Fix: the bug that allows regular users to add unregistered users to the workspace. (#328)

api/services/account_service.py

@@ -268,6 +268,7 @@ class TenantService:
         if action not in ['add', 'remove', 'update']:
             raise InvalidActionError("Invalid action.")
         
+        if member:
             if operator.id == member.id:
                 raise CannotOperateSelfError("Cannot operate self.")
 
@@ -365,6 +366,7 @@ class RegisterService:
         account = Account.query.filter_by(email=email).first()
 
         if not account:
+            TenantService.check_member_permission(tenant, inviter, None, 'add')
             name = email.split('@')[0]
             account = AccountService.create_account(email, name)
             account.status = AccountStatus.PENDING.value