fix(invitations): record the invoked operation in invitation audit metadata

Author: waleedlatif1

apps/sim/lib/invitations/__integration__/copilot-workspace-invitations.integration.ts

@@ -2,6 +2,7 @@
 
 import { db } from '@sim/db'
 import {
+  auditLog,
   invitation,
   invitationWorkspaceGrant,
   member,
@@ -12,7 +13,7 @@ import {
 } from '@sim/db/schema'
 import { generateId } from '@sim/utils/id'
 import { and, eq, inArray } from 'drizzle-orm'
-import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
 import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { createScopedCliTransport } from '@/lib/mothership/agent-cli/scoped-transport'
 import '@/app/api/v2/workspaces/[workspaceId]/invitations/route'
@@ -129,6 +130,7 @@ describe('chat-delegated workspace invitations', () => {
     await db
       .delete(invitation)
       .where(inArray(invitation.email, [newInvitee, pendingInvitee, writerInvitee]))
+    await db.delete(auditLog).where(eq(auditLog.workspaceId, workspaceId))
     await db.delete(workspace).where(eq(workspace.id, workspaceId))
     await db.delete(organization).where(eq(organization.id, organizationId))
     await db.delete(user).where(inArray(user.id, [adminId, writerId]))
@@ -144,6 +146,19 @@ describe('chat-delegated workspace invitations', () => {
     const [created] = await pendingInvitationsFor(newInvitee)
     expect(created.inviterId).toBe(adminId)
     expect(await grantsOf(created.id)).toEqual([{ workspaceId, permission: 'write' }])
+    await vi.waitFor(async () => {
+      const [audit] = await db
+        .select({ actorId: auditLog.actorId, metadata: auditLog.metadata })
+        .from(auditLog)
+        .where(and(eq(auditLog.workspaceId, workspaceId), eq(auditLog.resourceName, newInvitee)))
+      expect(audit).toMatchObject({
+        actorId: adminId,
+        metadata: {
+          operation: 'workspace_invitations.send_batch',
+          actor: { kind: 'delegated', serviceId: 'copilot' },
+        },
+      })
+    })
   })
 
   it('adds the workspace to a pending organization invitation instead of creating another', async () => {

apps/sim/lib/invitations/application/send-invitation-batch.test.ts

@@ -431,12 +431,9 @@ describe('workspace invitation delegation', () => {
     }
   )
 
-  it('invites as the delegating user while they hold current admin authority', async () => {
+  it('admits the delegating user while they hold current admin authority', async () => {
     const result = await sendWorkspaceInvitationBatch.execute({ principal: actor, input })
     expect(result).toMatchObject({ success: true, successful: ['person@example.com'] })
-    expect(mocks.workspaceContext).toHaveBeenCalledWith(
-      expect.objectContaining({ inviterId: 'admin-user', workspaceIds: ['workspace'] })
-    )
   })
 
   it('refuses an admin whose permission group disables invitations', async () => {

apps/sim/lib/invitations/application/send-invitation-batch.ts

@@ -10,6 +10,7 @@ import { createLogger } from '@sim/logger'
 import { normalizeEmail } from '@sim/utils/string'
 import { eq } from 'drizzle-orm'
 import {
+  type ApplicationOperation,
   assertOperationPrincipal,
   defineAuthorizedWorkspaceUseCase,
   ForbiddenOperationError,
@@ -78,13 +79,14 @@ export const sendInvitationBatch: OperationUseCase<
   async execute({ principal, input, request }) {
     requireAllowedWorkspacePrincipal(principal, invitationAuthorityOperations.workspace)
     assertOperationPrincipal(principal, invitationOperations.sendBatch)
-    return executeInvitationBatch(principal, input, request)
+    return executeInvitationBatch(principal, input, invitationOperations.sendBatch, request)
   },
 }
 
 async function executeInvitationBatch(
   principal: Principal,
   input: SendInvitationBatchInput,
+  operation: Pick<ApplicationOperation, 'id'>,
   request?: OrchestrationRequestContext
 ): Promise<SendInvitationBatchResult> {
   const actorId = requirePrincipalSubjectUserId(principal)
@@ -151,7 +153,7 @@ async function executeInvitationBatch(
             email: inviter.email,
             metadata: {
               actor: toPrincipalActor(principal),
-              operation: invitationOperations.sendBatch.id,
+              operation: operation.id,
             },
           },
         }
@@ -333,7 +335,8 @@ export const sendWorkspaceInvitationBatch = defineAuthorizedWorkspaceUseCase({
     return resolveActiveWorkspaceApplicationContext(input.workspaceIds[0])
   },
   authorizationOptions: { delegation: { audience: 'sim:settings', isWithinScope: () => true } },
-  execute: ({ principal, input, request }) => executeInvitationBatch(principal, input, request),
+  execute: ({ principal, input, request }) =>
+    executeInvitationBatch(principal, input, workspaceInvitationOperations.sendBatch, request),
 })
 
 const organizationInvitationSendOperation = defineOrganizationOperation({
@@ -361,6 +364,6 @@ export const sendOrganizationInvitationBatch: OperationUseCase<
     await authorizeOrganizationOperation(principal, organizationInvitationSendOperation, {
       organizationId: input.organizationId,
     })
-    return executeInvitationBatch(principal, input, request)
+    return executeInvitationBatch(principal, input, organizationInvitationSendOperation, request)
   },
 }