[PM-39815] feat: Surface org name on invite-link status when links unavailable

[r-tome]

🎟️ Tracking

Resolves PM-39815

📔 Objective

The anonymous POST /organizations/invite-link/status endpoint (GetOrganizationInviteLinkStatusQuery) previously returned 400 InviteLinkNotAvailable when organization.UseInviteLinks is false. Because the v2 error pipeline only serializes ErrorResponseModel.Message, the client couldn't display the organization's name in that case.

This change:

• Converts the UseInviteLinks == false case into a success 200 OK carrying OrganizationName, a new LinksEnabled: false flag, and SeatsAvailable: false, so the client can render an org-specific message.
• Adds OrganizationId to the invite-link status and validate-email-domain responses ("expose orgId across the board"). The CRUD (OrganizationInviteLinkResponseModel) and policies (PolicyResponseModel) responses already exposed it.
• Updates the IGetOrganizationInviteLinkStatusQuery XML doc to match the new contract.

Intentional divergence (re: keeping status/accept returns aligned): status now represents UseInviteLinks == false as a success (linksEnabled: false), while the authenticated accept endpoint continues to return InviteLinkNotAvailable (400) for the same condition. This is deliberate — status is a pre-flight read used to render a message, whereas accept is a guarded mutation that must reject. The shared error records/messages otherwise remain aligned.

Tests

• Core.Test, Api.Test, and Api.IntegrationTest invite-link suites updated and passing.
• AcceptOrganizationInviteLinkCommandTests confirm the accept endpoint's behavior is unchanged.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the change converting the anonymous POST /organizations/invite-link/status UseInviteLinks == false case from a 400 InviteLinkNotAvailable error into a 200 OK carrying OrganizationName, LinksEnabled: false, and SeatsAvailable: false, plus the addition of OrganizationId to the status and validate-email-domain responses. The links-disabled path correctly short-circuits before touching seats or SSO, and the change is additive to the response contracts. The exposed OrganizationId is a non-secret identifier already implied by possession of the invite code, and no Vault Data or zero-knowledge boundary is affected. Unit and integration test suites are updated to match, including confirmation that the authenticated accept endpoint's 400 behavior is intentionally unchanged.

Code Review Details

No findings. The status-code contract change is intentional and coordinated with the client per the PR description, the ValidateAsync return-type change updates both call sites, and InviteLinkNotAvailable remains in use by other invite-link operations (no dead code introduced).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.33%. Comparing base (5b4ac6e) to head (bedb8f4).
⚠️ Report is 11 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7928   +/-   ##
=======================================
  Coverage   61.33%   61.33%           
=======================================
  Files        2242     2243    +1     
  Lines       98630    98645   +15     
  Branches     8911     8911           
=======================================
+ Hits        60490    60506   +16     
+ Misses      36004    36003    -1     
  Partials     2136     2136           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.