refactor(invitations): drop dead code left by the revocation extraction

`revokeInvitationWorkspaceGrant` lost its only caller when the DELETE route
moved to `revokeInvitationAsAdmin`, leaving a locked wrapper nothing invoked.
Remove it and fold its documentation into `revokeInvitationWorkspaceGrantTx`,
which direct grants and scoped revocation still call. The grant-revocation test
now drives the transactional form directly, so the sibling-grant and
final-grant-cancels behaviour it covers stays under test.

`isSameOrgMember` has had no caller since before this branch — direct grant
resolves membership through `getUserOrganization` inside its own transaction —
so it and its tests go too.

`getWorkspaceMembership` is no longer imported outside its module now that
credential creation reads `getCredentialCreationWorkspaceContext`; make it
module-private rather than leave it on the public surface.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: icecrasher321

apps/sim/lib/credentials/environment.ts

@@ -24,7 +24,7 @@ export interface WorkspaceMembership {
  * Credential-admin status is derived from workspace role at access time, so
  * members are seeded only for use access (the owner plus permission holders).
  */
-export async function getWorkspaceMembership(workspaceId: string): Promise<WorkspaceMembership> {
+async function getWorkspaceMembership(workspaceId: string): Promise<WorkspaceMembership> {
   const [workspaceRows, permissionRows] = await Promise.all([
     db
       .select({ ownerId: workspace.ownerId })

apps/sim/lib/invitations/core.ts

@@ -1746,25 +1746,8 @@ export async function revokeInvitationAsAdmin(input: {
  * admin of one workspace has no authority over the others. Removing the final
  * grant would otherwise strand a pending invitation that grants nothing, so
  * that case cancels it instead.
- */
-export async function revokeInvitationWorkspaceGrant({
-  invitationId,
-  workspaceId,
-}: {
-  invitationId: string
-  workspaceId: string
-}): Promise<{ revoked: boolean; invitationCancelled: boolean }> {
-  return db.transaction(async (tx) => {
-    await acquireInvitationMutationLocks(tx, {
-      invitationIds: [invitationId],
-      workspaceIds: [workspaceId],
-    })
-    return revokeInvitationWorkspaceGrantTx(tx, { invitationId, workspaceId })
-  })
-}
-
-/**
- * Transaction-local form used by callers that already hold the canonical
+ *
+ * Transaction-local: callers must already hold the canonical
  * invitation/workspace advisory lock set. Keeping the grant deletion and
  * final-grant cancellation in one implementation prevents direct grants,
  * scoped revocation, and future callers from drifting on multi-workspace

apps/sim/lib/invitations/direct-grant.test.ts

@@ -74,7 +74,6 @@ vi.mock('@/lib/posthog/server', () => ({
 import {
   DirectGrantContextChangedError,
   grantWorkspaceAccessDirectly,
-  isSameOrgMember,
 } from '@/lib/invitations/direct-grant'
 
 const baseInput = {
@@ -246,30 +245,3 @@ describe('grantWorkspaceAccessDirectly', () => {
     expect(dbChainMockFns.insert).not.toHaveBeenCalled()
   })
 })
-
-describe('isSameOrgMember', () => {
-  beforeEach(() => {
-    vi.clearAllMocks()
-    resetDbChainMock()
-  })
-
-  it('returns false when the workspace has no organization', async () => {
-    expect(await isSameOrgMember('user-2', null)).toBe(false)
-    expect(mockGetUserOrganization).not.toHaveBeenCalled()
-  })
-
-  it('returns false when the user belongs to no organization', async () => {
-    mockGetUserOrganization.mockResolvedValueOnce(null)
-    expect(await isSameOrgMember('user-2', 'org-1')).toBe(false)
-  })
-
-  it('returns true when the user belongs to the workspace organization', async () => {
-    mockGetUserOrganization.mockResolvedValueOnce({ organizationId: 'org-1', role: 'member' })
-    expect(await isSameOrgMember('user-2', 'org-1')).toBe(true)
-  })
-
-  it('returns false when the user belongs to a different organization', async () => {
-    mockGetUserOrganization.mockResolvedValueOnce({ organizationId: 'org-2', role: 'member' })
-    expect(await isSameOrgMember('user-2', 'org-1')).toBe(false)
-  })
-})

apps/sim/lib/invitations/direct-grant.ts

@@ -67,20 +67,6 @@ export interface GrantWorkspaceAccessDirectlyInput {
   notify?: boolean
 }
 
-/**
- * Returns whether the given user is already a member of the workspace's
- * organization. Only same-org members are eligible for direct (no-acceptance)
- * workspace access.
- */
-export async function isSameOrgMember(
-  userId: string,
-  workspaceOrganizationId: string | null
-): Promise<boolean> {
-  if (!workspaceOrganizationId) return false
-  const membership = await getUserOrganization(userId)
-  return !!membership && membership.organizationId === workspaceOrganizationId
-}
-
 async function getPendingWorkspaceInvitationIds(
   executor: DbOrTx,
   workspaceId: string,

apps/sim/lib/invitations/grant-revocation.test.ts

@@ -1,45 +1,37 @@
 /**
  * @vitest-environment node
  */
+import { db } from '@sim/db'
 import { invitation, invitationWorkspaceGrant } from '@sim/db/schema'
 import { auditMock, dbChainMockFns, queueTableRows, resetDbChainMock } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockAcquireInvitationMutationLocks } = vi.hoisted(() => ({
-  mockAcquireInvitationMutationLocks: vi.fn(),
-}))
-
 vi.mock('@sim/audit', () => auditMock)
 
 vi.mock('@/lib/invitations/locks', () => ({
-  acquireInvitationMutationLocks: mockAcquireInvitationMutationLocks,
+  acquireInvitationMutationLocks: vi.fn(),
 }))
 
-import { revokeInvitationWorkspaceGrant } from '@/lib/invitations/core'
+import { revokeInvitationWorkspaceGrantTx } from '@/lib/invitations/core'
 
-describe('revokeInvitationWorkspaceGrant', () => {
+describe('revokeInvitationWorkspaceGrantTx', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     resetDbChainMock()
-    mockAcquireInvitationMutationLocks.mockResolvedValue(undefined)
   })
 
-  it('uses the shared lock fence and preserves sibling workspace grants', async () => {
+  it('preserves sibling workspace grants', async () => {
     queueTableRows(invitation, [{ id: 'inv-1' }])
     queueTableRows(invitationWorkspaceGrant, [{ value: 1 }])
     dbChainMockFns.returning.mockResolvedValueOnce([{ id: 'grant-1' }])
 
     await expect(
-      revokeInvitationWorkspaceGrant({
+      revokeInvitationWorkspaceGrantTx(db, {
         invitationId: 'inv-1',
         workspaceId: 'ws-1',
       })
     ).resolves.toEqual({ revoked: true, invitationCancelled: false })
 
-    expect(mockAcquireInvitationMutationLocks).toHaveBeenCalledWith(expect.anything(), {
-      invitationIds: ['inv-1'],
-      workspaceIds: ['ws-1'],
-    })
     expect(dbChainMockFns.set).toHaveBeenCalledWith(
       expect.not.objectContaining({ status: 'cancelled' })
     )
@@ -51,7 +43,7 @@ describe('revokeInvitationWorkspaceGrant', () => {
     dbChainMockFns.returning.mockResolvedValueOnce([{ id: 'grant-1' }])
 
     await expect(
-      revokeInvitationWorkspaceGrant({
+      revokeInvitationWorkspaceGrantTx(db, {
         invitationId: 'inv-1',
         workspaceId: 'ws-1',
       })