feat: Add setting to allow users to send invites (#6488)

server/routes/api/teams/schema.ts

@@ -35,6 +35,8 @@ export const TeamsUpdateSchema = BaseSchema.extend({
         publicBranding: z.boolean().optional(),
         /** Whether viewers should see download options. */
         viewersCanExport: z.boolean().optional(),
+        /** Whether members can invite new people to the team. */
+        membersCanInvite: z.boolean().optional(),
         /** Whether commenting is enabled */
         commenting: z.boolean().optional(),
         /** The custom theme for the team. */

server/routes/api/teams/teams.ts

@@ -47,7 +47,7 @@ const handleTeamUpdate = async (ctx: APIContext<T.TeamsUpdateSchemaReq>) => {
 
 router.post(
   "team.update",
-  rateLimiter(RateLimiterStrategy.TenPerHour),
+  rateLimiter(RateLimiterStrategy.TenPerMinute),
   auth(),
   validate(T.TeamsUpdateSchema),
   transaction(),
@@ -56,7 +56,7 @@ router.post(
 
 router.post(
   "teams.update",
-  rateLimiter(RateLimiterStrategy.TenPerHour),
+  rateLimiter(RateLimiterStrategy.TenPerMinute),
   auth(),
   validate(T.TeamsUpdateSchema),
   transaction(),

server/routes/api/users/users.test.ts

@@ -1,8 +1,10 @@
+import { TeamPreference } from "@shared/types";
 import {
   buildTeam,
   buildAdmin,
   buildUser,
   buildInvite,
+  buildViewer,
 } from "@server/test/factories";
 import { getTestServer } from "@server/test/support";
 
@@ -271,11 +273,51 @@ describe("#users.invite", () => {
     expect(res.status).toEqual(400);
   });
 
-  it("should require admin", async () => {
-    const admin = await buildUser();
+  it("should allow members to invite members", async () => {
+    const user = await buildUser();
     const res = await server.post("/api/users.invite", {
       body: {
-        token: admin.getJwtToken(),
+        token: user.getJwtToken(),
+        invites: [
+          {
+            email: "test@example.com",
+            name: "Test",
+            role: "member",
+          },
+        ],
+      },
+    });
+    const body = await res.json();
+    expect(res.status).toEqual(200);
+    expect(body.data.sent.length).toEqual(1);
+  });
+
+  it("should now allow viewers to invite", async () => {
+    const user = await buildViewer();
+    const res = await server.post("/api/users.invite", {
+      body: {
+        token: user.getJwtToken(),
+        invites: [
+          {
+            email: "test@example.com",
+            name: "Test",
+            role: "member",
+          },
+        ],
+      },
+    });
+    expect(res.status).toEqual(403);
+  });
+
+  it("should allow restricting invites to admin", async () => {
+    const team = await buildTeam();
+    team.setPreference(TeamPreference.MembersCanInvite, false);
+    await team.save();
+
+    const user = await buildUser({ teamId: team.id });
+    const res = await server.post("/api/users.invite", {
+      body: {
+        token: user.getJwtToken(),
         invites: [
           {
             email: "test@example.com",