fix: prevent managers from deleting admin invitations (#2636)

packages/trpc/server/organisation-router/delete-organisation-member-invites.ts

@@ -1,8 +1,12 @@
 import { syncMemberCountWithStripeSeatPlan } from '@documenso/ee/server-only/stripe/update-subscription-item-quantity';
 import { ORGANISATION_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/organisations';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import { getMemberOrganisationRole } from '@documenso/lib/server-only/team/get-member-roles';
 import { validateIfSubscriptionIsRequired } from '@documenso/lib/utils/billing';
-import { buildOrganisationWhereQuery } from '@documenso/lib/utils/organisations';
+import {
+  buildOrganisationWhereQuery,
+  isOrganisationRoleWithinUserHierarchy,
+} from '@documenso/lib/utils/organisations';
 import { prisma } from '@documenso/prisma';
 
 import { authenticatedProcedure } from '../trpc';
@@ -52,6 +56,41 @@ export const deleteOrganisationMemberInvitesRoute = authenticatedProcedure
       throw new AppError(AppErrorCode.NOT_FOUND);
     }
 
+    const currentOrganisationMemberRole = await getMemberOrganisationRole({
+      organisationId: organisation.id,
+      reference: {
+        type: 'User',
+        id: userId,
+      },
+    });
+
+    const invitesToDelete = await prisma.organisationMemberInvite.findMany({
+      where: {
+        id: {
+          in: invitationIds,
+        },
+        organisationId: organisation.id,
+      },
+      select: {
+        id: true,
+        organisationRole: true,
+      },
+    });
+
+    const hasUnauthorizedRoleAccess = invitesToDelete.some(
+      (invite) =>
+        !isOrganisationRoleWithinUserHierarchy(
+          currentOrganisationMemberRole,
+          invite.organisationRole,
+        ),
+    );
+
+    if (hasUnauthorizedRoleAccess) {
+      throw new AppError(AppErrorCode.UNAUTHORIZED, {
+        message: 'User does not have permission to delete invitations for higher roles',
+      });
+    }
+
     const { organisationClaim } = organisation;
 
     const subscription = validateIfSubscriptionIsRequired(organisation.subscription);