The coverage map distinguishes a dedicated scenario from an unresolved category. Proposed scenarios define proof to build; bindings retain the exact assertion references and identify their executable suite.
Use an isolated membership status in invited state, with the required authority and guard fixtures.
Steps
[
{
"do": "Directly activate a linked invited member that has never received an invitation.",
"expect": "Read the resulting membership status as active; inspect the associated records and recorded history for this transition.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/invitations/activate-user.ts",
"services-platform at ad3f6a65: modules/security/db/users.table.ts; services/invitations/accept-invitation.ts, activate-user.ts, invite-user.ts, revoke-user.ts, suspend-user.ts, resend-invitation.ts, user-deletion.ts; services/membership/lockout.ts, last-administrator.ts."
]
}
]
Expected
Read the resulting membership status as active; inspect the associated records and recorded history for this transition.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Use an isolated membership status in invited state, with the required authority and guard fixtures.
Steps
[
{
"do": "Withdraw the invited membership and inspect its offered assignments and removal work.",
"expect": "Read the resulting membership status as revoked; inspect the associated records and recorded history for this transition.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/invitations/revoke-user.ts",
"services-platform at ad3f6a65: modules/security/db/users.table.ts; services/invitations/accept-invitation.ts, activate-user.ts, invite-user.ts, revoke-user.ts, suspend-user.ts, resend-invitation.ts, user-deletion.ts; services/membership/lockout.ts, last-administrator.ts."
]
}
]
Expected
Read the resulting membership status as revoked; inspect the associated records and recorded history for this transition.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Use an isolated membership status in revoked state, with the required authority and guard fixtures.
Steps
[
{
"do": "Invite the revoked address again and compare membership identity and invitation identity.",
"expect": "Read the resulting membership status as invited; inspect the associated records and recorded history for this transition.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/persistence/users.ts:reinviteRevokedUser",
"services-platform at ad3f6a65: modules/security/db/users.table.ts; services/invitations/accept-invitation.ts, activate-user.ts, invite-user.ts, revoke-user.ts, suspend-user.ts, resend-invitation.ts, user-deletion.ts; services/membership/lockout.ts, last-administrator.ts."
]
}
]
Expected
Read the resulting membership status as invited; inspect the associated records and recorded history for this transition.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Use an isolated invitation in issued state, with the required authority and guard fixtures.
Steps
[
{
"do": "Prepare the provider account and issue the invitation token before delivery.",
"expect": "Read the resulting invitation as live; inspect the associated records and recorded history for this transition.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/persistence/invitations.ts:issueInvitationToken",
"services-platform at ad3f6a65: modules/security/db/user-invitations.table.ts; services/persistence/invitations.ts; services/invitations/invitation-lifetime.ts, resend-invitation.ts, accept-invitation.ts; services/provisioning/provision-user.ts."
]
}
]
Expected
Read the resulting invitation as live; inspect the associated records and recorded history for this transition.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Source
services-platform:modules/security/services/persistence/invitations.ts:issueInvitationToken,services-platform at ad3f6a65: modules/security/db/user-invitations.table.ts; services/persistence/invitations.ts; services/invitations/invitation-lifetime.ts, resend-invitation.ts, accept-invitation.ts; services/provisioning/provision-user.ts.
16Invitation: live to supersededtransitionapiproposed
Use an isolated invitation in live state, with the required authority and guard fixtures.
Steps
[
{
"do": "Resend the invitation and attempt to use the replaced link.",
"expect": "Read the resulting invitation as superseded; inspect the associated records and recorded history for this transition.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/persistence/invitations.ts:supersedeOutstandingInvitations",
"services-platform at ad3f6a65: modules/security/db/user-invitations.table.ts; services/persistence/invitations.ts; services/invitations/invitation-lifetime.ts, resend-invitation.ts, accept-invitation.ts; services/provisioning/provision-user.ts."
]
}
]
Expected
Read the resulting invitation as superseded; inspect the associated records and recorded history for this transition.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Source
services-platform:modules/security/services/persistence/invitations.ts:supersedeOutstandingInvitations,services-platform at ad3f6a65: modules/security/db/user-invitations.table.ts; services/persistence/invitations.ts; services/invitations/invitation-lifetime.ts, resend-invitation.ts, accept-invitation.ts; services/provisioning/provision-user.ts.
17Invitation: expired to supersededtransitionapiproposed
Use an isolated invitation in expired state, with the required authority and guard fixtures.
Steps
[
{
"do": "Replace the expired invitation and compare the new validity window.",
"expect": "Read the resulting invitation as superseded; inspect the associated records and recorded history for this transition.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/invitations/resend-invitation.ts",
"services-platform at ad3f6a65: modules/security/db/user-invitations.table.ts; services/persistence/invitations.ts; services/invitations/invitation-lifetime.ts, resend-invitation.ts, accept-invitation.ts; services/provisioning/provision-user.ts."
]
}
]
Expected
Read the resulting invitation as superseded; inspect the associated records and recorded history for this transition.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Source
services-platform:modules/security/services/invitations/resend-invitation.ts,services-platform at ad3f6a65: modules/security/db/user-invitations.table.ts; services/persistence/invitations.ts; services/invitations/invitation-lifetime.ts, resend-invitation.ts, accept-invitation.ts; services/provisioning/provision-user.ts.
18Invitation: issued to supersededtransitionapiproposed
Use an isolated invitation in issued state, with the required authority and guard fixtures.
Steps
[
{
"do": "Resend an invitation whose provider preparation has not yet produced a token.",
"expect": "Read the resulting invitation as superseded; inspect the associated records and recorded history for this transition.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/invitations/resend-invitation.ts",
"services-platform at ad3f6a65: modules/security/db/user-invitations.table.ts; services/persistence/invitations.ts; services/invitations/invitation-lifetime.ts, resend-invitation.ts, accept-invitation.ts; services/provisioning/provision-user.ts."
]
}
]
Expected
Read the resulting invitation as superseded; inspect the associated records and recorded history for this transition.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Source
services-platform:modules/security/services/invitations/resend-invitation.ts,services-platform at ad3f6a65: modules/security/db/user-invitations.table.ts; services/persistence/invitations.ts; services/invitations/invitation-lifetime.ts, resend-invitation.ts, accept-invitation.ts; services/provisioning/provision-user.ts.
19Role assignment: pending to revokedtransitionapiproposed
Use an isolated role assignment in pending state, with the required authority and guard fixtures.
Steps
[
{
"do": "Withdraw the invitation and inspect the pending assignment’s retained row.",
"expect": "Read the resulting role assignment as revoked; inspect the associated records and recorded history for this transition.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/persistence/assignments.ts:revokeAssignmentsOfUser",
"services-platform at ad3f6a65: modules/security/db/security-assignments.table.ts; services/persistence/assignments.ts; services/membership/manage-assignments.ts; services/invitations/widening.ts."
]
}
]
Expected
Read the resulting role assignment as revoked; inspect the associated records and recorded history for this transition.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
An invited person retains the first invitation link.
Steps
Resend the invitation, attempt acceptance through the old link, then accept through the replacement.
Expected
The old link is superseded; only the replacement activates the membership.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#answers an expired, a revoked and a superseded token with the same sentence, and records which it was,services-platform:modules/security/tests/unit/services/invitations/resend-invitation.spec.js#supersedes the outstanding invitations and issues a new one with a new token, in one transaction
21Offer and manage an invitation with maintain console membershipsinteractionapinegativeproposed
An access manager can delegate one role but lacks another role’s powers.
Steps
Invite with the permitted role, then attempt another invitation carrying the unavailable role.
Expected
The first creates pending assignments; the second creates neither invitation nor assignment.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses a role that grants more than the caller may do there, and names what was missing,services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#refuses a scope the caller does not manage, and says which scope rather than which role