fix(webapp): match org invite emails case-insensitively (#3849)

Org member invites couldn't be accepted when the invite email's casing
didn't match the invitee's account email (for example,
`User@example.com` vs `user@example.com`). The accept route compared
emails strictly, and the pending-invite lookups used exact matching, so
the invite never appeared for the invitee in the first place.

Author: isshaddad

.server-changes/invite-email-case-insensitive.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Org member invites now match emails case-insensitively, so an invite whose email casing differs from the invitee's account email can be accepted.

apps/webapp/app/models/member.server.ts

@@ -135,11 +135,25 @@ export async function inviteMembers({
   const existingMembers = await prisma.orgMember.findMany({
     where: {
       organizationId: org.id,
-      user: { email: { in: boundedIn([...uniqueEmails]) } },
+      user: { email: { in: boundedIn([...uniqueEmails]), mode: "insensitive" } },
     },
     select: { user: { select: { email: true } } },
   });
-  const existingMemberEmails = new Set(existingMembers.map((member) => member.user.email));
+  // Compare folded: stored account emails and invite rows can both carry
+  // casing the caller didn't type, and the unique org+email constraint the
+  // P2002 below relies on is itself case-sensitive.
+  const existingMemberEmails = new Set(
+    existingMembers.map((member) => member.user.email.toLowerCase())
+  );
+
+  const pendingInvites = await prisma.orgMemberInvite.findMany({
+    where: {
+      organizationId: org.id,
+      email: { in: boundedIn([...uniqueEmails]), mode: "insensitive" },
+    },
+    select: { email: true },
+  });
+  const pendingInviteEmails = new Set(pendingInvites.map((invite) => invite.email.toLowerCase()));
 
   // Create one invite per unique email and return ONLY the invites actually
   // created by this call. A P2002 means the email is already invited to this org
@@ -153,15 +167,26 @@ export async function inviteMembers({
   const alreadyInvited: string[] = [];
 
   for (const email of uniqueEmails) {
-    if (existingMemberEmails.has(email)) {
+    const folded = email.toLowerCase();
+
+    if (existingMemberEmails.has(folded)) {
       alreadyMembers.push(email);
       continue;
     }
 
+    if (pendingInviteEmails.has(folded)) {
+      alreadyInvited.push(email);
+      continue;
+    }
+
     try {
       const invite = await prisma.orgMemberInvite.create({
         data: {
-          email,
+          // Store folded. The @@unique([organizationId, email]) backstop is
+          // case-sensitive, so it only catches a concurrent duplicate if every
+          // row for an address is written the same way — this keeps that true
+          // regardless of what a caller passes in.
+          email: folded,
           token: tokenGenerator(),
           organizationId: org.id,
           inviterId: userId,
@@ -204,7 +229,7 @@ export async function getInviteFromToken({ token }: { token: string }) {
 export async function getUsersInvites({ email }: { email: string }) {
   return await prisma.orgMemberInvite.findMany({
     where: {
-      email,
+      email: { equals: email, mode: "insensitive" },
       organization: {
         deletedAt: null,
       },
@@ -467,7 +492,7 @@ export async function acceptInvite({
   const invite = await prisma.orgMemberInvite.findFirst({
     where: {
       id: inviteId,
-      email: user.email,
+      email: { equals: user.email, mode: "insensitive" },
       organization: {
         deletedAt: null,
       },
@@ -563,7 +588,7 @@ export async function acceptInvite({
     await prisma.orgMemberInvite.delete({
       where: {
         id: inviteId,
-        email: user.email,
+        email: { equals: user.email, mode: "insensitive" },
       },
     });
   } catch (error) {
@@ -606,7 +631,7 @@ export async function declineInvite({
     const declinedInvite = await tx.orgMemberInvite.delete({
       where: {
         id: inviteId,
-        email: user.email,
+        email: { equals: user.email, mode: "insensitive" },
       },
       include: {
         organization: true,
@@ -616,7 +641,7 @@ export async function declineInvite({
     //2. check for other invites
     const remainingInvites = await tx.orgMemberInvite.findMany({
       where: {
-        email: user.email,
+        email: { equals: user.email, mode: "insensitive" },
       },
     });
 

apps/webapp/app/routes/_app.orgs.$organizationSlug.invite/route.tsx

@@ -127,7 +127,7 @@ const schema = z.object({
     }
 
     return [""];
-  }, z.string().email().array().nonempty("At least one email is required")),
+  }, z.string().trim().toLowerCase().email().array().nonempty("At least one email is required")),
   rbacRoleId: z.string().optional(),
 });
 

apps/webapp/app/routes/api.v1.orgs.$orgParam.invites.ts

@@ -18,6 +18,8 @@ const ParamsSchema = z.object({
 const InviteRequestBody = z.object({
   emails: z
     .string()
+    .trim()
+    .toLowerCase()
     .email()
     .array()
     .nonempty("At least one email is required")

apps/webapp/app/routes/invite-accept.tsx

@@ -34,7 +34,7 @@ export async function loader({ request }: LoaderFunctionArgs) {
     );
   }
 
-  if (invite.email !== user.email) {
+  if (invite.email.toLowerCase() !== user.email.toLowerCase()) {
     return redirectWithErrorMessage(
       "/",
       request,