1. Force EnterpriseService.WorkspacePermissionService.get_permission(workspace_id) to fail (e.g., mock exception, network timeout, or temporary backend outage). If workspace policy permission cannot be verified (service error/timeout/exception), the API should fail closed and deny the action with a clear permission-related error. When enterprise policy lookup raises non-Forbidden exceptions, the code logs the error and continues execution. This can allow invite/owner-transfer operations to proceed even though policy validation failed.

TL;DR

The issue can be fixed by modifying the code to handle non-Forbidden exceptions during enterprise policy lookup and denying the action with a clear permission-related error.

Guidance

• Review the EnterpriseService.WorkspacePermissionService.get_permission(workspace_id) method to ensure it properly handles exceptions and returns a Forbidden error when policy lookup fails.
• Modify the API endpoints (POST /console/api/workspaces/current/members/invite-email and owner transfer flow endpoints) to check for exceptions during policy lookup and deny the action if an exception occurs.
• Consider implementing a retry mechanism for temporary backend outages or network timeouts to prevent false negatives.
• Verify that the code logs the error and provides a clear permission-related error message when policy validation fails.

Example

try:
    permission = EnterpriseService.WorkspacePermissionService.get_permission(workspace_id)
    # proceed with the operation if permission is granted
except Exception as e:
    # log the error and deny the action with a clear permission-related error
    logger.error(f"Error checking permission: {e}")
    return {"error": "Permission denied due to policy validation failure"}

Notes

This fix assumes that the EnterpriseService.WorkspacePermissionService.get_permission(workspace_id) method is the sole point of failure. Additional logging and error handling may be necessary to ensure the fix is effective.

Recommendation

Apply workaround: Modify the code to handle non-Forbidden exceptions during enterprise policy lookup and deny the action with a clear permission-related error, as this will prevent invite/owner-transfer operations from proceeding when policy validation fails.