From a1ffab395bed45b091b157bfb0d9eb67d9302837 Mon Sep 17 00:00:00 2001
From: Anton Alexeyev <alexeyev.anton@gmail.com>
Date: Sat, 11 Oct 2025 02:45:24 +0700
Subject: [PATCH] Office: Forbid anonymous invites & join requests (#10065)

Signed-off-by: Anton Alexeyev <alexeyev.anton@gmail.com>
---
 plugins/love-resources/src/invites.ts      | 5 ++++-
 plugins/love-resources/src/joinRequests.ts | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/plugins/love-resources/src/invites.ts b/plugins/love-resources/src/invites.ts
index 50e617e645..cca7439673 100644
--- a/plugins/love-resources/src/invites.ts
+++ b/plugins/love-resources/src/invites.ts
@@ -13,7 +13,7 @@
 // limitations under the License.
 //
 
-import { type Ref } from '@hcengineering/core'
+import { AccountRole, getCurrentAccount, type Ref } from '@hcengineering/core'
 import { getCurrentEmployee, type Person } from '@hcengineering/contact'
 import { type PopupResult, showPopup } from '@hcengineering/ui'
 import { type UnsubscribeCallback } from '@hcengineering/hulypulse-client'
@@ -68,6 +68,7 @@ export async function unsubscribeInviteResponses (): Promise<void> {
 }
 
 export function sendInvites (persons: Array<Ref<Person>>): void {
+  if (getCurrentAccount().role === AccountRole.ReadOnlyGuest) return
   closeInvitesPopup()
   requestPersons = persons
   const myParticipation = get(myInfo)
@@ -86,6 +87,7 @@ export function closeInvitesPopup (): void {
 }
 
 export async function updateInvites (persons: Array<Ref<Person>>, meetingId: string): Promise<void> {
+  if (getCurrentAccount().role === AccountRole.ReadOnlyGuest) return
   const client = await createPulseClient()
   const currentPerson = getCurrentEmployee()
 
@@ -143,6 +145,7 @@ let activeRequestKey: string | undefined
 let activeRequestsMap: Map<string, InviteRequest | undefined>
 
 export async function subscribeInviteRequests (): Promise<void> {
+  if (getCurrentAccount().role === AccountRole.ReadOnlyGuest) return
   const client = await createPulseClient()
   if (client === undefined) return
 
diff --git a/plugins/love-resources/src/joinRequests.ts b/plugins/love-resources/src/joinRequests.ts
index 88e77630e3..b6cdc8d66b 100644
--- a/plugins/love-resources/src/joinRequests.ts
+++ b/plugins/love-resources/src/joinRequests.ts
@@ -13,7 +13,7 @@
 // limitations under the License.
 //
 
-import { type Ref } from '@hcengineering/core'
+import { AccountRole, getCurrentAccount, type Ref } from '@hcengineering/core'
 import { getCurrentEmployee, type Person } from '@hcengineering/contact'
 import { type PopupResult, showPopup } from '@hcengineering/ui'
 import { type UnsubscribeCallback } from '@hcengineering/hulypulse-client'
@@ -65,6 +65,7 @@ export async function unsubscribeJoinResponses (): Promise<void> {
 }
 
 export function sendJoinRequest (meetingId: string): void {
+  if (getCurrentAccount().role === AccountRole.ReadOnlyGuest) return
   closeJoinRequestPopup()
   requestMeetingId = meetingId
   requestPopup = showPopup(JoinRequestPopup, { meetingId }, undefined, undefined, undefined, {
@@ -80,6 +81,7 @@ export function closeJoinRequestPopup (): void {
 }
 
 export async function updateJoinRequest (): Promise<void> {
+  if (getCurrentAccount().role === AccountRole.ReadOnlyGuest) return
   const client = await createPulseClient()
   const currentPerson = getCurrentEmployee()
 
@@ -135,6 +137,7 @@ let activeRequestKey: string | undefined
 let activeRequestsMap: Map<string, JoinRequest | undefined> | undefined
 
 export async function subscribeJoinRequests (meetingId: string | undefined): Promise<void> {
+  if (getCurrentAccount().role === AccountRole.ReadOnlyGuest) return
   if (meetingId === undefined) return
 
   const client = await createPulseClient()