The discussion revolves around an issue with invite fields when creating an invite as a moderator. Zeemah reported that despite moderators not being able to add invitees to a group due to permissions (returning a 403 error), the group selection dropdown is still available. NateDhaliwal asked about errors, and Zeemah confirmed that submitting a request without sufficient access throws an error.
mcwumbly suggested that the dropdown should only be visible to admins or group owners, with non-admin group owners only able to select groups they own. Southpaw proposed an alternative solution, where instead of hiding the dropdown, it could be shown with a message indicating that the moderator is not the owner of any groups, providing a clearer understanding of how to populate the field.
Hi,
When creating a new invite via [..site..]/new-invite as a moderator, it allows for the invite to add the invitee to a group. Despite this not allowing the moderator to do so (returning a 403), the drop down box still is available. See below:
Nothing exploitable, so probably UX than bug(?)
Merry Christmas 
Error message:
An error occurred: You are not permitted to view the requested resource.
Any errors in the console or in /logs?
Yes, as this is unintended behaviour. So submitting a request to somewhere without enough access throws an error.
The drop-down should probably only show for any admin or group owner.
(Non admin group owners should probably only be able to select a group that they own).
Instead of hiding the drop-down box from a moderator who is not an owner of any group, would it be possible to show the drop-down box with only a message of “You are not the owner of any groups”?
Such a message would give the moderator and their admin a better grasp of how to populate the field so that the moderator can accomplish their task of inviting a user while adding the user to a group.
