feat(authsome-mode): Do not allow EiC to send or cancel invitations

packages/xpub-faraday/config/authsome-mode.js

@@ -417,6 +417,20 @@ async function applyEditorInChiefPolicy(user, operation, object, context) {
       return false
     }
   }
+  if (operation === 'POST') {
+    if (
+      get(object, 'path') ===
+      '/api/collections/:collectionId/fragments/:fragmentId/invitations'
+    )
+      return false
+  }
+  if (operation === 'DELETE') {
+    if (
+      get(object, 'path') ===
+      '/api/collections/:collectionId/invitations/:invitationId'
+    )
+      return false
+  }
   return true
 }