Add hx-confirm for destructive org actions and standardize invitation exceptions.

Mirror formettle PR #101 follow-up: require confirmation before cancelling invitations or removing members, and use InsufficientPermissionsError and RoleNotFoundError in the invitation router.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: chriscarrollsmith

routers/core/invitation.py

@@ -25,6 +25,8 @@
     InvitationEmailSendError,
     InvalidInvitationTokenError,
     InvitationNotFoundError,
+    InsufficientPermissionsError,
+    RoleNotFoundError,
 )
 from exceptions.exceptions import EmailSendFailedError
 from utils.core.htmx import is_htmx_request, append_toast
@@ -83,15 +85,12 @@ async def create_invitation(
 
     # Check if the current user has permission to invite users to this organization
     if not current_user.has_permission(ValidPermissions.INVITE_USER, organization):
-        raise HTTPException(
-            status_code=403,
-            detail="You don't have permission to invite users to this organization",
-        )
+        raise InsufficientPermissionsError()
 
     # Verify the role exists and belongs to this organization
     role = session.get(Role, role_id)
     if not role:
-        raise HTTPException(status_code=404, detail="Role not found")
+        raise RoleNotFoundError()
     if role.organization_id != organization_id:
         raise InvalidRoleForOrganizationError()
 
@@ -205,10 +204,7 @@ async def delete_invitation(
         raise OrganizationNotFoundError()
 
     if not current_user.has_permission(ValidPermissions.INVITE_USER, organization):
-        raise HTTPException(
-            status_code=403,
-            detail="You don't have permission to manage invitations for this organization",
-        )
+        raise InsufficientPermissionsError()
 
     invitation = session.get(Invitation, invitation_id)
     if not invitation or invitation.organization_id != organization_id:

templates/organization/modals/members_card.html

@@ -59,7 +59,8 @@
                             <form method="POST" action="{{ url_for('remove_user_from_organization') }}" class="d-inline"
                                   hx-post="{{ url_for('remove_user_from_organization') }}"
                                   hx-target="#members-card-content"
-                                  hx-swap="innerHTML">
+                                  hx-swap="innerHTML"
+                                  hx-confirm="Remove {{ member.name }} from this organization?">
                                 <input type="hidden" name="user_id" value="{{ member.id }}">
                                 <input type="hidden" name="organization_id" value="{{ organization.id }}">
                                 <button type="submit" class="btn btn-sm btn-outline-danger" {% if member.id == user.id %}disabled{% endif %}>

templates/organization/partials/invitations_list.html

@@ -9,7 +9,8 @@
         <form method="POST" action="{{ url_for('delete_invitation') }}" class="invitation-cancel-form mb-0"
               hx-post="{{ url_for('delete_invitation') }}"
               hx-target="#members-card-content"
-              hx-swap="innerHTML">
+              hx-swap="innerHTML"
+              hx-confirm="Cancel invitation for {{ inv.invitee_email }}?">
             <input type="hidden" name="invitation_id" value="{{ inv.id }}">
             <input type="hidden" name="organization_id" value="{{ organization.id }}">
             <button type="submit" class="btn btn-sm btn-outline-danger">Cancel</button>

templates/organization/partials/member_row.html

@@ -29,7 +29,8 @@
         <form method="POST" action="{{ url_for('remove_user_from_organization') }}" class="d-inline"
               hx-post="{{ url_for('remove_user_from_organization') }}"
               hx-target="#members-card-content"
-              hx-swap="innerHTML">
+              hx-swap="innerHTML"
+              hx-confirm="Remove {{ member.name }} from this organization?">
             <input type="hidden" name="user_id" value="{{ member.id }}">
             <input type="hidden" name="organization_id" value="{{ organization.id }}">
             <button type="submit" class="btn btn-sm btn-outline-danger" {% if member.id == user.id %}disabled{% endif %}>

templates/organization/partials/members_table.html

@@ -47,7 +47,8 @@
                     <form method="POST" action="{{ url_for('remove_user_from_organization') }}" class="d-inline"
                           hx-post="{{ url_for('remove_user_from_organization') }}"
                           hx-target="#members-card-content"
-                          hx-swap="innerHTML">
+                          hx-swap="innerHTML"
+                          hx-confirm="Remove {{ member.name }} from this organization?">
                         <input type="hidden" name="user_id" value="{{ member.id }}">
                         <input type="hidden" name="organization_id" value="{{ organization.id }}">
                         <button type="submit" class="btn btn-sm btn-outline-danger" {% if member.id == user.id %}disabled{% endif %}>

tests/test_templates.py

@@ -99,6 +99,23 @@ def test_invite_member_form_has_hx_post():
     assert "hx-post" in content
 
 
+def test_pending_invitations_include_cancel_confirm():
+    content = Path("templates/organization/partials/invitations_list.html").read_text()
+    assert "url_for('delete_invitation')" in content
+    assert "hx-confirm" in content
+
+
+def test_remove_member_forms_include_confirm():
+    for path in (
+        "templates/organization/modals/members_card.html",
+        "templates/organization/partials/members_table.html",
+        "templates/organization/partials/member_row.html",
+    ):
+        content = Path(path).read_text()
+        assert "url_for('remove_user_from_organization')" in content
+        assert "hx-confirm" in content
+
+
 def test_edit_organization_form_has_hx_post():
     content = Path(
         "templates/organization/modals/edit_organization_modal.html"