The suite follows the administrative work of inviting a colleague, maintaining their membership and changing their roles. It keeps the live views and retained history tied to the same person.
Membership changes affect invitations and assignments, while role changes affect both holders and effective access. Refused changes must leave usable administration and attributable history together. The interaction rows identify the participating capabilities and the detailed proofs they assume. A complete feature chain needs its own executable evidence even when its individual outcomes already have bindings.
Two qualifying administrators protect the customer from lockout.
Steps
[object Object]
Expected
The membership, assignment and history identify the same colleague throughout the administration work.
Data
A disposable customer and workspace with run-owned memberships, assignments and definitions; clock-controlled expiry fixtures where needed.
Source
react-console:e2e/security/invitations.spec.ts#invites a new identity from the Users screen,react-console:e2e/security/users.spec.ts#edits a person's details and keeps them through a reload,react-console:e2e/security/users.spec.ts#gives a role, says who granted it, and takes it away again,services-platform:modules/security/tests/integration/services/persistence/audit-events.integration.spec.js#records the actor in their wall, the session, the keys, before and after, and the request
02Role holders and the user assignment agreeinteractionproposed
A colleague has an outstanding invitation and pending access.
Steps
[object Object]
Expected
The old offer grants no access; the retained membership receives a new offer and new pending assignments.
Data
A disposable customer and workspace with run-owned memberships, assignments and definitions; clock-controlled expiry fixtures where needed.
Source
services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses an invitation to somebody who has already accepted, pointing at their roles instead,services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#revoking a membership stops the link already in the inbox, and the account cannot come back by accepting it,services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#revokes a membership with every assignment it held, and nothing undoes it,services-platform:modules/security/tests/integration/services/membership/manage-assignments.integration.spec.js#grants a role at customer scope, active at once for an active person, and audits it as widening
04Readers cannot invite or widen accesspermissionnegativeproposed
A read-only user and an access manager can see the same colleague.
Steps
[object Object]
Expected
Missing management or explanation authority is refused without the attempted mutation.
Data
A disposable customer and workspace with run-owned memberships, assignments and definitions; clock-controlled expiry fixtures where needed.
Source
services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#lets a caller grant a role whose every key they are allowed where they are granting it,services-platform:modules/security/tests/e2e/console-users.e2e.spec.js#changes the names and answers the person again, at the next version,services-platform:modules/security/tests/e2e/console-users.e2e.spec.js#refuses the reader’s attempt to grant as 403, and grants nothing,services-platform:modules/security/tests/e2e/console-users.e2e.spec.js#refuses the reader, who may not read the history either
05Failed lockout changes leave both access and refusal historyregressionnegativeproposed
Only one qualifying customer administrator remains.
Steps
[object Object]
Expected
The administrator remains active and both refusals are attributable after rollback.
Data
A disposable customer and workspace with run-owned memberships, assignments and definitions; clock-controlled expiry fixtures where needed.
Source
services-platform:modules/security/tests/unit/services/invitations/suspend-revoke.spec.js#refuses a suspension that would leave the customer with no security administrator, and suspends nobody,services-platform:modules/security/tests/integration/services/membership/manage-assignments.integration.spec.js#revokes the grant, keeps the row, and audits what was withdrawn,services-platform:modules/security/tests/integration/services/invitations/revoke-lockout.integration.spec.js#records the refused attempt with the guard’s reason, outside the transaction that was rolled back