[BUG] Trezu - Members: Existing member can change their name through Join Invitation

[rknearn-qa]

Summary

A user who is already a member of a Treasury can open a member invitation link and submit a new name through the Ask Join flow.

The application correctly detects that the account is already a Treasury member and displays the corresponding validation message, but the submitted name is still applied to the existing member.

This allows the Join flow to unexpectedly mutate data for an already active member.

Preconditions

• Treasury exists (https://testenv.trezu.app/staging-qa.sputnik-dao.near/members)
• User account is already an active member of the Treasury (littlelemon7742.near)
• A valid invitation link for the same Treasury is available.

Steps To Reproduce

1. Open the Treasury Invitation link using an account that is already a member.
2. Enter a different name in the Your name field.
3. Click Ask Join.
4. Observe the validation message.
5. Open the Members page and check the existing member.

Actual Result

• The application displays:

  Account is already a treasury member

• However, the member's name is still changed to the newly entered value.

• The Join request is rejected/blocked, but the member data has already been mutated.

Invite.2.webm

Invite.Member.-.The.same.address.webm

Expected Result

• If the account is already a Treasury member, the Join flow must not modify the existing member.
• The Your name value should have no effect on the existing member.
• The validation should prevent the entire Join operation, including any member-data mutation.

Special Notes

Possible Root Cause:

The "already a member" validation appears to happen after the member
name has already been persisted or after the existing member record has
been updated.

The Join flow should validate membership state before performing any
mutation.

Expected flow:

Open invitation
      ↓
Check whether account is already a member
      ↓
Already a member?
      ↓
Yes → show validation error
      ↓
STOP — do not update member data

The membership validation and member-name mutation should be part of
the same protected operation/transaction so that a rejected Join request
cannot modify an existing member.

Workarounds

• Do not use an invitation link to join a Treasury where the account is already a member.

Repro Rate

Always (10/10)

Setup - OS - Browser - Environment

• OS / Devices: Windows 11 (x64), Motorola G23 (Android 14), Iphone XR (iOs 18.7.6)
• Screen resolution(s): 1366 x 768, 1600 x 720, 1792×828
• Browser(s) + version(s): Chrome (150.0.7871.129), Mozilla Firefox (151.0.3), Brave (1.91.168), Safari (18.7.4), Edge (149.0.4022.52)
• Wallet: Meteor
• App environment: Staging (trezu.app)
• Near Network: Mainnet

Resources & Additional Notes

Impact

User Impact

• Existing members can have their display/name information unexpectedly changed.
• The user receives an error suggesting that nothing was accepted, while their member data has actually been modified.

System Impact

• A rejected Join operation can mutate an existing member record.
• Validation and data mutation are not atomic.

Business / Release Risk

• Creates inconsistent and misleading member-management behavior.
• Could allow unintended modification of member information through an invitation flow.

QA Verdict

Verdict: ❌ Needs Fix

Rationale

A validation failure must not produce any side effects. If the account is already a Treasury member, the Join flow should terminate before modifying any existing member data.

Recommendation

• Perform the already-member check before updating member information.

• Prevent any member mutation when the Join request is rejected.

• Make the validation and mutation atomic where possible.

• Add regression coverage for:

  • Existing member opening an invitation.
  • Existing member submitting a different name.
  • Existing member submitting the same name.
  • Non-member successfully joining through invitation.
  • Existing member with different roles/permissions.
  • Rejected Join flow leaving all existing member data unchanged.

Priority

🟡 P2 : Medium

[rknearn-qa]

Retested
Fixed

• OS / Devices: Windows 11 (x64), Motorola G23 (Android 14), Iphone XR (iOs 18.7.6)
• Screen resolution(s): 1366 x 768, 1600 x 720, 1792×828
• Browser(s) + version(s): Chrome (150.0.7871.129), Mozilla Firefox (151.0.3), Brave (1.91.168), Safari (18.7.4), Edge (149.0.4022.52)
• Wallet: Meteor
• App environment: Staging (trezu.app)
• Near Network: Mainnet