fix(react): validate role count limit on member invitations

[grandmaester]

Summary

Adds the missing "max roles per request" validation to the member invitation create flow, so inviting a member with more than the allowed number of roles is blocked client-side and surfaces an error toast instead of silently failing.

Why

The Invite Member modal allowed selecting more than the maximum number of roles per request. The role-count limit was already enforced in the member-detail role assignment flow (validateRequestRoleForMember), but the invitation create flow had no equivalent guard. As a result a user could select e.g. 11+ roles and submit, with no proper validation gating the request.

What

• Validate the de-duplicated set of role IDs across all invitees in createInvitationMutation using the existing validateRequestRoleForMember helper (with assign = true), matching member-detail behavior.
• Return early with the aborted result when validation fails, so the API call is not made and the success path (onAfter, success toast) is skipped.
• Propagate the aborted result through handleCreateSubmit so the Invite Member modal stays open when the limit is exceeded (instead of closing).
• Update the createInvitationMutation result type to MemberInvitation | { aborted: true } | undefined.

Packages

• packages/core
• packages/react
• examples

References

When more than the allowed number of roles is selected, the error toast "You can only assign a maximum of 10 roles at a time." is shown and the modal remains open:

Testing

How can this be verified? Note anything intentionally not covered by tests and why.

1. Open the Invite Member modal.
2. Enter an email and select more than the maximum allowed roles.
3. Click Send Invite — an error toast appears and the modal stays open; no invitation request is sent.
4. Reduce the selection to within the limit — the invitation is sent and the modal closes.

• This change adds unit test coverage
• Tested for both SPA and RWA flows, all example apps working
• All existing and new tests complete without errors

Checklist

• Breaking change
• Requires docs update
• Backward compatible

Contributing

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct

[codecov-commenter]

Codecov Report

❌ Patch coverage is 53.84615% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.19%. Comparing base (ae427eb) to head (a8d8635).
⚠️ Report is 12 commits behind head on main.

Files with missing lines	Patch %	Lines
...organization/use-organization-member-management.ts	0.00%	4 Missing ⚠️
...n/shared/services/use-member-management-service.ts	77.77%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #387      +/-   ##
==========================================
- Coverage   88.20%   88.19%   -0.02%     
==========================================
  Files         199      199              
  Lines       16978    16999      +21     
  Branches     1826     2219     +393     
==========================================
+ Hits        14976    14992      +16     
- Misses       2002     2007       +5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[rax7389]

@coderabbitai

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

The PR description image shows a browser window at localhost:5173/member-management displaying the "Members" page of an Auth0 organization management UI. An "Invite Member" modal is open, showing:

• An "Email Address*" field populated with rohit.sharma+0906@okta.com
• Helper text: "Add up to 10 members in a comma-separated list."
• A "Roles" field with selected role chips member, Test10, Test11, and a "+12 more" indicator, with an "Add more..." input and dropdown
• A "Provider" dropdown showing "Select provider (optional)" with helper text "If none is selected, the member can log in with any provider."
• "Cancel" and "Send Invite" buttons
• A red error toast in the top-right corner reading: "You can only assign a maximum of 10 roles at a time."
• Below the browser viewport, Chrome DevTools is open on the Console tab, showing various logging/filter options and "9 Issues: 4 4, 5" indicators.

This matches the PR's described behavior: selecting more than 10 roles in the Invite Member modal triggers the "max roles" validation error toast while the modal stays open.

@rax7389 Thanks for the tag! I don't see a specific question or request in your message — could you let me know what you'd like me to help with? For example, I can:

• Review the changes in this PR
• Answer questions about the role-count validation logic in createInvitationMutation / handleCreateSubmit
• Investigate the Codecov coverage gaps flagged above (use-organization-member-management.ts and use-member-management-service.ts)

Just let me know and I'll dig in.