#3096 fix(security): compare inviter rank before org_super_admin invites

Summary (AI generated)

• Close GHSA-7g7p-fxx8-4wm8: validateInvite no longer treats org.update_user_roles as enough to invite org_super_admin.
• Load the inviter's max org priority_rank and the target role rank, then deny unless caller_max_priority >= target_priority (same comparison as invite_user_to_org_rbac).
• Reuse that helper for existing-user invite resends so the two private invite paths stay aligned.
• Accept still applies tmp_users as written; new poisoned super-admin invites can no longer be created from the TS path.

Motivation (AI generated)

org_admin already has org.update_user_roles, so the old special-case let an admin-level inviter create an org_super_admin invitation. The SQL RPC already compared ranks; the TypeScript invite path did not.

Business Impact (AI generated)

Stops privilege escalation through new-user org invites. An org admin can no longer mint a super-admin invitation. Super-admins can still invite peers. Existing member invite denials stay in place.

Test Plan (AI generated)

• org_admin cannot invite org_super_admin via /private/invite_new_user_to_org
• org_super_admin can still invite org_super_admin
• org_member still cannot invite org_admin
• Existing-user invite rank tests still pass
• CI backend tests pass

Generated with AI

Made with Cursor

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• New Features

  • Added role-based authorization when inviting new or existing organization members.
  • Invitations now prevent callers from assigning roles higher than their own permitted rank.
  • Added support for validating role-assignment permissions across authenticated users and API keys.

• Bug Fixes

  • Prevented unauthorized role promotions during the invitation process.

• Tests

  • Added coverage for permitted and forbidden invitations, including role persistence and cleanup scenarios.