[BUG] Workspace invitation endpoint requires site-level admin instead of workspace-level admin

[vipul674]

Description of the Bug

In backend/app/routes/workspaces.py, the invite_workspace endpoint uses get_admin_user as a dependency:

admin_user: User = Depends(get_admin_user)

get_admin_user checks for UserRole.admin, which is a site-level global admin role. However, workspace invitations should be available to workspace-level administrators (users who have WorkspaceRole.admin in that specific workspace).

This means:

• Only global site administrators can send workspace invitations
• Workspace creators and workspace admins cannot invite new members
• The workspace collaboration feature is effectively broken unless the user is a site admin
• This defeats the entire purpose of workspace-level role management

Steps to Reproduce

1. Register as a regular user (not a site admin)
2. Create a workspace (you become the workspace owner)
3. Try to invite another user to the workspace via the invite endpoint
4. The request fails with a 403 Unauthorized error because you are not a site-level admin

Expected Behavior

The invite endpoint should:

• Accept any authenticated user
• Verify that the user has WorkspaceRole.admin or WorkspaceRole.owner for the specific workspace
• Only then allow sending invitations

Affected File

backend/app/routes/workspaces.py (line ~79)

Suggested Fix

Change the dependency from get_admin_user to get_current_user, then validate workspace admin permissions within the endpoint:

@router.post("/{workspace_id}/invite")
def invite_workspace(
    workspace_id: str,
    payload: InviteRequest,
    current_user: User = Depends(get_current_user),
    db: Session = Depends(get_db_session),
):
    # Check workspace membership and admin role
    membership = db.query(WorkspaceMember).filter(
        WorkspaceMember.workspace_id == workspace_id,
        WorkspaceMember.user_id == current_user.id,
        WorkspaceMember.role.in_([WorkspaceRole.admin, WorkspaceRole.owner])
    ).first()
    if not membership:
        raise ForbiddenException("Only workspace admins can send invitations")

GSSoC '26

• Yes, I am participating in GirlScript Summer of Code and would like to fix this.

[github-actions]

Hi @vipul674! 👋

Thanks for opening this issue! We are thrilled to have you contribute to PDF-Assistant-RAG for GSSoC 2026.

📌 Before you start:

• Make sure you have read our Contributing Guidelines.
• Wait for a project admin to assign this issue to you before working on it.
• Remember to branch off dev and not main.

Happy Coding! 🚀

[vipul674]

@param20h I would like to work on this issue under GSSoC 2026. Please assign it to me.

[ananyasingh7052258502-coder]

Hi @param20h,

I'm a GSSoC'26 contributor and would like to work on this issue.

The bug is clear - invite_workspace endpoint is using get_admin_user which checks for site-level UserRole.admin, but it should check for workspace-level WorkspaceRole.admin instead.

I can fix this by:

1. Creating a new dependency get_workspace_admin that validates user's role for that specific workspace
2. Replacing Depends(get_admin_user) with the new dependency in backend/app/routes/workspaces.py
3. Adding proper checks to ensure only workspace admins can invite users to their own workspace

Can you please assign this to me under GSSoC'26?

Thanks!