In this episode, we dive into how to handle authorizing team invitation creation. The focus is on making sure that only users with the right permissions in the context of a team are able to send out team invites. First, we double-check what happens when someone like Mabel, who shouldn’t have permission, tries to send an invite—especially if someone gets clever and tries to trigger the invite manually!
We write a test to make sure permission checks work as expected, including the edge case where a user tries to invite someone to a team they're not a part of. We look at different ways to write these checks both in our policy and the authorization logic and discuss how these interact with existing middleware, especially for testing.
Finally, we talk about the subtleties of testing these scenarios—like toggling permission checks, and when being part of the team matters (or doesn’t). Through this, you’ll see how authorization logic actually works in practice, both in code and in making sure it’s enforceable through tests and your app’s UI.