--- id: JNY-PFM-SEC-003 title: Invite a colleague and maintain their console access feature: FEAT-PFM-SEC-03 product_area: platform module: security revision: 1 status: draft product_intent: confirmed implementation_evidence: observed supersedes: [] source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f actor: ACT-PFM-001 goal: >- Bring a colleague into the customer, manage role reach and membership status, and preserve an administrator. capabilities: - CAP-PFM-SEC-008 - CAP-PFM-SEC-010 - CAP-PFM-SEC-009 - CAP-PFM-SEC-011 screens: - '/console/{tenantId}/security/users' - '/console/{tenantId}/security/users/{userId}' - '/console/{tenantId}/security/users/{userId}/edit' steps: - 'n': 1 surface: '/console/{tenantId}/security/users' action: Invite the colleague from the Users page. capability: CAP-PFM-SEC-008 expected: The browser test observes an invited membership after submission. provenance: test source: 'react-console:e2e/security/invitations.spec.ts#invites a new identity from the Users screen' - 'n': 2 surface: resendConsoleUserInvitation action: Resend the outstanding invitation. capability: CAP-PFM-SEC-008 expected: The replacement link supersedes the previously issued link. provenance: test source: >- react-console:e2e/security/invitations.spec.ts#resending from the console invalidates the link it replaces - 'n': 3 surface: '/console/{tenantId}/security/users/{userId}/edit' action: Assign a role from the person’s page. capability: CAP-PFM-SEC-010 expected: The tested grant identifies its grantor and can subsequently be removed. provenance: test source: 'react-console:e2e/security/users.spec.ts#gives a role, says who granted it, and takes it away again' - 'n': 4 surface: '/console/{tenantId}/security/users/{userId}' action: Edit the colleague’s profile information. capability: CAP-PFM-SEC-009 expected: The saved details remain after a page reload. provenance: test source: 'react-console:e2e/security/users.spec.ts#edits a person''s details and keeps them through a reload' - 'n': 5 surface: suspendConsoleUser action: 'Deactivate the membership, then reactivate it.' capability: CAP-PFM-SEC-009 expected: >- The browser test observes rejected sign-in after deactivation and restored sign-in after reactivation; it does not measure already cached authority. provenance: test source: >- react-console:e2e/security/users.spec.ts#deactivating really shuts somebody out, and reactivating lets them back in alternates: - from_step: 1 condition: The address already belongs to a membership. path: Reject invitation creation and offer navigation to that person. outcome: The administrator can open the existing membership. provenance: test source: >- react-console:e2e/security/invitations.spec.ts#refuses to invite an address that already belongs to a user, and offers the user instead - from_step: 5 condition: The colleague leaves permanently. path: Remove their access and later issue a new invitation if they return. outcome: The browser test verifies that reinvitation works after removal. provenance: test source: >- react-console:e2e/security/invitations.spec.ts#re-invites them after their access is removed, and the new link works failures: - from_step: 3 condition: The offered role exceeds the administrator’s authority. path: Reject the grant and describe the missing permission. outcome: No invitation message is sent by the rejected operation. provenance: test source: >- services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses a role that grants more than the caller may do there, and names what was missing - from_step: 5 condition: The administrator tries to remove the final Administrator assignment. path: Reject the removal. outcome: The remaining administrator retains the role. provenance: test source: >- react-console:e2e/security/users.spec.ts#refuses to remove the Administrator role from the last person who holds it rules_in_play: - BR-CAP-PFM-SEC-008-03 - BR-CAP-PFM-SEC-008-04 - BR-CAP-PFM-SEC-008-05 - BR-CAP-PFM-SEC-008-07 - BR-CAP-PFM-SEC-010-02 - BR-CAP-PFM-SEC-010-08 - BR-CAP-PFM-SEC-009-03 - BR-CAP-PFM-SEC-009-04 - BR-CAP-PFM-SEC-009-07 - BR-CAP-PFM-SEC-011-01 assertions: - id: AS-JNY-PFM-SEC-003-01 statement: The Users invitation flow creates a membership shown as Invited. provenance: test source: 'react-console:e2e/security/invitations.spec.ts#invites a new identity from the Users screen' - id: AS-JNY-PFM-SEC-003-02 statement: The person’s role grant displays its grantor and supports removal. provenance: test source: 'react-console:e2e/security/users.spec.ts#gives a role, says who granted it, and takes it away again' - id: AS-JNY-PFM-SEC-003-03 statement: >- The deactivation browser test refuses sign-in until reactivation; this is separate from profile persistence and gateway-cache timing. provenance: test source: >- react-console:e2e/security/users.spec.ts#deactivating really shuts somebody out, and reactivating lets them back in e2e_policy: required e2e_reason: >- The journey involves an administrator’s Security pages and a colleague’s invitation and sign-in. Browser proof must establish that interaction; cached request propagation remains a separately qualified rule. evidence: - >- Pinned react-console references for the structured rows: e2e/security/invitations.spec.ts; e2e/security/users.spec.ts. - >- Pinned services-platform references for the structured rows: modules/security/tests/e2e/invitations.e2e.spec.js. proved_by: [] --- # Invite a colleague and maintain their console access ## Story A customer security administrator invites a new coordinator and resends the message if needed. After acceptance, the administrator manages role assignments from the person’s page and corrects profile details. During leave they deactivate the membership and later reactivate it. Role widening and administrator protection remain governed by the shared capability rules.