Merge pull request #14096 from overleaf/bg-managed-users-restrict-join-other-group

prevent managed users joining other groups

GitOrigin-RevId: ad47e08d302473dccbe150722d93c9194f15e95f

services/web/app/src/Features/Subscription/SubscriptionRouter.js

@@ -67,6 +67,7 @@ module.exports = {
     // Team invites
     webRouter.get(
       '/subscription/invites/:token/',
+      PermissionsController.useCapabilities(),
       TeamInvitesController.viewInvite
     )
     webRouter.put(

services/web/app/src/Features/Subscription/TeamInvitesController.js

@@ -112,6 +112,7 @@ async function viewInvite(req, res, next) {
         hasIndividualRecurlySubscription,
         appName: settings.appName,
         expired: req.query.expired,
+        userRestrictions: Array.from(req.userRestrictions || []),
       })
     }
   } else {

services/web/app/views/subscriptions/team/invite.pug

@@ -18,6 +18,10 @@ block content
 						.page-header
 							h1.text-centered(ng-non-bindable) #{translate("invited_to_group", {inviterName: inviterName, appName: appName})}
 
+						div(ng-show="view =='restrictedByManagedGroup'")
+							.alert.alert-info #{translate("restricted")}
+								p #{translate("account_managed_by_group_administrator")}
+
 						div(ng-show="view =='hasIndividualRecurlySubscription'")
 							p #{translate("cancel_personal_subscription_first")}
 							.alert.alert-danger(ng-show="cancel_error" ng-cloak) #{translate("something_went_wrong_canceling_your_subscription")}

services/web/frontend/js/main/subscription/team-invite-controller.js

@@ -14,11 +14,15 @@ import getMeta from '../../utils/meta'
 
 export default App.controller('TeamInviteController', function ($scope, $http) {
   $scope.inflight = false
+
+  const hideJoinSubscription = getMeta('ol-cannot-join-subscription')
   const hasIndividualRecurlySubscription = getMeta(
     'ol-hasIndividualRecurlySubscription'
   )
 
-  if (hasIndividualRecurlySubscription) {
+  if (hideJoinSubscription) {
+    $scope.view = 'restrictedByManagedGroup'
+  } else if (hasIndividualRecurlySubscription) {
     $scope.view = 'hasIndividualRecurlySubscription'
   } else {
     $scope.view = 'teamInvite'