feat: add batch email org invites (#44832)

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Feature

## What is the current behavior?

When sending organization invites to multiple emails at once, the
invitations API is called once for each email passed, passing a single
email address in the `email` field.

## What is the new behavior?

A single request is used when sending multiple organization invites at
once, by using the new `emails` field.

## Additional context

This builds further on https://github.com/supabase/supabase/pull/42637

⚠️ Note: I'd like to merge this after getting the API changes in first:
https://github.com/supabase/platform/pull/31561


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Bulk invite: paste comma-separated emails (parsed, trimmed,
deduplicated, lowercased) and send as a single batched request; inputs
are categorized into new, already-invited, and existing members.
  * SSO and project scope options included in invite payloads.

* **Bug Fixes / API**
* Invitation endpoint now accepts multiple emails; resend uses
multi-email format. Invalid addresses are blocked, existing members are
skipped with error toasts, and overall success is reported with the
dialog closing after invite.

* **Tests**
* Added unit and UI tests covering parsing, categorization, payload
building, validation limits, and invite flows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com>

apps/studio/components/interfaces/Organization/TeamSettings/InviteMemberButton.tsx

@@ -31,6 +31,14 @@ import { Admonition } from 'ui-patterns/admonition'
 import { FormItemLayout } from 'ui-patterns/form/FormItemLayout/FormItemLayout'
 import * as z from 'zod'
 
+import {
+  BatchInvitationResult,
+  buildProjectPayload,
+  buildSsoPayload,
+  categorizeInviteEmails,
+  emailSchema,
+  parseEmails,
+} from './InviteMemberButton.utils'
 import { useGetRolesManagementPermissions } from './TeamSettings.utils'
 import { DiscardChangesConfirmationDialog } from '@/components/ui-patterns/Dialogs/DiscardChangesConfirmationDialog'
 import { ButtonTooltip } from '@/components/ui/ButtonTooltip'
@@ -50,13 +58,6 @@ import { useConfirmOnClose } from '@/hooks/ui/useConfirmOnClose'
 import { DOCS_URL } from '@/lib/constants'
 import { useProfile } from '@/lib/profile'
 
-function parseEmails(value: string): string[] {
-  return value
-    .split(',')
-    .map((e) => e.trim())
-    .filter(Boolean)
-}
-
 export const InviteMemberButton = () => {
   const { slug } = useParams()
   const { profile } = useProfile()
@@ -115,33 +116,23 @@ export const InviteMemberButton = () => {
   const { mutateAsync: inviteMemberAsync, isPending: isInviting } =
     useOrganizationCreateInvitationMutation()
 
-  const emailSchema = z
-    .string()
-    .min(1, 'At least one email address is required')
-    .refine(
-      (val) => {
-        const emails = parseEmails(val)
-        if (emails.length === 0) return false
-        return emails.every((e) => z.string().email().safeParse(e).success)
-      },
-      (val) => {
-        const emails = parseEmails(val)
-        const invalid = emails.find((e) => !z.string().email().safeParse(e).success)
-        return {
-          message: invalid
-            ? `Invalid email address: ${invalid}`
-            : 'At least one email address is required',
-        }
+  const FormSchema = z
+    .object({
+      email: emailSchema,
+      role: z.string().min(1, 'Role is required'),
+      applyToOrg: z.boolean(),
+      projectRef: z.string(),
+      requireSso: z.enum(['auto', 'sso', 'non-sso']),
+    })
+    .superRefine((data, ctx) => {
+      if (!data.applyToOrg && !data.projectRef) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: 'A project must be selected',
+          path: ['projectRef'],
+        })
       }
-    )
-
-  const FormSchema = z.object({
-    email: emailSchema,
-    role: z.string().min(1, 'Role is required'),
-    applyToOrg: z.boolean(),
-    projectRef: z.string(),
-    requireSso: z.enum(['auto', 'sso', 'non-sso']),
-  })
+    })
 
   const form = useForm<z.infer<typeof FormSchema>>({
     mode: 'onSubmit',
@@ -159,22 +150,10 @@ export const InviteMemberButton = () => {
     if (profile?.id === undefined) return console.error('Profile ID required')
     const emails = parseEmails(values.email).map((e) => e.toLowerCase())
 
-    const alreadyInvited: string[] = []
-    const alreadyMembers: string[] = []
-    const toInvite: string[] = []
-
-    for (const emailAddress of emails) {
-      const existingMember = (members ?? []).find((member) => member.primary_email === emailAddress)
-      if (existingMember !== undefined) {
-        if (existingMember.invited_id) {
-          alreadyInvited.push(emailAddress)
-        } else {
-          alreadyMembers.push(emailAddress)
-        }
-      } else {
-        toInvite.push(emailAddress)
-      }
-    }
+    const { alreadyInvited, alreadyMembers, toInvite } = categorizeInviteEmails(
+      emails,
+      members ?? []
+    )
 
     if (alreadyInvited.length > 0) {
       toast.error(
@@ -194,47 +173,39 @@ export const InviteMemberButton = () => {
       if (toInvite.length === 0) return
     }
 
-    const projectPayload =
-      !values.applyToOrg && values.projectRef ? { projects: [values.projectRef] } : {}
+    const projectPayload = buildProjectPayload(values.applyToOrg, values.projectRef)
+    const ssoPayload = buildSsoPayload(values.requireSso)
 
-    // Transform SSO preference to backend format
-    const ssoPayload =
-      values.requireSso === 'sso'
-        ? { requireSso: true }
-        : values.requireSso === 'non-sso'
-          ? { requireSso: false }
-          : {} // 'auto' - let backend use automatic behavior
-
-    const results = await Promise.allSettled(
-      toInvite.map((emailAddress) =>
-        inviteMemberAsync({
-          slug,
-          email: emailAddress,
-          roleId: Number(values.role),
-          ...projectPayload,
-          ...ssoPayload,
-        })
-      )
-    )
-
-    const successCount = results.filter((r) => r.status === 'fulfilled').length
-    const failedEmails = toInvite.filter((_, i) => results[i].status === 'rejected')
-
-    if (successCount > 0) {
-      toast.success(
-        successCount === 1
-          ? 'Successfully sent invitation to new member'
-          : `Successfully sent invitations to ${successCount} new members`
-      )
-      closeInviteDialog()
+    let result: BatchInvitationResult
+    try {
+      result = (await inviteMemberAsync({
+        slug,
+        emails: toInvite,
+        roleId: Number(values.role),
+        ...projectPayload,
+        ...ssoPayload,
+      })) as BatchInvitationResult
+    } catch {
+      return // onError callback already showed the toast
     }
-    if (failedEmails.length > 0) {
-      toast.error(
-        failedEmails.length === 1
-          ? `Failed to send invitation to ${failedEmails[0]}`
-          : `Failed to send invitations to ${failedEmails.length} emails`
+
+    const { succeeded, failed } = result
+
+    if (succeeded.length > 0) {
+      toast.success(
+        succeeded.length === 1
+          ? 'Successfully sent invitation to new member'
+          : `Successfully sent invitations to ${succeeded.length} new members`
       )
     }
+
+    for (const { email, error } of failed) {
+      toast.error(`Failed to invite ${email}: ${error}`)
+    }
+
+    if (succeeded.length > 0) {
+      closeInviteDialog()
+    }
   }
 
   useEffect(() => {

apps/studio/components/interfaces/Organization/TeamSettings/InviteMemberButton.utils.ts

@@ -0,0 +1,109 @@
+import * as z from 'zod'
+
+import type { OrganizationMember } from '@/data/organizations/organization-members-query'
+
+export const MAX_BATCH_INVITE_SIZE = 50
+
+/** Max characters to show when an invalid token is long (e.g. comma-less paste of many addresses). */
+const MAX_INVALID_EMAIL_SNIPPET_LENGTH = 120
+
+function formatInvalidEmailSnippet(token: string): string {
+  if (token.length <= MAX_INVALID_EMAIL_SNIPPET_LENGTH) return token
+  return `${token.slice(0, MAX_INVALID_EMAIL_SNIPPET_LENGTH)}…`
+}
+
+export const emailSchema = z
+  .string()
+  .min(1, 'At least one email address is required')
+  .refine(
+    (val) => {
+      const emails = parseEmails(val)
+      if (emails.length === 0) return false
+      return emails.every((e) => z.string().email().safeParse(e).success)
+    },
+    (val) => {
+      const emails = parseEmails(val)
+      const invalid = emails.find((e) => !z.string().email().safeParse(e).success)
+      return {
+        message: invalid
+          ? `Invalid email address: "${formatInvalidEmailSnippet(invalid)}"`
+          : 'At least one email address is required',
+      }
+    }
+  )
+  .refine(
+    (val) => parseEmails(val).length <= MAX_BATCH_INVITE_SIZE,
+    (val) => {
+      const count = parseEmails(val).length
+      return {
+        message: `You can invite up to ${MAX_BATCH_INVITE_SIZE} members at a time. Remove ${count - MAX_BATCH_INVITE_SIZE} email ${count - MAX_BATCH_INVITE_SIZE === 1 ? 'address' : 'addresses'} to continue.`,
+      }
+    }
+  )
+
+export function parseEmails(value: string): string[] {
+  const emails = value
+    .split(/[\s,]+/)
+    .map((e) => e.trim().toLowerCase())
+    .filter(Boolean)
+  return [...new Set(emails)]
+}
+
+export type CategorizedEmails = {
+  alreadyInvited: string[]
+  alreadyMembers: string[]
+  toInvite: string[]
+}
+
+export type BatchInvitationFailure = {
+  email: string
+  error: string
+}
+
+export type BatchInvitationResult = {
+  succeeded: string[]
+  failed: BatchInvitationFailure[]
+}
+
+export function categorizeInviteEmails(
+  emails: string[],
+  members: OrganizationMember[]
+): CategorizedEmails {
+  const alreadyInvited: string[] = []
+  const alreadyMembers: string[] = []
+  const toInvite: string[] = []
+
+  for (const email of emails) {
+    const existingMember = members.find((m) => m.primary_email === email)
+    if (existingMember !== undefined) {
+      if (existingMember.invited_id) {
+        alreadyInvited.push(email)
+      } else {
+        alreadyMembers.push(email)
+      }
+    } else {
+      toInvite.push(email)
+    }
+  }
+
+  return { alreadyInvited, alreadyMembers, toInvite }
+}
+
+export function buildProjectPayload(
+  applyToOrg: boolean,
+  projectRef: string
+): { projects: string[] } | Record<string, never> {
+  if (applyToOrg) return {}
+  if (!projectRef) {
+    throw new Error('projectRef is required when applyToOrg is false')
+  }
+  return { projects: [projectRef] }
+}
+
+export function buildSsoPayload(
+  requireSso: 'auto' | 'sso' | 'non-sso'
+): { requireSso: boolean } | Record<string, never> {
+  if (requireSso === 'sso') return { requireSso: true }
+  if (requireSso === 'non-sso') return { requireSso: false }
+  return {}
+}

apps/studio/components/interfaces/Organization/TeamSettings/MemberActions.tsx

@@ -128,12 +128,12 @@ export const MemberActions = ({ member }: MemberActionsProps) => {
             const projects = projectScopedRole.projects.map(({ ref }) => ref)
             inviteMember({
               slug,
-              email: member.primary_email,
+              emails: [member.primary_email],
               roleId: projectScopedRole.base_role_id,
               projects,
             })
           } else {
-            inviteMember({ slug, email: member.primary_email, roleId })
+            inviteMember({ slug, emails: [member.primary_email], roleId })
           }
         },
       }

apps/studio/data/organization-members/organization-invitation-create-mutation.ts

@@ -9,7 +9,7 @@ import type { ResponseError, UseCustomMutationOptions } from '@/types'
 
 export type OrganizationCreateInvitationVariables = {
   slug: string
-  email: string
+  emails: string[]
   roleId: number
   projects?: string[]
   requireSso?: boolean
@@ -17,12 +17,12 @@ export type OrganizationCreateInvitationVariables = {
 
 export async function createOrganizationInvitation({
   slug,
-  email,
+  emails,
   roleId,
   projects,
   requireSso,
 }: OrganizationCreateInvitationVariables) {
-  const payload: components['schemas']['CreateInvitationBody'] = { email, role_id: roleId }
+  const payload: components['schemas']['CreateInvitationBody'] = { emails, role_id: roleId }
   if (projects !== undefined) payload.role_scoped_projects = projects
   if (requireSso !== undefined) payload.require_sso = requireSso
 
@@ -69,7 +69,7 @@ export const useOrganizationCreateInvitationMutation = ({
     },
     async onError(data, variables, context) {
       if (onError === undefined) {
-        toast.error(`Failed to update member role: ${data.message}`)
+        toast.error(`Failed to send invitation${data.message ? ': ' + data.message : ''}`)
       } else {
         onError(data, variables, context)
       }

apps/studio/tests/components/Organization/TeamSettings/InviteMemberButton.test.tsx

@@ -0,0 +1,254 @@
+import { fireEvent, screen, waitFor } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { toast } from 'sonner'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { InviteMemberButton } from '@/components/interfaces/Organization/TeamSettings/InviteMemberButton'
+import { customRender } from '@/tests/lib/custom-render'
+
+vi.mock('sonner', () => ({
+  toast: { success: vi.fn(), error: vi.fn() },
+}))
+
+vi.mock('common', async (importOriginal) => {
+  const actual = (await importOriginal()) as typeof import('common')
+  return { ...actual, useParams: () => ({ slug: 'test-org' }) }
+})
+
+vi.mock('@/lib/profile', () => ({
+  useProfile: () => ({ profile: { id: 1, gotrue_id: 'user-1' } }),
+}))
+
+vi.mock('@/hooks/misc/useSelectedOrganization', () => ({
+  useSelectedOrganizationQuery: () => ({
+    data: { id: 1, slug: 'test-org', name: 'Test Org' },
+  }),
+}))
+
+vi.mock('@/hooks/misc/useCheckPermissions', () => ({
+  useGetPermissions: () => ({ permissions: [], organizationSlug: 'test-org' }),
+  doPermissionsCheck: () => true,
+  useAsyncCheckPermissions: () => ({ can: true, isSuccess: true }),
+}))
+
+vi.mock('@/hooks/misc/useIsFeatureEnabled', () => ({
+  useIsFeatureEnabled: () => ({ organizationMembersCreate: true }),
+}))
+
+vi.mock('@/data/organizations/organization-members-query', () => ({
+  useOrganizationMembersQuery: () => ({
+    data: [
+      {
+        gotrue_id: 'user-1',
+        primary_email: 'me@example.com',
+        role_ids: [1],
+      },
+      {
+        gotrue_id: 'existing-user',
+        primary_email: 'existing@example.com',
+        role_ids: [1],
+      },
+    ],
+  }),
+}))
+
+const mockRoles = {
+  org_scoped_roles: [{ id: 1, name: 'Developer', description: null }],
+}
+vi.mock('@/data/organization-members/organization-roles-query', () => ({
+  useOrganizationRolesV2Query: () => ({ data: mockRoles, isSuccess: true }),
+}))
+
+vi.mock('@/data/sso/sso-config-query', () => ({
+  useOrgSSOConfigQuery: () => ({ data: null }),
+}))
+
+vi.mock('@/data/subscriptions/org-subscription-query', () => ({
+  useHasAccessToProjectLevelPermissions: () => false,
+}))
+
+vi.mock('@/hooks/misc/useCheckEntitlements', () => ({
+  useCheckEntitlements: () => ({ hasAccess: false }),
+}))
+
+vi.mock('@/components/interfaces/Organization/TeamSettings/TeamSettings.utils', () => ({
+  useGetRolesManagementPermissions: () => ({ rolesAddable: [1], rolesRemovable: [1] }),
+}))
+
+const mockInvite = vi.fn().mockResolvedValue({ succeeded: [], failed: [] })
+vi.mock('@/data/organization-members/organization-invitation-create-mutation', () => ({
+  useOrganizationCreateInvitationMutation: () => ({
+    mutateAsync: mockInvite,
+    isPending: false,
+  }),
+}))
+
+vi.mock('@/hooks/ui/useConfirmOnClose', () => ({
+  useConfirmOnClose: ({ onClose }: { checkIsDirty: () => boolean; onClose: () => void }) => ({
+    confirmOnClose: onClose,
+    handleOpenChange: (open: boolean) => {
+      if (!open) onClose()
+    },
+    modalProps: { visible: false, onClose, onCancel: vi.fn() },
+  }),
+}))
+
+// Helpers
+async function openDialog() {
+  await userEvent.click(screen.getByRole('button', { name: /invite members/i }))
+  return screen.findByRole('dialog')
+}
+
+async function submitForm(emailValue: string) {
+  await openDialog()
+  fireEvent.change(screen.getByPlaceholderText(/name@example\.com/i), {
+    target: { value: emailValue },
+  })
+  fireEvent.click(screen.getByRole('button', { name: /send invitation/i }))
+}
+
+// Tests
+describe('InviteMemberButton', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockInvite.mockResolvedValue({ succeeded: [], failed: [] })
+  })
+
+  it('renders an enabled Invite members button', () => {
+    customRender(<InviteMemberButton />)
+    expect(screen.getByRole('button', { name: /invite members/i })).toBeEnabled()
+  })
+
+  it('opens the invite dialog when the button is clicked', async () => {
+    customRender(<InviteMemberButton />)
+    await openDialog()
+    expect(screen.getByRole('dialog')).toBeInTheDocument()
+    expect(screen.getByText('Invite team members')).toBeInTheDocument()
+  })
+
+  it('calls the mutation with a single email in an array', async () => {
+    customRender(<InviteMemberButton />)
+    await submitForm('new@example.com')
+
+    await waitFor(() => {
+      expect(mockInvite).toHaveBeenCalledWith(
+        expect.objectContaining({ emails: ['new@example.com'] })
+      )
+    })
+  })
+
+  it('calls the mutation with multiple emails parsed from a comma-separated input', async () => {
+    customRender(<InviteMemberButton />)
+    await submitForm('alice@example.com, bob@example.com, carol@example.com')
+
+    await waitFor(() => {
+      expect(mockInvite).toHaveBeenCalledWith(
+        expect.objectContaining({
+          emails: ['alice@example.com', 'bob@example.com', 'carol@example.com'],
+        })
+      )
+    })
+  })
+
+  it('lowercases emails before sending', async () => {
+    customRender(<InviteMemberButton />)
+    await submitForm('User@Example.COM')
+
+    await waitFor(() => {
+      expect(mockInvite).toHaveBeenCalledWith(
+        expect.objectContaining({ emails: ['user@example.com'] })
+      )
+    })
+  })
+
+  it('shows a validation error for an invalid email', async () => {
+    customRender(<InviteMemberButton />)
+    await openDialog()
+    fireEvent.change(screen.getByPlaceholderText(/name@example\.com/i), {
+      target: { value: 'not-an-email' },
+    })
+    fireEvent.click(screen.getByRole('button', { name: /send invitation/i }))
+
+    expect(await screen.findByText(/invalid email address: "not-an-email"/i)).toBeInTheDocument()
+    expect(mockInvite).not.toHaveBeenCalled()
+  })
+
+  it('shows an error toast and skips the mutation for an already-existing member', async () => {
+    customRender(<InviteMemberButton />)
+    await submitForm('existing@example.com')
+
+    await waitFor(() => {
+      expect(toast.error).toHaveBeenCalledWith(
+        'existing@example.com is already in this organization'
+      )
+    })
+    expect(mockInvite).not.toHaveBeenCalled()
+  })
+
+  it('still invites new emails in a batch that also contains an existing member', async () => {
+    customRender(<InviteMemberButton />)
+    await submitForm('new@example.com, existing@example.com')
+
+    await waitFor(() => {
+      expect(toast.error).toHaveBeenCalled()
+      expect(mockInvite).toHaveBeenCalledWith(
+        expect.objectContaining({ emails: ['new@example.com'] })
+      )
+    })
+  })
+
+  it('shows a success toast for a single email in succeeded', async () => {
+    mockInvite.mockResolvedValueOnce({ succeeded: ['new@example.com'], failed: [] })
+    customRender(<InviteMemberButton />)
+    await submitForm('new@example.com')
+
+    await waitFor(() => {
+      expect(toast.success).toHaveBeenCalledWith('Successfully sent invitation to new member')
+    })
+  })
+
+  it('shows a plural success toast when multiple emails succeeded', async () => {
+    mockInvite.mockResolvedValueOnce({
+      succeeded: ['alice@example.com', 'bob@example.com'],
+      failed: [],
+    })
+    customRender(<InviteMemberButton />)
+    await submitForm('alice@example.com, bob@example.com')
+
+    await waitFor(() => {
+      expect(toast.success).toHaveBeenCalledWith('Successfully sent invitations to 2 new members')
+    })
+  })
+
+  it('shows an error toast with the server error for each failed email', async () => {
+    mockInvite.mockResolvedValueOnce({
+      succeeded: [],
+      failed: [{ email: 'new@example.com', error: 'Domain not allowed' }],
+    })
+    customRender(<InviteMemberButton />)
+    await submitForm('new@example.com')
+
+    await waitFor(() => {
+      expect(toast.error).toHaveBeenCalledWith(
+        'Failed to invite new@example.com: Domain not allowed'
+      )
+    })
+    expect(toast.success).not.toHaveBeenCalled()
+  })
+
+  it('shows both success and error toasts for a partial batch result', async () => {
+    mockInvite.mockResolvedValueOnce({
+      succeeded: ['alice@example.com'],
+      failed: [{ email: 'bob@example.com', error: 'Domain not allowed' }],
+    })
+    customRender(<InviteMemberButton />)
+    await submitForm('alice@example.com, bob@example.com')
+
+    await waitFor(() => {
+      expect(toast.success).toHaveBeenCalledWith('Successfully sent invitation to new member')
+      expect(toast.error).toHaveBeenCalledWith(
+        'Failed to invite bob@example.com: Domain not allowed'
+      )
+    })
+  })
+})

apps/studio/tests/components/Organization/TeamSettings/InviteMemberButton.utils.test.ts

@@ -0,0 +1,261 @@
+import { describe, expect, test } from 'vitest'
+
+import {
+  buildProjectPayload,
+  buildSsoPayload,
+  categorizeInviteEmails,
+  emailSchema,
+  MAX_BATCH_INVITE_SIZE,
+  parseEmails,
+} from '@/components/interfaces/Organization/TeamSettings/InviteMemberButton.utils'
+import type { OrganizationMember } from '@/data/organizations/organization-members-query'
+
+describe('parseEmails', () => {
+  test('parses a single email', () => {
+    expect(parseEmails('user@example.com')).toStrictEqual(['user@example.com'])
+  })
+
+  test('parses multiple comma-separated emails', () => {
+    expect(parseEmails('a@example.com,b@example.com,c@example.com')).toStrictEqual([
+      'a@example.com',
+      'b@example.com',
+      'c@example.com',
+    ])
+  })
+
+  test('trims whitespace around each email', () => {
+    expect(parseEmails(' a@example.com , b@example.com ')).toStrictEqual([
+      'a@example.com',
+      'b@example.com',
+    ])
+  })
+
+  test('filters out empty entries from trailing, leading, or double commas', () => {
+    expect(parseEmails(',a@example.com,,b@example.com,')).toStrictEqual([
+      'a@example.com',
+      'b@example.com',
+    ])
+  })
+
+  test('removes duplicate email addresses', () => {
+    expect(parseEmails('a@example.com,a@example.com')).toStrictEqual(['a@example.com'])
+  })
+
+  test('returns an empty array for an empty string', () => {
+    expect(parseEmails('')).toStrictEqual([])
+  })
+
+  test('returns an empty array for a whitespace-only string', () => {
+    expect(parseEmails('   ')).toStrictEqual([])
+  })
+
+  test('returns an empty array for commas only', () => {
+    expect(parseEmails(',,,,')).toStrictEqual([])
+  })
+
+  test('parses space-separated emails', () => {
+    expect(parseEmails('a@example.com b@example.com')).toStrictEqual([
+      'a@example.com',
+      'b@example.com',
+    ])
+  })
+
+  test('parses line breaks and mixed comma or space separators', () => {
+    expect(parseEmails('a@example.com\nb@example.com, c@example.com')).toStrictEqual([
+      'a@example.com',
+      'b@example.com',
+      'c@example.com',
+    ])
+  })
+})
+
+function makeMember(overrides: Partial<OrganizationMember> = {}): OrganizationMember {
+  return {
+    gotrue_id: 'gotrue-1',
+    primary_email: 'member@example.com',
+    role_ids: [1],
+    username: 'member',
+    ...overrides,
+  } as OrganizationMember
+}
+
+describe('categorizeInviteEmails', () => {
+  test('places a new email in toInvite when no members exist', () => {
+    expect(categorizeInviteEmails(['new@example.com'], [])).toStrictEqual({
+      alreadyInvited: [],
+      alreadyMembers: [],
+      toInvite: ['new@example.com'],
+    })
+  })
+
+  test('places an email in alreadyMembers when that member exists without an invited_id', () => {
+    const members = [makeMember({ primary_email: 'existing@example.com' })]
+    expect(categorizeInviteEmails(['existing@example.com'], members)).toStrictEqual({
+      alreadyInvited: [],
+      alreadyMembers: ['existing@example.com'],
+      toInvite: [],
+    })
+  })
+
+  test('places an email in alreadyInvited when that member has an invited_id', () => {
+    const members = [makeMember({ primary_email: 'invited@example.com', invited_id: 42 })]
+    expect(categorizeInviteEmails(['invited@example.com'], members)).toStrictEqual({
+      alreadyInvited: ['invited@example.com'],
+      alreadyMembers: [],
+      toInvite: [],
+    })
+  })
+
+  test('correctly categorizes a mixed batch', () => {
+    const members = [
+      makeMember({ primary_email: 'member@example.com' }),
+      makeMember({ primary_email: 'invited@example.com', invited_id: 7 }),
+    ]
+    expect(
+      categorizeInviteEmails(
+        ['new@example.com', 'member@example.com', 'invited@example.com'],
+        members
+      )
+    ).toStrictEqual({
+      alreadyInvited: ['invited@example.com'],
+      alreadyMembers: ['member@example.com'],
+      toInvite: ['new@example.com'],
+    })
+  })
+
+  test('places all emails in toInvite when none match existing members', () => {
+    const members = [makeMember({ primary_email: 'other@example.com' })]
+    expect(
+      categorizeInviteEmails(['a@example.com', 'b@example.com', 'c@example.com'], members)
+    ).toStrictEqual({
+      alreadyInvited: [],
+      alreadyMembers: [],
+      toInvite: ['a@example.com', 'b@example.com', 'c@example.com'],
+    })
+  })
+
+  test('returns all-empty for an empty email list', () => {
+    expect(categorizeInviteEmails([], [makeMember()])).toStrictEqual({
+      alreadyInvited: [],
+      alreadyMembers: [],
+      toInvite: [],
+    })
+  })
+
+  test('uses strict equality — does not match different casing', () => {
+    // The component lowercases emails before calling this function,
+    // so 'member@example.com' must NOT match 'Member@Example.com'
+    const members = [makeMember({ primary_email: 'Member@Example.com' })]
+    const result = categorizeInviteEmails(['member@example.com'], members)
+    expect(result.toInvite).toStrictEqual(['member@example.com'])
+    expect(result.alreadyMembers).toStrictEqual([])
+  })
+})
+
+describe('buildProjectPayload', () => {
+  test('returns empty object when applyToOrg is true', () => {
+    expect(buildProjectPayload(true, 'ref_abc')).toStrictEqual({})
+  })
+
+  test('throws an error when applyToOrg is false but projectRef is empty', () => {
+    expect(() => buildProjectPayload(false, '')).toThrowError(
+      'projectRef is required when applyToOrg is false'
+    )
+  })
+
+  test('returns projects array when applyToOrg is false and projectRef is set', () => {
+    expect(buildProjectPayload(false, 'ref_abc')).toStrictEqual({ projects: ['ref_abc'] })
+  })
+
+  test('wraps the projectRef in a single-element array', () => {
+    expect(buildProjectPayload(false, 'my-project-ref')).toStrictEqual({
+      projects: ['my-project-ref'],
+    })
+  })
+})
+
+describe('buildSsoPayload', () => {
+  test('returns empty object for "auto"', () => {
+    expect(buildSsoPayload('auto')).toStrictEqual({})
+  })
+
+  test('returns { requireSso: true } for "sso"', () => {
+    expect(buildSsoPayload('sso')).toStrictEqual({ requireSso: true })
+  })
+
+  test('returns { requireSso: false } for "non-sso"', () => {
+    expect(buildSsoPayload('non-sso')).toStrictEqual({ requireSso: false })
+  })
+})
+
+function makeEmailList(count: number): string {
+  return Array.from({ length: count }, (_, i) => `user${i + 1}@example.com`).join(', ')
+}
+
+function makeEmailListSpaceSeparated(count: number): string {
+  return Array.from({ length: count }, (_, i) => `user${i + 1}@example.com`).join(' ')
+}
+
+describe('emailSchema', () => {
+  test('accepts a single valid email', () => {
+    expect(emailSchema.safeParse('user@example.com').success).toBe(true)
+  })
+
+  test('accepts exactly 50 emails', () => {
+    expect(emailSchema.safeParse(makeEmailList(MAX_BATCH_INVITE_SIZE)).success).toBe(true)
+  })
+
+  test('rejects 51 emails — singular "address" when exactly 1 needs removing', () => {
+    const result = emailSchema.safeParse(makeEmailList(51))
+    expect(result.success).toBe(false)
+    if (!result.success) {
+      expect(result.error.issues[0].message).toBe(
+        'You can invite up to 50 members at a time. Remove 1 email address to continue.'
+      )
+    }
+  })
+
+  test('rejects 51 space-separated emails (same as comma-separated batch limit)', () => {
+    const result = emailSchema.safeParse(makeEmailListSpaceSeparated(51))
+    expect(result.success).toBe(false)
+    if (!result.success) {
+      expect(result.error.issues[0].message).toBe(
+        'You can invite up to 50 members at a time. Remove 1 email address to continue.'
+      )
+    }
+  })
+
+  test('rejects 99 emails — plural "addresses" when more than 1 needs removing', () => {
+    const result = emailSchema.safeParse(makeEmailList(99))
+    expect(result.success).toBe(false)
+    if (!result.success) {
+      expect(result.error.issues[0].message).toBe(
+        'You can invite up to 50 members at a time. Remove 49 email addresses to continue.'
+      )
+    }
+  })
+
+  test('rejects an empty string', () => {
+    const result = emailSchema.safeParse('')
+    expect(result.success).toBe(false)
+  })
+
+  test('rejects an invalid email address and names it', () => {
+    const result = emailSchema.safeParse('notanemail')
+    expect(result.success).toBe(false)
+    if (!result.success) {
+      expect(result.error.issues[0].message).toBe('Invalid email address: "notanemail"')
+    }
+  })
+
+  test('truncates a very long invalid token in the error message', () => {
+    const longToken = `${'x'.repeat(130)}@`
+    const result = emailSchema.safeParse(longToken)
+    expect(result.success).toBe(false)
+    if (!result.success) {
+      expect(result.error.issues[0].message.startsWith('Invalid email address: "')).toBe(true)
+      expect(result.error.issues[0].message.endsWith('…"')).toBe(true)
+      expect(result.error.issues[0].message.length).toBeLessThan(longToken.length + 50)
+    }
+  })
+})