SIGN IN SIGN UP

fix(server): don't delete the invitation before resend passes its gates (#24758)

## Context

Security scan finding (HIGH_BUG, true positive):
`resendWorkspaceInvitation` could destroy a pending invitation with no
replacement.

## Problem

`resendWorkspaceInvitation` deleted the original `appToken` up front,
then called `sendInvitations`, which runs several gates that can throw
**before** a new token is created:

- role validation (`validateRoleAssignableToUsersOrThrow`)
- the onboarding-invite limit
(`throwIfOnboardingInvitationLimitReached`)
- the per-email / per-workspace throttle (`throttleInvitationSending`)

If any gate threw (a throttled resend is the common case), the original
invitation was already gone and no new one was issued — the invitee
silently loses their invitation.

The delete had to happen before `createWorkspaceInvitation` because that
method throws `INVITATION_ALREADY_EXIST` while the old token is still
present. The throttle consumes a Redis token bucket, so it can't be
pre-checked without double-charging the limit.

## Fix

Defer the deletion into `sendInvitations`, running it **after** the
pre-creation gates and **before** the new token is created, via an
optional `appTokenIdToInvalidate`. A throttled or otherwise rejected
resend now leaves the original invitation intact.

## Test

Integration spec: a resend that fails a pre-creation gate (seeded with a
non-assignable role) errors, and the original invitation is still
present afterwards.


<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/24758?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
C
Charles Bochet committed
922ba42e769ba7c7e222d2d0dd4410eb68f12f0c
Parent: e13dac6
Committed by GitHub <noreply@github.com> on 8/25/2026, 2:12:55 PM