       options.sort  = { 'meta.createdAt' : -1 }
       options.limit = Math.min limit ? 10, 25
 
-      group.fetchMembers$ client, {}, options, (err, members) ->
+      group.fetchMembers$ client, {}, options, (err, members_) ->
 
         if err and err.message is 'Access denied'
           params = { name, client, options, token }
-          return handleTokenedRequest params, res, next
+          handleTokenedRequest params, (err, members_) ->
+            return next err  if err
+            members = members_
+            return next()
         else if err
-          return res.status(500).send 'an error occured'
+          return next generateAPIError 500, 'an error occured'
         else
-          return res.status(200).send members
+          members = members_
+          return next()
 
   ]
 
-  async.series queue
+  async.series queue, (err) ->
+    return res.status(err.status).send err.message  if err
+    res.status(200).send members

koding                 = require './../bongo'
async                  = require 'async'

{ isLoggedIn }         = require './../helpers'
{ generateFakeClient } = require './../client'

# handleTokenedRequest handles the request if it has a token as query param,
# fetchMembers is secured by a permission, that can be turned off by default,
# but we want to show latest members to invited user
handleTokenedRequest = (params, res, next) ->

  { JGroup, JInvitation }           = koding.models
  { name, options, token, client }  = params

  group = null

  queue = [

    (next) ->
      return res.status(403).send 'not authorized'  unless token

      # fetch invitation
      JInvitation.byCode token, (err, token_) ->
        return res.status(403).send 'not authorized'  if err or not token_
        next()

    (next) ->
      # fetch the group that we have in token
      JGroup.one { slug : name }, (err, group_) ->
        return res.status(500).send 'an error occured'  if err
        return res.status(404).send 'no group found'    unless group_

        group = group_
        # override group name with the one in token


    (next) ->
      # fetch members of that group
      group.fetchMembers {}, options, (err, members_) ->
        return next generateAPIError 500, 'an error occured'  if err
        members = members_
        next()

  ]

  async.series queue, (err) ->
    return callback err  if err
    callback null, members


# fetch last members of a group, if we have a permission issue for the current
