fix

apps/api/internal/httpapi/company_member_role_test.go

@@ -152,6 +152,28 @@ func TestAllowCompanyAdminOrPlatform(t *testing.T) {
 		}
 	})
 
+	t.Run("company_owner_member_role", func(t *testing.T) {
+		t.Parallel()
+		s := &Server{
+			testPlatformAdmin: func(context.Context, uuid.UUID) (bool, error) {
+				return false, nil
+			},
+			testCompanyOwner: func(_ context.Context, got uuid.UUID) (bool, error) {
+				if got != uid {
+					t.Fatalf("userID = %s, want %s", got, uid)
+				}
+				return true, nil
+			},
+		}
+		ctx := context.WithValue(context.Background(), ctxUserID, uid)
+		ctx = context.WithValue(ctx, ctxRole, "member")
+		req := httptest.NewRequest(http.MethodGet, "/", nil).WithContext(ctx)
+		rec := httptest.NewRecorder()
+		if !s.allowCompanyAdminOrPlatform(rec, req) {
+			t.Fatal("company owner with membership role=member must be allowed to invite")
+		}
+	})
+
 	t.Run("impersonated_member_denied", func(t *testing.T) {
 		t.Parallel()
 		actor := uuid.MustParse("bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb")