u

src/api/routes/auth/login.js

@@ -3,6 +3,7 @@ import { OAuth2Client } from 'google-auth-library';
 import env from '../../../config/env.js';
 import * as db from '../../../db/googleAuth.js';
 import * as autoinviteDb from '../../../db/autoinvite.js';
+import * as companyDb from '../../../db/company.js';
 import { clearCachedUser } from '../../middleware/auth.js';
 import { downloadPicture, toPictureBuffer } from '../../../util/pictureBinary.js';
 
@@ -109,6 +110,13 @@ export function register(app, basePath = '') {
             if (!allowed && (env.implicitCreate || (await autoinviteDb.hasPendingInvite(email)))) {
                 await db.addAllowedEmail(email);
                 allowed = await db.getAllowedEmail(email);
+                if (allowed && allowed.selectedCompanyId == null) {
+                    const companies = await companyDb.listCompanies(allowed.id);
+                    if (companies.length > 0) {
+                        await db.setSelectedCompany(allowed.id, companies[0].id);
+                        allowed = await db.getAllowedEmail(email);
+                    }
+                }
             }
             if (!allowed) {
                 console.warn(`Login rejected: email not authorized (${email})`);

src/api/routes/company.js

@@ -2,6 +2,7 @@ import fs from 'fs';
 import path from 'path';
 import multer from 'multer';
 import JSZip from 'jszip';
+import env from '../../config/env.js';
 import * as db from '../../db/company.js';
 import * as googleAuth from '../../db/googleAuth.js';
 import { clearCachedUser } from '../middleware/auth.js';
@@ -87,7 +88,7 @@ function companyErrorStatus(error) {
     if (error.message === 'Company not found') return 404;
     if (error.message === 'Company name not available') return 409;
     if (error.message === 'Invalid tax rate' || error.message === 'Text required' || error.message === 'No company selected') return 400;
-    if (error.message === 'Not authorized') return 403;
+    if (error.message === 'Not authorized' || error.message === 'Invited users cannot create a company') return 403;
     return 500;
 }
 
@@ -186,6 +187,12 @@ export function register(app, basePath = '') {
      *           application/json:
      *             schema:
      *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized (invited users cannot create companies when implicit create is disabled)
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
      */
     // #region GET /company
 
@@ -209,6 +216,13 @@ export function register(app, basePath = '') {
             return res.status(400).json({ error: body.error });
         }
 
+        if (!env.implicitCreate) {
+            const isInvited = await db.isInvitedUser(req.user.id);
+            if (isInvited) {
+                return res.status(403).json({ error: 'Invited users cannot create a company' });
+            }
+        }
+
         try {
             const company = await db.createCompany(req.user.id, body);
             await googleAuth.setSelectedCompany(req.user.id, company.id);