Invalidate old invitations when organization membership changes

Signed-off-by: Cole Speelman <crspeelman@gmail.com>
2026-09-05 00:12:40 -04:00
parent c0986168bc
commit f142ac23a9
4 changed files with 73 additions and 3 deletions
@@ -14,7 +14,10 @@ authenticated user's normalized email matches and applies the membership,
 roles, teams, consumption marker, and audit event in one transaction. The
 recipient and issuing member must remain active, fully registered users of an
 active organization; a suspended recipient cannot use an invitation as implicit
-reactivation. Duplicate or concurrent acceptance consumes the token only once.
+reactivation. Existing members use the membership editor, not another invitation,
+to change roles or teams. Duplicate or concurrent acceptance consumes the token
+only once. Removal revokes older pending invitations for that recipient in the
+same transaction; a new, intentional invitation is needed to rejoin later.
 When `OwnerRole` is configured, invitations granting that role require a current
 direct owner at creation and acceptance, and an owner for revocation. Set
 `OwnerManagedInvitations: true` to apply that rule to every invitation, including