fix(auth): forbid users on shared subscription to send out invitations

packages/auth/src/Domain/UseCase/InviteToSharedSubscription/InviteToSharedSubscription.spec.ts

@@ -9,6 +9,7 @@ import { InviteToSharedSubscription } from './InviteToSharedSubscription'
 import { UserSubscriptionRepositoryInterface } from '../../Subscription/UserSubscriptionRepositoryInterface'
 import { UserSubscription } from '../../Subscription/UserSubscription'
 import { RoleName } from '@standardnotes/common'
+import { UserSubscriptionType } from '../../Subscription/UserSubscriptionType'
 
 describe('InviteToSharedSubscription', () => {
   let userSubscriptionRepository: UserSubscriptionRepositoryInterface
@@ -28,9 +29,10 @@ describe('InviteToSharedSubscription', () => {
 
   beforeEach(() => {
     userSubscriptionRepository = {} as jest.Mocked<UserSubscriptionRepositoryInterface>
-    userSubscriptionRepository.findOneByUserUuid = jest
-      .fn()
-      .mockReturnValue({ subscriptionId: 2 } as jest.Mocked<UserSubscription>)
+    userSubscriptionRepository.findOneByUserUuid = jest.fn().mockReturnValue({
+      subscriptionId: 2,
+      subscriptionType: UserSubscriptionType.Regular,
+    } as jest.Mocked<UserSubscription>)
 
     timer = {} as jest.Mocked<TimerInterface>
     timer.getTimestampInMicroseconds = jest.fn().mockReturnValue(1)
@@ -159,4 +161,24 @@ describe('InviteToSharedSubscription', () => {
     })
     expect(domainEventPublisher.publish).toHaveBeenCalled()
   })
+
+  it('should not create an inivitation for sharing the subscription if the inviter is on a shared subscription', async () => {
+    userSubscriptionRepository.findOneByUserUuid = jest.fn().mockReturnValue({
+      subscriptionId: 2,
+      subscriptionType: UserSubscriptionType.Shared,
+    } as jest.Mocked<UserSubscription>)
+
+    await createUseCase().execute({
+      inviteeIdentifier: '[email protected]',
+      inviterUuid: '1-2-3',
+      inviterEmail: '[email protected]',
+      inviterRoles: [RoleName.ProUser],
+    })
+
+    expect(sharedSubscriptionInvitationRepository.save).not.toHaveBeenCalled()
+
+    expect(domainEventFactory.createSharedSubscriptionInvitationCreatedEvent).not.toHaveBeenCalled()
+
+    expect(domainEventPublisher.publish).not.toHaveBeenCalled()
+  })
 })

packages/auth/src/Domain/UseCase/InviteToSharedSubscription/InviteToSharedSubscription.ts

@@ -11,6 +11,7 @@ import { InviterIdentifierType } from '../../SharedSubscription/InviterIdentifie
 import { SharedSubscriptionInvitation } from '../../SharedSubscription/SharedSubscriptionInvitation'
 import { SharedSubscriptionInvitationRepositoryInterface } from '../../SharedSubscription/SharedSubscriptionInvitationRepositoryInterface'
 import { UserSubscriptionRepositoryInterface } from '../../Subscription/UserSubscriptionRepositoryInterface'
+import { UserSubscriptionType } from '../../Subscription/UserSubscriptionType'
 import { UseCaseInterface } from '../UseCaseInterface'
 
 import { InviteToSharedSubscriptionDTO } from './InviteToSharedSubscriptionDTO'
@@ -35,18 +36,18 @@ export class InviteToSharedSubscription implements UseCaseInterface {
       }
     }
 
-    const numberOfUsedInvites = await this.sharedSubscriptionInvitationRepository.countByInviterEmailAndStatus(
-      dto.inviterEmail,
-      [InvitationStatus.Sent, InvitationStatus.Accepted],
-    )
-    if (numberOfUsedInvites >= this.MAX_NUMBER_OF_INVITES) {
+    const inviterUserSubscription = await this.userSubscriptionRepository.findOneByUserUuid(dto.inviterUuid)
+    if (inviterUserSubscription === null || inviterUserSubscription.subscriptionType === UserSubscriptionType.Shared) {
       return {
         success: false,
       }
     }
 
-    const inviterUserSubscription = await this.userSubscriptionRepository.findOneByUserUuid(dto.inviterUuid)
-    if (inviterUserSubscription === null) {
+    const numberOfUsedInvites = await this.sharedSubscriptionInvitationRepository.countByInviterEmailAndStatus(
+      dto.inviterEmail,
+      [InvitationStatus.Sent, InvitationStatus.Accepted],
+    )
+    if (numberOfUsedInvites >= this.MAX_NUMBER_OF_INVITES) {
       return {
         success: false,
       }