Merge pull request #6351 from nocodb/fix/pr-invite

fix: validate invite role

packages/nocodb/src/services/project-users/project-users.service.ts

@@ -1,6 +1,7 @@
 import { Injectable } from '@nestjs/common';
 import {
   AppEvents,
+  extractRolesObj,
   OrgUserRoles,
   PluginCategory,
   ProjectRoles,
@@ -53,6 +54,26 @@ export class ProjectUsersService {
       param.projectUser,
     );
 
+    if (
+      getProjectRolePower({
+        project_roles: extractRolesObj(param.projectUser.roles),
+      }) > getProjectRolePower(param.req.user)
+    ) {
+      NcError.badRequest(`Insufficient privilege to invite with this role`);
+    }
+
+    if (
+      ![
+        ProjectRoles.CREATOR,
+        ProjectRoles.EDITOR,
+        ProjectRoles.COMMENTER,
+        ProjectRoles.VIEWER,
+        ProjectRoles.NO_ACCESS,
+      ].includes(param.projectUser.roles as ProjectRoles)
+    ) {
+      NcError.badRequest('Invalid role');
+    }
+
     const emails = (param.projectUser.email || '')
       .toLowerCase()
       .split(/\s*,\s*/)