fix(organizations): respect inherited access when inviting members

[waleedlatif1]

Summary

• Treat inherited organization-admin access as existing workspace access in invitations and provisioning, avoiding redundant grants and notifications. Recheck roles, workspace scope, and inviter authority under existing locks, preserve promotion outcomes, and keep foreign-organization roles scoped correctly.
• Name missing approval fingerprints and decline reasons using the shared validation helper.
• Add PostgreSQL member-to-admin request flows to CI, covering permission approval, credit-cap increases, stale previews, cancellation, scope isolation, and unchanged state on rejected or repeated decisions.

Type of Change

• Bug fix

Testing

45 PostgreSQL integration tests, 497 focused tests on the final patch, and 1,216 CLI tests passed. Verified the published CLI against REST and MCP, including pagination, validation, and unauthenticated boundaries for 21 organization and workspace operations. Type checking, lint, and all 47 repository audits passed.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 22, 2026 7:34am UTC

[cubic-dev-ai]

No issues found across 6 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no actionable new defect or outstanding previous finding remains.

Summary

This PR makes invitation and enterprise-provisioning reconciliation account for workspace access inherited from organization-admin roles while revalidating mutable authorization state under locks.

• Treats organization owner/admin roles as satisfying workspace access without redundant grants, notifications, or credential synchronization.
• Preserves explicit grants when inherited access disappears during a concurrent demotion.
• Verifies enterprise provisioning outcomes against the requested organization role and every selected workspace.
• Improves required-field messages for access-request decisions.
• Adds PostgreSQL integration coverage for access-request approval, cancellation, stale previews, credit limits, and scope isolation.
• Runs the new PostgreSQL flow suite in CI.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Invitation or provisioning request] --> B[Resolve existing user and organization membership]
  B --> C{Inherited organization-admin access?}
  C -->|Yes| D[Revalidate membership, workspace scope, and inviter authority under locks]
  D --> E{Admin access still present?}
  E -->|Yes| F[Return unchanged without redundant workspace grants]
  E -->|No, demoted| G[Apply required explicit workspace grants]
  C -->|No| G
  G --> H[Verify requested role and workspace permissions]
  H --> I[Record applied outcome]

Loading

_{Reviews (3) · Last reviewed commit: "fix(organizations): verify effective acc..."}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 8 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 10 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}