From a42ae50bca0fd8c0ae46e31409811ceb2e10f782 Mon Sep 17 00:00:00 2001
From: Rotimi Best <best@classroomio.com>
Date: Thu, 12 Mar 2026 05:31:46 +0100
Subject: [PATCH] feat: add check for existing organization members to prevent
 duplicates during member creation

---
 apps/api/src/services/account.ts              | 37 +++++++++++--------
 .../lib/features/tag/pages/tags-admin.svelte  |  2 +-
 .../src/queries/organization/organization.ts  | 25 +++++++++++++
 packages/db/src/schema.ts                     |  6 ++-
 4 files changed, 53 insertions(+), 17 deletions(-)

diff --git a/apps/api/src/services/account.ts b/apps/api/src/services/account.ts
index e60aa493..a78bd4d9 100644
--- a/apps/api/src/services/account.ts
+++ b/apps/api/src/services/account.ts
@@ -1,16 +1,17 @@
 import { AppError, ErrorCodes } from '@api/utils/errors';
-import { getProfileByEmail, getProfileById, updateProfile } from '@cio/db/queries/auth';
-import { getLicenseStatus } from '@api/services/license';
-
-import type { OrganizationWithMemberAndPlans } from '@cio/db/queries/organization/types';
-import type { TProfile } from '@cio/db/types';
 import {
   createOrganizationMember,
   getFirstOrganization,
-  getOrganizationByProfileId
+  getOrganizationByProfileId,
+  hasOrgMemberByProfileIdOrEmail
 } from '@cio/db/queries/organization';
-import { env } from '@api/config/env';
+import { getProfileByEmail, getProfileById, updateProfile } from '@cio/db/queries/auth';
+
+import type { OrganizationWithMemberAndPlans } from '@cio/db/queries/organization/types';
 import { ROLE } from '@cio/utils/constants';
+import type { TProfile } from '@cio/db/types';
+import { env } from '@api/config/env';
+import { getLicenseStatus } from '@api/services/license';
 
 export type GetAccountDataResult = {
   profile: TProfile;
@@ -35,17 +36,23 @@ export async function getAccountData(userId: string): Promise<GetAccountDataResu
     throw new AppError(`Account not found for user ID: ${userId}`, ErrorCodes.ACCOUNT_NOT_FOUND, 404);
   }
 
-  // Self-hosted: auto-add user as student to the single org if they are not a member
+  // Self-hosted: auto-add user as student to the single org if they are not a member.
+  // Skip if they already have membership (by profileId) or a pending invite (by email).
   if (env.PUBLIC_IS_SELFHOSTED === 'true' && organizations.length === 0) {
     const firstOrg = await getFirstOrganization();
     if (firstOrg) {
-      await createOrganizationMember({
-        organizationId: firstOrg.id,
-        profileId: userId,
-        roleId: ROLE.STUDENT,
-        verified: true
-      });
-      organizations = await getOrganizationByProfileId(userId);
+      const alreadyInOrg = await hasOrgMemberByProfileIdOrEmail(firstOrg.id, userId, profile.email ?? undefined);
+
+      if (!alreadyInOrg) {
+        await createOrganizationMember({
+          organizationId: firstOrg.id,
+          profileId: userId,
+          roleId: ROLE.STUDENT,
+          verified: true
+        });
+
+        organizations = await getOrganizationByProfileId(userId);
+      }
     }
   }
 
diff --git a/apps/dashboard/src/lib/features/tag/pages/tags-admin.svelte b/apps/dashboard/src/lib/features/tag/pages/tags-admin.svelte
index a48a854c..9b2936ff 100644
--- a/apps/dashboard/src/lib/features/tag/pages/tags-admin.svelte
+++ b/apps/dashboard/src/lib/features/tag/pages/tags-admin.svelte
@@ -380,7 +380,7 @@
               </Button>
             {/snippet}
           </Popover.Trigger>
-          <Popover.Content align="start" class="w-44 p-3">
+          <Popover.Content align="start" class="z-250! w-44 p-3">
             <div class="grid grid-cols-5 gap-2">
               {#each TAG_COLOR_OPTIONS as color (color)}
                 <Button
diff --git a/packages/db/src/queries/organization/organization.ts b/packages/db/src/queries/organization/organization.ts
index d8434259..72b88216 100644
--- a/packages/db/src/queries/organization/organization.ts
+++ b/packages/db/src/queries/organization/organization.ts
@@ -165,6 +165,31 @@ export const checkEmailExistsInOrg = async (orgId: string, email: string): Promi
   return result.length > 0;
 };
 
+/**
+ * Checks if an org has a member matching the given profileId or email.
+ * Used to avoid creating duplicate members (e.g. when user has a pending invite).
+ */
+export const hasOrgMemberByProfileIdOrEmail = async (
+  orgId: string,
+  profileId: string,
+  email: string | null | undefined
+): Promise<boolean> => {
+  const conditions = [eq(schema.organizationmember.organizationId, orgId)];
+
+  const profileOrEmailMatch = or(
+    eq(schema.organizationmember.profileId, profileId),
+    ...(email ? [eq(schema.organizationmember.email, email.toLowerCase().trim())] : [])
+  );
+
+  const result = await db
+    .select({ id: schema.organizationmember.id })
+    .from(schema.organizationmember)
+    .where(and(...conditions, profileOrEmailMatch))
+    .limit(1);
+
+  return result.length > 0;
+};
+
 /**
  * Checks which emails already exist as team members in an organization (bulk check)
  * Checks both organizationmember.email and profile.email (via organizationmember.profileId)
diff --git a/packages/db/src/schema.ts b/packages/db/src/schema.ts
index 1f8fa82e..fa8e4e30 100644
--- a/packages/db/src/schema.ts
+++ b/packages/db/src/schema.ts
@@ -14,6 +14,7 @@ import {
   text,
   timestamp,
   unique,
+  uniqueIndex,
   uuid,
   varchar
 } from 'drizzle-orm/pg-core';
@@ -1467,7 +1468,10 @@ export const organizationmember = pgTable(
     }),
     index('idx_organizationmember_profile_id').on(table.profileId),
     index('idx_organizationmember_organization_id').on(table.organizationId),
-    index('idx_organizationmember_profile_org').on(table.profileId, table.organizationId)
+    index('idx_organizationmember_profile_org').on(table.profileId, table.organizationId),
+    uniqueIndex('organizationmember_org_profile_unique')
+      .on(table.organizationId, table.profileId)
+      .where(sql`${table.profileId} IS NOT NULL`)
   ]
 );