Team

1. 1

   Gate admin work

   Team management runs behind admin access before invite, role, permission, or member actions execute.

   • src/app/(dashboard)/admin/team/page.tsx
   • src/lib/auth/guards/route.ts
2. 2

   Validate action payloads

   Invite and role schemas normalize user input before services apply business rules.

   • src/features/team/server/access/schemas/invite.ts
   • src/features/team/server/access/actions/permission-form.ts
3. 3

   Apply RBAC changes through services

   Role and permission services write through persistence modules and keep navigation feature gates aligned.

   • src/features/team/server/access/services/custom-role.ts
   • src/features/team/server/access/services/permissions.ts
   • src/lib/auth/rbac/nav-config.ts
4. 4

   Keep public directory separate

   Public team member content uses its own repository and does not grant staff access by itself.

   • src/features/team/server/public-directory/repository.ts
   • src/features/team/server/public-directory/actions.ts

Source: src/features/team/server/access/actions/staff-invites.ts

Invite creation checks write access, validates the form, delegates to a service, and revalidates the admin team route.

export async function createStaffInvite(prevState: InviteState, formData: FormData): Promise<InviteState> {
  const profile = await getActiveProfile();

  const accessCheck = await assertTeamWriteAccess(profile);
  if (!accessCheck.success) return { error: accessCheck.error };

  const rawEmail = formData.get("email")?.toString().toLowerCase().trim();
  const rawAssignedRole = formData.get("assignedRole")?.toString() || null;

  const result = InviteSchema.safeParse({
    email: rawEmail,
    assignedRole: rawAssignedRole,
  });

  if (!result.success) {
    return { error: result.error.errors[0].message };
  }