fix: permissions to update/delete invites 2

Author: maxceem

src/routes/projectMemberInvites/delete.js

@@ -42,17 +42,13 @@ module.exports = [
           && !util.hasPermission(PERMISSION.DELETE_REQUESTED_INVITE, req.authUser, req.context.currentProjectMembers)
         ) {
           error = 'You don\'t have permissions to cancel requested invites.';
-        }
-
-        if (
+        } else if (
           invite.role !== PROJECT_MEMBER_ROLE.CUSTOMER
           && !ownInvite
           && !util.hasPermission(PERMISSION.DELETE_NON_CUSTOMER_INVITE, req.authUser, req.context.currentProjectMembers)
         ) {
           error = 'You don\'t have permissions to cancel invites to Topcoder Team for other users.';
-        }
-
-        if (
+        } else if (
           invite.role === PROJECT_MEMBER_ROLE.CUSTOMER
           && !ownInvite
           && !util.hasPermission(PERMISSION.DELETE_CUSTOMER_INVITE, req.authUser, req.context.currentProjectMembers)

src/routes/projectMemberInvites/update.js

@@ -62,10 +62,9 @@ module.exports = [
           && !util.hasPermission(PERMISSION.UPDATE_REQUESTED_INVITE, req.authUser, req.context.currentProjectMembers)
         ) {
           error = 'You don\'t have permissions to update requested invites.';
-        }
-
-        if (
-          !ownInvite
+        } else if (
+          invite.status !== INVITE_STATUS.REQUESTED
+          && !ownInvite
           && !util.hasPermission(PERMISSION.UPDATE_NOT_OWN_INVITE, req.authUser, req.context.currentProjectMembers)
         ) {
           error = 'You don\'t have permissions to update invites for other users.';