Bug Description
The "invite to room" feature doesn't actually invite anyone. If you're a room owner and you type in someone's GitHub username, they get added to the room immediately — no request sent to them, no notification, nothing for them to accept or decline. They just wake up as a member of a room with people they may not know, and their username/avatar now visible to everyone in that room's member list, and they've got access to a chat history they never agreed to join.
The only thing checked is that the username is a real GitHub account not whether that person wants to be added.
Steps to Reproduce
- Log in as User A and create a room.
- Go to invite/add a member, and type in User B's GitHub username (any real GitHub user works, doesn't have to be a DevTrack user even necessarily active).
- Submit the invite.
- Log in as User B (or check their account) — they're already a full member of the room. No pending invite, no prompt, nothing waiting for approval.
5.Check User B's notifications — there isn't one telling them they were added to anything.
Affected Area
Collaboration Rooms
Screenshots
No response
Browser & OS
Chrome 126 on Windows 11
Environment
None
Additional Context
File: src/app/api/rooms/[roomId]/invite/route.ts — after verifying the GitHub username is real, it goes straight to addRoomMember(roomId, github_username) in src/lib/supabase-rooms.ts, which just inserts a row into room_members with role member. There's no pending/invited state in the schema at all as far as I can tell, and no call into the notifications system (createAndEmitNotification or similar) to actually let the person know.
Bug Description
The "invite to room" feature doesn't actually invite anyone. If you're a room owner and you type in someone's GitHub username, they get added to the room immediately — no request sent to them, no notification, nothing for them to accept or decline. They just wake up as a member of a room with people they may not know, and their username/avatar now visible to everyone in that room's member list, and they've got access to a chat history they never agreed to join.
The only thing checked is that the username is a real GitHub account not whether that person wants to be added.
Steps to Reproduce
5.Check User B's notifications — there isn't one telling them they were added to anything.
Affected Area
Collaboration Rooms
Screenshots
No response
Browser & OS
Chrome 126 on Windows 11
Environment
None
Additional Context
File: src/app/api/rooms/[roomId]/invite/route.ts — after verifying the GitHub username is real, it goes straight to addRoomMember(roomId, github_username) in src/lib/supabase-rooms.ts, which just inserts a row into room_members with role member. There's no pending/invited state in the schema at all as far as I can tell, and no call into the notifications system (createAndEmitNotification or similar) to actually let the person know.