diff --git a/core/server/models/invite.js b/core/server/models/invite.js index d4002e87c9..cbd1bc837b 100644 --- a/core/server/models/invite.js +++ b/core/server/models/invite.js @@ -47,12 +47,6 @@ Invite = ghostBookshelf.Model.extend({ async permissible(inviteModel, action, context, unsafeAttrs, loadedPermissions, hasUserPermission, hasApiKeyPermission) { const isAdd = (action === 'add'); - if (isAdd && limitService.isLimited('staff')) { - // CASE: if your site is limited to a certain number of staff users - // Inviting a new user requires we check we won't go over the limit - await limitService.errorIfWouldGoOverLimit('staff'); - } - if (!isAdd) { if (hasUserPermission && hasApiKeyPermission) { return Promise.resolve(); @@ -66,7 +60,7 @@ Invite = ghostBookshelf.Model.extend({ // CASE: make sure user is allowed to add a user with this role return ghostBookshelf.model('Role') .findOne({id: unsafeAttrs.role_id}) - .then((roleToInvite) => { + .then(async (roleToInvite) => { if (!roleToInvite) { return Promise.reject(new errors.NotFoundError({ message: i18n.t('errors.api.invites.roleNotFound') @@ -79,6 +73,12 @@ Invite = ghostBookshelf.Model.extend({ })); } + if (isAdd && limitService.isLimited('staff') && roleToInvite.get('name') !== 'Contributor') { + // CASE: if your site is limited to a certain number of staff users + // Inviting a new user requires we check we won't go over the limit + await limitService.errorIfWouldGoOverLimit('staff'); + } + let allowed = []; if (_.some(loadedPermissions.user.roles, {name: 'Owner'}) ||