@cosmicdrift/kumiko-bundled-features 0.328.0 → 0.328.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.328.0",
+  "version": "0.328.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -134,12 +134,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.328.0",
-    "@cosmicdrift/kumiko-framework": "0.328.0",
-    "@cosmicdrift/kumiko-headless": "0.328.0",
-    "@cosmicdrift/kumiko-renderer": "0.328.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.328.0",
-    "@cosmicdrift/kumiko-types": "0.328.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.328.1",
+    "@cosmicdrift/kumiko-framework": "0.328.1",
+    "@cosmicdrift/kumiko-headless": "0.328.1",
+    "@cosmicdrift/kumiko-renderer": "0.328.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.328.1",
+    "@cosmicdrift/kumiko-types": "0.328.1",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -167,8 +167,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.328.0",
-    "@cosmicdrift/kumiko-locale-es": "0.328.0",
+    "@cosmicdrift/kumiko-locale-de": "0.328.1",
+    "@cosmicdrift/kumiko-locale-es": "0.328.1",
     "jsqr": "^1.4.0"
   }
 }

package/src/auth-email-password/__tests__/invite-flow-kms.integration.test.ts

@@ -36,8 +36,12 @@ import { createRendererFoundationFeature } from "../../renderer-foundation/featu
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
 import { decryptStoredPii, hashPassword } from "../../shared";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
-import { createTenantFeature } from "../../tenant";
-import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant/invitation-table";
+import { createTenantFeature, TenantHandlers } from "../../tenant";
+import {
+  INVITATION_STATUS,
+  tenantInvitationEntity,
+  tenantInvitationsTable,
+} from "../../tenant/invitation-table";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
 import { seedTenant, seedTenantMembership } from "../../tenant/seeding";
@@ -47,7 +51,7 @@ import {
   tenantInvitationDeleteHook,
   tenantInvitationExportHook,
 } from "../../user-data-rights-defaults";
-import { AuthHandlers } from "../constants";
+import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
 import { seedUser } from "../seeding";
 
@@ -257,6 +261,33 @@ describe("auth flows with active KMS + blind index", () => {
     expect(memberships).toHaveLength(2);
   });
 
+  test("removed member cannot rejoin via an invitation issued before removal", async () => {
+    await seedTenantMembership(stack.db, {
+      userId: bobId,
+      tenantId: TENANT_A_ID,
+      roles: ["Editor"],
+    });
+    const token = await inviteEmail(BOB_EMAIL, "Admin");
+
+    await stack.http.writeOk(
+      TenantHandlers.removeMember,
+      { userId: bobId, tenantId: TENANT_A_ID },
+      { id: "system-admin", tenantId: TENANT_A_ID, roles: ["SystemAdmin"] },
+    );
+
+    const res = await stack.http.raw(
+      "POST",
+      "/api/auth/invite-accept",
+      { token },
+      { Authorization: `Bearer ${await stack.jwt.sign(bobSession())}` },
+    );
+    expect(res.status).toBe(422);
+    const body = (await res.json()) as { error?: { details?: { reason?: string } } };
+    expect(body.error?.details?.reason).toBe(AuthErrors.invalidInviteToken);
+    const [invitation] = await selectMany(stack.db, tenantInvitationsTable, { email: BOB_EMAIL });
+    expect(invitation?.["status"]).toBe(INVITATION_STATUS.cancelled);
+  });
+
   test("Branch 3: invite-signup-complete creates the user from the DECRYPTED invitation email", async () => {
     const token = await inviteEmail(CAROL_EMAIL, "Admin");
 

package/src/auth-email-password/__tests__/invite-flow.integration.test.ts

@@ -29,6 +29,7 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
@@ -39,7 +40,7 @@ import { createRendererFoundationFeature } from "../../renderer-foundation/featu
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
 import { hashPassword } from "../../shared";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
-import { createTenantFeature } from "../../tenant";
+import { createTenantFeature, TenantErrors, TenantHandlers } from "../../tenant";
 import {
   INVITATION_STATUS,
   tenantInvitationEntity,
@@ -216,6 +217,34 @@ async function authedRaw(
   return stack.http.raw(method, path, body, { Authorization: `Bearer ${token}` });
 }
 
+async function membershipRowOf(userId: string, tenantId: TenantId) {
+  const [row] = await selectMany(stack.db, tenantMembershipsTable, { userId, tenantId });
+  if (!row) throw new Error(`no membership for ${userId} in ${tenantId}`);
+  return row;
+}
+
+async function membershipRolesOf(userId: string, tenantId: TenantId): Promise<string[]> {
+  return [...parseRoles((await membershipRowOf(userId, tenantId))["roles"])].sort();
+}
+
+async function membershipVersionOf(userId: string, tenantId: TenantId): Promise<unknown> {
+  return (await membershipRowOf(userId, tenantId))["version"];
+}
+
+async function changeBobRolesInTenantA(roles: readonly string[]): Promise<void> {
+  await stack.http.writeOk(
+    TenantHandlers.updateMemberRoles,
+    { userId: bobId, roles },
+    aliceSession(),
+  );
+}
+
+async function expectInvitationSuperseded(res: Response): Promise<void> {
+  expect(res.status).toBe(409);
+  const body = (await res.json()) as { error?: { details?: { reason?: string } } };
+  expect(body.error?.details?.reason).toBe(TenantErrors.invitationSuperseded);
+}
+
 async function inviteEmail(email: string, role: string): Promise<string> {
   // invite-create geht via /api/write (Admin-Auth via JWT). Der Handler
   // dispatcht die Invite-Mail via delivery; der Token erreicht den Invitee
@@ -327,8 +356,7 @@ describe("invite-accept (Branch 1: logged-in)", () => {
     expect(body.error?.details?.reason).toBe(AuthErrors.inviteEmailMismatch);
   });
 
-  test("Already-Member: Bob ist schon Member → idempotent no-op + alreadyMember=true", async () => {
-    // Bob direkt zu Tenant-A hinzufügen
+  test("Already-Member: Bob ist schon Member → invited role is added, existing role kept, alreadyMember=true", async () => {
     await seedTenantMembership(stack.db, {
       userId: bobId,
       tenantId: TENANT_A_ID,
@@ -344,6 +372,66 @@ describe("invite-accept (Branch 1: logged-in)", () => {
       bobSession(),
     )) as { alreadyMember: boolean };
     expect(result.alreadyMember).toBe(true);
+    expect(await membershipRolesOf(bobId, TENANT_A_ID)).toEqual(["Admin", "User"]);
+  });
+
+  test("bare member of the inviting tenant, logged in there, gets the invited role", async () => {
+    await seedTenantMembership(stack.db, { userId: bobId, tenantId: TENANT_A_ID, roles: [] });
+    const token = await inviteEmail(BOB_EMAIL, "Editor");
+
+    const result = (await stack.http.writeOk(
+      AuthHandlers.inviteAccept,
+      { token },
+      { id: bobId, tenantId: TENANT_A_ID, roles: [] },
+    )) as { alreadyMember: boolean };
+
+    expect(result.alreadyMember).toBe(true);
+    expect(await membershipRolesOf(bobId, TENANT_A_ID)).toEqual(["Editor"]);
+  });
+
+  test("member who already holds the invited role keeps an unchanged membership stream", async () => {
+    await seedTenantMembership(stack.db, {
+      userId: bobId,
+      tenantId: TENANT_A_ID,
+      roles: ["Admin"],
+    });
+    const versionBefore = await membershipVersionOf(bobId, TENANT_A_ID);
+    const token = await inviteEmail(BOB_EMAIL, "Admin");
+
+    await stack.http.writeOk(AuthHandlers.inviteAccept, { token }, bobSession());
+
+    expect(await membershipRolesOf(bobId, TENANT_A_ID)).toEqual(["Admin"]);
+    expect(await membershipVersionOf(bobId, TENANT_A_ID)).toBe(versionBefore);
+  });
+
+  test("roles changed after the invitation was issued → accept rejected, roles unchanged", async () => {
+    await seedTenantMembership(stack.db, {
+      userId: bobId,
+      tenantId: TENANT_A_ID,
+      roles: ["Editor"],
+    });
+    const token = await inviteEmail(BOB_EMAIL, "Admin");
+    await changeBobRolesInTenantA(["User"]);
+
+    const res = await authedRaw("POST", "/api/auth/invite-accept", { token }, bobSession());
+
+    await expectInvitationSuperseded(res);
+    expect(await membershipRolesOf(bobId, TENANT_A_ID)).toEqual(["User"]);
+  });
+
+  test("invitation re-issued after a role change is accepted again", async () => {
+    await seedTenantMembership(stack.db, {
+      userId: bobId,
+      tenantId: TENANT_A_ID,
+      roles: ["Editor"],
+    });
+    await inviteEmail(BOB_EMAIL, "Admin");
+    await changeBobRolesInTenantA(["User"]);
+    const reissuedToken = await inviteEmail(BOB_EMAIL, "Admin");
+
+    await stack.http.writeOk(AuthHandlers.inviteAccept, { token: reissuedToken }, bobSession());
+
+    expect(await membershipRolesOf(bobId, TENANT_A_ID)).toEqual(["Admin", "User"]);
   });
 });
 
@@ -380,6 +468,61 @@ describe("invite-accept-with-login (Branch 2: anon + existing email)", () => {
     expect(payload.locale).toBeUndefined();
   });
 
+  test("bare member of the inviting tenant accepts with login → membership and session carry the invited role", async () => {
+    await seedTenantMembership(stack.db, { userId: bobId, tenantId: TENANT_A_ID, roles: [] });
+    const token = await inviteEmail(BOB_EMAIL, "Editor");
+
+    const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token,
+      email: BOB_EMAIL,
+      password: BOB_PASSWORD,
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { user: { roles: string[] } };
+
+    expect(await membershipRolesOf(bobId, TENANT_A_ID)).toEqual(["Editor"]);
+    expect(body.user.roles).toContain("Editor");
+  });
+
+  test("an existing Admin invited as Editor keeps Admin (accepting never demotes)", async () => {
+    await seedTenantMembership(stack.db, {
+      userId: bobId,
+      tenantId: TENANT_A_ID,
+      roles: ["Admin"],
+    });
+    const token = await inviteEmail(BOB_EMAIL, "Editor");
+
+    const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token,
+      email: BOB_EMAIL,
+      password: BOB_PASSWORD,
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { user: { roles: string[] } };
+
+    expect(await membershipRolesOf(bobId, TENANT_A_ID)).toEqual(["Admin", "Editor"]);
+    expect(body.user.roles).toEqual(expect.arrayContaining(["Admin", "Editor"]));
+  });
+
+  test("roles changed after the invitation was issued → accept with login rejected, roles unchanged", async () => {
+    await seedTenantMembership(stack.db, {
+      userId: bobId,
+      tenantId: TENANT_A_ID,
+      roles: ["Editor"],
+    });
+    const token = await inviteEmail(BOB_EMAIL, "Admin");
+    await changeBobRolesInTenantA(["User"]);
+
+    const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token,
+      email: BOB_EMAIL,
+      password: BOB_PASSWORD,
+    });
+
+    await expectInvitationSuperseded(res);
+    expect(await membershipRolesOf(bobId, TENANT_A_ID)).toEqual(["User"]);
+  });
+
   test("Bob accepts with a locale → JWT retains the locale", async () => {
     await asRawClient(stack.db).unsafe(
       `UPDATE "${userTable.tableName}" SET locale = $1 WHERE id = $2`,
@@ -690,20 +833,9 @@ describe("invite-accept defense-in-depth (assertAssignableMembershipRoles)", ()
 });
 
 describe("invite-accept-with-login/signup-complete defense-in-depth (637/1)", () => {
-  // Branch 1 (invite-accept, logged-in) and Branch 3 (invite-signup-complete)
-  // both route every new membership through seedTenantMembership, which
-  // calls assertAssignableMembershipRoles unconditionally (tenant/seeding.ts)
-  // — a forbidden invitation role is rejected outright, 403, before it ever
-  // reaches stripForbiddenMembershipRoles. Branch 2 (invite-accept-with-login)
-  // is different: it skips seedTenantMembership entirely when the user is
-  // ALREADY a member of the invited tenant (idempotent-accept path) — for
-  // that one case, stripForbiddenMembershipRoles at the session mint is the
-  // ONLY protection. Removing that call would silently mint a
-  // SystemAdmin-carrying session with no other test catching it.
-  test("invite-accept-with-login: already-member path strips a forbidden invitation role (seedTenantMembership's guard is skipped here)", async () => {
-    // Bob already has a (legitimate) membership in TENANT_A_ID — the
-    // handler's alreadyMember check short-circuits before seedTenantMembership,
-    // so assertAssignableMembershipRoles never runs for this accept.
+  // The already-member path writes the invitation role too, so it needs the
+  // create path's reserved-role guard, not just the session-mint strip.
+  test("invite-accept-with-login: already-member path rejects a forbidden invitation role and leaves the membership untouched", async () => {
     await seedTenantMembership(stack.db, {
       userId: bobId,
       tenantId: TENANT_A_ID,
@@ -724,9 +856,8 @@ describe("invite-accept-with-login/signup-complete defense-in-depth (637/1)", ()
       email: BOB_EMAIL,
       password: BOB_PASSWORD,
     });
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as { user: { roles: string[] } };
-    expect(body.user.roles).toEqual([]);
+    expect(res.status).toBe(403);
+    expect(await membershipRolesOf(bobId, TENANT_A_ID)).toEqual(["User"]);
   });
 
   test("invite-signup-complete: a brand-new user always hits seedTenantMembership's guard — forbidden role rejected, not silently stripped", async () => {
@@ -764,6 +895,59 @@ describe("Single-Use-Burn (alle Branches)", () => {
   });
 });
 
+describe("remove-member cancels the removed member's open invitations", () => {
+  async function removeBobFromTenantA(): Promise<void> {
+    await stack.http.writeOk(
+      TenantHandlers.removeMember,
+      { userId: bobId, tenantId: TENANT_A_ID },
+      { id: "system-admin", tenantId: TENANT_A_ID, roles: ["SystemAdmin"] },
+    );
+  }
+
+  async function invitationStatusOf(email: string): Promise<unknown> {
+    const [row] = await selectMany(stack.db, tenantInvitationsTable, {
+      email,
+      tenantId: TENANT_A_ID,
+    });
+    return row?.["status"];
+  }
+
+  test("removed member cannot rejoin via an invitation issued before removal", async () => {
+    await seedTenantMembership(stack.db, {
+      userId: bobId,
+      tenantId: TENANT_A_ID,
+      roles: ["Editor"],
+    });
+    const token = await inviteEmail(BOB_EMAIL, "Admin");
+
+    await removeBobFromTenantA();
+
+    const res = await authedRaw("POST", "/api/auth/invite-accept", { token }, bobSession());
+    expect(res.status).toBe(422);
+    const body = (await res.json()) as { error?: { details?: { reason?: string } } };
+    expect(body.error?.details?.reason).toBe(AuthErrors.invalidInviteToken);
+    expect(await invitationStatusOf(BOB_EMAIL)).toBe(INVITATION_STATUS.cancelled);
+    const memberships = await selectMany(stack.db, tenantMembershipsTable, {
+      userId: bobId,
+      tenantId: TENANT_A_ID,
+    });
+    expect(memberships).toHaveLength(0);
+  });
+
+  test("invitations to other emails stay pending", async () => {
+    await seedTenantMembership(stack.db, {
+      userId: bobId,
+      tenantId: TENANT_A_ID,
+      roles: ["Editor"],
+    });
+    await inviteEmail(CAROL_EMAIL, "Editor");
+
+    await removeBobFromTenantA();
+
+    expect(await invitationStatusOf(CAROL_EMAIL)).toBe(INVITATION_STATUS.pending);
+  });
+});
+
 describe("cancel-invitation", () => {
   test("Admin cancellt → status=cancelled + token weg, accept wird invalid", async () => {
     const token = await inviteEmail(BOB_EMAIL, "Admin");

package/src/auth-email-password/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.328.1",
+    "type": "fix",
+    "title": "Accepting an invitation grants the invited role to existing members of the tenant",
+    "detail": "`invite-accept` and `invite-accept-with-login` used to skip the membership write when the user already belonged to the invited tenant, so a member without roles who accepted an invitation kept no roles and saw no accessible screen. The invited role is now added to the existing membership through the event-store executor. Existing roles are kept, because accepting an invitation never demotes. `invite-accept-with-login` builds the session from the resulting membership roles and rejects a reserved invitation role on this path with 403, the same as the other invite branches. An invitation issued before a later change to the membership is rejected with 409 and `TenantErrors.invitationSuperseded`; re-sending the invitation issues it anew. Removing a member cancels their open invitations in that tenant."
+  },
   {
     "version": "0.328.0",
     "type": "improvement",

package/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -31,6 +31,7 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import type { Temporal } from "temporal-polyfill";
 import * as z from "zod";
 import { decryptStoredPii, sessionLocaleField, sessionTimezoneField } from "../../shared";
 // kumiko-lint-ignore cross-feature-import invite-flow
@@ -39,13 +40,8 @@ import {
   tenantInvitationEntity,
   tenantInvitationsTable,
 } from "../../tenant/invitation-table";
-// kumiko-lint-ignore cross-feature-import reserved-role check owned by tenant-feature
-import {
-  findForbiddenMembershipRole,
-  reservedMembershipRoleError,
-} from "../../tenant/membership-roles";
-// kumiko-lint-ignore cross-feature-import membership-seed-helper for a privileged cross-tenant add
-import { seedTenantMembership } from "../../tenant/seeding";
+// kumiko-lint-ignore cross-feature-import membership grant for a privileged cross-tenant add
+import { grantInvitedMembershipRole, invitationIssuedAt } from "../../tenant/invited-membership";
 // kumiko-lint-ignore cross-feature-import login-style password-check
 import { userTable } from "../../user/schema/user";
 import {
@@ -147,6 +143,8 @@ export function createInviteAcceptWithLoginHandler(opts: InviteAcceptWithLoginOp
         readonly email: string;
         readonly role: string;
         readonly version: number;
+        readonly insertedAt: Temporal.Instant;
+        readonly modifiedAt: Temporal.Instant | null;
       };
       type UserAuthRow = {
         readonly id: string;
@@ -215,29 +213,17 @@ export function createInviteAcceptWithLoginHandler(opts: InviteAcceptWithLoginOp
 
         const userId = userRow.id;
 
-        // Already-member check (idempotent)
-        const memberships = (await ctx.queryAs(
-          createSystemUser(invitationTenantId),
-          "tenant:query:memberships",
-          { userId },
-        )) as Array<{ tenantId: string }>; // @cast-boundary db-row
-        const alreadyMember = memberships.some((m) => m.tenantId === invitationTenantId);
-
         const dbConn = ctx.db.unsafeRaw(
           "adds the membership and accepts the invitation in the invitation's tenant, which differs from the caller's tenant",
         );
 
-        if (!alreadyMember) {
-          const forbiddenInviteRole = findForbiddenMembershipRole([invitationRole]);
-          if (forbiddenInviteRole !== undefined) {
-            return writeFailure(reservedMembershipRoleError(forbiddenInviteRole));
-          }
-          await seedTenantMembership(dbConn, {
-            userId,
-            tenantId: invitationTenantId,
-            roles: [invitationRole],
-          });
-        }
+        const grant = await grantInvitedMembershipRole(dbConn, {
+          userId,
+          tenantId: invitationTenantId,
+          role: invitationRole,
+          invitationIssuedAt: invitationIssuedAt(invitation),
+        });
+        if (!grant.isSuccess) return grant;
 
         // Invitation → accepted: TenantDb for the invitation's tenant.
         const invitationTdb = createTenantDb(dbConn, invitationTenantId, "system");
@@ -255,8 +241,8 @@ export function createInviteAcceptWithLoginHandler(opts: InviteAcceptWithLoginOp
         await deleteInviteToken(ctx.redis, { invitationId, token: event.payload.token });
 
         // buildSessionRoles calls stripForbiddenMembershipRoles internally —
-        // a reserved role on the invitation itself must never reach the session.
-        const mergedRoles = buildSessionRoles([], [invitationRole]);
+        // a reserved role on an existing membership must never reach the session.
+        const mergedRoles = buildSessionRoles([], grant.data.roles);
 
         // MFA gate runs after membership is granted (mirrors login.write.ts's
         // own order: membership resolution before MFA) — a challenge halts

package/src/auth-email-password/handlers/invite-accept.write.ts

@@ -6,8 +6,8 @@
 //   2. Burn (single-use)
 //   3. Invitation-Row aus DB
 //   4. Email-Match: invitation.email === user.email (sonst inviteEmailMismatch)
-//   5. Already-Member-Check: User schon Member im invited Tenant → no-op success
-//   6. Membership-Add via system-dispatcher (TenantHandlers.addMember)
+//   5+6. grantInvitedMembershipRole: create the membership, or add the
+//      invited role to an existing one (add-only)
 //   7. Invitation-Row → status=accepted
 //   8. Redis-Keys löschen (Burn-Key bleibt für Replay-Schutz)
 //
@@ -23,6 +23,7 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import type { Temporal } from "temporal-polyfill";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared";
 // kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link), DB-row-owner ist tenant-feature
@@ -31,15 +32,8 @@ import {
   tenantInvitationEntity,
   tenantInvitationsTable,
 } from "../../tenant/invitation-table";
-// kumiko-lint-ignore cross-feature-import reserved-role check owned by tenant-feature
-import {
-  findForbiddenMembershipRole,
-  reservedMembershipRoleError,
-} from "../../tenant/membership-roles";
-// kumiko-lint-ignore cross-feature-import direkter membership-Lookup (ungefiltert, s. alreadyMember-Kommentar)
-import { tenantMembershipsTable } from "../../tenant/membership-table";
-// kumiko-lint-ignore cross-feature-import membership-seed-helper für privilegierten cross-tenant-add (analog provisionSignupAccount)
-import { seedTenantMembership } from "../../tenant/seeding";
+// kumiko-lint-ignore cross-feature-import membership grant for a privileged cross-tenant add (like provisionSignupAccount)
+import { grantInvitedMembershipRole, invitationIssuedAt } from "../../tenant/invited-membership";
 // kumiko-lint-ignore cross-feature-import auth handler reads user-row für email-match
 import { userTable } from "../../user/schema/user";
 import { invalidInviteToken, inviteEmailMismatch } from "../errors";
@@ -113,6 +107,8 @@ export function createInviteAcceptHandler() {
         readonly email: string;
         readonly role: string;
         readonly version: number;
+        readonly insertedAt: Temporal.Instant;
+        readonly modifiedAt: Temporal.Instant | null;
       };
       type UserEmailRow = { readonly email: string };
 
@@ -148,37 +144,17 @@ export function createInviteAcceptHandler() {
           return inviteEmailMismatch();
         }
 
-        // Already-Member-Check direkt gegen die memberships-Projektion —
-        // NICHT via tenant:query:memberships, die disabled Tenants filtert:
-        // ein Re-Invite in einen (vorübergehend) disabled Tenant würde dort
-        // alreadyMember=false sehen und am Unique-Constraint scheitern.
-        // Idempotenz: schon Member → no-op + 200 mit alreadyMember=true.
-        const invitationTenantRunner = ctx.db.unsafeRaw(ADD_MEMBERSHIP_INVITATION_TENANT_REASON);
-        const membershipRow = await fetchOne(invitationTenantRunner, tenantMembershipsTable, {
+        // Executor instead of dispatcher.writeAs(addMember): addMember only
+        // accepts SystemAdmin, createSystemUser carries "system".
+        const dbConn = ctx.db.unsafeRaw(ADD_MEMBERSHIP_INVITATION_TENANT_REASON);
+        const grant = await grantInvitedMembershipRole(dbConn, {
           userId: event.user.id,
           tenantId: invitationTenantId,
+          role: invitationRole,
+          invitationIssuedAt: invitationIssuedAt(invitation),
         });
-        const alreadyMember = membershipRow !== undefined;
-
-        const dbConn = invitationTenantRunner;
-
-        if (!alreadyMember) {
-          // Membership-Add via seedTenantMembership-helper (event-store-
-          // executor pattern, gleich wie provisionSignupAccount). Nicht
-          // dispatcher.writeAs(addMember) weil addMember-Handler nur
-          // ["SystemAdmin"]-Role akzeptiert; createSystemUser produziert
-          // "system"-Role die NICHT matcht. Direkt-via-Executor bypassed
-          // den Access-Check für privilegierte Cross-Tenant-Operationen.
-          const forbiddenInviteRole = findForbiddenMembershipRole([invitationRole]);
-          if (forbiddenInviteRole !== undefined) {
-            return writeFailure(reservedMembershipRoleError(forbiddenInviteRole));
-          }
-          await seedTenantMembership(dbConn, {
-            userId: event.user.id,
-            tenantId: invitationTenantId,
-            roles: [invitationRole],
-          });
-        }
+        if (!grant.isSuccess) return grant;
+        const { alreadyMember } = grant.data;
 
         // Invitation-Status → accepted via event-store-executor.
         // Tenant-scoping: ctx.db ist auf event.user.tenantId gescopt

package/src/tenant/constants.ts

@@ -68,4 +68,5 @@ export const TenantErrors = {
   membershipNotFound: "membership_not_found",
   membershipAlreadyExists: "membership_already_exists",
   lastTenantAdmin: "last_tenant_admin",
+  invitationSuperseded: "invitation_superseded",
 } as const;

package/src/tenant/handlers/remove-member.write.ts

@@ -1,13 +1,33 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, type DbRow } from "@cosmicdrift/kumiko-framework/db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  createEventStoreExecutor,
+  type DbRow,
+  type TenantDb,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   defineWriteHandler,
+  type SessionUser,
   withResponseData,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError, NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  InternalError,
+  NotFoundError,
+  type WriteFailure,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
+import type { Redis } from "ioredis";
 import * as z from "zod";
+// kumiko-lint-ignore cross-feature-import cancel needs invite-token-store for Redis cleanup
+import { invalidateExistingInviteToken } from "../../auth-email-password/invite-token-store";
+import { decryptStoredPii } from "../../shared";
+import { userTable } from "../../user";
+import {
+  INVITATION_STATUS,
+  tenantInvitationEntity,
+  tenantInvitationsTable,
+} from "../invitation-table";
 import { assertNotLastTenantAdmin } from "../last-tenant-admin";
 import { tenantMembershipEntity, tenantMembershipsTable } from "../membership-table";
 
@@ -15,6 +35,48 @@ const executor = createEventStoreExecutor(tenantMembershipsTable, tenantMembersh
   entityName: "tenant-membership",
 });
 
+const invitationExecutor = createEventStoreExecutor(
+  tenantInvitationsTable,
+  tenantInvitationEntity,
+  { entityName: "tenant-invitation" },
+);
+
+type PendingInvitationCancel = {
+  readonly userId: string;
+  readonly tenantId: string;
+  readonly actor: SessionUser;
+  readonly redis: Redis | undefined;
+};
+
+async function cancelPendingInvitationsOfUser(
+  db: TenantDb,
+  options: PendingInvitationCancel,
+): Promise<WriteFailure | undefined> {
+  const user = await fetchOne<{ email: string | null }>(db, userTable, { id: options.userId });
+  if (!user?.email) return undefined;
+  const email = (await decryptStoredPii(user.email, "email", "tenant:remove-member")).toLowerCase();
+
+  const pendingInvitations = await selectMany<{ id: string; version: number }>(
+    db,
+    tenantInvitationsTable,
+    { tenantId: options.tenantId, email, status: INVITATION_STATUS.pending },
+  );
+  for (const invitation of pendingInvitations) {
+    const updateResult = await invitationExecutor.update(
+      {
+        id: invitation.id,
+        version: invitation.version,
+        changes: { status: INVITATION_STATUS.cancelled },
+      },
+      options.actor,
+      db,
+    );
+    if (!updateResult.isSuccess) return updateResult;
+    if (options.redis) await invalidateExistingInviteToken(options.redis, invitation.id);
+  }
+  return undefined;
+}
+
 // Literal QN, not an import off the sessions feature — tenant is
 // foundational and must boot without sessions mounted (no r.requires/
 // r.usesApi here, unlike user-data-rights:restrict-account's hard dep).
@@ -78,6 +140,16 @@ export const removeMemberWrite = defineWriteHandler({
       event.user,
       db,
     );
+    if (!result.isSuccess) return result;
+
+    // Actor tenant = invitation tenant so the update hits the invitation's stream.
+    const cancelFailure = await cancelPendingInvitationsOfUser(db, {
+      userId: event.payload.userId,
+      tenantId: event.payload.tenantId,
+      actor: { ...event.user, tenantId: event.payload.tenantId },
+      redis: ctx.redis,
+    });
+    if (cancelFailure !== undefined) return cancelFailure;
 
     return withResponseData(result, event.payload);
   },

package/src/tenant/invited-membership.ts

@@ -0,0 +1,97 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  createEventStoreExecutor,
+  createTenantDb,
+  type DbRunner,
+} from "@cosmicdrift/kumiko-framework/db";
+import { createSystemUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { ConflictError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
+import { Temporal } from "temporal-polyfill";
+import { TenantErrors } from "./constants";
+import { findForbiddenMembershipRole, reservedMembershipRoleError } from "./membership-roles";
+import { tenantMembershipEntity, tenantMembershipsTable } from "./membership-table";
+import { seedTenantMembership } from "./seeding";
+
+const membershipExecutor = createEventStoreExecutor(
+  tenantMembershipsTable,
+  tenantMembershipEntity,
+  { entityName: "tenant-membership" },
+);
+
+export type InvitedMembershipOptions = {
+  readonly userId: string;
+  readonly tenantId: TenantId;
+  readonly role: string;
+  readonly invitationIssuedAt: Temporal.Instant;
+};
+
+type MembershipRow = {
+  readonly id: string;
+  readonly version: number;
+  readonly roles: string;
+  readonly insertedAt: Temporal.Instant;
+  readonly modifiedAt: Temporal.Instant | null;
+};
+
+// Add-only, so unlike updateMemberRoles no session revoke or last-TenantAdmin check.
+// Read unfiltered: tenant:query:memberships hides disabled tenants.
+export async function grantInvitedMembershipRole(db: DbRunner, options: InvitedMembershipOptions) {
+  const forbiddenRole = findForbiddenMembershipRole([options.role]);
+  if (forbiddenRole !== undefined) return writeFailure(reservedMembershipRoleError(forbiddenRole));
+
+  const existing = await fetchOne<MembershipRow>(db, tenantMembershipsTable, {
+    userId: options.userId,
+    tenantId: options.tenantId,
+  });
+  if (!existing) {
+    await seedTenantMembership(db, {
+      userId: options.userId,
+      tenantId: options.tenantId,
+      roles: [options.role],
+    });
+    return grantedMembership(false, [options.role]);
+  }
+
+  // A membership decision made after the invitation was issued wins over it.
+  if (isMembershipChangedAfter(existing, options.invitationIssuedAt)) {
+    return writeFailure(invitationSupersededError());
+  }
+
+  const currentRoles = parseRoles(existing.roles);
+  if (currentRoles.includes(options.role)) return grantedMembership(true, currentRoles);
+
+  const roles = [...currentRoles, options.role];
+  const updateResult = await membershipExecutor.update(
+    { id: existing.id, version: existing.version, changes: { roles: JSON.stringify(roles) } },
+    createSystemUser(options.tenantId),
+    createTenantDb(db, options.tenantId, "system"),
+  );
+  if (!updateResult.isSuccess) return updateResult;
+  return grantedMembership(true, roles);
+}
+
+// Resend reuses the invitation row, so its last modification is the latest issuance.
+export function invitationIssuedAt(invitation: {
+  readonly insertedAt: Temporal.Instant;
+  readonly modifiedAt: Temporal.Instant | null;
+}): Temporal.Instant {
+  return invitation.modifiedAt ?? invitation.insertedAt;
+}
+
+function isMembershipChangedAfter(membership: MembershipRow, instant: Temporal.Instant): boolean {
+  const lastChangedAt = membership.modifiedAt ?? membership.insertedAt;
+  return Temporal.Instant.compare(lastChangedAt, instant) > 0;
+}
+
+function invitationSupersededError(): ConflictError {
+  return new ConflictError({
+    message: "the membership changed after this invitation was issued",
+    i18nKey: "tenant.errors.invitationSuperseded",
+    details: { reason: TenantErrors.invitationSuperseded },
+  });
+}
+
+function grantedMembership(alreadyMember: boolean, roles: readonly string[]) {
+  return { isSuccess: true, data: { alreadyMember, roles } } as const;
+}