From 41991f387989d6d4a660a418824ffa3ebb8ea0bb Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Wed, 27 May 2026 18:51:59 +0000
Subject: [PATCH] Expire invitations when archiving user

Ensure ArchiveUser deactivates pending invitations for the archived\nprofile so invited accounts cannot still activate after archive.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
---
 pkg/iam/organization_service.go | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pkg/iam/organization_service.go b/pkg/iam/organization_service.go
index 21ea51409..c134f3399 100644
--- a/pkg/iam/organization_service.go
+++ b/pkg/iam/organization_service.go
@@ -407,6 +407,18 @@ func (s *OrganizationService) ArchiveUser(
 				}
 			}
 
+			invitations := &coredata.Invitations{}
+			onlyPending := coredata.NewInvitationFilter([]coredata.InvitationStatus{coredata.InvitationStatusPending})
+			if err := invitations.ExpireByUserID(
+				ctx,
+				tx,
+				scope,
+				profile.ID,
+				onlyPending,
+			); err != nil {
+				return fmt.Errorf("cannot expire pending invitations: %w", err)
+			}
+
 			now := time.Now()
 
 			if profile.State != coredata.ProfileStateInactive {