fix(api): enforce current invitation and organization scope

Author: waleedlatif1

.github/workflows/test-build.yml

@@ -128,6 +128,7 @@ jobs:
           lib/billing/core/organization-activity.postgres.test.ts
           lib/billing/core/usage-analytics-queries.postgres.test.ts
           lib/billing/core/organization-usage-pagination.postgres.test.ts
+          lib/billing/organizations/member-limits.postgres.test.ts
           lib/billing/calculations/usage-reservation.test.ts
 
       - name: Verify access request pagination and impact in PostgreSQL

apps/docs/content/docs/cli/organizations.mdx

@@ -418,7 +418,7 @@ Get Organization Member Credit Limit (OAuth login or personal API key required)
 
 | Argument | Required | Description |
 | --- | --- | --- |
-| `userId` | Yes | User ID from List Organization Members or List Workspace Members, including external workspace collaborators. |
+| `userId` | Yes | User ID of an organization member or external collaborator with workspace access in this organization. Use List Organization Members or List Workspace Members to find it. |
 
 </CommandTable>
 
@@ -446,7 +446,7 @@ Update Organization Member Credit Limit (OAuth login or personal API key require
 
 | Argument | Required | Description |
 | --- | --- | --- |
-| `userId` | Yes | User ID from List Organization Members or List Workspace Members, including external workspace collaborators. |
+| `userId` | Yes | User ID of an organization member or external collaborator with workspace access in this organization. Use List Organization Members or List Workspace Members to find it. |
 
 </CommandTable>
 

apps/docs/content/docs/cli/reference.mdx

@@ -3409,7 +3409,7 @@ sim organizations members usage-limit get <userId> [options]
 
 | Argument | Required | Description |
 | --- | --- | --- |
-| `userId` | Yes | User ID from List Organization Members or List Workspace Members, including external workspace collaborators. |
+| `userId` | Yes | User ID of an organization member or external collaborator with workspace access in this organization. Use List Organization Members or List Workspace Members to find it. |
 
 </CommandTable>
 
@@ -3437,7 +3437,7 @@ sim organizations members usage-limit update <userId> [options]
 
 | Argument | Required | Description |
 | --- | --- | --- |
-| `userId` | Yes | User ID from List Organization Members or List Workspace Members, including external workspace collaborators. |
+| `userId` | Yes | User ID of an organization member or external collaborator with workspace access in this organization. Use List Organization Members or List Workspace Members to find it. |
 
 </CommandTable>
 

apps/docs/lib/openapi-download.test.ts

@@ -33,7 +33,7 @@ describe('OpenAPI download', () => {
     const tags = document.tags as Array<{ name: string }>
 
     expect(document.openapi).toBe('3.1.0')
-    expect(Object.keys(paths)).toHaveLength(170)
+    expect(Object.keys(paths)).toHaveLength(187)
     expect(tags.map((tag) => tag.name)).toEqual([
       'Workspace Sync',
       'Workflows',
@@ -44,6 +44,7 @@ describe('OpenAPI download', () => {
       'Tables',
       'Knowledge Bases',
       'Billing',
+      'Access Requests',
       'Organizations',
       'Permission Groups',
       'Meta',

apps/docs/openapi-v2-resources.json

@@ -7016,7 +7016,7 @@
       "get": {
         "operationId": "getOrganizationMemberUsageLimit",
         "summary": "Get Organization Member Credit Limit",
-        "description": "Read a person’s credit cap and credits consumed in the organization billing period. Hosted only. The userId identifies a user, including an external workspace collaborator; it is not a membership record ID. Null means no per-person cap, while organization limits still apply. Requires organization administrator access. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:read`.",
+        "description": "Read a person’s credit cap and credits consumed in the organization billing period. Hosted only. The userId identifies an organization member or external collaborator with workspace access in this organization; it is not a membership record ID. Null means no per-person cap, while organization limits still apply. Requires organization administrator access. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:read`.",
         "x-sim-operation": "organization_member_usage_limits.read",
         "x-oauth-scope": "api:read",
         "tags": ["Organizations"],
@@ -7036,11 +7036,11 @@
             "name": "userId",
             "in": "path",
             "required": true,
-            "description": "User ID from List Organization Members or List Workspace Members, including external workspace collaborators.",
+            "description": "User ID of an organization member or external collaborator with workspace access in this organization. Use List Organization Members or List Workspace Members to find it.",
             "schema": {
               "type": "string",
               "minLength": 1,
-              "description": "User ID from List Organization Members or List Workspace Members, including external workspace collaborators."
+              "description": "User ID of an organization member or external collaborator with workspace access in this organization. Use List Organization Members or List Workspace Members to find it."
             }
           }
         ],
@@ -7092,7 +7092,7 @@
       "patch": {
         "operationId": "updateOrganizationMemberUsageLimit",
         "summary": "Update Organization Member Credit Limit",
-        "description": "Set or clear a person’s credit cap. Hosted only. The userId can identify an external workspace collaborator. The cap is a nonnegative whole number of credits, not dollars: 0 prevents further credit-consuming usage; null removes the per-person cap. Organization limits continue to apply. Retrying the same value is safe. Requires organization administrator access. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:write`.",
+        "description": "Set or clear a person’s credit cap. Hosted only. The userId must identify an organization member or external collaborator with workspace access in this organization. The cap is a nonnegative whole number of credits, not dollars: 0 prevents further credit-consuming usage; null removes the per-person cap. Organization limits continue to apply. Retrying the same value is safe. Requires organization administrator access. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:write`.",
         "x-sim-operation": "organization_member_usage_limits.update",
         "x-oauth-scope": "api:write",
         "tags": ["Organizations"],
@@ -7112,11 +7112,11 @@
             "name": "userId",
             "in": "path",
             "required": true,
-            "description": "User ID from List Organization Members or List Workspace Members, including external workspace collaborators.",
+            "description": "User ID of an organization member or external collaborator with workspace access in this organization. Use List Organization Members or List Workspace Members to find it.",
             "schema": {
               "type": "string",
               "minLength": 1,
-              "description": "User ID from List Organization Members or List Workspace Members, including external workspace collaborators."
+              "description": "User ID of an organization member or external collaborator with workspace access in this organization. Use List Organization Members or List Workspace Members to find it."
             }
           }
         ],
@@ -18624,7 +18624,7 @@
               "properties": {
                 "id": {
                   "type": "string",
-                  "description": "Group or event identifier; an empty group ID represents unattributed usage."
+                  "description": "Group identifier; an empty ID represents unattributed usage."
                 },
                 "label": {
                   "type": "string",

apps/sim/app/api/organizations/[id]/members/[memberId]/usage-limit/route.test.ts

@@ -20,26 +20,25 @@ const {
   mockGetOrgMemberUsageForCurrentPeriod,
   mockSetOrgMemberUsageLimit,
   mockGetOrganizationSubscription,
+  mockIsOrgMemberUsageLimitTarget,
 } = vi.hoisted(() => ({
   mockGetOrgMemberUsageLimit: vi.fn(),
   mockGetOrgMemberUsageForCurrentPeriod: vi.fn(),
   mockSetOrgMemberUsageLimit: vi.fn(),
   mockGetOrganizationSubscription: vi.fn(),
+  mockIsOrgMemberUsageLimitTarget: vi.fn(),
 }))
 
 vi.mock('@sim/audit', () => auditMock)
 
 vi.mock('@/lib/permission-groups/resolve.server', () => ({
   getUserPermissionConfigForOrganization: vi.fn().mockResolvedValue(null),
 }))
-vi.mock('@/lib/users/queries', () => ({
-  getUserProfile: vi.fn().mockResolvedValue({ id: 'user-2' }),
-}))
-
 vi.mock('@/lib/billing/organizations/member-limits', () => ({
   getOrgMemberUsageForCurrentPeriod: mockGetOrgMemberUsageForCurrentPeriod,
   getOrgMemberUsageLimit: mockGetOrgMemberUsageLimit,
   setOrgMemberUsageLimit: mockSetOrgMemberUsageLimit,
+  isOrgMemberUsageLimitTarget: mockIsOrgMemberUsageLimitTarget,
 }))
 
 vi.mock('@/lib/billing/core/billing', () => ({
@@ -74,6 +73,7 @@ describe('GET /api/organizations/[id]/members/[memberId]/usage-limit', () => {
     })
     resetDbChainMock()
     queueTableRows(member, [{ role: 'admin' }])
+    mockIsOrgMemberUsageLimitTarget.mockResolvedValue(true)
     mockGetOrgMemberUsageForCurrentPeriod.mockResolvedValue(1) // $1 -> 200 credits
     mockGetOrgMemberUsageLimit.mockResolvedValue(2) // $2 -> 400 credits
     mockGetOrganizationSubscription.mockResolvedValue(null)
@@ -110,6 +110,16 @@ describe('GET /api/organizations/[id]/members/[memberId]/usage-limit', () => {
       },
     })
     expect(mockGetOrgMemberUsageForCurrentPeriod).toHaveBeenCalledWith('org-1', 'user-2', null)
+    expect(mockIsOrgMemberUsageLimitTarget).toHaveBeenCalledWith('org-1', 'user-2')
+  })
+
+  it('returns 404 before reading a target outside the organization', async () => {
+    mockIsOrgMemberUsageLimitTarget.mockResolvedValue(false)
+    const res = await GET(getRequest(), context())
+    expect(res.status).toBe(404)
+    expect(mockGetOrgMemberUsageLimit).not.toHaveBeenCalled()
+    expect(mockGetOrganizationSubscription).not.toHaveBeenCalled()
+    expect(mockGetOrgMemberUsageForCurrentPeriod).not.toHaveBeenCalled()
   })
 
   it('reuses the fetched org subscription for the usage window', async () => {
@@ -157,6 +167,7 @@ describe('PUT /api/organizations/[id]/members/[memberId]/usage-limit', () => {
     })
     resetDbChainMock()
     queueTableRows(member, [{ role: 'admin' }])
+    mockIsOrgMemberUsageLimitTarget.mockResolvedValue(true)
     mockSetOrgMemberUsageLimit.mockResolvedValue(undefined)
   })
 
@@ -193,6 +204,17 @@ describe('PUT /api/organizations/[id]/members/[memberId]/usage-limit', () => {
     expect(mockSetOrgMemberUsageLimit).toHaveBeenCalledWith('org-1', 'user-2', null, 'admin-1')
   })
 
+  it.each([400, null])(
+    'rejects cap %s for a target outside the organization',
+    async (creditLimit) => {
+      mockIsOrgMemberUsageLimitTarget.mockResolvedValue(false)
+      const res = await PUT(putRequest({ creditLimit }), context())
+      expect(res.status).toBe(404)
+      expect(mockSetOrgMemberUsageLimit).not.toHaveBeenCalled()
+      expect(auditMock.recordAudit).not.toHaveBeenCalled()
+    }
+  )
+
   it('rejects a negative credit limit with 400', async () => {
     const res = await PUT(putRequest({ creditLimit: -5 }), context())
     expect(res.status).toBe(400)