Bug Description
Description
The "Invite to Room" feature does not actually send an invitation.
When a room owner enters a GitHub username, the specified user is immediately added as a full room member without receiving any invitation, notification, or opportunity to accept or decline.
This means users can be added to private rooms without their consent.
Current Behavior
A room owner enters a GitHub username.
The backend verifies that the GitHub username exists.
The user is immediately inserted into the room as a member.
No invitation is created.
No notification is sent.
The invited user has no opportunity to accept or reject the invitation.
Expected Behavior
Inviting someone should create a pending invitation, not immediate membership.
A typical flow would be:
Room owner sends an invitation.
A pending invite is stored.
The invited user receives a notification.
The user can Accept or Decline.
Only after acceptance should the user be added to room_members.
Additional Context
Current implementation:
API: src/app/api/rooms/[roomId]/invite/route.ts
After validating that the GitHub username exists, the route directly calls:
addRoomMember(roomId, github_username)
located in:
src/lib/supabase-rooms.ts
which immediately inserts a row into the room_members table with:
role = "member"
There does not appear to be:
a pending or invited membership state,
an invitation table,
an approval flow,
or any integration with the notification system (e.g. createAndEmitNotification) to notify the recipient.
Steps to Reproduce
Log in as User A.
Create a room.
Open the Invite Member dialog.
Enter User B's GitHub username (any valid GitHub account).
Submit the invitation.
Log in as User B.
Observe that User B is already a full room member.
Check User B's notifications.
Actual Result
User B is automatically added to the room.
No invitation is sent.
No approval is requested.
No notification is generated.
User B immediately gains access to room membership and chat history.
Affected Area
Collaboration Rooms
Screenshots
No response
Browser & OS
No response
Environment
None
Additional Context
No response
Bug Description
Description
The "Invite to Room" feature does not actually send an invitation.
When a room owner enters a GitHub username, the specified user is immediately added as a full room member without receiving any invitation, notification, or opportunity to accept or decline.
This means users can be added to private rooms without their consent.
Current Behavior
A room owner enters a GitHub username.
The backend verifies that the GitHub username exists.
The user is immediately inserted into the room as a member.
No invitation is created.
No notification is sent.
The invited user has no opportunity to accept or reject the invitation.
Expected Behavior
Inviting someone should create a pending invitation, not immediate membership.
A typical flow would be:
Room owner sends an invitation.
A pending invite is stored.
The invited user receives a notification.
The user can Accept or Decline.
Only after acceptance should the user be added to room_members.
Additional Context
Current implementation:
API: src/app/api/rooms/[roomId]/invite/route.ts
After validating that the GitHub username exists, the route directly calls:
addRoomMember(roomId, github_username)
located in:
src/lib/supabase-rooms.ts
which immediately inserts a row into the room_members table with:
role = "member"
There does not appear to be:
a pending or invited membership state,
an invitation table,
an approval flow,
or any integration with the notification system (e.g. createAndEmitNotification) to notify the recipient.
Steps to Reproduce
Log in as User A.
Create a room.
Open the Invite Member dialog.
Enter User B's GitHub username (any valid GitHub account).
Submit the invitation.
Log in as User B.
Observe that User B is already a full room member.
Check User B's notifications.
Actual Result
User B is automatically added to the room.
No invitation is sent.
No approval is requested.
No notification is generated.
User B immediately gains access to room membership and chat history.
Affected Area
Collaboration Rooms
Screenshots
No response
Browser & OS
No response
Environment
None
Additional Context
No response