[PM-39815] feat: Surface org name on invite-link status when links unavailable

[r-tome]

🎟️ Tracking

Resolves PM-39815
Clients PR: bitwarden/clients#21820

📔 Objective

The anonymous POST /organizations/invite-link/status endpoint (GetOrganizationInviteLinkStatusQuery) previously returned 400 InviteLinkNotAvailable when organization.UseInviteLinks is false. Because the v2 error pipeline only serializes ErrorResponseModel.Message, the client couldn't display the organization's name in that case.

This change:

• Converts the UseInviteLinks == false case into a success 200 OK carrying OrganizationName, a new LinksEnabled: false flag, and SeatsAvailable: false, so the client can render an org-specific message.
• Updates the IGetOrganizationInviteLinkStatusQuery XML doc to match the new contract.

Intentional divergence (re: keeping status/accept returns aligned): status now represents UseInviteLinks == false as a success (linksEnabled: false), while the authenticated accept endpoint continues to return InviteLinkNotAvailable (400) for the same condition. This is deliberate — status is a pre-flight read used to render a message, whereas accept is a guarded mutation that must reject. The shared error records/messages otherwise remain aligned.

Tests

• Core.Test, Api.Test, and Api.IntegrationTest invite-link suites updated and passing.
• AcceptOrganizationInviteLinkCommandTests confirm the accept endpoint's behavior is unchanged.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the change converting the anonymous POST /organizations/invite-link/status endpoint's UseInviteLinks == false case from a 400 InviteLinkNotAvailable error into a 200 OK success carrying OrganizationName, a new LinksEnabled: false flag, and SeatsAvailable: false. Verified the OrganizationInviteLinkStatus record, response model, controller mapping, XML doc, and all four call sites are updated consistently. The intentional divergence between status (pre-flight read, returns 200) and accept (guarded mutation, still returns 400) is clearly documented.

Code Review Details

No findings. Notes considered during review:

• Data exposure: the endpoint is anonymous, but returning OrganizationName when links are disabled is not a new disclosure class — a valid invite-link code (a GUID that must exist) is required, and the org name is already returned on the existing success path. The organization is null or { Enabled: false } case still returns InviteLinkNotFound and leaks nothing.
• All positional constructor call sites for OrganizationInviteLinkStatus and OrganizationInviteLinkStatusResponseModel were updated for the inserted LinksEnabled parameter; no argument-order mismatch remains.
• Test coverage is aligned: Core.Test asserts the new links-disabled success path, Api.Test asserts the flag propagates and removes the now-invalid bad-request test, and Api.IntegrationTest asserts LinksEnabled on the happy path.
• The prior CRITICAL thread referencing result.OrganizationId is against an outdated diff and does not apply to the current change set.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.57%. Comparing base (5b4ac6e) to head (32ee1d2).
⚠️ Report is 51 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7928      +/-   ##
==========================================
+ Coverage   61.33%   61.57%   +0.24%     
==========================================
  Files        2242     2256      +14     
  Lines       98630    99397     +767     
  Branches     8911     8984      +73     
==========================================
+ Hits        60490    61200     +710     
- Misses      36004    36045      +41     
- Partials     2136     2152      +16     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jrmccannon]

This makes sense to me. Returning a 200 on the status endpoint works with the addition of the links enabled property. 👍

[JaredSnider-Bitwarden]

src/Api/AdminConsole/Models/Response/Organizations/OrganizationInviteLinkStatusResponseModel.cs LGTM!