#3097 fix(security): require pending invite for org_users inserts

Summary (AI generated)

• Authenticated org admins can no longer PostgREST-INSERT an active public.org_users membership (is_invite=false) for an arbitrary existing users.id.
• check_org_user_privileges now requires NEW.is_invite = true on INSERT after the existing internal-role, org-creation bootstrap, and invitee-self exceptions.
• Recreate check_privileges so UPDATE OF includes is_invite, so flipping invite state is validated (invitee self-activate path unchanged).

Motivation (AI generated)

RLS Allow org admin to insert / update on org_users only checked org_update_user_roles. The privilege trigger did not require a pending invite on INSERT, and is_invite was missing from UPDATE OF, so an admin could create an active membership and skip invite accept / captcha / email. org_users is metadata (real rights live in role_bindings), but this still bypassed invite UX and could pair with role_bindings writes.

Business Impact (AI generated)

Stops a membership-metadata bypass that could add users to an org without the invite flow. Invite creation (is_invite=true), invitee accept (accept_invitation_to_org / accept_invitation), org-creation bootstrap, and service-role/internal paths stay available.

Test Plan (AI generated)

• Org admin direct INSERT of {user_id: other, org_id, rbac_role_name, is_invite: false} fails
• Org admin INSERT with is_invite: true (pending invite) still works
• Invitee can still accept via accept_invitation_to_org
• Existing accept-invitation-admin-privilege tests still pass

Generated with AI

Made with Cursor

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• New Features

  • Organization memberships must now be created or activated through valid invitations.
  • Supported organization setup and internal operations continue to work as expected.

• Bug Fixes

  • Blocked unauthorized membership creation, role escalation, invalid roles, and insufficient-permission changes.
  • Improved protection against invalid membership and invitation state changes.

• Tests

  • Added coverage for invitation enforcement, acceptance flows, administrative clearing, and rejected membership changes.