fix(web): invites ride the signed path — creation, acceptance and reads stop trusting the client

Rewires all 8 exports of supabase-invites.ts to Task 4's org-membership
edge function contract: create/revoke/accept/decline/list_invites/
has_pending_invite go through callOrgMembership(account, action, payload)
with a signed message, and invitedBy/the leaving wallet are derived
server-side from the verified signer rather than trusted from the client.
fetchInviteByToken moves to the anon-callable get_invite_by_token RPC
(bearer-token lookup, no wallet param). Reads keep a read-only fallback to
the direct invite_tokens query (isolated to three helpers, clearly
commented) for the deploy window before the RPC/edge function are live in
production; writes never fall back.

hasPendingInvite's new contract only answers for the calling wallet (the
edge function won't check an arbitrary wallet — that would leak other
users' invite status), so org/manage's duplicate-invite precheck is
dropped; duplicates are already legal in the schema.

Also threads useActiveAccount() through every invite call site
(invite/[token]/page.tsx, org/manage/page.tsx), and drops the
administrator-only 'stadt'/'fraktion' sub_types from the org/create picker
now that create_account rejects them for self-service callers (folded in
from the Task 4 review).

Author: MaxBrych

apps/web/src/app/app/org/create/page.tsx

@@ -23,12 +23,14 @@ import {
   type OrgSubType,
 } from "@/types/account";
 
+// Self-service sub_types only — the org-membership edge function's
+// create_account action rejects 'stadt'/'fraktion' (administrator-issued
+// only, via the service role), so offering them here would just produce a
+// BAD_REQUEST for anyone who picks them.
 const ORG_SUB_TYPES: OrgSubType[] = [
   "unternehmen",
   "restaurant",
   "verein",
-  "stadt",
-  "fraktion",
   "journalist",
 ];
 

apps/web/src/app/app/org/manage/page.tsx

@@ -22,7 +22,6 @@ import {
   revokeInvite as revokeInviteDB,
   createInAppInvite,
   createLinkInvite,
-  hasPendingInvite,
 } from "@/lib/supabase-invites"
 import type {
   MemberWithProfile,
@@ -84,16 +83,16 @@ export default function OrgManagePage() {
   const canLeave = canLeaveOrg(currentRole, ownerCount)
 
   const load = useCallback(async () => {
-    if (!accountId || !walletAddress) return
+    if (!accountId || !walletAddress || !thirdwebAccount) return
     const [membersData, invitesData, role] = await Promise.all([
       fetchMembersWithProfiles(accountId),
-      fetchPendingInvites(accountId),
+      fetchPendingInvites(thirdwebAccount, accountId),
       getAccountRole(accountId, walletAddress),
     ])
     setMembers(membersData)
     setPendingInvites(invitesData)
     setCurrentRole(role)
-  }, [accountId, walletAddress])
+  }, [accountId, walletAddress, thirdwebAccount])
 
   useEffect(() => {
     setIsLoading(true)
@@ -112,12 +111,15 @@ export default function OrgManagePage() {
   }
 
   const handleSendInvite = async () => {
-    if (!selectedUser || !walletAddress || !accountId) return
+    if (!selectedUser || !thirdwebAccount || !accountId) return
     setIsSending(true)
     try {
-      const exists = await hasPendingInvite(accountId, selectedUser.wallet_address)
-      if (exists) { alert("Dieser Benutzer hat bereits eine ausstehende Einladung."); return }
-      await createInAppInvite(accountId, selectedUser.wallet_address, inviteRole, walletAddress)
+      // hasPendingInvite now answers only for the calling wallet (the edge
+      // function doesn't accept an arbitrary wallet to check — that would
+      // leak other wallets' invite status), so there's no client-side
+      // precheck for the invitee anymore. Duplicate pending invites for the
+      // same person are allowed by the schema; create_invite just proceeds.
+      await createInAppInvite(thirdwebAccount, accountId, selectedUser.wallet_address, inviteRole)
       setShowInvite(false)
       setSelectedUser(null)
       setSearchQuery("")
@@ -130,10 +132,10 @@ export default function OrgManagePage() {
   }
 
   const handleCreateLink = async () => {
-    if (!walletAddress || !accountId) return
+    if (!thirdwebAccount || !accountId) return
     setIsSending(true)
     try {
-      const invite = await createLinkInvite(accountId, inviteRole, walletAddress, expiryDays)
+      const invite = await createLinkInvite(thirdwebAccount, accountId, inviteRole, expiryDays)
       setGeneratedLink(`https://roebel.app/invite/${invite.token}`)
       await load()
     } catch (e: any) {
@@ -144,8 +146,8 @@ export default function OrgManagePage() {
   }
 
   const handleRevoke = async (inviteId: string) => {
-    if (!confirm("Einladung wirklich widerrufen?")) return
-    await revokeInviteDB(inviteId)
+    if (!thirdwebAccount || !confirm("Einladung wirklich widerrufen?")) return
+    await revokeInviteDB(thirdwebAccount, inviteId)
     await load()
   }
 

apps/web/src/app/invite/[token]/page.tsx

@@ -61,10 +61,10 @@ export default function InviteTokenPage() {
   }, [token, walletAddress])
 
   const handleAccept = async () => {
-    if (!invite || !walletAddress) return
+    if (!invite || !thirdwebAccount) return
     setIsAccepting(true)
     try {
-      await acceptInvite(invite.id, walletAddress)
+      await acceptInvite(thirdwebAccount, invite.id)
       setResolved("accepted")
     } catch (err: any) {
       setError(err?.message || "Fehler beim Annehmen")
@@ -74,10 +74,10 @@ export default function InviteTokenPage() {
   }
 
   const handleDecline = async () => {
-    if (!invite) return
+    if (!invite || !thirdwebAccount) return
     setIsDeclining(true)
     try {
-      await declineInvite(invite.id)
+      await declineInvite(thirdwebAccount, invite.id)
       setResolved("declined")
     } catch (err: any) {
       setError(err?.message || "Fehler beim Ablehnen")