Add invitingOrganizations field on viewer

Expose viewer.invitingOrganizations: [Organization!]! returning the
organizations that have a live pending invitation directed at the
current identity (accepted_at IS NULL AND expires_at > NOW()). The
list is rendered under a "Pending invitations" section on the
memberships page and in the organization selector dropdown, so a user
already signed in with an existing identity can see which
organizations have invited them without having to dig through their
inbox.

The new field is gated by iam:invitation:list against the viewer's
own identity, so it does not loosen authorization on Organization
elsewhere. E2E coverage validates the live-pending case, the
no-invitation and post-accept cases, and a multi-org scenario.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/coredata/organization.go

@@ -255,6 +255,66 @@ WHERE
 	return nil
 }
 
+func (o *Organizations) LoadAllByIdentityIDWithPendingInvitation(
+	ctx context.Context,
+	conn pg.Querier,
+	scope Scoper,
+	identityID gid.GID,
+) error {
+	q := `
+WITH invited_org AS (
+	SELECT DISTINCT
+		p.organization_id
+	FROM
+		iam_membership_profiles p
+	INNER JOIN iam_invitations inv ON inv.user_id = p.id
+	WHERE
+		p.identity_id = @identity_id
+		AND inv.accepted_at IS NULL
+		AND inv.expires_at > NOW()
+)
+SELECT
+	tenant_id,
+	id,
+	name,
+	logo_file_id,
+	horizontal_logo_file_id,
+	description,
+	website_url,
+	email,
+	headquarter_address,
+	custom_domain_id,
+	created_at,
+	updated_at
+FROM
+	organizations
+INNER JOIN
+	invited_org ON organizations.id = invited_org.organization_id
+WHERE
+	%s
+ORDER BY name ASC
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"identity_id": identityID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query organizations: %w", err)
+	}
+
+	organizations, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Organization])
+	if err != nil {
+		return fmt.Errorf("cannot collect organizations: %w", err)
+	}
+
+	*o = organizations
+
+	return nil
+}
+
 func (o *Organization) Insert(
 	ctx context.Context,
 	conn pg.Tx,

pkg/iam/account_service.go

@@ -600,6 +600,27 @@ func (s *AccountService) DeletePersonalAPIKey(
 	)
 }
 
+func (s AccountService) ListInvitingOrganizations(ctx context.Context, identityID gid.GID) ([]*coredata.Organization, error) {
+	var organizations coredata.Organizations
+
+	err := s.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			err := organizations.LoadAllByIdentityIDWithPendingInvitation(ctx, conn, coredata.NewNoScope(), identityID)
+			if err != nil {
+				return fmt.Errorf("cannot load inviting organizations: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return organizations, nil
+}
+
 func (s AccountService) ListOrganizations(ctx context.Context, identityID gid.GID) ([]*coredata.Organization, error) {
 	var organizations coredata.Organizations
 

pkg/server/api/connect/v1/graphql/identity.graphql

@@ -30,6 +30,10 @@ type Identity implements Node {
     before: CursorKey
   ): PersonalAPIKeyConnection @goField(forceResolver: true)
 
+  invitingOrganizations: [Organization!]!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+
   ssoLoginURL: String
     @goField(forceResolver: true)
     @session(required: PRESENT)

pkg/server/api/connect/v1/identity_resolvers.go

@@ -130,6 +130,26 @@ func (r *identityResolver) PersonalAPIKeys(ctx context.Context, obj *types.Ident
 	return types.NewPersonalAPIKeyConnection(page, r, obj.ID), nil
 }
 
+// InvitingOrganizations is the resolver for the invitingOrganizations field.
+func (r *identityResolver) InvitingOrganizations(ctx context.Context, obj *types.Identity) ([]*types.Organization, error) {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionInvitationList, authz.WithSkipAssumptionCheck()); err != nil {
+		return nil, err
+	}
+
+	organizations, err := r.iam.AccountService.ListInvitingOrganizations(ctx, obj.ID)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list inviting organizations", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	result := make([]*types.Organization, len(organizations))
+	for i, organization := range organizations {
+		result[i] = types.NewOrganization(organization)
+	}
+
+	return result, nil
+}
+
 // SsoLoginURL is the resolver for the ssoLoginURL field.
 func (r *identityResolver) SsoLoginURL(ctx context.Context, obj *types.Identity) (*string, error) {
 	if _, err := r.authorize(ctx, obj.ID, iam.ActionIdentityGet); err != nil {