A user is able to add any other user as a member of their Grant's team

[gdixon]

Describe the bug

As demonstrated here: https://gitcoin.co/grants/1945/gitcoin-grants-round-9-dev-fund-2, a user/scammer is able to add any other user to their Grant without approval or verification. This offers the user/scammer legitimacy and might make it more likely for victims to fall foul of scam Grants.

To Reproduce

• Follow the create new Grant flow and add any user in the system to your Grant as a team member

Expected behavior

Each user listed under a Grant should have to accept a request to be part of the Grants team, they should not be displayed to any other user or join team_members until they have accepted.

Screenshots

[thelostone-mc]

I did build something similar but we retired that eventually https://github.com/gitcoinco/web/pull/3366

[nopslip]

What about something like this:

1) user adds new member(s) to the grant using existing TEAM MEMBERS drop down from edit grant window

2) if/when SAVE CHANGES is pressed backed end will queue and send send 'invitation to join Gitcoin Grant XYZ' email to address(es) connected to those accounts.

Similar to a password reset email or something, if the link to approve is not clicked nothing happens. If they do click it could auto approve or take them to a page with more info about the grant where it can be approved. Some UX would be helpful to guide the user though this as well but it feels like a clean and efficient way to implement approvals with minimal overhead.

What you do you guys think?

[PixelantDesign]

Yes! Like this idea. Will take a look at this today.

[PixelantDesign]

Here is a draft

Edit Form

Grant detail display

Email confirming user has accepted

Email confirming user has been invited to join

This means all grants created with have pending team members.

[nopslip]

Looks good to me!

One other thing that occurred to me is that there should be probably some kind of limiter put in place so prevent the backend from spamming invitees. For example, if a user - [added, saved, removed, saved, re-added, saved] we don't want to generate an email each time. Also, if a user gets removed we would probably need to make sure the invite is no longer valid.