fix(send): protect folder owner from losing access when an invitation is removed#1005
Merged
Merged
Conversation
… is removed The owner's access to a folder is stored as a membership row keyed by (groupId, userId), the same key any invited guest gets. If the owner ended up on their own folder's invitation list, removing that invitation deleted the owner's real membership and permanently locked them out of their own folder, with no in-app recovery. - removeGroupMember() now no-ops when the target user is the container owner, so the owner's membership can never be deleted via the invitation- or member-removal paths. - createInvitation() refuses to create an invitation whose recipient is the owner (defense in depth, removes the precondition entirely). - createInvitationFromAccessLink()/the accept route treat "owner accepts their own access link" as a graceful no-op success instead of an error. - Adds regression tests covering all of the above. Closes #1004 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
radishmouse
approved these changes
Jul 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed?
This fixes a bug where removing a share invitation could lock a folder's owner out of their own folder — permanently.
In plain terms: every folder has an owner who always has full access. When you share a folder, you invite guests. Cancelling an invitation is supposed to remove a guest's access. But if the owner ever ended up on their own folder's invitation list, cancelling that invitation removed the owner's access by mistake, and there was no way to recover from inside the app.
The change makes three things safe:
Regression tests were added for all three cases, and the full backend test suite passes.
AI disclosure: This change was written by an AI agent (Claude) working from a bug report, with a human reviewing the approach, the diff, and the results. A separate AI code-review pass was run over the diff and its feedback was incorporated.
Why?
The owner's access and a guest's access were stored the same way internally, so the system couldn't tell them apart. That meant a routine "remove invitation" action could silently delete the owner's own access. Because the owner is the only account guaranteed full access to a folder, losing it left the folder unopenable with no self-service fix — a developer had to repair the account directly. This closes that gap.
How to reproduce (before the fix)
You need one account and a folder you own:
After this fix: step 4 works normally — the folder still opens, and steps 2 and the "open your own share link" case no longer cause an error.
Limitations and Notes
Applicable Issues
Closes #1004