FailSafe 6fc5d82f1d fix: restrict email invite metadata lookup (#15150) ...

## Summary

This change restricts email invitation metadata lookup to the
authenticated user that the invitation was issued to.

## Impact

The public invite-info resolver returns workspace, owner, invitee, and
status details for a valid invitation identifier. For email invitations,
that information should only be returned to the intended recipient after
authentication.

## Fix

- Keep existing link-invitation behavior unchanged.
- For email invitations, require an authenticated user whose id matches
the invitation recipient before returning invitation details.
- Return the existing invalid-invitation error for mismatched or
unauthenticated access.

## Validation

- `git diff --check`
- Full test/lint suite was not run locally because dependencies are not
installed in this checkout.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Tightened invitation access checks so non-link invites are only
readable by the intended recipient.
* Invalid or missing user context now returns an error earlier,
preventing access to invite details when the invitation doesn’t match.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: failsafesecurity <190101117+failsafesecurity@users.noreply.github.com>
Co-authored-by: DarkSky <25152247+darkskygit@users.noreply.github.com>

2026-08-28 12:05:40 +08:00

..

backend

fix: restrict email invite metadata lookup (#15150)

2026-08-28 12:05:40 +08:00

common

fix(ios): ios local access limit for self-hosted workspace (#15338)

2026-08-24 09:33:58 +08:00

frontend

feat(ios): improve share preview (#15538)

2026-08-28 03:32:26 +08:00