fix(groups): enforce invite role hierarchy

[IvGolovach]

Summary

This PR enforces the existing group role hierarchy when creating group invites. Admins can still invite regular members, and owners can still invite admins, but invites can no longer bypass the direct role-management restrictions.

Why

Direct member role changes already require the actor to outrank the target role. The invite route did not apply the same rule before creating an invite, so an admin could create an admin invite and grant peer-level permissions through the join flow.

Diff Scope

• Applies canManageGroupRole in POST /api/groups/[slug]/invite before creating an invite.
• Adds route coverage for admin-created admin invites, owner-created admin invites, admin-created member invites, owner-role invite rejection, and invalid-role fallback behavior.

Branch Integrity

• Base: junhoyeo/tokscale:main
• Validated base SHA: 8e73312f05f603d5184d36059e4ce2604322d492
• Head: IvGolovach:codex/groups-invite-role-hierarchy
• Head SHA: ae01b4648e7746bc0fe25d04cb00ae473324e46a
• Ahead/behind: 0 behind / 1 ahead

Commit Integrity

• ae01b4648e7746bc0fe25d04cb00ae473324e46a fix(groups): enforce invite role hierarchy
• Final diff only touches the group invite route and targeted route test coverage.

Diff Hygiene

• git diff --check origin/main...HEAD: PASS, no output
• Forbidden/local artifact files: not present
• DB migrations: not applicable; no schema changed
• Ledger: not applicable; not required for this change family
• Version: not applicable; not required for this change family

Validation

Validation mode: Mode 2 — narrow frontend route permission change.

• bun x vitest run __tests__/api/groupInviteRoute.test.ts: PASS
• bun x vitest run __tests__/api/groupInviteRoute.test.ts __tests__/api/groupInviteJoinRoute.test.ts __tests__/lib/groupInvites.test.ts __tests__/lib/groupHelpers.test.ts: PASS, 14 tests
• bun x vitest run __tests__/api/group*.test.ts __tests__/lib/group*.test.ts: PASS, 20 tests
• bun x eslint __tests__/api/groupInviteRoute.test.ts 'src/app/api/groups/[slug]/invite/route.ts': PASS
• git diff --check origin/main...HEAD: PASS

Not used as proof: full frontend lint/typecheck currently report unrelated existing issues outside this diff, so this PR relies on targeted route coverage and targeted ESLint.

CI Context

Pending — required remote checks will run after the PR is opened.

Runtime Safety

This only tightens an existing permission check on invite creation. It does not change invite token format, invite acceptance persistence, group membership schema, or cache invalidation behavior. No invariant regression introduced.

Rollback Plan

Rollback: revert this PR.

DB downgrade: not applicable.

Data repair: not applicable.

Operational caveats: reverting would restore the invite-based role escalation path for group admins.

Known Residual Risks

None known for the scoped permission fix.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tokscale	Ready	Preview, Comment	May 25, 2026 9:28pm

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}

[junhoyeo]

@IvGolovach this has been merged to v3.0.0: https://github.com/junhoyeo/tokscale/releases/tag/v3.0.0 thanks for the contribution!