect={(event) => projects.length > 0 && event.preventDefault()}
+                                onClick={() => {
+                                  if (projectIds.includes(String(project.id))) {
+                                    field.onChange(
+                                      projectIds.filter(
+                                        (projectId: string) => projectId !== String(project.id)
+                                      )
+                                    );
+                                  } else {
+                                    field.onChange([...projectIds, String(project.id)]);
+                                  }
+                                }}
+                                key={`project-id-${project.id}`}
+                                icon={
+                                  isSelected ? (
+                                    <FontAwesomeIcon
+                                      icon={faCheckCircle}
+                                      className="pr-0.5 text-primary"
+                                    />
+                                  ) : (
+                                    <div className="pl-[1.01rem]" />
+                                  )
+                                }
+                                iconPos="left"
+                                className="w-[28.4rem] text-sm"
+                              >
+                                {project.name}
+                              </DropdownMenuItem>
+                            );
+                          })
+                        ) : (
+                          <div />
+                        )}
+                      </DropdownMenuContent>
+                    </DropdownMenu>
+                  </FormControl>
+                )}
+              />
+              <p className="ml-0.5 text-xs text-mineshaft-400">
+                Members will automatically be assigned the <a className="font-bold">Developer</a>{" "}
+                role for the projects you select.
+              </p>
+            </div>
+
             <div className="mt-8 flex items-center">
               <Button
                 className="mr-4"
@@ -141,20 +294,11 @@ export const AddOrgMemberModal = ({
             </div>
           </form>
         )}
-        {completeInviteLink && (
-          <div className="mt-2 mb-3 mr-2 flex items-center justify-end rounded-md bg-white/[0.07] p-2 text-base text-gray-400">
-            <p className="mr-4 break-all">{completeInviteLink}</p>
-            <IconButton
-              ariaLabel="copy icon"
-              colorSchema="secondary"
-              className="group relative"
-              onClick={copyTokenToClipboard}
-            >
-              <FontAwesomeIcon icon={isInviteLinkCopied ? faCheck : faCopy} />
-              <span className="absolute -left-8 -top-20 hidden w-28 translate-y-full rounded-md bg-bunker-800 py-2 pl-3 text-center text-sm text-gray-400 group-hover:flex group-hover:animate-fadeIn">
-                click to copy
-              </span>
-            </IconButton>
+        {completeInviteLinks && (
+          <div className="space-y-3">
+            {completeInviteLinks.map((invite) => (
+              <OrgInviteLink key={`invite-${invite.email}`} invite={invite} />
+            ))}
           </div>
         )}
       </ModalContent>

From 121b642d502b4d2c905d00a74b6c39aa04db7c74 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:13:29 +0400
Subject: [PATCH 08/29] Added new metadata parameter for signup

---
 backend/src/server/routes/v3/signup-router.ts |  3 +-
 .../services/auth-token/auth-token-types.ts   | 11 ++++
 .../src/services/auth/auth-signup-service.ts  | 56 +++++++++++++++++--
 frontend/src/pages/signupinvite.tsx           |  7 ++-
 4 files changed, 69 insertions(+), 8 deletions(-)

diff --git a/backend/src/server/routes/v3/signup-router.ts b/backend/src/server/routes/v3/signup-router.ts
index 59131464a..276a2e8cb 100644
--- a/backend/src/server/routes/v3/signup-router.ts
+++ b/backend/src/server/routes/v3/signup-router.ts
@@ -179,7 +179,8 @@ export const registerSignupRouter = async (server: FastifyZodProvider) => {
         encryptedPrivateKeyIV: z.string().trim(),
         encryptedPrivateKeyTag: z.string().trim(),
         salt: z.string().trim(),
-        verifier: z.string().trim()
+        verifier: z.string().trim(),
+        metadata: z.string().optional()
       }),
       response: {
         200: z.object({
diff --git a/backend/src/services/auth-token/auth-token-types.ts b/backend/src/services/auth-token/auth-token-types.ts
index 8917bd672..dbe949fd9 100644
--- a/backend/src/services/auth-token/auth-token-types.ts
+++ b/backend/src/services/auth-token/auth-token-types.ts
@@ -49,3 +49,14 @@ export type TIssueAuthTokenDTO = {
   ip: string;
   userAgent: string;
 };
+
+export enum TokenMetadataType {
+  InviteToProjects = "projects-invite"
+}
+
+// TODO: Split the payloads into separate types for better type inference (not needed until we add more types of metadata)
+export type TTokenMetadata = {
+  type: TokenMetadataType.InviteToProjects;
+  projectIds: string[];
+  userId: string;
+};
diff --git a/backend/src/services/auth/auth-signup-service.ts b/backend/src/services/auth/auth-signup-service.ts
index 83a5b27d9..8714f5081 100644
--- a/backend/src/services/auth/auth-signup-service.ts
+++ b/backend/src/services/auth/auth-signup-service.ts
@@ -1,7 +1,7 @@
 import bcrypt from "bcrypt";
 import jwt from "jsonwebtoken";
 
-import { OrgMembershipStatus, TableName } from "@app/db/schemas";
+import { OrgMembershipStatus, ProjectMembershipRole, TableName } from "@app/db/schemas";
 import { convertPendingGroupAdditionsToGroupMemberships } from "@app/ee/services/group/group-fns";
 import { TUserGroupMembershipDALFactory } from "@app/ee/services/group/user-group-membership-dal";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
@@ -9,7 +9,7 @@ import { isAuthMethodSaml } from "@app/ee/services/permission/permission-fns";
 import { getConfig } from "@app/lib/config/env";
 import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
 import { getUserPrivateKey } from "@app/lib/crypto/srp";
-import { BadRequestError } from "@app/lib/errors";
+import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
 import { isDisposableEmail } from "@app/lib/validator";
 import { TGroupProjectDALFactory } from "@app/services/group-project/group-project-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
@@ -17,9 +17,12 @@ import { TProjectBotDALFactory } from "@app/services/project-bot/project-bot-dal
 import { TProjectKeyDALFactory } from "@app/services/project-key/project-key-dal";
 
 import { TAuthTokenServiceFactory } from "../auth-token/auth-token-service";
-import { TokenType } from "../auth-token/auth-token-types";
+import { TokenType, TTokenMetadata } from "../auth-token/auth-token-types";
 import { TOrgDALFactory } from "../org/org-dal";
 import { TOrgServiceFactory } from "../org/org-service";
+import { TProjectMembershipDALFactory } from "../project-membership/project-membership-dal";
+import { addMembersToProject } from "../project-membership/project-membership-fns";
+import { TProjectUserMembershipRoleDALFactory } from "../project-membership/project-user-membership-role-dal";
 import { SmtpTemplates, TSmtpService } from "../smtp/smtp-service";
 import { TUserDALFactory } from "../user/user-dal";
 import { TAuthDALFactory } from "./auth-dal";
@@ -32,10 +35,14 @@ type TAuthSignupDep = {
   userDAL: TUserDALFactory;
   userGroupMembershipDAL: Pick<
     TUserGroupMembershipDALFactory,
-    "find" | "transaction" | "insertMany" | "deletePendingUserGroupMembershipsByUserIds"
+    | "find"
+    | "transaction"
+    | "insertMany"
+    | "deletePendingUserGroupMembershipsByUserIds"
+    | "findUserGroupMembershipsInProject"
   >;
   projectKeyDAL: Pick<TProjectKeyDALFactory, "find" | "findLatestProjectKey" | "insertMany">;
-  projectDAL: Pick<TProjectDALFactory, "findProjectGhostUser">;
+  projectDAL: Pick<TProjectDALFactory, "findProjectGhostUser" | "findProjectById">;
   projectBotDAL: Pick<TProjectBotDALFactory, "findOne">;
   groupProjectDAL: Pick<TGroupProjectDALFactory, "find">;
   orgService: Pick<TOrgServiceFactory, "createOrganization">;
@@ -43,6 +50,8 @@ type TAuthSignupDep = {
   tokenService: TAuthTokenServiceFactory;
   smtpService: TSmtpService;
   licenseService: Pick<TLicenseServiceFactory, "updateSubscriptionOrgMemberCount">;
+  projectMembershipDAL: Pick<TProjectMembershipDALFactory, "find" | "transaction" | "insertMany">;
+  projectUserMembershipRoleDAL: Pick<TProjectUserMembershipRoleDALFactory, "insertMany">;
 };
 
 export type TAuthSignupFactory = ReturnType<typeof authSignupServiceFactory>;
@@ -58,6 +67,8 @@ export const authSignupServiceFactory = ({
   smtpService,
   orgService,
   orgDAL,
+  projectMembershipDAL,
+  projectUserMembershipRoleDAL,
   licenseService
 }: TAuthSignupDep) => {
   // first step of signup. create user and send email
@@ -301,7 +312,8 @@ export const authSignupServiceFactory = ({
     encryptedPrivateKey,
     encryptedPrivateKeyIV,
     encryptedPrivateKeyTag,
-    authorization
+    authorization,
+    metadata
   }: TCompleteAccountInviteDTO) => {
     const user = await userDAL.findUserByUsername(email);
     if (!user || (user && user.isAccepted)) {
@@ -358,6 +370,38 @@ export const authSignupServiceFactory = ({
         tx
       );
 
+      if (metadata) {
+        const metadataObj = jwt.verify(metadata, appCfg.AUTH_SECRET) as TTokenMetadata;
+
+        if (user.id !== metadataObj.userId) {
+          throw new UnauthorizedError({
+            message: "Malformed or invalid metadata token"
+          });
+        }
+
+        for await (const projectId of metadataObj.projectIds) {
+          await addMembersToProject({
+            orgDAL,
+            projectDAL,
+            projectMembershipDAL,
+            projectKeyDAL,
+            userGroupMembershipDAL,
+            projectBotDAL,
+            projectUserMembershipRoleDAL,
+            smtpService
+          }).addMembersToNonE2EEProject(
+            {
+              emails: [user.email!],
+              usernames: [],
+              projectId,
+              projectMembershipRole: ProjectMembershipRole.Member,
+              sendEmails: false
+            },
+            tx
+          );
+        }
+      }
+
       const updatedMembersips = await orgDAL.updateMembership(
         { inviteEmail: email, status: OrgMembershipStatus.Invited },
         { userId: us.id, status: OrgMembershipStatus.Accepted },
diff --git a/frontend/src/pages/signupinvite.tsx b/frontend/src/pages/signupinvite.tsx
index 725dc6113..9c5c01b32 100644
--- a/frontend/src/pages/signupinvite.tsx
+++ b/frontend/src/pages/signupinvite.tsx
@@ -64,6 +64,10 @@ export default function SignupInvite() {
   const email = (parsedUrl.to as string)?.replace(" ", "+").trim();
   const { config } = useServerConfig();
 
+  const queryParams = new URLSearchParams(window.location.search);
+
+  const metadata = queryParams.get("metadata") || undefined;
+
   const { mutateAsync: selectOrganization } = useSelectOrganization();
 
   useEffect(() => {
@@ -160,7 +164,8 @@ export default function SignupInvite() {
                 encryptedPrivateKeyIV,
                 encryptedPrivateKeyTag,
                 salt: result.salt,
-                verifier: result.verifier
+                verifier: result.verifier,
+                metadata
               });
 
               // unset temporary signup JWT token and set JWT token

From 9f6a6a7b7c85f4074d3ff152a1c088accf212448 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:13:44 +0400
Subject: [PATCH 09/29] Automatic timed toggle

---
 frontend/src/hooks/useToggle.tsx | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/frontend/src/hooks/useToggle.tsx b/frontend/src/hooks/useToggle.tsx
index 83d73bcb1..ecc243ade 100644
--- a/frontend/src/hooks/useToggle.tsx
+++ b/frontend/src/hooks/useToggle.tsx
@@ -8,6 +8,7 @@ type UseToggleReturn = [
     on: VoidFn;
     off: VoidFn;
     toggle: VoidFn;
+    timedToggle: (timeout?: number) => void;
   }
 ];
 
@@ -26,5 +27,13 @@ export const useToggle = (initialState = false): UseToggleReturn => {
     setValue((prev) => (typeof isOpen === "boolean" ? isOpen : !prev));
   }, []);
 
-  return [value, { on, off, toggle }];
+  const timedToggle = useCallback((timeout = 2000) => {
+    setValue((prev) => !prev);
+
+    setTimeout(() => {
+      setValue(false);
+    }, timeout);
+  }, []);
+
+  return [value, { on, off, toggle, timedToggle }];
 };

From c8248ef4e98d0d33087c1fbcddf33ac0ba7bd4a3 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:14:03 +0400
Subject: [PATCH 10/29] Fix: Skip org selection when user only has one org

---
 .../src/pages/login/select-organization.tsx   | 22 ++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/frontend/src/pages/login/select-organization.tsx b/frontend/src/pages/login/select-organization.tsx
index 349952ba5..cf953664d 100644
--- a/frontend/src/pages/login/select-organization.tsx
+++ b/frontend/src/pages/login/select-organization.tsx
@@ -38,6 +38,7 @@ export default function LoginPage() {
   const { user, isLoading: userLoading } = useUser();
 
   const queryParams = new URLSearchParams(window.location.search);
+  const callbackPort = queryParams.get("callback_port");
 
   const logout = useLogoutUser(true);
   const handleLogout = useCallback(async () => {
@@ -52,8 +53,6 @@ export default function LoginPage() {
 
   const handleSelectOrganization = useCallback(
     async (organization: Organization) => {
-      const callbackPort = queryParams.get("callback_port");
-
       if (organization.authEnforced) {
         // org has an org-level auth method enabled (e.g. SAML)
         // -> logout + redirect to SAML SSO
@@ -116,9 +115,8 @@ export default function LoginPage() {
     [selectOrg]
   );
 
-  useEffect(() => {
+  const handleCliRedirect = useCallback(() => {
     const authToken = getAuthToken();
-    const callbackPort = queryParams.get("callback_port");
 
     if (authToken && !callbackPort) {
       const decodedJwt = jwt_decode(authToken) as any;
@@ -131,13 +129,27 @@ export default function LoginPage() {
     if (!isLoggedIn()) {
       router.push("/login");
     }
+  }, []);
+
+  useEffect(() => {
+    if (callbackPort) {
+      handleCliRedirect();
+    }
   }, [router]);
 
   // Case: User has no organizations.
   // This can happen if the user was previously a member, but the organization was deleted or the user was removed.
   useEffect(() => {
-    if (!organizations.isLoading && organizations.data?.length === 0) {
+    if (organizations.isLoading || !organizations.data) return;
+
+    if (organizations.data.length === 0) {
       router.push("/org/none");
+    } else if (organizations.data.length === 1) {
+      if (callbackPort) {
+        handleCliRedirect();
+      } else {
+        handleSelectOrganization(organizations.data[0]);
+      }
     }
   }, [organizations.isLoading, organizations.data]);
 

From c2c9edf1566f61186e68958f48e593d14b7a9498 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:14:09 +0400
Subject: [PATCH 11/29] Update types.ts

---
 frontend/src/hooks/api/users/types.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/frontend/src/hooks/api/users/types.ts b/frontend/src/hooks/api/users/types.ts
index 825d468da..aa0c2b9ac 100644
--- a/frontend/src/hooks/api/users/types.ts
+++ b/frontend/src/hooks/api/users/types.ts
@@ -149,7 +149,9 @@ export type DeletOrgMembershipDTO = {
 };
 
 export type AddUserToOrgDTO = {
-  inviteeEmail: string;
+  inviteeEmails: string[];
+  projectIds?: string[];
+  organizationRoleSlug?: string;
   organizationId: string;
 };
 

From c5c949e03433beb75b793f141c98f91586dfe5a5 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:14:44 +0400
Subject: [PATCH 12/29] Multi user org invites

---
 frontend/src/components/signup/TeamInviteStep.tsx | 6 +++---
 frontend/src/hooks/api/users/index.tsx            | 5 +++--
 frontend/src/hooks/api/users/queries.tsx          | 7 +++++--
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/frontend/src/components/signup/TeamInviteStep.tsx b/frontend/src/components/signup/TeamInviteStep.tsx
index a06fc3568..b6ce4e208 100644
--- a/frontend/src/components/signup/TeamInviteStep.tsx
+++ b/frontend/src/components/signup/TeamInviteStep.tsx
@@ -2,7 +2,7 @@ import React, { useState } from "react";
 import { useTranslation } from "react-i18next";
 import { useRouter } from "next/router";
 
-import { useAddUserToOrg } from "@app/hooks/api";
+import { useAddUsersToOrg } from "@app/hooks/api";
 import { useFetchServerStatus } from "@app/hooks/api/serverDetails";
 import { usePopUp } from "@app/hooks/usePopUp";
 
@@ -17,7 +17,7 @@ export default function TeamInviteStep(): JSX.Element {
   const [emails, setEmails] = useState("");
   const { data: serverDetails } = useFetchServerStatus();
 
-  const { mutateAsync } = useAddUserToOrg();
+  const { mutateAsync } = useAddUsersToOrg();
   const { handlePopUpToggle, popUp, handlePopUpOpen } = usePopUp(["setUpEmail"] as const);
 
   // Redirect user to the getting started page
@@ -31,7 +31,7 @@ export default function TeamInviteStep(): JSX.Element {
       .map((email) => email.trim())
       .map(async (email) => {
         mutateAsync({
-          inviteeEmail: email,
+          inviteeEmails: [email],
           organizationId: String(localStorage.getItem("orgData.id"))
         });
       });
diff --git a/frontend/src/hooks/api/users/index.tsx b/frontend/src/hooks/api/users/index.tsx
index 2026cede1..ed9e5cc47 100644
--- a/frontend/src/hooks/api/users/index.tsx
+++ b/frontend/src/hooks/api/users/index.tsx
@@ -6,7 +6,7 @@ export {
 } from "./mutation";
 export {
   fetchOrgUsers,
-  useAddUserToOrg,
+  useAddUsersToOrg,
   useCreateAPIKey,
   useDeleteAPIKey,
   useDeleteMe,
@@ -26,4 +26,5 @@ export {
   useRevokeMySessions,
   useUpdateMfaEnabled,
   useUpdateOrgMembership,
-  useUpdateUserAuthMethods} from "./queries";
+  useUpdateUserAuthMethods
+} from "./queries";
diff --git a/frontend/src/hooks/api/users/queries.tsx b/frontend/src/hooks/api/users/queries.tsx
index 4629ce4e6..402781e1c 100644
--- a/frontend/src/hooks/api/users/queries.tsx
+++ b/frontend/src/hooks/api/users/queries.tsx
@@ -157,12 +157,15 @@ export const useGetOrgUsers = (orgId: string) =>
 
 // mutation
 // TODO(akhilmhdh): move all mutation to mutation file
-export const useAddUserToOrg = () => {
+export const useAddUsersToOrg = () => {
   const queryClient = useQueryClient();
   type Response = {
     data: {
       message: string;
-      completeInviteLink: string | undefined;
+      completeInviteLinks: {
+        email: string;
+        link: string;
+      }[];
     };
   };
 

From 384a0daa313ee980948ba2f427b1d79fd7fce3da Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:14:50 +0400
Subject: [PATCH 13/29] Update types.ts

---
 frontend/src/hooks/api/auth/types.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/frontend/src/hooks/api/auth/types.ts b/frontend/src/hooks/api/auth/types.ts
index 1b4dff1f0..5ca5c75a2 100644
--- a/frontend/src/hooks/api/auth/types.ts
+++ b/frontend/src/hooks/api/auth/types.ts
@@ -93,6 +93,7 @@ export type CompleteAccountDTO = {
   salt: string;
   verifier: string;
   password: string;
+  metadata?: string;
 };
 
 export type CompleteAccountSignupDTO = CompleteAccountDTO & {

From d7171a1617b845fc663feb0d935887cd992b74a0 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:14:58 +0400
Subject: [PATCH 14/29] Removed unused code

---
 .../components/basic/dialog/AddUserDialog.tsx | 116 ------------------
 1 file changed, 116 deletions(-)
 delete mode 100644 frontend/src/components/basic/dialog/AddUserDialog.tsx

diff --git a/frontend/src/components/basic/dialog/AddUserDialog.tsx b/frontend/src/components/basic/dialog/AddUserDialog.tsx
deleted file mode 100644
index dd2aede0a..000000000
--- a/frontend/src/components/basic/dialog/AddUserDialog.tsx
+++ /dev/null
@@ -1,116 +0,0 @@
-import { Fragment } from "react";
-import { Dialog, Transition } from "@headlessui/react";
-
-import Button from "../buttons/Button";
-import InputField from "../InputField";
-
-type Props = {
-  isOpen: boolean;
-  closeModal: () => void;
-  submitModal: (email: string) => void;
-  email: string;
-  setEmail: (email: string) => void;
-  orgName: string;
-};
-
-const AddUserDialog = ({ isOpen, closeModal, submitModal, email, setEmail, orgName }: Props) => {
-  const submit = () => {
-    submitModal(email);
-  };
-
-  return (
-    <div className="z-50">
-      <Transition appear show={isOpen} as={Fragment}>
-        <Dialog as="div" className="relative" onClose={closeModal}>
-          <Transition.Child
-            as={Fragment}
-            enter="ease-out duration-300"
-            enterFrom="opacity-0"
-            enterTo="opacity-100"
-            leave="ease-in duration-200"
-            leaveFrom="opacity-100"
-            leaveTo="opacity-0"
-          >
-            <div className="fixed inset-0 bg-black bg-opacity-70" />
-          </Transition.Child>
-
-          <div className="fixed inset-0 overflow-y-auto">
-            <div className="flex min-h-full items-center justify-center p-4 text-center">
-              <Transition.Child
-                as={Fragment}
-                enter="ease-out duration-300"
-                enterFrom="opacity-0 scale-95"
-                enterTo="opacity-100 scale-100"
-                leave="ease-in duration-200"
-                leaveFrom="opacity-100 scale-100"
-                leaveTo="opacity-0 scale-95"
-              >
-                <Dialog.Panel className="w-full max-w-lg transform overflow-hidden rounded-md border border-gray-700 bg-bunker-800 p-6 text-left align-middle shadow-xl transition-all">
-                  <Dialog.Title
-                    as="h3"
-                    className="z-50 text-lg font-medium leading-6 text-gray-400"
-                  >
-                    Invite others to {orgName}
-                  </Dialog.Title>
-                  <div className="mt-2 mb-4">
-                    <p className="text-sm text-gray-500">
-                      An invite is specific to an email address and expires after 1 day. For
-                      security reasons, you will need to separately add members to projects.
-                    </p>
-                  </div>
-                  <div className="max-h-28">
-                    <InputField
-                      label="Email"
-                      onChangeHandler={setEmail}
-                      type="varName"
-                      value={email}
-                      placeholder=""
-                      isRequired
-                    />
-                  </div>
-                  <div className="mt-4 max-w-max">
-                    <Button onButtonPressed={submit} color="mineshaft" text="Invite" size="md" />
-                  </div>
-                </Dialog.Panel>
-                {/* <Dialog.Panel className="w-full max-w-md transform overflow-hidden rounded-md bg-bunker-800 border border-gray-700 p-6 text-left align-middle shadow-xl transition-all">
-									<Dialog.Title
-										as="h3"
-										className="text-xl font-medium leading-6 text-gray-300 z-50"
-									>
-										Unleash Infisical's Full Power
-									</Dialog.Title>
-									<div className="mt-4 mb-4">
-										<p className="text-sm text-gray-400 mb-2">
-											You have exceeded the number of members in a free organization.
-										</p>
-										<p className="text-sm text-gray-400">
-											Upgrade now and get access to adding more members, as well as to other powerful enhancements.
-										</p>
-									</div>
-									<div className="mt-6">
-										<button
-											type="button"
-											className="inline-flex justify-center rounded-md border border-transparent bg-primary px-4 py-2 text-sm font-medium text-black hover:opacity-80 hover:text-semibold duration-200 focus:outline-none focus-visible:ring-2 focus-visible:ring-blue-500 focus-visible:ring-offset-2"
-											onClick={() => router.push("/settings/billing/" + router.query.id)}
-										>
-											Upgrade Now
-										</button>
-										<button
-											type="button"
-											className="ml-2 inline-flex justify-center rounded-md border border-transparent bg-gray-800 px-4 py-2 text-sm font-medium text-gray-400 hover:bg-gray-500 hover:text-black hover:text-semibold duration-200 focus:outline-none focus-visible:ring-2 focus-visible:ring-blue-500 focus-visible:ring-offset-2"
-											onClick={closeModal}
-										>
-											Maybe Later
-										</button>
-									</div>
-								</Dialog.Panel> */}
-              </Transition.Child>
-            </div>
-          </div>
-        </Dialog>
-      </Transition>
-    </div>
-  );
-};
-
-export default AddUserDialog;

From fe04e6d20cc59fa77901f2cd9b0c216895838a4a Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:15:07 +0400
Subject: [PATCH 15/29] Remove *.*.posthog.com

---
 frontend/next.config.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/next.config.js b/frontend/next.config.js
index d1d5876ed..9b9db1346 100644
--- a/frontend/next.config.js
+++ b/frontend/next.config.js
@@ -2,7 +2,7 @@ const path = require("path");
 
 const ContentSecurityPolicy = `
 	default-src 'self';
-	script-src 'self' https://*.posthog.com https://*.*.posthog.com https://js.stripe.com https://api.stripe.com https://widget.intercom.io https://js.intercomcdn.com https://hcaptcha.com https://*.hcaptcha.com 'unsafe-inline' 'unsafe-eval';
+	script-src 'self' https://*.posthog.com https://js.stripe.com https://api.stripe.com https://widget.intercom.io https://js.intercomcdn.com https://hcaptcha.com https://*.hcaptcha.com 'unsafe-inline' 'unsafe-eval';
 	style-src 'self' https://rsms.me 'unsafe-inline' https://hcaptcha.com https://*.hcaptcha.com;
 	child-src https://api.stripe.com;
 	frame-src https://js.stripe.com/ https://api.stripe.com https://www.youtube.com/ https://hcaptcha.com https://*.hcaptcha.com;

From 3f1f018adca2354ebcc19156d8dc81c3a7bb7e08 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:15:12 +0400
Subject: [PATCH 16/29] Update telemetry-types.ts

---
 backend/src/services/telemetry/telemetry-types.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/backend/src/services/telemetry/telemetry-types.ts b/backend/src/services/telemetry/telemetry-types.ts
index b168fe5d7..ddeb24211 100644
--- a/backend/src/services/telemetry/telemetry-types.ts
+++ b/backend/src/services/telemetry/telemetry-types.ts
@@ -100,7 +100,9 @@ export type TIntegrationCreatedEvent = {
 export type TUserOrgInvitedEvent = {
   event: PostHogEventTypes.UserOrgInvitation;
   properties: {
-    inviteeEmail: string;
+    inviteeEmails: string[];
+    projectIds?: string[];
+    organizationRoleSlug?: string;
   };
 };
 

From 07fd67b32896a53d7a407386854d8cf5cb873318 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:15:26 +0400
Subject: [PATCH 17/29] Add metadata to SMTP email

---
 .../services/smtp/templates/organizationInvitation.handlebars   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/src/services/smtp/templates/organizationInvitation.handlebars b/backend/src/services/smtp/templates/organizationInvitation.handlebars
index 024fca132..3ee16ee37 100644
--- a/backend/src/services/smtp/templates/organizationInvitation.handlebars
+++ b/backend/src/services/smtp/templates/organizationInvitation.handlebars
@@ -9,7 +9,7 @@
 <body>
     <h2>Join your organization on Infisical</h2>
     <p>{{inviterFirstName}} ({{inviterUsername}}) has invited you to their Infisical organization — {{organizationName}}</p>
-    <a href="{{callback_url}}?token={{token}}&to={{email}}&organization_id={{organizationId}}">Join now</a>
+    <a href="{{callback_url}}?token={{token}}{{#if metadata}}&metadata={{metadata}}{{/if}}&to={{email}}&organization_id={{organizationId}}">Join now</a>
     <h3>What is Infisical?</h3>
     <p>Infisical is an easy-to-use end-to-end encrypted tool that enables developers to sync and manage their secrets and configs.</p>
 </body>

From 626e37e3d009487a6a3e3ce71606453e836af884 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:15:51 +0400
Subject: [PATCH 18/29] Moved project membership creation to project membership
 fns

---
 .../project-membership-fns.ts                 | 184 ++++++++++++++++++
 .../project-membership-service.ts             | 134 ++-----------
 2 files changed, 201 insertions(+), 117 deletions(-)
 create mode 100644 backend/src/services/project-membership/project-membership-fns.ts

diff --git a/backend/src/services/project-membership/project-membership-fns.ts b/backend/src/services/project-membership/project-membership-fns.ts
new file mode 100644
index 000000000..6395f5324
--- /dev/null
+++ b/backend/src/services/project-membership/project-membership-fns.ts
@@ -0,0 +1,184 @@
+import { Knex } from "knex";
+
+import { ProjectMembershipRole, SecretKeyEncoding, TProjectMemberships } from "@app/db/schemas";
+import { TUserGroupMembershipDALFactory } from "@app/ee/services/group/user-group-membership-dal";
+import { getConfig } from "@app/lib/config/env";
+import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
+import { BadRequestError } from "@app/lib/errors";
+import { groupBy } from "@app/lib/fn";
+
+import { TOrgDALFactory } from "../org/org-dal";
+import { TProjectDALFactory } from "../project/project-dal";
+import { assignWorkspaceKeysToMembers } from "../project/project-fns";
+import { TProjectBotDALFactory } from "../project-bot/project-bot-dal";
+import { TProjectKeyDALFactory } from "../project-key/project-key-dal";
+import { SmtpTemplates, TSmtpService } from "../smtp/smtp-service";
+import { TProjectMembershipDALFactory } from "./project-membership-dal";
+import { TProjectUserMembershipRoleDALFactory } from "./project-user-membership-role-dal";
+
+type TAddMembersToProjectArg = {
+  orgDAL: Pick<TOrgDALFactory, "findMembership" | "findOrgMembersByUsername">;
+  projectMembershipDAL: Pick<TProjectMembershipDALFactory, "find" | "transaction" | "insertMany">;
+  projectDAL: Pick<TProjectDALFactory, "findProjectById" | "findProjectGhostUser">;
+  projectKeyDAL: Pick<TProjectKeyDALFactory, "findLatestProjectKey" | "insertMany">;
+  projectBotDAL: Pick<TProjectBotDALFactory, "findOne">;
+  userGroupMembershipDAL: Pick<TUserGroupMembershipDALFactory, "findUserGroupMembershipsInProject">;
+  projectUserMembershipRoleDAL: Pick<TProjectUserMembershipRoleDALFactory, "insertMany">;
+  smtpService: Pick<TSmtpService, "sendMail">;
+};
+
+type AddMembersToNonE2EEProjectDTO = {
+  emails: string[];
+  usernames: string[];
+  projectId: string;
+  projectMembershipRole: ProjectMembershipRole;
+  sendEmails?: boolean;
+};
+
+export const addMembersToProject = ({
+  orgDAL,
+  projectDAL,
+  projectMembershipDAL,
+  projectKeyDAL,
+  projectBotDAL,
+  userGroupMembershipDAL,
+  projectUserMembershipRoleDAL,
+  smtpService
+}: TAddMembersToProjectArg) => {
+  const addMembersToNonE2EEProject = async (
+    { emails, usernames, projectId, projectMembershipRole, sendEmails }: AddMembersToNonE2EEProjectDTO,
+    transaction?: Knex
+  ) => {
+    const processTransaction = async (tx: Knex) => {
+      const usernamesAndEmails = [...emails, ...usernames];
+
+      const project = await projectDAL.findProjectById(projectId);
+      if (!project) throw new BadRequestError({ message: "Project not found" });
+
+      const orgMembers = await orgDAL.findOrgMembersByUsername(
+        project.orgId,
+        [...new Set(usernamesAndEmails.map((element) => element.toLowerCase()))],
+        tx
+      );
+
+      // const allorgMembers = await orgDAL.findAllOrgMembers(project.orgId,);
+
+      console.log("usernameandena", usernamesAndEmails);
+      console.log("orgMembers", orgMembers);
+      // console.log("allorgMembers", allorgMembers);
+
+      if (orgMembers.length !== usernamesAndEmails.length)
+        throw new BadRequestError({ message: "Some users are not part of org" });
+
+      if (!orgMembers.length) return [];
+
+      const existingMembers = await projectMembershipDAL.find({
+        projectId,
+        $in: { userId: orgMembers.map(({ user }) => user.id).filter(Boolean) }
+      });
+      if (existingMembers.length) throw new BadRequestError({ message: "Some users are already part of project" });
+
+      const ghostUser = await projectDAL.findProjectGhostUser(projectId);
+
+      if (!ghostUser) {
+        throw new BadRequestError({
+          message: "Failed to find sudo user"
+        });
+      }
+
+      const ghostUserLatestKey = await projectKeyDAL.findLatestProjectKey(ghostUser.id, projectId);
+
+      if (!ghostUserLatestKey) {
+        throw new BadRequestError({
+          message: "Failed to find sudo user latest key"
+        });
+      }
+
+      const bot = await projectBotDAL.findOne({ projectId });
+      if (!bot) {
+        throw new BadRequestError({
+          message: "Failed to find bot"
+        });
+      }
+
+      const botPrivateKey = infisicalSymmetricDecrypt({
+        keyEncoding: bot.keyEncoding as SecretKeyEncoding,
+        iv: bot.iv,
+        tag: bot.tag,
+        ciphertext: bot.encryptedPrivateKey
+      });
+
+      const newWsMembers = assignWorkspaceKeysToMembers({
+        decryptKey: ghostUserLatestKey,
+        userPrivateKey: botPrivateKey,
+        members: orgMembers.map((membership) => ({
+          orgMembershipId: membership.id,
+          projectMembershipRole,
+          userPublicKey: membership.user.publicKey
+        }))
+      });
+
+      const members: TProjectMemberships[] = [];
+
+      const userIdsToExcludeForProjectKeyAddition = new Set(
+        await userGroupMembershipDAL.findUserGroupMembershipsInProject(usernamesAndEmails, projectId)
+      );
+      const projectMemberships = await projectMembershipDAL.insertMany(
+        orgMembers.map(({ user }) => ({
+          projectId,
+          userId: user.id
+        })),
+        tx
+      );
+      await projectUserMembershipRoleDAL.insertMany(
+        projectMemberships.map(({ id }) => ({ projectMembershipId: id, role: ProjectMembershipRole.Member })),
+        tx
+      );
+
+      members.push(...projectMemberships);
+
+      const encKeyGroupByOrgMembId = groupBy(newWsMembers, (i) => i.orgMembershipId);
+      await projectKeyDAL.insertMany(
+        orgMembers
+          .filter(({ user }) => !userIdsToExcludeForProjectKeyAddition.has(user.id))
+          .map(({ user, id }) => ({
+            encryptedKey: encKeyGroupByOrgMembId[id][0].workspaceEncryptedKey,
+            nonce: encKeyGroupByOrgMembId[id][0].workspaceEncryptedNonce,
+            senderId: ghostUser.id,
+            receiverId: user.id,
+            projectId
+          })),
+        tx
+      );
+
+      if (sendEmails) {
+        const recipients = orgMembers.filter((i) => i.user.email).map((i) => i.user.email as string);
+
+        const appCfg = getConfig();
+
+        if (recipients.length) {
+          await smtpService.sendMail({
+            template: SmtpTemplates.WorkspaceInvite,
+            subjectLine: "Infisical project invitation",
+            recipients: orgMembers.filter((i) => i.user.email).map((i) => i.user.email as string),
+            substitutions: {
+              workspaceName: project.name,
+              callback_url: `${appCfg.SITE_URL}/login`
+            }
+          });
+        }
+      }
+
+      return members;
+    };
+
+    if (transaction) {
+      return processTransaction(transaction);
+    }
+    return projectMembershipDAL.transaction(processTransaction);
+  };
+
+  return {
+    addMembersToNonE2EEProject
+  };
+};
diff --git a/backend/src/services/project-membership/project-membership-service.ts b/backend/src/services/project-membership/project-membership-service.ts
index 6996625f7..077838918 100644
--- a/backend/src/services/project-membership/project-membership-service.ts
+++ b/backend/src/services/project-membership/project-membership-service.ts
@@ -2,19 +2,12 @@
 import { ForbiddenError } from "@casl/ability";
 import ms from "ms";
 
-import {
-  ProjectMembershipRole,
-  ProjectVersion,
-  SecretKeyEncoding,
-  TableName,
-  TProjectMemberships
-} from "@app/db/schemas";
+import { ProjectMembershipRole, ProjectVersion, TableName } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-dal";
 import { getConfig } from "@app/lib/config/env";
-import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
 import { BadRequestError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 
@@ -23,13 +16,13 @@ import { ActorType } from "../auth/auth-type";
 import { TGroupProjectDALFactory } from "../group-project/group-project-dal";
 import { TOrgDALFactory } from "../org/org-dal";
 import { TProjectDALFactory } from "../project/project-dal";
-import { assignWorkspaceKeysToMembers } from "../project/project-fns";
 import { TProjectBotDALFactory } from "../project-bot/project-bot-dal";
 import { TProjectKeyDALFactory } from "../project-key/project-key-dal";
 import { TProjectRoleDALFactory } from "../project-role/project-role-dal";
 import { SmtpTemplates, TSmtpService } from "../smtp/smtp-service";
 import { TUserDALFactory } from "../user/user-dal";
 import { TProjectMembershipDALFactory } from "./project-membership-dal";
+import { addMembersToProject } from "./project-membership-fns";
 import {
   ProjectUserMembershipTemporaryMode,
   TAddUsersToWorkspaceDTO,
@@ -53,7 +46,7 @@ type TProjectMembershipServiceFactoryDep = {
   userGroupMembershipDAL: TUserGroupMembershipDALFactory;
   projectRoleDAL: Pick<TProjectRoleDALFactory, "find">;
   orgDAL: Pick<TOrgDALFactory, "findMembership" | "findOrgMembersByUsername">;
-  projectDAL: Pick<TProjectDALFactory, "findById" | "findProjectGhostUser" | "transaction">;
+  projectDAL: Pick<TProjectDALFactory, "findById" | "findProjectGhostUser" | "transaction" | "findProjectById">;
   projectKeyDAL: Pick<TProjectKeyDALFactory, "findLatestProjectKey" | "delete" | "insertMany">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
   projectUserAdditionalPrivilegeDAL: Pick<TProjectUserAdditionalPrivilegeDALFactory, "delete">;
@@ -247,116 +240,23 @@ export const projectMembershipServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Member);
 
-    const usernamesAndEmails = [...emails, ...usernames];
-
-    const orgMembers = await orgDAL.findOrgMembersByUsername(project.orgId, [
-      ...new Set(usernamesAndEmails.map((element) => element.toLowerCase()))
-    ]);
-
-    if (orgMembers.length !== usernamesAndEmails.length)
-      throw new BadRequestError({ message: "Some users are not part of org" });
-
-    if (!orgMembers.length) return [];
-
-    const existingMembers = await projectMembershipDAL.find({
+    const members = await addMembersToProject({
+      orgDAL,
+      projectDAL,
+      projectMembershipDAL,
+      projectKeyDAL,
+      userGroupMembershipDAL,
+      projectBotDAL,
+      projectUserMembershipRoleDAL,
+      smtpService
+    }).addMembersToNonE2EEProject({
+      emails,
+      usernames,
       projectId,
-      $in: { userId: orgMembers.map(({ user }) => user.id).filter(Boolean) }
-    });
-    if (existingMembers.length) throw new BadRequestError({ message: "Some users are already part of project" });
-
-    const ghostUser = await projectDAL.findProjectGhostUser(projectId);
-
-    if (!ghostUser) {
-      throw new BadRequestError({
-        message: "Failed to find sudo user"
-      });
-    }
-
-    const ghostUserLatestKey = await projectKeyDAL.findLatestProjectKey(ghostUser.id, projectId);
-
-    if (!ghostUserLatestKey) {
-      throw new BadRequestError({
-        message: "Failed to find sudo user latest key"
-      });
-    }
-
-    const bot = await projectBotDAL.findOne({ projectId });
-    if (!bot) {
-      throw new BadRequestError({
-        message: "Failed to find bot"
-      });
-    }
-
-    const botPrivateKey = infisicalSymmetricDecrypt({
-      keyEncoding: bot.keyEncoding as SecretKeyEncoding,
-      iv: bot.iv,
-      tag: bot.tag,
-      ciphertext: bot.encryptedPrivateKey
+      projectMembershipRole: ProjectMembershipRole.Member,
+      sendEmails
     });
 
-    const newWsMembers = assignWorkspaceKeysToMembers({
-      decryptKey: ghostUserLatestKey,
-      userPrivateKey: botPrivateKey,
-      members: orgMembers.map((membership) => ({
-        orgMembershipId: membership.id,
-        projectMembershipRole: ProjectMembershipRole.Member,
-        userPublicKey: membership.user.publicKey
-      }))
-    });
-
-    const members: TProjectMemberships[] = [];
-
-    const userIdsToExcludeForProjectKeyAddition = new Set(
-      await userGroupMembershipDAL.findUserGroupMembershipsInProject(usernamesAndEmails, projectId)
-    );
-
-    await projectMembershipDAL.transaction(async (tx) => {
-      const projectMemberships = await projectMembershipDAL.insertMany(
-        orgMembers.map(({ user }) => ({
-          projectId,
-          userId: user.id
-        })),
-        tx
-      );
-      await projectUserMembershipRoleDAL.insertMany(
-        projectMemberships.map(({ id }) => ({ projectMembershipId: id, role: ProjectMembershipRole.Member })),
-        tx
-      );
-
-      members.push(...projectMemberships);
-
-      const encKeyGroupByOrgMembId = groupBy(newWsMembers, (i) => i.orgMembershipId);
-      await projectKeyDAL.insertMany(
-        orgMembers
-          .filter(({ user }) => !userIdsToExcludeForProjectKeyAddition.has(user.id))
-          .map(({ user, id }) => ({
-            encryptedKey: encKeyGroupByOrgMembId[id][0].workspaceEncryptedKey,
-            nonce: encKeyGroupByOrgMembId[id][0].workspaceEncryptedNonce,
-            senderId: ghostUser.id,
-            receiverId: user.id,
-            projectId
-          })),
-        tx
-      );
-    });
-
-    if (sendEmails) {
-      const recipients = orgMembers.filter((i) => i.user.email).map((i) => i.user.email as string);
-
-      const appCfg = getConfig();
-
-      if (recipients.length) {
-        await smtpService.sendMail({
-          template: SmtpTemplates.WorkspaceInvite,
-          subjectLine: "Infisical project invitation",
-          recipients: orgMembers.filter((i) => i.user.email).map((i) => i.user.email as string),
-          substitutions: {
-            workspaceName: project.name,
-            callback_url: `${appCfg.SITE_URL}/login`
-          }
-        });
-      }
-    }
     return members;
   };
 

From 1d096930419451f188739fa2cd7231fa4ff8e1de Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:16:08 +0400
Subject: [PATCH 19/29] Update org-types.ts

---
 backend/src/services/org/org-types.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/backend/src/services/org/org-types.ts b/backend/src/services/org/org-types.ts
index 08b4c1c92..dbc2f7e2e 100644
--- a/backend/src/services/org/org-types.ts
+++ b/backend/src/services/org/org-types.ts
@@ -29,7 +29,9 @@ export type TInviteUserToOrgDTO = {
   orgId: string;
   actorOrgId: string | undefined;
   actorAuthMethod: ActorAuthMethod;
-  inviteeEmail: string;
+  inviteeEmails: string[];
+  organizationRoleSlug?: string;
+  projectIds?: string[];
 };
 
 export type TVerifyUserToOrgDTO = {

From fbf3f26abd9c579acaaaa758bb7e4e806a167b42 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:16:46 +0400
Subject: [PATCH 20/29] Refactored org invites to allow for multiple users and
 to handle project invites

---
 backend/src/services/org/org-service.ts | 260 ++++++++++++++++--------
 1 file changed, 174 insertions(+), 86 deletions(-)

diff --git a/backend/src/services/org/org-service.ts b/backend/src/services/org/org-service.ts
index 23e0aeeff..e6c8944ff 100644
--- a/backend/src/services/org/org-service.ts
+++ b/backend/src/services/org/org-service.ts
@@ -4,9 +4,10 @@ import crypto from "crypto";
 import jwt from "jsonwebtoken";
 import { Knex } from "knex";
 
-import { OrgMembershipRole, OrgMembershipStatus, TableName } from "@app/db/schemas";
+import { OrgMembershipRole, OrgMembershipStatus, ProjectMembershipRole, TableName, TUsers } from "@app/db/schemas";
 import { TProjects } from "@app/db/schemas/projects";
 import { TGroupDALFactory } from "@app/ee/services/group/group-dal";
+import { TUserGroupMembershipDALFactory } from "@app/ee/services/group/user-group-membership-dal";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
@@ -24,10 +25,13 @@ import { TUserAliasDALFactory } from "@app/services/user-alias/user-alias-dal";
 
 import { ActorAuthMethod, ActorType, AuthMethod, AuthTokenType } from "../auth/auth-type";
 import { TAuthTokenServiceFactory } from "../auth-token/auth-token-service";
-import { TokenType } from "../auth-token/auth-token-types";
+import { TokenMetadataType, TokenType } from "../auth-token/auth-token-types";
 import { TProjectDALFactory } from "../project/project-dal";
+import { TProjectBotDALFactory } from "../project-bot/project-bot-dal";
 import { TProjectKeyDALFactory } from "../project-key/project-key-dal";
 import { TProjectMembershipDALFactory } from "../project-membership/project-membership-dal";
+import { addMembersToProject } from "../project-membership/project-membership-fns";
+import { TProjectUserMembershipRoleDALFactory } from "../project-membership/project-user-membership-role-dal";
 import { SmtpTemplates, TSmtpService } from "../smtp/smtp-service";
 import { TUserDALFactory } from "../user/user-dal";
 import { TIncidentContactsDALFactory } from "./incident-contacts-dal";
@@ -56,8 +60,11 @@ type TOrgServiceFactoryDep = {
   userDAL: TUserDALFactory;
   groupDAL: TGroupDALFactory;
   projectDAL: TProjectDALFactory;
-  projectMembershipDAL: Pick<TProjectMembershipDALFactory, "findProjectMembershipsByUserId" | "delete">;
-  projectKeyDAL: Pick<TProjectKeyDALFactory, "find" | "delete">;
+  projectMembershipDAL: Pick<
+    TProjectMembershipDALFactory,
+    "findProjectMembershipsByUserId" | "delete" | "create" | "find" | "insertMany" | "transaction"
+  >;
+  projectKeyDAL: Pick<TProjectKeyDALFactory, "find" | "delete" | "insertMany" | "findLatestProjectKey">;
   orgMembershipDAL: Pick<TOrgMembershipDALFactory, "findOrgMembershipById" | "findOne">;
   incidentContactDAL: TIncidentContactsDALFactory;
   samlConfigDAL: Pick<TSamlConfigDALFactory, "findOne" | "findEnforceableSamlCfg">;
@@ -69,6 +76,9 @@ type TOrgServiceFactoryDep = {
     "getPlan" | "updateSubscriptionOrgMemberCount" | "generateOrgCustomerId" | "removeOrgCustomer"
   >;
   projectUserAdditionalPrivilegeDAL: Pick<TProjectUserAdditionalPrivilegeDALFactory, "delete">;
+  userGroupMembershipDAL: Pick<TUserGroupMembershipDALFactory, "findUserGroupMembershipsInProject">;
+  projectBotDAL: Pick<TProjectBotDALFactory, "findOne">;
+  projectUserMembershipRoleDAL: Pick<TProjectUserMembershipRoleDALFactory, "insertMany">;
 };
 
 export type TOrgServiceFactory = ReturnType<typeof orgServiceFactory>;
@@ -90,7 +100,10 @@ export const orgServiceFactory = ({
   tokenService,
   orgBotDAL,
   licenseService,
-  samlConfigDAL
+  samlConfigDAL,
+  userGroupMembershipDAL,
+  projectBotDAL,
+  projectUserMembershipRoleDAL
 }: TOrgServiceFactoryDep) => {
   /*
    * Get organization details by the organization id
@@ -420,10 +433,14 @@ export const orgServiceFactory = ({
   const inviteUserToOrganization = async ({
     orgId,
     userId,
-    inviteeEmail,
+    inviteeEmails,
+    organizationRoleSlug,
+    projectIds,
     actorAuthMethod,
     actorOrgId
   }: TInviteUserToOrgDTO) => {
+    const appCfg = getConfig();
+
     const { permission } = await permissionService.getUserOrgPermission(userId, orgId, actorAuthMethod, actorOrgId);
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Member);
 
@@ -450,98 +467,169 @@ export const orgServiceFactory = ({
       });
     }
 
-    const invitee = await orgDAL.transaction(async (tx) => {
-      const inviteeUser = await userDAL.findUserByUsername(inviteeEmail, tx);
-      if (inviteeUser) {
-        // if user already exist means its already part of infisical
-        // Thus the signup flow is not needed anymore
-        const [inviteeMembership] = await orgDAL.findMembership(
-          {
-            [`${TableName.OrgMembership}.orgId` as "orgId"]: orgId,
-            [`${TableName.OrgMembership}.userId` as "userId"]: inviteeUser.id
-          },
-          { tx }
-        );
-        if (inviteeMembership && inviteeMembership.status === OrgMembershipStatus.Accepted) {
+    const inviteeUsers = await orgDAL.transaction(async (tx) => {
+      const users: Pick<
+        TUsers & { orgId: string },
+        "id" | "firstName" | "lastName" | "email" | "orgId" | "username"
+      >[] = [];
+      for await (const inviteeEmail of inviteeEmails) {
+        const inviteeUser = await userDAL.findUserByUsername(inviteeEmail, tx);
+        if (inviteeUser) {
+          // if user already exist means its already part of infisical
+          // Thus the signup flow is not needed anymore
+          const [inviteeMembership] = await orgDAL.findMembership(
+            {
+              [`${TableName.OrgMembership}.orgId` as "orgId"]: orgId,
+              [`${TableName.OrgMembership}.userId` as "userId"]: inviteeUser.id
+            },
+            { tx }
+          );
+          if (inviteeMembership && inviteeMembership.status === OrgMembershipStatus.Accepted) {
+            throw new BadRequestError({
+              message: `Failed to invite members because ${inviteeEmail} is already part of the organization`,
+              name: "Invite user to org"
+            });
+          }
+
+          if (!inviteeMembership) {
+            await orgDAL.createMembership(
+              {
+                userId: inviteeUser.id,
+                inviteEmail: inviteeEmail,
+                orgId,
+                role: OrgMembershipRole.Member,
+                status: OrgMembershipStatus.Invited,
+                isActive: true
+              },
+              tx
+            );
+
+            if (projectIds) {
+              for await (const projectId of projectIds) {
+                await projectMembershipDAL.create(
+                  {
+                    projectId,
+                    userId: inviteeUser.id
+                  },
+                  tx
+                );
+
+                await addMembersToProject({
+                  orgDAL,
+                  projectDAL,
+                  projectMembershipDAL,
+                  projectKeyDAL,
+                  userGroupMembershipDAL,
+                  projectBotDAL,
+                  projectUserMembershipRoleDAL,
+                  smtpService
+                }).addMembersToNonE2EEProject(
+                  {
+                    emails: [inviteeEmail],
+                    usernames: [],
+                    projectId,
+                    projectMembershipRole: ProjectMembershipRole.Member,
+                    sendEmails: false
+                  },
+                  tx
+                );
+              }
+            }
+          }
+          return [{ ...inviteeUser, orgId }];
+        }
+        const isEmailInvalid = await isDisposableEmail(inviteeEmail);
+        if (isEmailInvalid) {
           throw new BadRequestError({
-            message: "Failed to invite an existing member of org",
-            name: "Invite user to org"
+            message: "Provided a disposable email",
+            name: "Org invite"
           });
         }
+        // not invited before
+        const user = await userDAL.create(
+          {
+            username: inviteeEmail,
+            email: inviteeEmail,
+            isAccepted: false,
+            authMethods: [AuthMethod.EMAIL],
+            isGhost: false
+          },
+          tx
+        );
+        await orgDAL.createMembership(
+          {
+            inviteEmail: inviteeEmail,
+            orgId,
+            userId: user.id,
+            role: organizationRoleSlug || OrgMembershipRole.Member,
+            status: OrgMembershipStatus.Invited,
+            isActive: true
+          },
+          tx
+        );
 
-        if (!inviteeMembership) {
-          await orgDAL.createMembership(
-            {
-              userId: inviteeUser.id,
-              inviteEmail: inviteeEmail,
-              orgId,
-              role: OrgMembershipRole.Member,
-              status: OrgMembershipStatus.Invited,
-              isActive: true
-            },
-            tx
-          );
-        }
-        return inviteeUser;
-      }
-      const isEmailInvalid = await isDisposableEmail(inviteeEmail);
-      if (isEmailInvalid) {
-        throw new BadRequestError({
-          message: "Provided a disposable email",
-          name: "Org invite"
+        users.push({
+          ...user,
+          orgId
         });
       }
-      // not invited before
-      const user = await userDAL.create(
-        {
-          username: inviteeEmail,
-          email: inviteeEmail,
-          isAccepted: false,
-          authMethods: [AuthMethod.EMAIL],
-          isGhost: false
-        },
-        tx
-      );
-      await orgDAL.createMembership(
-        {
-          inviteEmail: inviteeEmail,
-          orgId,
-          userId: user.id,
-          role: OrgMembershipRole.Member,
-          status: OrgMembershipStatus.Invited,
-          isActive: true
-        },
-        tx
-      );
-      return user;
-    });
-
-    const token = await tokenService.createTokenForUser({
-      type: TokenType.TOKEN_EMAIL_ORG_INVITATION,
-      userId: invitee.id,
-      orgId
+      return users;
     });
 
     const user = await userDAL.findById(userId);
-    const appCfg = getConfig();
-    await smtpService.sendMail({
-      template: SmtpTemplates.OrgInvite,
-      subjectLine: "Infisical organization invitation",
-      recipients: [inviteeEmail],
-      substitutions: {
-        inviterFirstName: user.firstName,
-        inviterUsername: user.username,
-        organizationName: org?.name,
-        email: inviteeEmail,
-        organizationId: org?.id.toString(),
-        token,
-        callback_url: `${appCfg.SITE_URL}/signupinvite`
-      }
-    });
 
+    const tokenMap: { email: string; link: string }[] = [];
+    if (inviteeUsers) {
+      for await (const invitee of inviteeUsers) {
+        const token = await tokenService.createTokenForUser({
+          type: TokenType.TOKEN_EMAIL_ORG_INVITATION,
+          userId: invitee.id,
+          orgId
+        });
+
+        let inviteMetadata: string = "";
+        if (projectIds && projectIds.length > 0) {
+          inviteMetadata = jwt.sign(
+            {
+              type: TokenMetadataType.InviteToProjects,
+              projectIds,
+              userId: invitee.id
+            },
+            appCfg.AUTH_SECRET,
+            {
+              expiresIn: appCfg.JWT_INVITE_LIFETIME
+            }
+          );
+        }
+
+        tokenMap.push({
+          email: invitee.email || invitee.username,
+          link: `${appCfg.SITE_URL}/signupinvite?token=${token}${
+            inviteMetadata ? `&metadata=${inviteMetadata}` : ""
+          }&to=${invitee.email || invitee.username}&organization_id=${org?.id}`
+        });
+
+        await smtpService.sendMail({
+          template: SmtpTemplates.OrgInvite,
+          subjectLine: "Infisical organization invitation",
+          recipients: [invitee.email || invitee.username],
+          substitutions: {
+            metadata: inviteMetadata,
+            inviterFirstName: user.firstName,
+            inviterUsername: user.username,
+            organizationName: org?.name,
+            email: invitee.email || invitee.username,
+            organizationId: org?.id.toString(),
+            token,
+            callback_url: `${appCfg.SITE_URL}/signupinvite`
+          }
+        });
+      }
+    }
     await licenseService.updateSubscriptionOrgMemberCount(orgId);
+
     if (!appCfg.isSmtpConfigured) {
-      return `${appCfg.SITE_URL}/signupinvite?token=${token}&to=${inviteeEmail}&organization_id=${org?.id}`;
+      return tokenMap;
     }
   };
 

From 783d4c7bd65ece0b1db0ff113aca27dcd4138ad5 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:16:55 +0400
Subject: [PATCH 21/29] Update org-dal.ts

---
 backend/src/services/org/org-dal.ts | 31 +++++++++++++++--------------
 1 file changed, 16 insertions(+), 15 deletions(-)

diff --git a/backend/src/services/org/org-dal.ts b/backend/src/services/org/org-dal.ts
index 051869429..d7c6ba31a 100644
--- a/backend/src/services/org/org-dal.ts
+++ b/backend/src/services/org/org-dal.ts
@@ -114,10 +114,11 @@ export const orgDALFactory = (db: TDbClient) => {
     }
   };
 
-  const findOrgMembersByUsername = async (orgId: string, usernames: string[]) => {
+  const findOrgMembersByUsername = async (orgId: string, usernames: string[], tx?: Knex) => {
     try {
-      const members = await db
-        .replicaNode()(TableName.OrgMembership)
+      const conn = tx || db;
+      const members = await conn(TableName.OrgMembership)
+        // .replicaNode()(TableName.OrgMembership)
         .where(`${TableName.OrgMembership}.orgId`, orgId)
         .join(TableName.Users, `${TableName.OrgMembership}.userId`, `${TableName.Users}.id`)
         .leftJoin<TUserEncryptionKeys>(
@@ -126,18 +127,18 @@ export const orgDALFactory = (db: TDbClient) => {
           `${TableName.Users}.id`
         )
         .select(
-          db.ref("id").withSchema(TableName.OrgMembership),
-          db.ref("inviteEmail").withSchema(TableName.OrgMembership),
-          db.ref("orgId").withSchema(TableName.OrgMembership),
-          db.ref("role").withSchema(TableName.OrgMembership),
-          db.ref("roleId").withSchema(TableName.OrgMembership),
-          db.ref("status").withSchema(TableName.OrgMembership),
-          db.ref("username").withSchema(TableName.Users),
-          db.ref("email").withSchema(TableName.Users),
-          db.ref("firstName").withSchema(TableName.Users),
-          db.ref("lastName").withSchema(TableName.Users),
-          db.ref("id").withSchema(TableName.Users).as("userId"),
-          db.ref("publicKey").withSchema(TableName.UserEncryptionKey)
+          conn.ref("id").withSchema(TableName.OrgMembership),
+          conn.ref("inviteEmail").withSchema(TableName.OrgMembership),
+          conn.ref("orgId").withSchema(TableName.OrgMembership),
+          conn.ref("role").withSchema(TableName.OrgMembership),
+          conn.ref("roleId").withSchema(TableName.OrgMembership),
+          conn.ref("status").withSchema(TableName.OrgMembership),
+          conn.ref("username").withSchema(TableName.Users),
+          conn.ref("email").withSchema(TableName.Users),
+          conn.ref("firstName").withSchema(TableName.Users),
+          conn.ref("lastName").withSchema(TableName.Users),
+          conn.ref("id").withSchema(TableName.Users).as("userId"),
+          conn.ref("publicKey").withSchema(TableName.UserEncryptionKey)
         )
         .where({ isGhost: false })
         .whereIn("username", usernames);

From 2ecfd1bb7e38779666e0c253ebc75524249e39be Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 22 Aug 2024 08:17:05 +0400
Subject: [PATCH 22/29] Update auth-signup-type.ts

---
 backend/src/services/auth/auth-signup-type.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/backend/src/services/auth/auth-signup-type.ts b/backend/src/services/auth/auth-signup-type.ts
index 9cd70f8c7..c5c535f39 100644
--- a/backend/src/services/auth/auth-signup-type.ts
+++ b/backend/src/services/auth/auth-signup-type.ts
@@ -37,4 +37,5 @@ export type TCompleteAccountInviteDTO = {
   ip: string;
   userAgent: string;
   authorization: string;
+  metadata?: string;
 };

From 06d8800ee0a1f0993004b52afbd982db9e2db910 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Fri, 23 Aug 2024 00:51:11 +0400
Subject: [PATCH 23/29] Feat: Specify organization role and projects when
 inviting users to org

---
 backend/src/server/routes/index.ts            |   1 +
 .../src/server/routes/v1/invite-org-router.ts |   6 +-
 .../src/server/routes/v1/project-router.ts    |  28 ++-
 .../services/auth-token/auth-token-types.ts   |  13 +-
 .../src/services/auth/auth-signup-service.ts  |  19 +-
 backend/src/services/org/org-service.ts       |  67 +++++-
 backend/src/services/org/org-types.ts         |   4 +-
 .../project-membership-fns.ts                 |  28 ++-
 .../services/project-role/project-role-fns.ts |  52 +++++
 .../project-role/project-role-service.ts      |  52 +----
 backend/src/services/project/project-fns.ts   |  11 +
 .../src/services/project/project-service.ts   |  37 ++-
 backend/src/services/project/project-types.ts |   4 +
 .../src/components/signup/TeamInviteStep.tsx  |   3 +-
 frontend/src/hooks/api/roles/queries.tsx      |   2 +-
 frontend/src/hooks/api/users/queries.tsx      |   2 +-
 frontend/src/hooks/api/users/types.ts         |   3 +-
 frontend/src/hooks/api/workspace/queries.tsx  |  12 +-
 frontend/src/hooks/api/workspace/types.ts     |   4 +
 .../OrgMembersSection/AddOrgMemberModal.tsx   | 211 +++++++++++-------
 .../OrgMembersSection/OrgMembersTable.tsx     |   3 +-
 .../components/UserDetailsSection.tsx         |   3 +-
 22 files changed, 387 insertions(+), 178 deletions(-)
 create mode 100644 backend/src/services/project-role/project-role-fns.ts

diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts
index d1ce11db1..99c9626f4 100644
--- a/backend/src/server/routes/index.ts
+++ b/backend/src/server/routes/index.ts
@@ -688,6 +688,7 @@ export const registerRoutes = async (
     orgDAL,
     orgService,
     projectMembershipDAL,
+    projectRoleDAL,
     folderDAL,
     licenseService,
     certificateAuthorityDAL,
diff --git a/backend/src/server/routes/v1/invite-org-router.ts b/backend/src/server/routes/v1/invite-org-router.ts
index be9fdbf74..c2907d3ca 100644
--- a/backend/src/server/routes/v1/invite-org-router.ts
+++ b/backend/src/server/routes/v1/invite-org-router.ts
@@ -1,6 +1,6 @@
 import { z } from "zod";
 
-import { UsersSchema } from "@app/db/schemas";
+import { OrgMembershipRole, ProjectMembershipRole, UsersSchema } from "@app/db/schemas";
 import { inviteUserRateLimit } from "@app/server/config/rateLimiter";
 import { getTelemetryDistinctId } from "@app/server/lib/telemetry";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -19,7 +19,8 @@ export const registerInviteOrgRouter = async (server: FastifyZodProvider) => {
         inviteeEmails: z.array(z.string().trim().email()),
         organizationId: z.string().trim(),
         projectIds: z.array(z.string().trim()).optional(),
-        organizationRoleSlug: z.string().trim().optional()
+        projectRoleSlug: z.nativeEnum(ProjectMembershipRole).optional(),
+        organizationRoleSlug: z.nativeEnum(OrgMembershipRole)
       }),
       response: {
         200: z.object({
@@ -44,6 +45,7 @@ export const registerInviteOrgRouter = async (server: FastifyZodProvider) => {
         userId: req.permission.id,
         inviteeEmails: req.body.inviteeEmails,
         projectIds: req.body.projectIds,
+        projectRoleSlug: req.body.projectRoleSlug,
         organizationRoleSlug: req.body.organizationRoleSlug,
         actorAuthMethod: req.permission.authMethod,
         actorOrgId: req.permission.orgId
diff --git a/backend/src/server/routes/v1/project-router.ts b/backend/src/server/routes/v1/project-router.ts
index ac9703f07..a380eb934 100644
--- a/backend/src/server/routes/v1/project-router.ts
+++ b/backend/src/server/routes/v1/project-router.ts
@@ -1,6 +1,12 @@
 import { z } from "zod";
 
-import { IntegrationsSchema, ProjectMembershipsSchema, UserEncryptionKeysSchema, UsersSchema } from "@app/db/schemas";
+import {
+  IntegrationsSchema,
+  ProjectMembershipsSchema,
+  ProjectRolesSchema,
+  UserEncryptionKeysSchema,
+  UsersSchema
+} from "@app/db/schemas";
 import { PROJECTS } from "@app/lib/api-docs";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -122,15 +128,31 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
       rateLimit: readLimit
     },
     schema: {
+      querystring: z.object({
+        includeRoles: z
+          .enum(["true", "false"])
+          .default("false")
+          .transform((value) => value === "true")
+      }),
       response: {
         200: z.object({
-          workspaces: projectWithEnv.array()
+          workspaces: projectWithEnv
+            .extend({
+              roles: ProjectRolesSchema.array().optional()
+            })
+            .array()
         })
       }
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
     handler: async (req) => {
-      const workspaces = await server.services.project.getProjects(req.permission.id);
+      const workspaces = await server.services.project.getProjects({
+        includeRoles: req.query.includeRoles,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actor: req.permission.type,
+        actorOrgId: req.permission.orgId
+      });
       return { workspaces };
     }
   });
diff --git a/backend/src/services/auth-token/auth-token-types.ts b/backend/src/services/auth-token/auth-token-types.ts
index dbe949fd9..65d16850a 100644
--- a/backend/src/services/auth-token/auth-token-types.ts
+++ b/backend/src/services/auth-token/auth-token-types.ts
@@ -1,3 +1,5 @@
+import { ProjectMembershipRole } from "@app/db/schemas";
+
 export enum TokenType {
   TOKEN_EMAIL_CONFIRMATION = "emailConfirmation",
   TOKEN_EMAIL_VERIFICATION = "emailVerification", // unverified -> verified
@@ -54,9 +56,14 @@ export enum TokenMetadataType {
   InviteToProjects = "projects-invite"
 }
 
-// TODO: Split the payloads into separate types for better type inference (not needed until we add more types of metadata)
+export type TTokenInviteToProjectsMetadataPayload = {
+  projectIds: string[];
+  projectRoleSlug: ProjectMembershipRole;
+  userId: string;
+  orgId: string;
+};
+
 export type TTokenMetadata = {
   type: TokenMetadataType.InviteToProjects;
-  projectIds: string[];
-  userId: string;
+  payload: TTokenInviteToProjectsMetadataPayload;
 };
diff --git a/backend/src/services/auth/auth-signup-service.ts b/backend/src/services/auth/auth-signup-service.ts
index 8714f5081..33092484e 100644
--- a/backend/src/services/auth/auth-signup-service.ts
+++ b/backend/src/services/auth/auth-signup-service.ts
@@ -1,7 +1,7 @@
 import bcrypt from "bcrypt";
 import jwt from "jsonwebtoken";
 
-import { OrgMembershipStatus, ProjectMembershipRole, TableName } from "@app/db/schemas";
+import { OrgMembershipStatus, TableName } from "@app/db/schemas";
 import { convertPendingGroupAdditionsToGroupMemberships } from "@app/ee/services/group/group-fns";
 import { TUserGroupMembershipDALFactory } from "@app/ee/services/group/user-group-membership-dal";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
@@ -17,7 +17,7 @@ import { TProjectBotDALFactory } from "@app/services/project-bot/project-bot-dal
 import { TProjectKeyDALFactory } from "@app/services/project-key/project-key-dal";
 
 import { TAuthTokenServiceFactory } from "../auth-token/auth-token-service";
-import { TokenType, TTokenMetadata } from "../auth-token/auth-token-types";
+import { TokenMetadataType, TokenType, TTokenMetadata } from "../auth-token/auth-token-types";
 import { TOrgDALFactory } from "../org/org-dal";
 import { TOrgServiceFactory } from "../org/org-service";
 import { TProjectMembershipDALFactory } from "../project-membership/project-membership-dal";
@@ -373,13 +373,17 @@ export const authSignupServiceFactory = ({
       if (metadata) {
         const metadataObj = jwt.verify(metadata, appCfg.AUTH_SECRET) as TTokenMetadata;
 
-        if (user.id !== metadataObj.userId) {
+        if (
+          metadataObj.payload.userId !== user.id ||
+          metadataObj.payload.orgId !== orgMembership.orgId ||
+          metadataObj.type !== TokenMetadataType.InviteToProjects
+        ) {
           throw new UnauthorizedError({
             message: "Malformed or invalid metadata token"
           });
         }
 
-        for await (const projectId of metadataObj.projectIds) {
+        for await (const projectId of metadataObj.payload.projectIds) {
           await addMembersToProject({
             orgDAL,
             projectDAL,
@@ -394,10 +398,13 @@ export const authSignupServiceFactory = ({
               emails: [user.email!],
               usernames: [],
               projectId,
-              projectMembershipRole: ProjectMembershipRole.Member,
+              projectMembershipRole: metadataObj.payload.projectRoleSlug,
               sendEmails: false
             },
-            tx
+            {
+              tx,
+              throwOnProjectNotFound: false
+            }
           );
         }
       }
diff --git a/backend/src/services/org/org-service.ts b/backend/src/services/org/org-service.ts
index e6c8944ff..4966354c0 100644
--- a/backend/src/services/org/org-service.ts
+++ b/backend/src/services/org/org-service.ts
@@ -4,7 +4,14 @@ import crypto from "crypto";
 import jwt from "jsonwebtoken";
 import { Knex } from "knex";
 
-import { OrgMembershipRole, OrgMembershipStatus, ProjectMembershipRole, TableName, TUsers } from "@app/db/schemas";
+import {
+  OrgMembershipRole,
+  OrgMembershipStatus,
+  ProjectMembershipRole,
+  ProjectVersion,
+  TableName,
+  TUsers
+} from "@app/db/schemas";
 import { TProjects } from "@app/db/schemas/projects";
 import { TGroupDALFactory } from "@app/ee/services/group/group-dal";
 import { TUserGroupMembershipDALFactory } from "@app/ee/services/group/user-group-membership-dal";
@@ -25,8 +32,9 @@ import { TUserAliasDALFactory } from "@app/services/user-alias/user-alias-dal";
 
 import { ActorAuthMethod, ActorType, AuthMethod, AuthTokenType } from "../auth/auth-type";
 import { TAuthTokenServiceFactory } from "../auth-token/auth-token-service";
-import { TokenMetadataType, TokenType } from "../auth-token/auth-token-types";
+import { TokenMetadataType, TokenType, TTokenMetadata } from "../auth-token/auth-token-types";
 import { TProjectDALFactory } from "../project/project-dal";
+import { verifyProjectVersion } from "../project/project-fns";
 import { TProjectBotDALFactory } from "../project-bot/project-bot-dal";
 import { TProjectKeyDALFactory } from "../project-key/project-key-dal";
 import { TProjectMembershipDALFactory } from "../project-membership/project-membership-dal";
@@ -435,6 +443,7 @@ export const orgServiceFactory = ({
     userId,
     inviteeEmails,
     organizationRoleSlug,
+    projectRoleSlug,
     projectIds,
     actorAuthMethod,
     actorOrgId
@@ -467,6 +476,22 @@ export const orgServiceFactory = ({
       });
     }
 
+    if (projectIds?.length) {
+      const projects = await projectDAL.find({
+        orgId,
+        $in: {
+          id: projectIds
+        }
+      });
+
+      // if its not v3, throw an error
+      if (!verifyProjectVersion(projects, ProjectVersion.V3)) {
+        throw new BadRequestError({
+          message: "One or more selected projects are not compatible with this operation. Please upgrade your projects."
+        });
+      }
+    }
+
     const inviteeUsers = await orgDAL.transaction(async (tx) => {
       const users: Pick<
         TUsers & { orgId: string },
@@ -474,6 +499,7 @@ export const orgServiceFactory = ({
       >[] = [];
       for await (const inviteeEmail of inviteeEmails) {
         const inviteeUser = await userDAL.findUserByUsername(inviteeEmail, tx);
+
         if (inviteeUser) {
           // if user already exist means its already part of infisical
           // Thus the signup flow is not needed anymore
@@ -504,7 +530,22 @@ export const orgServiceFactory = ({
               tx
             );
 
-            if (projectIds) {
+            if (projectIds?.length) {
+              if (
+                organizationRoleSlug === OrgMembershipRole.Custom ||
+                projectRoleSlug === ProjectMembershipRole.Custom
+              ) {
+                throw new BadRequestError({
+                  message: "Custom roles are not supported for inviting users to projects and organizations"
+                });
+              }
+
+              if (!projectRoleSlug) {
+                throw new BadRequestError({
+                  message: "Selecting a project role is required to invite users to projects"
+                });
+              }
+
               for await (const projectId of projectIds) {
                 await projectMembershipDAL.create(
                   {
@@ -528,10 +569,12 @@ export const orgServiceFactory = ({
                     emails: [inviteeEmail],
                     usernames: [],
                     projectId,
-                    projectMembershipRole: ProjectMembershipRole.Member,
+                    projectMembershipRole: projectRoleSlug,
                     sendEmails: false
                   },
-                  tx
+                  {
+                    tx
+                  }
                 );
               }
             }
@@ -561,7 +604,7 @@ export const orgServiceFactory = ({
             inviteEmail: inviteeEmail,
             orgId,
             userId: user.id,
-            role: organizationRoleSlug || OrgMembershipRole.Member,
+            role: organizationRoleSlug,
             status: OrgMembershipStatus.Invited,
             isActive: true
           },
@@ -588,13 +631,17 @@ export const orgServiceFactory = ({
         });
 
         let inviteMetadata: string = "";
-        if (projectIds && projectIds.length > 0) {
+        if (projectIds && projectIds?.length > 0) {
           inviteMetadata = jwt.sign(
             {
               type: TokenMetadataType.InviteToProjects,
-              projectIds,
-              userId: invitee.id
-            },
+              payload: {
+                projectIds,
+                projectRoleSlug: projectRoleSlug!, // Implicitly checked inside transaction if projectRoleSlug is undefined
+                userId: invitee.id,
+                orgId
+              }
+            } satisfies TTokenMetadata,
             appCfg.AUTH_SECRET,
             {
               expiresIn: appCfg.JWT_INVITE_LIFETIME
diff --git a/backend/src/services/org/org-types.ts b/backend/src/services/org/org-types.ts
index dbc2f7e2e..3fa4ae493 100644
--- a/backend/src/services/org/org-types.ts
+++ b/backend/src/services/org/org-types.ts
@@ -1,3 +1,4 @@
+import { OrgMembershipRole, ProjectMembershipRole } from "@app/db/schemas";
 import { TOrgPermission } from "@app/lib/types";
 
 import { ActorAuthMethod, ActorType } from "../auth/auth-type";
@@ -30,8 +31,9 @@ export type TInviteUserToOrgDTO = {
   actorOrgId: string | undefined;
   actorAuthMethod: ActorAuthMethod;
   inviteeEmails: string[];
-  organizationRoleSlug?: string;
+  organizationRoleSlug: OrgMembershipRole;
   projectIds?: string[];
+  projectRoleSlug?: ProjectMembershipRole;
 };
 
 export type TVerifyUserToOrgDTO = {
diff --git a/backend/src/services/project-membership/project-membership-fns.ts b/backend/src/services/project-membership/project-membership-fns.ts
index 6395f5324..98acd6eec 100644
--- a/backend/src/services/project-membership/project-membership-fns.ts
+++ b/backend/src/services/project-membership/project-membership-fns.ts
@@ -35,6 +35,11 @@ type AddMembersToNonE2EEProjectDTO = {
   sendEmails?: boolean;
 };
 
+type AddMembersToNonE2EEProjectOptions = {
+  tx?: Knex;
+  throwOnProjectNotFound?: boolean;
+};
+
 export const addMembersToProject = ({
   orgDAL,
   projectDAL,
@@ -45,15 +50,22 @@ export const addMembersToProject = ({
   projectUserMembershipRoleDAL,
   smtpService
 }: TAddMembersToProjectArg) => {
+  // Can create multiple memberships for a singular project, based on user email / username
   const addMembersToNonE2EEProject = async (
     { emails, usernames, projectId, projectMembershipRole, sendEmails }: AddMembersToNonE2EEProjectDTO,
-    transaction?: Knex
+    options: AddMembersToNonE2EEProjectOptions = { throwOnProjectNotFound: true }
   ) => {
     const processTransaction = async (tx: Knex) => {
       const usernamesAndEmails = [...emails, ...usernames];
 
       const project = await projectDAL.findProjectById(projectId);
-      if (!project) throw new BadRequestError({ message: "Project not found" });
+      if (!project) {
+        if (options.throwOnProjectNotFound) {
+          throw new BadRequestError({ message: "Project not found when attempting to add user to project" });
+        }
+
+        return [];
+      }
 
       const orgMembers = await orgDAL.findOrgMembersByUsername(
         project.orgId,
@@ -61,12 +73,6 @@ export const addMembersToProject = ({
         tx
       );
 
-      // const allorgMembers = await orgDAL.findAllOrgMembers(project.orgId,);
-
-      console.log("usernameandena", usernamesAndEmails);
-      console.log("orgMembers", orgMembers);
-      // console.log("allorgMembers", allorgMembers);
-
       if (orgMembers.length !== usernamesAndEmails.length)
         throw new BadRequestError({ message: "Some users are not part of org" });
 
@@ -131,7 +137,7 @@ export const addMembersToProject = ({
         tx
       );
       await projectUserMembershipRoleDAL.insertMany(
-        projectMemberships.map(({ id }) => ({ projectMembershipId: id, role: ProjectMembershipRole.Member })),
+        projectMemberships.map(({ id }) => ({ projectMembershipId: id, role: projectMembershipRole })),
         tx
       );
 
@@ -172,8 +178,8 @@ export const addMembersToProject = ({
       return members;
     };
 
-    if (transaction) {
-      return processTransaction(transaction);
+    if (options.tx) {
+      return processTransaction(options.tx);
     }
     return projectMembershipDAL.transaction(processTransaction);
   };
diff --git a/backend/src/services/project-role/project-role-fns.ts b/backend/src/services/project-role/project-role-fns.ts
new file mode 100644
index 000000000..c465715a7
--- /dev/null
+++ b/backend/src/services/project-role/project-role-fns.ts
@@ -0,0 +1,52 @@
+import { ProjectMembershipRole } from "@app/db/schemas";
+import {
+  projectAdminPermissions,
+  projectMemberPermissions,
+  projectNoAccessPermissions,
+  projectViewerPermission
+} from "@app/ee/services/permission/project-permission";
+
+export const getPredefinedRoles = (projectId: string, roleFilter?: ProjectMembershipRole) => {
+  return [
+    {
+      id: "b11b49a9-09a9-4443-916a-4246f9ff2c69", // dummy userid
+      projectId,
+      name: "Admin",
+      slug: ProjectMembershipRole.Admin,
+      permissions: projectAdminPermissions,
+      description: "Full administrative access over a project",
+      createdAt: new Date(),
+      updatedAt: new Date()
+    },
+    {
+      id: "b11b49a9-09a9-4443-916a-4246f9ff2c70", // dummy user for zod validation in response
+      projectId,
+      name: "Developer",
+      slug: ProjectMembershipRole.Member,
+      permissions: projectMemberPermissions,
+      description: "Limited read/write role in a project",
+      createdAt: new Date(),
+      updatedAt: new Date()
+    },
+    {
+      id: "b11b49a9-09a9-4443-916a-4246f9ff2c71", // dummy user for zod validation in response
+      projectId,
+      name: "Viewer",
+      slug: ProjectMembershipRole.Viewer,
+      permissions: projectViewerPermission,
+      description: "Only read role in a project",
+      createdAt: new Date(),
+      updatedAt: new Date()
+    },
+    {
+      id: "b11b49a9-09a9-4443-916a-4246f9ff2c72", // dummy user for zod validation in response
+      projectId,
+      name: "No Access",
+      slug: ProjectMembershipRole.NoAccess,
+      permissions: projectNoAccessPermissions,
+      description: "No access to any resources in the project",
+      createdAt: new Date(),
+      updatedAt: new Date()
+    }
+  ].filter(({ slug }) => !roleFilter || roleFilter.includes(slug));
+};
diff --git a/backend/src/services/project-role/project-role-service.ts b/backend/src/services/project-role/project-role-service.ts
index 8c71a6e02..f60577516 100644
--- a/backend/src/services/project-role/project-role-service.ts
+++ b/backend/src/services/project-role/project-role-service.ts
@@ -5,13 +5,9 @@ import { ProjectMembershipRole } from "@app/db/schemas";
 import { UnpackedPermissionSchema } from "@app/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import {
-  projectAdminPermissions,
-  projectMemberPermissions,
-  projectNoAccessPermissions,
   ProjectPermissionActions,
   ProjectPermissionSet,
-  ProjectPermissionSub,
-  projectViewerPermission
+  ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
 import { BadRequestError } from "@app/lib/errors";
 
@@ -20,6 +16,7 @@ import { TIdentityProjectMembershipRoleDALFactory } from "../identity-project/id
 import { TProjectDALFactory } from "../project/project-dal";
 import { TProjectUserMembershipRoleDALFactory } from "../project-membership/project-user-membership-role-dal";
 import { TProjectRoleDALFactory } from "./project-role-dal";
+import { getPredefinedRoles } from "./project-role-fns";
 import { TCreateRoleDTO, TDeleteRoleDTO, TGetRoleBySlugDTO, TListRolesDTO, TUpdateRoleDTO } from "./project-role-types";
 
 type TProjectRoleServiceFactoryDep = {
@@ -37,51 +34,6 @@ const unpackPermissions = (permissions: unknown) =>
     unpackRules((permissions || []) as PackRule<RawRuleOf<MongoAbility<ProjectPermissionSet>>>[])
   );
 
-const getPredefinedRoles = (projectId: string, roleFilter?: ProjectMembershipRole) => {
-  return [
-    {
-      id: "b11b49a9-09a9-4443-916a-4246f9ff2c69", // dummy userid
-      projectId,
-      name: "Admin",
-      slug: ProjectMembershipRole.Admin,
-      permissions: projectAdminPermissions,
-      description: "Full administrative access over a project",
-      createdAt: new Date(),
-      updatedAt: new Date()
-    },
-    {
-      id: "b11b49a9-09a9-4443-916a-4246f9ff2c70", // dummy user for zod validation in response
-      projectId,
-      name: "Developer",
-      slug: ProjectMembershipRole.Member,
-      permissions: projectMemberPermissions,
-      description: "Limited read/write role in a project",
-      createdAt: new Date(),
-      updatedAt: new Date()
-    },
-    {
-      id: "b11b49a9-09a9-4443-916a-4246f9ff2c71", // dummy user for zod validation in response
-      projectId,
-      name: "Viewer",
-      slug: ProjectMembershipRole.Viewer,
-      permissions: projectViewerPermission,
-      description: "Only read role in a project",
-      createdAt: new Date(),
-      updatedAt: new Date()
-    },
-    {
-      id: "b11b49a9-09a9-4443-916a-4246f9ff2c72", // dummy user for zod validation in response
-      projectId,
-      name: "No Access",
-      slug: ProjectMembershipRole.NoAccess,
-      permissions: projectNoAccessPermissions,
-      description: "No access to any resources in the project",
-      createdAt: new Date(),
-      updatedAt: new Date()
-    }
-  ].filter(({ slug }) => !roleFilter || roleFilter.includes(slug));
-};
-
 export const projectRoleServiceFactory = ({
   projectRoleDAL,
   permissionService,
diff --git a/backend/src/services/project/project-fns.ts b/backend/src/services/project/project-fns.ts
index d6b010e0b..f67882c0e 100644
--- a/backend/src/services/project/project-fns.ts
+++ b/backend/src/services/project/project-fns.ts
@@ -1,5 +1,6 @@
 import crypto from "crypto";
 
+import { ProjectVersion, TProjects } from "@app/db/schemas";
 import { decryptAsymmetric, encryptAsymmetric } from "@app/lib/crypto";
 import { BadRequestError } from "@app/lib/errors";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
@@ -53,6 +54,16 @@ export const createProjectKey = ({ publicKey, privateKey, plainProjectKey }: TCr
   return { key: encryptedProjectKey, iv: encryptedProjectKeyIv };
 };
 
+export const verifyProjectVersion = (projects: Pick<TProjects, "version">[], version: ProjectVersion) => {
+  for (const project of projects) {
+    if (project.version !== version) {
+      return false;
+    }
+  }
+
+  return true;
+};
+
 export const getProjectKmsCertificateKeyId = async ({
   projectId,
   projectDAL,
diff --git a/backend/src/services/project/project-service.ts b/backend/src/services/project/project-service.ts
index a7111d784..bc9ed5dee 100644
--- a/backend/src/services/project/project-service.ts
+++ b/backend/src/services/project/project-service.ts
@@ -10,6 +10,7 @@ import { TKeyStoreFactory } from "@app/keystore/keystore";
 import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { groupBy } from "@app/lib/fn";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { TProjectPermission } from "@app/lib/types";
 
@@ -30,6 +31,8 @@ import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
 import { TProjectKeyDALFactory } from "../project-key/project-key-dal";
 import { TProjectMembershipDALFactory } from "../project-membership/project-membership-dal";
 import { TProjectUserMembershipRoleDALFactory } from "../project-membership/project-user-membership-role-dal";
+import { TProjectRoleDALFactory } from "../project-role/project-role-dal";
+import { getPredefinedRoles } from "../project-role/project-role-fns";
 import { ROOT_FOLDER_NAME, TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
 import { TUserDALFactory } from "../user/user-dal";
 import { TProjectDALFactory } from "./project-dal";
@@ -44,6 +47,7 @@ import {
   TListProjectCasDTO,
   TListProjectCertificateTemplatesDTO,
   TListProjectCertsDTO,
+  TListProjectsDTO,
   TLoadProjectKmsBackupDTO,
   TToggleProjectAutoCapitalizationDTO,
   TUpdateAuditLogsRetentionDTO,
@@ -84,6 +88,7 @@ type TProjectServiceFactoryDep = {
   orgDAL: Pick<TOrgDALFactory, "findOne">;
   keyStore: Pick<TKeyStoreFactory, "deleteItem">;
   projectBotDAL: Pick<TProjectBotDALFactory, "create">;
+  projectRoleDAL: Pick<TProjectRoleDALFactory, "find">;
   kmsService: Pick<
     TKmsServiceFactory,
     | "updateProjectSecretManagerKmsKey"
@@ -112,6 +117,7 @@ export const projectServiceFactory = ({
   projectEnvDAL,
   licenseService,
   projectUserMembershipRoleDAL,
+  projectRoleDAL,
   identityProjectMembershipRoleDAL,
   certificateAuthorityDAL,
   certificateDAL,
@@ -389,8 +395,37 @@ export const projectServiceFactory = ({
     return deletedProject;
   };
 
-  const getProjects = async (actorId: string) => {
+  const getProjects = async ({ actorId, includeRoles, actor, actorAuthMethod, actorOrgId }: TListProjectsDTO) => {
     const workspaces = await projectDAL.findAllProjects(actorId);
+
+    if (includeRoles) {
+      const customRoles = await projectRoleDAL.find({
+        $in: {
+          projectId: workspaces.map((workspace) => workspace.id)
+        }
+      });
+
+      const workspaceMappedToRoles = groupBy(customRoles, (role) => role.projectId);
+
+      const workspacesWithRoles = await Promise.all(
+        workspaces.map(async (workspace) => {
+          const { permission } = await permissionService.getProjectPermission(
+            actor,
+            actorId,
+            workspace.id,
+            actorAuthMethod,
+            actorOrgId
+          );
+          ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Role);
+          return {
+            ...workspace,
+            roles: [...(workspaceMappedToRoles[workspace.id] || []), ...getPredefinedRoles(workspace.id)]
+          };
+        })
+      );
+
+      return workspacesWithRoles;
+    }
     return workspaces;
   };
 
diff --git a/backend/src/services/project/project-types.ts b/backend/src/services/project/project-types.ts
index ee2f1aea9..c0ef2579e 100644
--- a/backend/src/services/project/project-types.ts
+++ b/backend/src/services/project/project-types.ts
@@ -75,6 +75,10 @@ export type TDeleteProjectDTO = {
   actorOrgId: string | undefined;
 } & Omit<TProjectPermission, "projectId">;
 
+export type TListProjectsDTO = {
+  includeRoles: boolean;
+} & Omit<TProjectPermission, "projectId">;
+
 export type TUpgradeProjectDTO = {
   userPrivateKey: string;
 } & TProjectPermission;
diff --git a/frontend/src/components/signup/TeamInviteStep.tsx b/frontend/src/components/signup/TeamInviteStep.tsx
index b6ce4e208..934935a42 100644
--- a/frontend/src/components/signup/TeamInviteStep.tsx
+++ b/frontend/src/components/signup/TeamInviteStep.tsx
@@ -32,7 +32,8 @@ export default function TeamInviteStep(): JSX.Element {
       .map(async (email) => {
         mutateAsync({
           inviteeEmails: [email],
-          organizationId: String(localStorage.getItem("orgData.id"))
+          organizationId: String(localStorage.getItem("orgData.id")),
+          organizationRoleSlug: "member"
         });
       });
 
diff --git a/frontend/src/hooks/api/roles/queries.tsx b/frontend/src/hooks/api/roles/queries.tsx
index 865d28789..77e82e4fa 100644
--- a/frontend/src/hooks/api/roles/queries.tsx
+++ b/frontend/src/hooks/api/roles/queries.tsx
@@ -47,7 +47,7 @@ export const roleQueryKeys = {
     ["user-project-permissions", { workspaceId }] as const
 };
 
-const getProjectRoles = async (projectId: string) => {
+export const getProjectRoles = async (projectId: string) => {
   const { data } = await apiRequest.get<{ roles: Array<Omit<TProjectRole, "permissions">> }>(
     `/api/v1/workspace/${projectId}/roles`
   );
diff --git a/frontend/src/hooks/api/users/queries.tsx b/frontend/src/hooks/api/users/queries.tsx
index 402781e1c..ead567bee 100644
--- a/frontend/src/hooks/api/users/queries.tsx
+++ b/frontend/src/hooks/api/users/queries.tsx
@@ -162,7 +162,7 @@ export const useAddUsersToOrg = () => {
   type Response = {
     data: {
       message: string;
-      completeInviteLinks: {
+      completeInviteLinks?: {
         email: string;
         link: string;
       }[];
diff --git a/frontend/src/hooks/api/users/types.ts b/frontend/src/hooks/api/users/types.ts
index aa0c2b9ac..550159fb4 100644
--- a/frontend/src/hooks/api/users/types.ts
+++ b/frontend/src/hooks/api/users/types.ts
@@ -151,7 +151,8 @@ export type DeletOrgMembershipDTO = {
 export type AddUserToOrgDTO = {
   inviteeEmails: string[];
   projectIds?: string[];
-  organizationRoleSlug?: string;
+  projectRoleSlug?: string;
+  organizationRoleSlug: string;
   organizationId: string;
 };
 
diff --git a/frontend/src/hooks/api/workspace/queries.tsx b/frontend/src/hooks/api/workspace/queries.tsx
index 8f1b065da..9ca3bbf34 100644
--- a/frontend/src/hooks/api/workspace/queries.tsx
+++ b/frontend/src/hooks/api/workspace/queries.tsx
@@ -138,8 +138,12 @@ export const useGetUpgradeProjectStatus = ({
   });
 };
 
-const fetchUserWorkspaces = async () => {
-  const { data } = await apiRequest.get<{ workspaces: Workspace[] }>("/api/v1/workspace");
+const fetchUserWorkspaces = async (includeRoles?: boolean) => {
+  const { data } = await apiRequest.get<{ workspaces: Workspace[] }>("/api/v1/workspace", {
+    params: {
+      includeRoles
+    }
+  });
   return data.workspaces;
 };
 
@@ -171,8 +175,8 @@ export const useGetWorkspaceById = (
   });
 };
 
-export const useGetUserWorkspaces = () =>
-  useQuery(workspaceKeys.getAllUserWorkspace, fetchUserWorkspaces);
+export const useGetUserWorkspaces = (includeRoles?: boolean) =>
+  useQuery(workspaceKeys.getAllUserWorkspace, () => fetchUserWorkspaces(includeRoles));
 
 const fetchUserWorkspaceMemberships = async (orgId: string) => {
   const { data } = await apiRequest.get<Record<string, Workspace[]>>(
diff --git a/frontend/src/hooks/api/workspace/types.ts b/frontend/src/hooks/api/workspace/types.ts
index 51bb08e3d..efb31b330 100644
--- a/frontend/src/hooks/api/workspace/types.ts
+++ b/frontend/src/hooks/api/workspace/types.ts
@@ -1,3 +1,5 @@
+import { TProjectRole } from "../roles/types";
+
 export enum ProjectVersion {
   V1 = 1,
   V2 = 2,
@@ -22,6 +24,8 @@ export type Workspace = {
   auditLogsRetentionDays: number;
   slug: string;
   createdAt: string;
+
+  roles?: TProjectRole[];
 };
 
 export type WorkspaceEnv = {
diff --git a/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/AddOrgMemberModal.tsx b/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/AddOrgMemberModal.tsx
index f0dfe5b77..67a03b18a 100644
--- a/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/AddOrgMemberModal.tsx
+++ b/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/AddOrgMemberModal.tsx
@@ -1,3 +1,4 @@
+import { useMemo } from "react";
 import { Controller, useForm } from "react-hook-form";
 import { faCheckCircle, faChevronDown } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
@@ -25,18 +26,21 @@ import {
   useGetOrgRoles,
   useGetUserWorkspaces
 } from "@app/hooks/api";
+import { ProjectMembershipRole } from "@app/hooks/api/roles/types";
+import { ProjectVersion } from "@app/hooks/api/workspace/types";
 import { UsePopUpState } from "@app/hooks/usePopUp";
 
 import { OrgInviteLink } from "./OrgInviteLink";
 
-const DEFAULT_ORG_MEMBER_ROLE_SLUG = "member";
+const DEFAULT_ORG_AND_PROJECT_MEMBER_ROLE_SLUG = "member";
 
 const EmailSchema = z.string().email().min(1).trim().toLowerCase();
 
 const addMemberFormSchema = z.object({
   emails: z.string().min(1).trim().toLowerCase(),
   projectIds: z.array(z.string().min(1).trim().toLowerCase()).default([]),
-  organizationRoleSlug: z.string().min(1).default(DEFAULT_ORG_MEMBER_ROLE_SLUG)
+  projectRoleSlug: z.string().min(1).default(DEFAULT_ORG_AND_PROJECT_MEMBER_ROLE_SLUG),
+  organizationRoleSlug: z.string().min(1).default(DEFAULT_ORG_AND_PROJECT_MEMBER_ROLE_SLUG)
 });
 
 type TAddMemberForm = z.infer<typeof addMemberFormSchema>;
@@ -71,7 +75,12 @@ export const AddOrgMemberModal = ({
     formState: { isSubmitting }
   } = useForm<TAddMemberForm>({ resolver: zodResolver(addMemberFormSchema) });
 
-  const onAddMembers = async ({ emails, organizationRoleSlug, projectIds }: TAddMemberForm) => {
+  const onAddMembers = async ({
+    emails,
+    organizationRoleSlug,
+    projectIds,
+    projectRoleSlug
+  }: TAddMemberForm) => {
     if (!currentOrg?.id) return;
 
     try {
@@ -98,7 +107,8 @@ export const AddOrgMemberModal = ({
         organizationId: currentOrg?.id,
         inviteeEmails: emails.split(",").map((email) => email.trim()),
         organizationRoleSlug,
-        projectIds
+        projectIds,
+        projectRoleSlug
       });
 
       setCompleteInviteLinks(data?.completeInviteLinks ?? null);
@@ -128,7 +138,12 @@ export const AddOrgMemberModal = ({
   };
 
   const projectIds = watch("projectIds", []);
-  const { data: projects } = useGetUserWorkspaces();
+  const { data: projects } = useGetUserWorkspaces(true);
+
+  const filteredProjects = useMemo(
+    () => projects?.filter((project) => project.version === ProjectVersion.V3),
+    [projects]
+  );
 
   return (
     <Modal
@@ -179,7 +194,7 @@ export const AddOrgMemberModal = ({
                   >
                     <div>
                       <Select
-                        defaultValue={DEFAULT_ORG_MEMBER_ROLE_SLUG}
+                        defaultValue={DEFAULT_ORG_AND_PROJECT_MEMBER_ROLE_SLUG}
                         {...field}
                         onValueChange={(val) => field.onChange(val)}
                       >
@@ -195,83 +210,117 @@ export const AddOrgMemberModal = ({
               />
             </div>
 
-            <div className="-space-y-3">
-              <Controller
-                control={control}
-                name="projectIds"
-                render={({ field, fieldState: { error } }) => (
-                  <FormControl
-                    label="Add user to projects"
-                    isError={Boolean(error?.message)}
-                    errorText={error?.message}
-                  >
-                    <DropdownMenu>
-                      <DropdownMenuTrigger asChild>
-                        {projects && projects.length > 0 ? (
-                          <div className="inline-flex w-full cursor-pointer items-center justify-between rounded-md border border-mineshaft-600 bg-mineshaft-900 px-3 py-2 font-inter text-sm font-normal text-bunker-200 outline-none data-[placeholder]:text-mineshaft-200">
-                            {projectIds.length === 1
-                              ? projects.find((project) => project.id === projectIds[0])?.name
-                              : `${projectIds.length} projects selected`}
-                            <FontAwesomeIcon icon={faChevronDown} className="text-xs" />
-                          </div>
-                        ) : (
-                          <div className="inline-flex w-full cursor-default items-center justify-between rounded-md border border-mineshaft-600 bg-mineshaft-900 px-3 py-2 font-inter text-sm font-normal text-bunker-200 outline-none data-[placeholder]:text-mineshaft-200">
-                            No projects found
-                          </div>
-                        )}
-                      </DropdownMenuTrigger>
-                      <DropdownMenuContent
-                        align="start"
-                        className="thin-scrollbar z-[100] max-h-80"
-                      >
-                        {projects && projects.length > 0 ? (
-                          projects.map((project) => {
-                            const isSelected = projectIds.includes(String(project.id));
+            <div className="flex items-center justify-between gap-2">
+              <div className="w-full">
+                <Controller
+                  control={control}
+                  name="projectIds"
+                  render={({ field, fieldState: { error } }) => (
+                    <FormControl
+                      label="Add user to projects"
+                      isError={Boolean(error?.message)}
+                      errorText={error?.message}
+                    >
+                      <DropdownMenu>
+                        <DropdownMenuTrigger asChild>
+                          {filteredProjects && filteredProjects.length > 0 ? (
+                            <div className="inline-flex w-full cursor-pointer items-center justify-between rounded-md border border-mineshaft-600 bg-mineshaft-900 px-3 py-2 font-inter text-sm font-normal text-bunker-200 outline-none data-[placeholder]:text-mineshaft-200">
+                              {projectIds.length === 1
+                                ? filteredProjects.find((project) => project.id === projectIds[0])
+                                    ?.name
+                                : `${projectIds.length} projects selected`}
+                              <FontAwesomeIcon icon={faChevronDown} className="text-xs" />
+                            </div>
+                          ) : (
+                            <div className="inline-flex w-full cursor-default items-center justify-between rounded-md border border-mineshaft-600 bg-mineshaft-900 px-3 py-2 font-inter text-sm font-normal text-bunker-200 outline-none data-[placeholder]:text-mineshaft-200">
+                              No projects found
+                            </div>
+                          )}
+                        </DropdownMenuTrigger>
+                        <DropdownMenuContent
+                          align="start"
+                          className="thin-scrollbar z-[100] max-h-80"
+                        >
+                          {filteredProjects && filteredProjects.length > 0 ? (
+                            filteredProjects.map((project) => {
+                              const isSelected = projectIds.includes(String(project.id));
 
-                            return (
-                              <DropdownMenuItem
-                                onSelect={(event) => projects.length > 0 && event.preventDefault()}
-                                onClick={() => {
-                                  if (projectIds.includes(String(project.id))) {
-                                    field.onChange(
-                                      projectIds.filter(
-                                        (projectId: string) => projectId !== String(project.id)
-                                      )
-                                    );
-                                  } else {
-                                    field.onChange([...projectIds, String(project.id)]);
+                              return (
+                                <DropdownMenuItem
+                                  onSelect={(event) =>
+                                    filteredProjects.length > 0 && event.preventDefault()
                                   }
-                                }}
-                                key={`project-id-${project.id}`}
-                                icon={
-                                  isSelected ? (
-                                    <FontAwesomeIcon
-                                      icon={faCheckCircle}
-                                      className="pr-0.5 text-primary"
-                                    />
-                                  ) : (
-                                    <div className="pl-[1.01rem]" />
-                                  )
-                                }
-                                iconPos="left"
-                                className="w-[28.4rem] text-sm"
-                              >
-                                {project.name}
-                              </DropdownMenuItem>
-                            );
-                          })
-                        ) : (
-                          <div />
-                        )}
-                      </DropdownMenuContent>
-                    </DropdownMenu>
-                  </FormControl>
-                )}
-              />
-              <p className="ml-0.5 text-xs text-mineshaft-400">
-                Members will automatically be assigned the <a className="font-bold">Developer</a>{" "}
-                role for the projects you select.
-              </p>
+                                  onClick={() => {
+                                    if (projectIds.includes(String(project.id))) {
+                                      field.onChange(
+                                        projectIds.filter(
+                                          (projectId: string) => projectId !== String(project.id)
+                                        )
+                                      );
+                                    } else {
+                                      field.onChange([...projectIds, String(project.id)]);
+                                    }
+                                  }}
+                                  key={`project-id-${project.id}`}
+                                  icon={
+                                    isSelected ? (
+                                      <FontAwesomeIcon
+                                        icon={faCheckCircle}
+                                        className="pr-0.5 text-primary"
+                                      />
+                                    ) : (
+                                      <div className="pl-[1.01rem]" />
+                                    )
+                                  }
+                                  iconPos="left"
+                                  className="w-[28.4rem] text-sm"
+                                >
+                                  {project.name}
+                                </DropdownMenuItem>
+                              );
+                            })
+                          ) : (
+                            <div />
+                          )}
+                        </DropdownMenuContent>
+                      </DropdownMenu>
+                    </FormControl>
+                  )}
+                />
+              </div>
+              <div className="flex min-w-fit justify-end">
+                <Controller
+                  control={control}
+                  name="projectRoleSlug"
+                  render={({ field, fieldState: { error } }) => (
+                    <FormControl
+                      tooltipText="Select which role to assign to the users in the selected projects."
+                      label="Role"
+                      isError={Boolean(error)}
+                      errorText={error?.message}
+                    >
+                      <div>
+                        <Select
+                          isDisabled={projectIds.length === 0}
+                          defaultValue={DEFAULT_ORG_AND_PROJECT_MEMBER_ROLE_SLUG}
+                          {...field}
+                          onValueChange={(val) => field.onChange(val)}
+                        >
+                          {Object.entries(ProjectMembershipRole).map(
+                            // eslint-disable-next-line @typescript-eslint/no-unused-vars
+                            ([_, slug]) =>
+                              slug !== "custom" && (
+                                <SelectItem key={slug} value={slug}>
+                                  <span className="capitalize">{slug.replace("-", " ")}</span>
+                                </SelectItem>
+                              )
+                          )}
+                        </Select>
+                      </div>
+                    </FormControl>
+                  )}
+                />
+              </div>
             </div>
 
             <div className="mt-8 flex items-center">
diff --git a/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersTable.tsx b/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersTable.tsx
index e5a67548b..7b02255ef 100644
--- a/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersTable.tsx
+++ b/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersTable.tsx
@@ -108,7 +108,8 @@ export const OrgMembersTable = ({ handlePopUpOpen, setCompleteInviteLinks }: Pro
     try {
       const { data } = await addUsersMutateAsync({
         organizationId: orgId,
-        inviteeEmails: [email]
+        inviteeEmails: [email],
+        organizationRoleSlug: "member"
       });
 
       setCompleteInviteLinks(data?.completeInviteLinks || null);
diff --git a/frontend/src/views/Org/UserPage/components/UserDetailsSection.tsx b/frontend/src/views/Org/UserPage/components/UserDetailsSection.tsx
index cd886728c..d19106693 100644
--- a/frontend/src/views/Org/UserPage/components/UserDetailsSection.tsx
+++ b/frontend/src/views/Org/UserPage/components/UserDetailsSection.tsx
@@ -50,7 +50,8 @@ export const UserDetailsSection = ({ membershipId, handlePopUpOpen }: Props) =>
     try {
       const { data } = await inviteUsers({
         organizationId: orgId,
-        inviteeEmails: [email]
+        inviteeEmails: [email],
+        organizationRoleSlug: "member"
       });
 
       //   setCompleteInviteLink(data?.completeInviteLink || "");

From 842ed62bec9e6ec24d54128c6f10ae78220aa620 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Fri, 23 Aug 2024 00:52:16 +0400
Subject: [PATCH 24/29] Rename

---
 backend/src/services/org/org-service.ts     | 4 ++--
 backend/src/services/project/project-fns.ts | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/backend/src/services/org/org-service.ts b/backend/src/services/org/org-service.ts
index 4966354c0..b02081af3 100644
--- a/backend/src/services/org/org-service.ts
+++ b/backend/src/services/org/org-service.ts
@@ -34,7 +34,7 @@ import { ActorAuthMethod, ActorType, AuthMethod, AuthTokenType } from "../auth/a
 import { TAuthTokenServiceFactory } from "../auth-token/auth-token-service";
 import { TokenMetadataType, TokenType, TTokenMetadata } from "../auth-token/auth-token-types";
 import { TProjectDALFactory } from "../project/project-dal";
-import { verifyProjectVersion } from "../project/project-fns";
+import { verifyProjectVersions } from "../project/project-fns";
 import { TProjectBotDALFactory } from "../project-bot/project-bot-dal";
 import { TProjectKeyDALFactory } from "../project-key/project-key-dal";
 import { TProjectMembershipDALFactory } from "../project-membership/project-membership-dal";
@@ -485,7 +485,7 @@ export const orgServiceFactory = ({
       });
 
       // if its not v3, throw an error
-      if (!verifyProjectVersion(projects, ProjectVersion.V3)) {
+      if (!verifyProjectVersions(projects, ProjectVersion.V3)) {
         throw new BadRequestError({
           message: "One or more selected projects are not compatible with this operation. Please upgrade your projects."
         });
diff --git a/backend/src/services/project/project-fns.ts b/backend/src/services/project/project-fns.ts
index f67882c0e..cb836d932 100644
--- a/backend/src/services/project/project-fns.ts
+++ b/backend/src/services/project/project-fns.ts
@@ -54,7 +54,7 @@ export const createProjectKey = ({ publicKey, privateKey, plainProjectKey }: TCr
   return { key: encryptedProjectKey, iv: encryptedProjectKeyIv };
 };
 
-export const verifyProjectVersion = (projects: Pick<TProjects, "version">[], version: ProjectVersion) => {
+export const verifyProjectVersions = (projects: Pick<TProjects, "version">[], version: ProjectVersion) => {
   for (const project of projects) {
     if (project.version !== version) {
       return false;

From 58549c398f12bd43b60186888a93844799d36d38 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Fri, 23 Aug 2024 02:07:21 +0400
Subject: [PATCH 25/29] Update project-service.ts

---
 backend/src/services/project/project-service.ts | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/backend/src/services/project/project-service.ts b/backend/src/services/project/project-service.ts
index bc9ed5dee..3e8f7582e 100644
--- a/backend/src/services/project/project-service.ts
+++ b/backend/src/services/project/project-service.ts
@@ -395,10 +395,14 @@ export const projectServiceFactory = ({
     return deletedProject;
   };
 
-  const getProjects = async ({ actorId, includeRoles, actor, actorAuthMethod, actorOrgId }: TListProjectsDTO) => {
+  const getProjects = async ({ actorId, includeRoles, actorAuthMethod, actorOrgId }: TListProjectsDTO) => {
     const workspaces = await projectDAL.findAllProjects(actorId);
 
     if (includeRoles) {
+      const { permission } = await permissionService.getUserOrgPermission(actorId, actorOrgId, actorAuthMethod);
+
+      // `includeRoles` is specifically used by organization admins when inviting new users to the organizations to avoid looping redundant api calls.
+      ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Member);
       const customRoles = await projectRoleDAL.find({
         $in: {
           projectId: workspaces.map((workspace) => workspace.id)
@@ -409,14 +413,6 @@ export const projectServiceFactory = ({
 
       const workspacesWithRoles = await Promise.all(
         workspaces.map(async (workspace) => {
-          const { permission } = await permissionService.getProjectPermission(
-            actor,
-            actorId,
-            workspace.id,
-            actorAuthMethod,
-            actorOrgId
-          );
-          ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Role);
           return {
             ...workspace,
             roles: [...(workspaceMappedToRoles[workspace.id] || []), ...getPredefinedRoles(workspace.id)]
@@ -426,6 +422,7 @@ export const projectServiceFactory = ({
 
       return workspacesWithRoles;
     }
+
     return workspaces;
   };
 

From d8bbfacae07b6af5a48fdec62be9763a8fff9c39 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Fri, 23 Aug 2024 02:19:54 +0400
Subject: [PATCH 26/29] UI improvements

---
 .../OrgMembersSection/AddOrgMemberModal.tsx   | 129 +++++++++++-------
 1 file changed, 78 insertions(+), 51 deletions(-)

diff --git a/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/AddOrgMemberModal.tsx b/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/AddOrgMemberModal.tsx
index 67a03b18a..10b1e0987 100644
--- a/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/AddOrgMemberModal.tsx
+++ b/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/AddOrgMemberModal.tsx
@@ -1,6 +1,9 @@
-import { useMemo } from "react";
 import { Controller, useForm } from "react-hook-form";
-import { faCheckCircle, faChevronDown } from "@fortawesome/free-solid-svg-icons";
+import {
+  faCheckCircle,
+  faChevronDown,
+  faExclamationCircle
+} from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { z } from "zod";
@@ -17,7 +20,8 @@ import {
   ModalContent,
   Select,
   SelectItem,
-  TextArea
+  TextArea,
+  Tooltip
 } from "@app/components/v2";
 import { useOrganization } from "@app/context";
 import {
@@ -66,6 +70,7 @@ export const AddOrgMemberModal = ({
   const { data: organizationRoles } = useGetOrgRoles(currentOrg?.id ?? "");
   const { data: serverDetails } = useFetchServerStatus();
   const { mutateAsync: addUsersMutateAsync } = useAddUsersToOrg();
+  const { data: projects } = useGetUserWorkspaces(true);
 
   const {
     control,
@@ -75,6 +80,8 @@ export const AddOrgMemberModal = ({
     formState: { isSubmitting }
   } = useForm<TAddMemberForm>({ resolver: zodResolver(addMemberFormSchema) });
 
+  const selectedProjectIds = watch("projectIds", []);
+
   const onAddMembers = async ({
     emails,
     organizationRoleSlug,
@@ -83,6 +90,21 @@ export const AddOrgMemberModal = ({
   }: TAddMemberForm) => {
     if (!currentOrg?.id) return;
 
+    const selectedProjects = projects?.filter((project) => projectIds.includes(String(project.id)));
+
+    if (selectedProjects?.length) {
+      // eslint-disable-next-line no-restricted-syntax
+      for (const project of selectedProjects) {
+        if (project.version !== ProjectVersion.V3) {
+          createNotification({
+            type: "error",
+            text: `Cannot add users to project "${project.name}" because it's incompatible. Please upgrade the project.`
+          });
+          return;
+        }
+      }
+    }
+
     try {
       const parsedEmails = emails
         .replace(/\s/g, "")
@@ -137,14 +159,6 @@ export const AddOrgMemberModal = ({
     reset();
   };
 
-  const projectIds = watch("projectIds", []);
-  const { data: projects } = useGetUserWorkspaces(true);
-
-  const filteredProjects = useMemo(
-    () => projects?.filter((project) => project.version === ProjectVersion.V3),
-    [projects]
-  );
-
   return (
     <Modal
       isOpen={popUp?.addMember?.isOpen}
@@ -171,7 +185,7 @@ export const AddOrgMemberModal = ({
               control={control}
               name="emails"
               render={({ field, fieldState: { error } }) => (
-                <FormControl label="Email" isError={Boolean(error)} errorText={error?.message}>
+                <FormControl label="Emails" isError={Boolean(error)} errorText={error?.message}>
                   <TextArea
                     {...field}
                     className="mt-1 h-20 w-full min-w-[30rem] rounded-md border border-mineshaft-500 bg-mineshaft-900/70 py-1 px-2 text-sm text-bunker-300 outline-none ring-primary-800 ring-opacity-70 transition-all placeholder:text-bunker-400 focus:ring-2"
@@ -181,34 +195,33 @@ export const AddOrgMemberModal = ({
               )}
             />
 
-            <div>
-              <Controller
-                control={control}
-                name="organizationRoleSlug"
-                render={({ field, fieldState: { error } }) => (
-                  <FormControl
-                    tooltipText="Select which organization role you want to assign to the user."
-                    label="Assign organization role"
-                    isError={Boolean(error)}
-                    errorText={error?.message}
-                  >
-                    <div>
-                      <Select
-                        defaultValue={DEFAULT_ORG_AND_PROJECT_MEMBER_ROLE_SLUG}
-                        {...field}
-                        onValueChange={(val) => field.onChange(val)}
-                      >
-                        {organizationRoles?.map((role) => (
-                          <SelectItem key={role.id} value={role.slug}>
-                            {role.name}
-                          </SelectItem>
-                        ))}
-                      </Select>
-                    </div>
-                  </FormControl>
-                )}
-              />
-            </div>
+            <Controller
+              control={control}
+              name="organizationRoleSlug"
+              render={({ field, fieldState: { error } }) => (
+                <FormControl
+                  tooltipText="Select which organization role you want to assign to the user."
+                  label="Assign organization role"
+                  isError={Boolean(error)}
+                  errorText={error?.message}
+                >
+                  <div>
+                    <Select
+                      className="w-full"
+                      defaultValue={DEFAULT_ORG_AND_PROJECT_MEMBER_ROLE_SLUG}
+                      {...field}
+                      onValueChange={(val) => field.onChange(val)}
+                    >
+                      {organizationRoles?.map((role) => (
+                        <SelectItem key={role.id} value={role.slug}>
+                          {role.name}
+                        </SelectItem>
+                      ))}
+                    </Select>
+                  </div>
+                </FormControl>
+              )}
+            />
 
             <div className="flex items-center justify-between gap-2">
               <div className="w-full">
@@ -217,7 +230,7 @@ export const AddOrgMemberModal = ({
                   name="projectIds"
                   render={({ field, fieldState: { error } }) => (
                     <FormControl
-                      label="Add user to projects"
+                      label="Assign users to projects (optional)"
                       isError={Boolean(error?.message)}
                       errorText={error?.message}
                     >
@@ -225,10 +238,14 @@ export const AddOrgMemberModal = ({
                         <DropdownMenuTrigger asChild>
                           {filteredProjects && filteredProjects.length > 0 ? (
                             <div className="inline-flex w-full cursor-pointer items-center justify-between rounded-md border border-mineshaft-600 bg-mineshaft-900 px-3 py-2 font-inter text-sm font-normal text-bunker-200 outline-none data-[placeholder]:text-mineshaft-200">
-                              {projectIds.length === 1
-                                ? filteredProjects.find((project) => project.id === projectIds[0])
-                                    ?.name
-                                : `${projectIds.length} projects selected`}
+                              {/* eslint-disable-next-line no-nested-ternary */}
+                              {selectedProjectIds.length === 1
+                                ? filteredProjects.find(
+                                    (project) => project.id === selectedProjectIds[0]
+                                  )?.name
+                                : selectedProjectIds.length === 0
+                                ? "No projects selected"
+                                : `${selectedProjectIds.length} projects selected`}
                               <FontAwesomeIcon icon={faChevronDown} className="text-xs" />
                             </div>
                           ) : (
@@ -243,7 +260,7 @@ export const AddOrgMemberModal = ({
                         >
                           {filteredProjects && filteredProjects.length > 0 ? (
                             filteredProjects.map((project) => {
-                              const isSelected = projectIds.includes(String(project.id));
+                              const isSelected = selectedProjectIds.includes(String(project.id));
 
                               return (
                                 <DropdownMenuItem
@@ -251,14 +268,14 @@ export const AddOrgMemberModal = ({
                                     filteredProjects.length > 0 && event.preventDefault()
                                   }
                                   onClick={() => {
-                                    if (projectIds.includes(String(project.id))) {
+                                    if (selectedProjectIds.includes(String(project.id))) {
                                       field.onChange(
-                                        projectIds.filter(
+                                        selectedProjectIds.filter(
                                           (projectId: string) => projectId !== String(project.id)
                                         )
                                       );
                                     } else {
-                                      field.onChange([...projectIds, String(project.id)]);
+                                      field.onChange([...selectedProjectIds, String(project.id)]);
                                     }
                                   }}
                                   key={`project-id-${project.id}`}
@@ -275,7 +292,17 @@ export const AddOrgMemberModal = ({
                                   iconPos="left"
                                   className="w-[28.4rem] text-sm"
                                 >
-                                  {project.name}
+                                  <div className="flex items-center gap-2 capitalize">
+                                    {project.name}
+                                    {project.version !== ProjectVersion.V3 && (
+                                      <Tooltip content="Project is not compatible with this action, please upgrade this project.">
+                                        <FontAwesomeIcon
+                                          icon={faExclamationCircle}
+                                          className="text-xs opacity-50"
+                                        />
+                                      </Tooltip>
+                                    )}
+                                  </div>
                                 </DropdownMenuItem>
                               );
                             })
@@ -301,7 +328,7 @@ export const AddOrgMemberModal = ({
                     >
                       <div>
                         <Select
-                          isDisabled={projectIds.length === 0}
+                          isDisabled={selectedProjectIds.length === 0}
                           defaultValue={DEFAULT_ORG_AND_PROJECT_MEMBER_ROLE_SLUG}
                           {...field}
                           onValueChange={(val) => field.onChange(val)}

From a6a2e2bae00b5dc65846d074de527b8ced721630 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Fri, 23 Aug 2024 02:21:11 +0400
Subject: [PATCH 27/29] Update AddOrgMemberModal.tsx

---
 .../OrgMembersSection/AddOrgMemberModal.tsx         | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/AddOrgMemberModal.tsx b/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/AddOrgMemberModal.tsx
index 10b1e0987..3e9720718 100644
--- a/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/AddOrgMemberModal.tsx
+++ b/frontend/src/views/Org/MembersPage/components/OrgMembersTab/components/OrgMembersSection/AddOrgMemberModal.tsx
@@ -236,13 +236,12 @@ export const AddOrgMemberModal = ({
                     >
                       <DropdownMenu>
                         <DropdownMenuTrigger asChild>
-                          {filteredProjects && filteredProjects.length > 0 ? (
+                          {projects && projects.length > 0 ? (
                             <div className="inline-flex w-full cursor-pointer items-center justify-between rounded-md border border-mineshaft-600 bg-mineshaft-900 px-3 py-2 font-inter text-sm font-normal text-bunker-200 outline-none data-[placeholder]:text-mineshaft-200">
                               {/* eslint-disable-next-line no-nested-ternary */}
                               {selectedProjectIds.length === 1
-                                ? filteredProjects.find(
-                                    (project) => project.id === selectedProjectIds[0]
-                                  )?.name
+                                ? projects.find((project) => project.id === selectedProjectIds[0])
+                                    ?.name
                                 : selectedProjectIds.length === 0
                                 ? "No projects selected"
                                 : `${selectedProjectIds.length} projects selected`}
@@ -258,14 +257,14 @@ export const AddOrgMemberModal = ({
                           align="start"
                           className="thin-scrollbar z-[100] max-h-80"
                         >
-                          {filteredProjects && filteredProjects.length > 0 ? (
-                            filteredProjects.map((project) => {
+                          {projects && projects.length > 0 ? (
+                            projects.map((project) => {
                               const isSelected = selectedProjectIds.includes(String(project.id));
 
                               return (
                                 <DropdownMenuItem
                                   onSelect={(event) =>
-                                    filteredProjects.length > 0 && event.preventDefault()
+                                    projects.length > 1 && event.preventDefault()
                                   }
                                   onClick={() => {
                                     if (selectedProjectIds.includes(String(project.id))) {

From 28ecc371634433d773096809e407ae0fde9773ea Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Fri, 23 Aug 2024 03:10:14 +0400
Subject: [PATCH 28/29] Update org-service.ts

---
 backend/src/services/org/org-service.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/backend/src/services/org/org-service.ts b/backend/src/services/org/org-service.ts
index b02081af3..c2a3133d3 100644
--- a/backend/src/services/org/org-service.ts
+++ b/backend/src/services/org/org-service.ts
@@ -621,7 +621,7 @@ export const orgServiceFactory = ({
 
     const user = await userDAL.findById(userId);
 
-    const tokenMap: { email: string; link: string }[] = [];
+    const signupTokens: { email: string; link: string }[] = [];
     if (inviteeUsers) {
       for await (const invitee of inviteeUsers) {
         const token = await tokenService.createTokenForUser({
@@ -649,7 +649,7 @@ export const orgServiceFactory = ({
           );
         }
 
-        tokenMap.push({
+        signupTokens.push({
           email: invitee.email || invitee.username,
           link: `${appCfg.SITE_URL}/signupinvite?token=${token}${
             inviteMetadata ? `&metadata=${inviteMetadata}` : ""
@@ -676,7 +676,7 @@ export const orgServiceFactory = ({
     await licenseService.updateSubscriptionOrgMemberCount(orgId);
 
     if (!appCfg.isSmtpConfigured) {
-      return tokenMap;
+      return signupTokens;
     }
   };
 

From a2b994ab233380e718939b6f8ab43dda3a4c68f7 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Sat, 24 Aug 2024 11:00:05 +0400
Subject: [PATCH 29/29] Requested changes

---
 backend/src/server/routes/v3/signup-router.ts    |  2 +-
 backend/src/services/auth/auth-signup-service.ts | 12 ++++++------
 backend/src/services/auth/auth-signup-type.ts    |  2 +-
 backend/src/services/org/org-service.ts          | 12 ++++--------
 frontend/src/hooks/api/auth/types.ts             |  2 +-
 frontend/src/pages/signupinvite.tsx              |  2 +-
 6 files changed, 14 insertions(+), 18 deletions(-)

diff --git a/backend/src/server/routes/v3/signup-router.ts b/backend/src/server/routes/v3/signup-router.ts
index 276a2e8cb..2b603f523 100644
--- a/backend/src/server/routes/v3/signup-router.ts
+++ b/backend/src/server/routes/v3/signup-router.ts
@@ -180,7 +180,7 @@ export const registerSignupRouter = async (server: FastifyZodProvider) => {
         encryptedPrivateKeyTag: z.string().trim(),
         salt: z.string().trim(),
         verifier: z.string().trim(),
-        metadata: z.string().optional()
+        tokenMetadata: z.string().optional()
       }),
       response: {
         200: z.object({
diff --git a/backend/src/services/auth/auth-signup-service.ts b/backend/src/services/auth/auth-signup-service.ts
index 33092484e..7cca07110 100644
--- a/backend/src/services/auth/auth-signup-service.ts
+++ b/backend/src/services/auth/auth-signup-service.ts
@@ -313,7 +313,7 @@ export const authSignupServiceFactory = ({
     encryptedPrivateKeyIV,
     encryptedPrivateKeyTag,
     authorization,
-    metadata
+    tokenMetadata
   }: TCompleteAccountInviteDTO) => {
     const user = await userDAL.findUserByUsername(email);
     if (!user || (user && user.isAccepted)) {
@@ -370,13 +370,13 @@ export const authSignupServiceFactory = ({
         tx
       );
 
-      if (metadata) {
-        const metadataObj = jwt.verify(metadata, appCfg.AUTH_SECRET) as TTokenMetadata;
+      if (tokenMetadata) {
+        const metadataObj = jwt.verify(tokenMetadata, appCfg.AUTH_SECRET) as TTokenMetadata;
 
         if (
-          metadataObj.payload.userId !== user.id ||
-          metadataObj.payload.orgId !== orgMembership.orgId ||
-          metadataObj.type !== TokenMetadataType.InviteToProjects
+          metadataObj?.payload?.userId !== user.id ||
+          metadataObj?.payload?.orgId !== orgMembership.orgId ||
+          metadataObj?.type !== TokenMetadataType.InviteToProjects
         ) {
           throw new UnauthorizedError({
             message: "Malformed or invalid metadata token"
diff --git a/backend/src/services/auth/auth-signup-type.ts b/backend/src/services/auth/auth-signup-type.ts
index c5c535f39..3308b9d12 100644
--- a/backend/src/services/auth/auth-signup-type.ts
+++ b/backend/src/services/auth/auth-signup-type.ts
@@ -37,5 +37,5 @@ export type TCompleteAccountInviteDTO = {
   ip: string;
   userAgent: string;
   authorization: string;
-  metadata?: string;
+  tokenMetadata?: string;
 };
diff --git a/backend/src/services/org/org-service.ts b/backend/src/services/org/org-service.ts
index c2a3133d3..6696a5323 100644
--- a/backend/src/services/org/org-service.ts
+++ b/backend/src/services/org/org-service.ts
@@ -546,15 +546,11 @@ export const orgServiceFactory = ({
                 });
               }
 
+              await projectMembershipDAL.insertMany(
+                projectIds.map((id) => ({ projectId: id, userId: inviteeUser.id })),
+                tx
+              );
               for await (const projectId of projectIds) {
-                await projectMembershipDAL.create(
-                  {
-                    projectId,
-                    userId: inviteeUser.id
-                  },
-                  tx
-                );
-
                 await addMembersToProject({
                   orgDAL,
                   projectDAL,
diff --git a/frontend/src/hooks/api/auth/types.ts b/frontend/src/hooks/api/auth/types.ts
index 5ca5c75a2..3664e8e96 100644
--- a/frontend/src/hooks/api/auth/types.ts
+++ b/frontend/src/hooks/api/auth/types.ts
@@ -93,7 +93,7 @@ export type CompleteAccountDTO = {
   salt: string;
   verifier: string;
   password: string;
-  metadata?: string;
+  tokenMetadata?: string;
 };
 
 export type CompleteAccountSignupDTO = CompleteAccountDTO & {
diff --git a/frontend/src/pages/signupinvite.tsx b/frontend/src/pages/signupinvite.tsx
index 9c5c01b32..713a64eb3 100644
--- a/frontend/src/pages/signupinvite.tsx
+++ b/frontend/src/pages/signupinvite.tsx
@@ -165,7 +165,7 @@ export default function SignupInvite() {
                 encryptedPrivateKeyTag,
                 salt: result.salt,
                 verifier: result.verifier,
-                metadata
+                tokenMetadata: metadata
               });
 
               // unset temporary signup JWT token and set JWT token