[web] [b2b] mark selected schemas as non-strict (#36780)

Two of the B2B request schemas flagged in #36577 reject bodies we don't
want to reject:

- POST /manage/groups/:id/settings/sso: the group settings frontend
  spreads the SSO config document it fetched from the GET route back into
  the POST body, so the request carries `_id`, `__v`, `validated`,
  `enabled` and `useSettingsUKAMF` that the handler recomputes or ignores.
- POST /manage/groups/:id/invites: an internal script sends an unsupported
  `expiresAt` alongside the email; the handler only reads `email`.

Swap z.strictObject() for z.object() on both, with a comment on each
explaining why it's deliberately non-strict.

GitOrigin-RevId: 5ff94ded579bdda07efc59d9ceb1d495964a912d

services/web/app/src/Features/Subscription/TeamInvitesController.mjs

@@ -32,8 +32,10 @@ const rateLimiters = {
   }),
 }
 
+// non-strict: evidence of scripts interacting with this that harmlessly send
+// extra, ignored fields, see https://github.com/overleaf/internal/issues/36577
 const createInviteSchema = z.object({
-  body: z.strictObject({
+  body: z.object({
     email: z.string(),
   }),
 })

services/web/test/unit/src/Subscription/TeamInvitesController.test.mjs

@@ -379,8 +379,8 @@ describe('TeamInvitesController', function () {
       setReqValidationModeForTests('enforce')
     })
 
-    it('createInvite rejects an unrecognized field in the body', async function (ctx) {
-      ctx.req.body = { email: 'invited@example.com', notAField: 'nope' }
+    it('createInvite rejects a request missing the email', async function (ctx) {
+      ctx.req.body = {}
       await new Promise(resolve => {
         ctx.Controller.createInvite(ctx.req, new MockResponse(vi), err => {
           expect(err).to.be.instanceof(InvalidRequestError)