---
id: TST-PFM-SEC-060
title: Invitations request checks
kind: api-lifecycle
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/security/tests/e2e/invitations.e2e.spec.js
implements:
  - ATS-PFM-SEC-005-03
  - ATS-PFM-SEC-005-04
  - ATS-PFM-SEC-005-07
  - ATS-PFM-SEC-008-01
  - ATS-PFM-SEC-008-03
  - ATS-PFM-SEC-008-04
  - ATS-PFM-SEC-008-05
  - ATS-PFM-SEC-008-06
  - ATS-PFM-SEC-008-07
  - ATS-PFM-SEC-008-08
  - ATS-PFM-SEC-008-09
  - ATS-PFM-SEC-009-03
  - ATS-PFM-SEC-009-05
  - ATS-PFM-SEC-010-02
  - ATS-PFM-SEC-019-08
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 5
isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records.
assertion_evidence:
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#security invitations API
      (end to end)
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#inviting, accepting and
      the public routes
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#creates the user,
      provisions the account and e-mails the token in the request, answering that it was sent and no
      token
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#shows the acceptance page
      the person's first name and a masked address, without a signed context
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#accepts the e-mailed
      token with a password and makes the account active (the invite created the account before it
      sent the link)
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#answers a second use of
      the same token as the success it already was
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses to invite an
      accepted account again, telling the administrator to reset the password instead
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses a malformed, an
      unknown, a revoked and a superseded token with one sentence and nothing more
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#resending, revoking and
      disabling
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#supersedes the old token
      on a resend, so only the newest link works
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#counts the e-mail that
      actually left against each invitation, on the invite and again on the resend
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#revoking a membership
      stops the link already in the inbox, and the account cannot come back by accepting it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#suspends an account,
      revoking its invitation with it, disabling its pool account and flushing the caches
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#revokes a membership with
      every assignment it held, and nothing undoes it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses a second
      invitation to somebody already invited here, telling the administrator to resend
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses an invitation to
      somebody who has already accepted, pointing at their roles instead
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#invites a revoked member
      back onto the row and the account they already had
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses an administrator
      who tries to suspend or revoke their own account
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#activating a user that
      already owns a pool account (never invited)
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#links the identity from
      the pool, activates without an invitation, and the user then reaches GET /users/me
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses to activate a
      user with an invitation in flight (the person accepts it, or has it resent), and one outside
      the scope
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#the user lists of the
      path's wall
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#lists the console users
      of the customer the path names, and nobody else's
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses the console-user
      list of a customer outside the caller's reach, and of one that does not exist, as 404
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#invites a member of the
      tenant's portal and lists the tenant's members, the console users left out
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses the member list
      of a tenant outside the caller's reach as 404
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses the member list
      of a tenant that does not exist as 403, before the route is reached
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#names that refusal
      TenantUnavailable
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#scope, permissions and
      the fail-closed read
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses an invitation
      into a customer the caller does not reach, as 404, and leaves nothing behind
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses to act on a user
      outside the caller's scope and an unknown one, telling the two apart for nobody
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses the seeded
      invited user every signed request until it accepts
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#declares the lifecycle
      routes with the one permission that gives access, and the public ones with none
  - provenance: test
    source: 'services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#the widening rule'
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#lets a caller grant a
      role whose every key they are allowed where they are granting it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses a role that
      grants more than the caller may do there, and names what was missing
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#never reaches the rule
      for a caller who cannot manage access in the customer at all
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses a grant that
      reaches outside the wall the user is being created in
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#accepting with Google
      (the public begin and complete routes)
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#begins with the token,
      refuses the completion of another Cognito user, completes once for the right one and refuses a
      replay
  - provenance: test
    source: >-
      services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses a bad token at
      begin and an unknown state at complete with the one sentence
dependency_evidence: >-
  The local request harness exercises the route dispatcher and the prepared database. The suite’s
  own dependency setup determines which external collaborators are controlled; registration alone
  does not certify them as live.
evidence:
  - 'services-platform:modules/security/tests/e2e/invitations.e2e.spec.js'
  - >-
    Static review at the recorded source revision; executable results remain not-run and conformance
    remains not-verified.
binding_note: >-
  Each binding names the scenario to which this file contributes assertions. A binding is not a
  recorded pass and does not extend the file’s dependency boundary.
examiner: codex
examined_at: '2026-10-23'
final_text: OpenAI
dependency_review:
  provenance: test
  source: 'services-platform:modules/security/tests/e2e/invitations.e2e.spec.js'
  explicit_no_doubles: false
  identified_double_boundaries: []
---
# Invitations request checks

## Verification Boundary

The file exercises public request handling through the local service harness. The assertion references identify the source checks for invitations.

## What This Suite Proves

The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions.

## What It Does Not Prove

This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence.

## Real Dependencies and Test Doubles

The local request harness exercises the route dispatcher and the prepared database. The suite’s own dependency setup determines which external collaborators are controlled; registration alone does not certify them as live.

## Must Not Be Doubled

Keep route dispatch, signed-context verification and the exercised service decisions real. A test key can supply signatures, but replacing the authorization decision cannot prove request enforcement.