From f1600793b2f3f0898b321de734bf23b4fc3e547a Mon Sep 17 00:00:00 2001
From: Henry <henry_ball@hotmail.co.uk>
Date: Mon, 24 Mar 2025 19:10:47 +0000
Subject: [PATCH] feat: restrict inviting and removing users to workspace
 admins

---
 apps/web/src/views/members/index.tsx | 22 +++++++++++-----------
 packages/db/seed.sql                 | 13 ++++++++++++-
 2 files changed, 23 insertions(+), 12 deletions(-)

diff --git a/apps/web/src/views/members/index.tsx b/apps/web/src/views/members/index.tsx
index 64ed5027..6e0e85d8 100644
--- a/apps/web/src/views/members/index.tsx
+++ b/apps/web/src/views/members/index.tsx
@@ -2,6 +2,7 @@ import { HiEllipsisHorizontal, HiOutlinePlusSmall } from "react-icons/hi2";
 import { twMerge } from "tailwind-merge";
 
 import Avatar from "~/components/Avatar";
+import Button from "~/components/Button";
 import Dropdown from "~/components/Dropdown";
 import Modal from "~/components/modal";
 import { NewWorkspaceForm } from "~/components/NewWorkspaceForm";
@@ -111,7 +112,12 @@ export default function MembersPage() {
                 </span>
               )}
             </div>
-            <div className={twMerge("relative", showSkeleton && "hidden")}>
+            <div
+              className={twMerge(
+                "relative",
+                (workspace.role !== "admin" || showSkeleton) && "hidden",
+              )}
+            >
               <Dropdown
                 items={[
                   {
@@ -146,19 +152,13 @@ export default function MembersPage() {
             Members
           </h1>
           <div className="flex">
-            <button
-              type="button"
-              className="flex items-center gap-x-1.5 rounded-md bg-light-1000 px-3 py-2 text-sm font-semibold text-light-50 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 dark:bg-dark-1000 dark:text-dark-50"
+            <Button
               onClick={() => openModal("INVITE_MEMBER")}
+              iconLeft={<HiOutlinePlusSmall className="h-4 w-4" />}
+              disabled={workspace.role !== "admin"}
             >
-              <div className="h-5 w-5 items-center">
-                <HiOutlinePlusSmall
-                  className="-mr-0.5 h-5 w-5"
-                  aria-hidden="true"
-                />
-              </div>
               Invite
-            </button>
+            </Button>
           </div>
         </div>
 
diff --git a/packages/db/seed.sql b/packages/db/seed.sql
index a03bd2b0..6722182a 100644
--- a/packages/db/seed.sql
+++ b/packages/db/seed.sql
@@ -118,6 +118,17 @@ AS $$
   );
 $$;
 
+CREATE OR REPLACE FUNCTION is_workspace_member(user_id UUID, workspace_id BIGINT) 
+RETURNS BOOLEAN
+LANGUAGE SQL
+AS $$
+  SELECT EXISTS (
+    SELECT 1 
+    FROM workspace_members 
+    WHERE "userId" = user_id AND "workspaceId" = workspace_id
+  );
+$$;
+
 alter table "_card_labels" enable row level security;
 alter table "_card_workspace_members" enable row level security;
 alter table "_card_activity" enable row level security;
@@ -676,7 +687,7 @@ FOR SELECT
 TO authenticated
 USING (
   "userId" = auth.uid() OR
-  is_workspace_admin(auth.uid(), "workspaceId")
+  is_workspace_member(auth.uid(), "workspaceId")
 );
 
 CREATE POLICY "Allow admins to add workspace members"