Skip to content

CAP-PFM-SEC-008Offer and manage an invitation

Markdown

CAP-PFM-SEC-008

Offer and manage an invitation

Markdown
  • DocumentDraft
  • Product intentConfirmed
  • ImplementationObserved

KindCapabilityProduct areaPlatformModuleSecurity, Customers and WorkspacesRevision1

Read atservices-platform ad3f6a65react-console baf6dae3

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
Administrators can distinguish a committed invitation from successful e-mail delivery.Offered assignments respect the inviter’s authority and membership boundary.Resend and withdrawal give administrators recovery actions for outstanding invitations.
Surfaces
consoleapi
Intent sources
services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-11 Final acceptance)services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-13/14 Final acceptance)services-platform:docs/security/security-administration.md#2. Capability checklist (U4, U13, I1 to I9)

Controls

36 controls apply, from the corpus control catalogue.

TC-AVL-001 TC-AVL-005 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-CRY-001 TC-CRY-002 TC-CRY-003 TC-CRY-004 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-IAM-001 TC-IAM-002 TC-IAM-004 TC-IAM-005 TC-LOG-001 TC-LOG-002 TC-LOG-003 TC-LOG-004 TC-LOG-005 TC-PI-001 TC-PI-005 TC-PRV-001 TC-PRV-002 TC-SEC-001 TC-SEC-002 TC-SEC-003 TC-SEC-004 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

KeyChecked atScope
platform.security-access.manageapitenant
platform.users.readapitenant

Business Rules

12 rules, 10 to be proved before approval. A rule's product intent is derived from its origin: 12 confirmed by a product decision, the rest inheriting this capability's confirmed.

IdRuleKindEnforced atProvenance
01must prove
Confirmed
Invitation creation, resend, withdrawal and direct activation require access-management authority within the addressed customer; unknown or outside-customer targets return not found without creating membership records.
origin: services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-13/14 Final acceptance)
no proof recorded yet
permissionapi, servicetest
services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses an invitation into a customer the caller does not reach, as 404, and leaves nothing behind
02must prove
Confirmed
Invitation creation requires a valid e-mail address and stores its canonical form; missing or invalid addresses create no person.
origin: services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-11 Final acceptance)
no proof recorded yet
validationservicetest
services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#refuses an invalid e-mail address as ObjectInvalid naming email_address, creating nobody
03must prove
Confirmed
Existing active members are directed to role management, already-invited members to resend, and revoked members return through their existing account and history.
origin: services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-11 Final acceptance)
no proof recorded yet
validationservice, databasetest
services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#refuses somebody already invited to that wall as already_invited, telling the administrator to resend
04must prove
Confirmed
Creation commits the membership and invitation together before provisioning sign-in and sending mail; the response reports delivery status and reason without the raw token, and delivery failure preserves the committed records.
origin: services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-11 Final acceptance)
no proof recorded yet
lifecycleservicetest
services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#keeps the user and the invitation when the e-mail could not be sent, and says why so the administrator can resend
05must prove
Confirmed
Inviters can offer only unconditionally allowed permissions at the proposed scopes, cannot invite roles onto their own account and receive the failing keys and scopes when delegation is refused.
origin: services-platform:docs/security/security-administration.md#4. Delegation, escalation and lockout
no proof recorded yet
permissionservicetest
services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses a role that grants more than the caller may do there, and names what was missing
06must prove
Confirmed
Offered assignments remain pending until acceptance; grants outside a console member’s customer or outside a portal member’s single workspace fail before membership creation.
origin: services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-11 Final acceptance)
no proof recorded yet
invariantservicetest
services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#refuses a grant that reaches outside the wall the user is being created in, before a user exists
07must prove
Confirmed
Resend replaces outstanding invitations with a fresh seven-day link for an invited membership; already-accepted members are refused and directed to password recovery.
origin: services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-11 Final acceptance)
no proof recorded yet
lifecycleservicetest
services-platform:modules/security/tests/unit/services/invitations/resend-invitation.spec.js#supersedes the outstanding invitations and issues a new one with a new token, in one transaction
08must prove
Confirmed
Withdrawing an invitation revokes membership so that the old link cannot activate the person or their pending roles.
origin: services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-11 Final acceptance)
no proof recorded yet
lifecycleservicetest
services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#revoking a membership stops the link already in the inbox, and the account cannot come back by accepting it
09
Confirmed
The user list reports the newest invitation’s pending, expired, accepted or revoked state with send and delivery information and supports invited, expired and never-invited filters.
origin: services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-13/14 Final acceptance)
policyapi, servicetest
services-platform:modules/security/tests/e2e/console-users.e2e.spec.js#answers the newest invitation of a row, and explicitly none for somebody never invited
10must prove
Confirmed
Direct activation requires an already-linked sign-in identity on a never-invited membership; a member with an invitation must accept it instead.
no proof recorded yet
lifecycleservicetest
services-platform:modules/security/tests/unit/services/invitations/activate-user.spec.js#refuses a user that was invited (accept or resend instead), an unprovisioned one and a disabled one, writing nothing
11
Confirmed
Workspace-scoped invitation and member-list operations can administer that workspace’s portal members, and the portal list excludes console memberships.
policyapi, servicetest
services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#invites a member of the tenant's portal and lists the tenant's members, the console users left out
12must prove
Confirmed
Invitation mail uses Rhythm’s sender and a first-name greeting, includes expiry when available and keeps the raw link token out of the subject; display-name escaping prevents header and markup injection.
no proof recorded yet
validationservicetest
services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#strips the quote and the newline of an injected display name, leaving one header line

Scenarios

IdGivenWhenThenProvenance
01An administrator offers a colleague customer-wide Read Only access.E-mail delivery fails after the invitation is committed.The colleague remains Invited with delivery information, and resend can issue a new link.test
02The requested colleague is already an active member of this customer.An administrator attempts another invitation.The refusal points the administrator toward the existing membership rather than create a duplicate.test
react-console:e2e/security/invitations.spec.ts#refuses to invite an address that already belongs to a user, and offers the user instead

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.