Repository navigation
console: workspace members page offers Invite / Remove member to the member role; only the server 403 stops it #4475
Description
Activity
CLAIM — session
session_017Qqyix2QcnpUC9XeYVDzx3, branchclaude/issue-4475-members-role-gating.Ruling (delegated authority; open veto window): gate the affordances by the active member's org role, using the same page's own Settings tab as the in-file precedent — it already does owner-gating right (form replaced by explanatory copy, destructive action disabled, Leave still enabled). Members/invitations tabs get the same treatment: a
membersees no Invite button and no Remove-member row actions; the role comes from the org context the page already consumes (measure which roles CAN invite/remove rather than hardcoding "owner" — the server's better-auth role model is the truth; mirror what the Settings tab keys on and what the server's own gates enforce, and say what you keyed on).Scope guards: (1) UI half ONLY — the server-side "can org_member read the invitation ledger" question is escalated as objectstack#8095, do NOT couple to it. (2) The card's probe note: the
remove-memberserver path's gating is unverified from the client (lookup runs before permission check) — MEASURE it read-only and report; if the server genuinely does not gate remove-member, that is a stop-and-report finding for the objectstack lane, not something to fix here. (3) New user-facing strings via the channel #4474 just established (PR #4496 landed —useObjectTranslationinline defaults + all-ten-packs parity; the role-label resolverresolveOrgRoleLabeland error mapper now exist, reuse them, don't fork).Red-first: member viewer on the members page → pre-fix Invite button enabled + Remove on every row (capture the DOM); post-fix neither affordance present, with the Settings-tab-style explanation where the design calls for one. Must-not-change (green both sides): owner/admin still see and use both affordances; Leave organization unaffected; the invitations tab's copy-link affordances follow the same measured role rule.
Grading: patch
@object-ui/app-shell. Never major.Surface (mutual exclusion):
packages/app-shell/src/console/organizations/manage/**(MembersPage, InvitationsPage if its affordances need the same gate, InviteMemberDialog) + tests + one changeset. Disjoint from in-flight #4434 (test-support), #4464 (plugin-grid), #4465 (plugin-dashboard filter bar), #4467 (shell chrome/impersonation — dispatching in parallel, does NOT enter organizations/manage).
Generated by Claude Code
Generated by Claude Code
- added a commit that references this issue
on Aug 17, 2026
On
/_console/organizations/<slug>/members, a user whose org role ismemberis shown the Invite member button and a per-row Member actions menu containing Remove member — including on the row of the workspace Owner. Nothing is disabled or hidden; the action only fails after the user commits to it.Repro
member./_console/organizations/acme-jia/members.Actual
You are not allowed to invite users to this organization(also see the i18n card console: organization & invitation UI ships untranslated English in a zh locale (6 sites, incl. icon-only aria-labels) #4474).…menu on every row, the Owner's included, offers Remove member.The server does gate the write —
POST /api/v1/auth/organization/invite-memberas the member returns:so this is a UI-gating gap, not a privilege escalation. (
remove-memberwas not exercised destructively; a probe with a non-existent member returned400 MEMBER_NOT_FOUND, i.e. the lookup runs before the permission check, so that path's gating is unverified from the client side and worth a look while fixing.)Expected
A
membersees no invite or remove affordances — matching the Settings tab of the very same page, which already gets this right: it replaces the form with "只有所有者可以修改设置。" and disables Delete organization while leaving Leave organization enabled. The members/invitations tabs simply never got the same treatment.Where
packages/app-shell/src/console/organizations/manage/—MembersPage(invite button + row actions) andInviteMemberDialog. The active member's role is already available via the org context used elsewhere on the page.Environment
Local dev server
http://localhost:8080, multi-org enabled, zh locale, observed 2026-08-12. The server was started by the maintainer and its exact commit is not verified.