From 4a276e3ef785930c520ea3ce8386577f5aafc5d3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= <emile@probo.com>
Date: Tue, 28 Jul 2026 17:03:52 +0200
Subject: [PATCH] Split inactive profile state
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace the binary profile ACTIVE/INACTIVE model with PENDING, ACTIVE,
and DEACTIVATED so invited-but-not-yet-activated members remain
assignable to assets, data, and risks instead of being treated like
deactivated users.

Add activated_at/deactivated_at timestamps and Mark* lifecycle helpers,
and update every transition (create, invite/re-invite, activation,
archive, SCIM, SAML, sessions, compliance-portal grant) to the new
states. Expose a multi-state states[] filter across coredata, GraphQL,
MCP, and the console owner pickers, which now request ACTIVE and
PENDING members.

A migration renames the membership_state enum, classifies existing
inactive profiles as PENDING from recent invitation activity, and
backfills the new timestamp columns.

Signed-off-by: Émile Ré <emile@probo.com>
---
 apps/console/src/_locales/en-US.json          |  2 +-
 apps/console/src/_locales/fr-FR.json          |  3 +-
 apps/console/src/hooks/graph/PeopleGraph.ts   |  8 ++-
 .../iam/organizations/people/PersonPage.tsx   |  2 +-
 .../people/_components/PeopleList.tsx         |  3 +-
 .../people/_components/PeopleListItem.tsx     |  9 +--
 e2e/console/user_test.go                      |  2 +-
 .../document/getAllSignatures.operation.ts    |  3 +-
 .../Probo/actions/user/listUsers.operation.ts |  3 +-
 pkg/cmd/user/list/list.go                     |  4 +-
 .../visitor/portal_access_service.go          |  3 +-
 pkg/complianceportal/visitor/service.go       |  1 +
 pkg/coredata/membership_profile.go            | 52 ++++++++++++++++++
 pkg/coredata/membership_profile_filter.go     | 19 ++++---
 pkg/coredata/migrations/20260728T143246Z.sql  | 55 +++++++++++++++++++
 pkg/coredata/profile_state.go                 | 39 +++++++++++--
 pkg/iam/auth_service.go                       |  5 +-
 pkg/iam/organization_service.go               | 32 ++++++++---
 pkg/iam/saml/service.go                       |  3 +-
 pkg/iam/scim/service.go                       | 27 +++++----
 pkg/iam/session_service.go                    |  8 +--
 .../api/connect/v1/graphql/profile.graphql    |  6 +-
 .../api/connect/v1/identity_resolvers.go      |  4 ++
 .../api/connect/v1/organization_resolvers.go  |  4 ++
 .../api/connect/v1/profile_resolvers.go       |  2 +-
 .../console/v1/graphql/organization.graphql   |  6 +-
 .../api/console/v1/organization_resolvers.go  |  4 ++
 pkg/server/api/mcp/v1/schema.resolvers.go     |  4 ++
 pkg/server/api/mcp/v1/specification.yaml      | 12 +++-
 29 files changed, 261 insertions(+), 64 deletions(-)
 create mode 100644 pkg/coredata/migrations/20260728T143246Z.sql

diff --git a/apps/console/src/_locales/en-US.json b/apps/console/src/_locales/en-US.json
index 0a18b3034..9d8bd3ccb 100644
--- a/apps/console/src/_locales/en-US.json
+++ b/apps/console/src/_locales/en-US.json
@@ -1371,7 +1371,7 @@
     "columns": { "name": "Name", "status": "Status", "email": "Email", "role": "Role", "createdOn": "Created on" },
     "empty": "No people",
     "searchPlaceholder": "Search people...",
-    "filters": { "allStatuses": "All statuses", "active": "Active", "inactive": "Inactive", "allRoles": "All roles", "allTypes": "All types" }
+    "filters": { "allStatuses": "All statuses", "pending": "Pending", "active": "Active", "deactivated": "Deactivated", "allRoles": "All roles", "allTypes": "All types" }
   },
   "peopleListItem": {
     "messages": { "invitationSent": "Invitation sent successfully", "roleUpdated": "Role updated successfully", "archived": "Person archived successfully", "removed": "Person removed successfully" },
diff --git a/apps/console/src/_locales/fr-FR.json b/apps/console/src/_locales/fr-FR.json
index 8b7e1f109..750f70b5b 100644
--- a/apps/console/src/_locales/fr-FR.json
+++ b/apps/console/src/_locales/fr-FR.json
@@ -2458,8 +2458,9 @@
     "searchPlaceholder": "Rechercher des personnes...",
     "filters": {
       "allStatuses": "Tous les statuts",
+      "pending": "En attente",
       "active": "Actif",
-      "inactive": "Inactif",
+      "deactivated": "Désactivé",
       "allRoles": "Tous les rôles",
       "allTypes": "Tous les types"
     }
diff --git a/apps/console/src/hooks/graph/PeopleGraph.ts b/apps/console/src/hooks/graph/PeopleGraph.ts
index c9e1d36fe..884855bce 100644
--- a/apps/console/src/hooks/graph/PeopleGraph.ts
+++ b/apps/console/src/hooks/graph/PeopleGraph.ts
@@ -24,7 +24,7 @@ import {
 } from "react-relay";
 import { graphql } from "relay-runtime";
 
-import type { PeopleGraphQuery } from "#/__generated__/core/PeopleGraphQuery.graphql";
+import type { PeopleGraphQuery, ProfileFilter } from "#/__generated__/core/PeopleGraphQuery.graphql";
 
 /* eslint-disable relay/unused-fields */
 
@@ -57,11 +57,15 @@ export function usePeople(
   organizationId: string,
   { contractEnded }: { contractEnded?: boolean } = {},
 ) {
+  const filter: ProfileFilter = contractEnded !== undefined
+    ? { contractEnded, states: ["ACTIVE", "PENDING"] }
+    : { states: ["ACTIVE", "PENDING"] };
+
   const data = useLazyLoadQuery<PeopleGraphQuery>(
     peopleQuery,
     {
       organizationId: organizationId,
-      filter: contractEnded !== undefined ? { contractEnded } : null,
+      filter,
     },
     { fetchPolicy: "network-only" },
   );
diff --git a/apps/console/src/pages/iam/organizations/people/PersonPage.tsx b/apps/console/src/pages/iam/organizations/people/PersonPage.tsx
index be12c7f4e..2329cdb6a 100644
--- a/apps/console/src/pages/iam/organizations/people/PersonPage.tsx
+++ b/apps/console/src/pages/iam/organizations/people/PersonPage.tsx
@@ -139,7 +139,7 @@ export function PersonPage(props: { queryRef: PreloadedQuery<PersonPageQuery> })
     );
   };
 
-  const canArchive = person.canDelete && person.source !== "SCIM" && person.state !== "INACTIVE";
+  const canArchive = person.canDelete && person.source !== "SCIM" && person.state !== "DEACTIVATED";
   const canRemove = person.canRemoveMember && person.source !== "SCIM";
 
   return (
diff --git a/apps/console/src/pages/iam/organizations/people/_components/PeopleList.tsx b/apps/console/src/pages/iam/organizations/people/_components/PeopleList.tsx
index 3b5a700b2..af0a9a189 100644
--- a/apps/console/src/pages/iam/organizations/people/_components/PeopleList.tsx
+++ b/apps/console/src/pages/iam/organizations/people/_components/PeopleList.tsx
@@ -231,8 +231,9 @@ export function PeopleList(props: {
           onValueChange={handleStateFilterChange}
         >
           <Option value="ALL">{t("peopleList.filters.allStatuses")}</Option>
+          <Option value="PENDING">{t("peopleList.filters.pending")}</Option>
           <Option value="ACTIVE">{t("peopleList.filters.active")}</Option>
-          <Option value="INACTIVE">{t("peopleList.filters.inactive")}</Option>
+          <Option value="DEACTIVATED">{t("peopleList.filters.deactivated")}</Option>
         </Select>
         <Select
           value={roleFilter ?? "ALL"}
diff --git a/apps/console/src/pages/iam/organizations/people/_components/PeopleListItem.tsx b/apps/console/src/pages/iam/organizations/people/_components/PeopleListItem.tsx
index 1ce478908..399b80afd 100644
--- a/apps/console/src/pages/iam/organizations/people/_components/PeopleListItem.tsx
+++ b/apps/console/src/pages/iam/organizations/people/_components/PeopleListItem.tsx
@@ -145,10 +145,11 @@ export function PeopleListItem(props: {
     ? availableRoles
     : [...availableRoles, profile.membership.role];
 
-  const isInactive = profile.state === "INACTIVE";
+  const isActive = profile.state === "ACTIVE";
+  const isInactive = !isActive;
 
-  const canSendActivationMail = isInactive && profile.source !== "SCIM" && profile.canInvite;
-  const canArchive = profile.canDelete && profile.source !== "SCIM" && profile.state !== "INACTIVE";
+  const canSendActivationMail = !isActive && profile.source !== "SCIM" && profile.canInvite;
+  const canArchive = profile.canDelete && profile.source !== "SCIM" && profile.state !== "DEACTIVATED";
   const canRemove = profile.canRemoveMember && profile.source !== "SCIM";
 
   const [inviteUser]
@@ -262,7 +263,7 @@ export function PeopleListItem(props: {
         <span className="font-semibold">{profile.fullName}</span>
       </Td>
       <Td>
-        <Badge variant={profile.state === "INACTIVE" ? "neutral" : "success"}>{profile.state}</Badge>
+        <Badge variant={isActive ? "success" : "neutral"}>{profile.state}</Badge>
       </Td>
       <Td className={clsx(
         isMutating && "opacity-60 pointer-events-none",
diff --git a/e2e/console/user_test.go b/e2e/console/user_test.go
index e03e18fd9..b583aed27 100644
--- a/e2e/console/user_test.go
+++ b/e2e/console/user_test.go
@@ -704,7 +704,7 @@ func TestUser_ArchiveUser(t *testing.T) {
 	}
 
 	require.NotEmpty(t, archivedUserState, "Should still find archived user")
-	assert.Equal(t, "INACTIVE", archivedUserState)
+	assert.Equal(t, "DEACTIVATED", archivedUserState)
 }
 
 func TestUser_DeactivateUserCancelsSignatureRequests(t *testing.T) {
diff --git a/packages/n8n-node/nodes/Probo/actions/document/getAllSignatures.operation.ts b/packages/n8n-node/nodes/Probo/actions/document/getAllSignatures.operation.ts
index 0444086bd..332ed1206 100644
--- a/packages/n8n-node/nodes/Probo/actions/document/getAllSignatures.operation.ts
+++ b/packages/n8n-node/nodes/Probo/actions/document/getAllSignatures.operation.ts
@@ -105,8 +105,9 @@ export const description: INodeProperties[] = [
 				description: 'Filter by signatory profile state',
 				options: [
 					{ name: 'Any', value: '' },
+					{ name: 'Pending', value: 'PENDING' },
 					{ name: 'Active', value: 'ACTIVE' },
-					{ name: 'Inactive', value: 'INACTIVE' },
+					{ name: 'Deactivated', value: 'DEACTIVATED' },
 				],
 			},
 		],
diff --git a/packages/n8n-node/nodes/Probo/actions/user/listUsers.operation.ts b/packages/n8n-node/nodes/Probo/actions/user/listUsers.operation.ts
index a5865df8f..c80a74a42 100644
--- a/packages/n8n-node/nodes/Probo/actions/user/listUsers.operation.ts
+++ b/packages/n8n-node/nodes/Probo/actions/user/listUsers.operation.ts
@@ -97,7 +97,8 @@ export const description: INodeProperties[] = [
 		options: [
 			{ name: 'Active', value: 'ACTIVE' },
 			{ name: 'All', value: '' },
-			{ name: 'Inactive', value: 'INACTIVE' },
+			{ name: 'Deactivated', value: 'DEACTIVATED' },
+			{ name: 'Pending', value: 'PENDING' },
 		],
 		default: '',
 		description: 'Filter by profile state',
diff --git a/pkg/cmd/user/list/list.go b/pkg/cmd/user/list/list.go
index 1115b6ccb..2ef5159b0 100644
--- a/pkg/cmd/user/list/list.go
+++ b/pkg/cmd/user/list/list.go
@@ -158,7 +158,7 @@ func NewCmdList(f *cmdutil.Factory) *cobra.Command {
 			}
 
 			if flagState != "" {
-				if err := cmdutil.ValidateEnum("state", flagState, []string{"ACTIVE", "INACTIVE"}); err != nil {
+				if err := cmdutil.ValidateEnum("state", flagState, []string{"PENDING", "ACTIVE", "DEACTIVATED"}); err != nil {
 					return err
 				}
 
@@ -273,7 +273,7 @@ func NewCmdList(f *cmdutil.Factory) *cobra.Command {
 	cmd.Flags().StringVar(&flagOrder, "order-by", "", "Order by field (FULL_NAME, CREATED_AT, KIND)")
 	cmd.Flags().StringVar(&flagOrderDir, "order-direction", "DESC", "Sort direction (ASC, DESC)")
 	cmd.Flags().StringVar(&flagContractEnded, "contract-ended", "", "Filter by contract status (true or false)")
-	cmd.Flags().StringVar(&flagState, "state", "", "Filter by profile state (ACTIVE or INACTIVE)")
+	cmd.Flags().StringVar(&flagState, "state", "", "Filter by profile state (PENDING, ACTIVE, DEACTIVATED)")
 	cmd.Flags().StringVarP(&flagFilter, "filter", "q", "", "Filter users by name or email search query")
 	cmd.Flags().StringVar(&flagRole, "role", "", "Filter by membership role (OWNER, ADMIN, VIEWER, AUDITOR, EMPLOYEE)")
 	cmd.Flags().StringVar(&flagKind, "kind", "", "Filter by profile kind (EMPLOYEE, CONTRACTOR, SERVICE_ACCOUNT)")
diff --git a/pkg/complianceportal/visitor/portal_access_service.go b/pkg/complianceportal/visitor/portal_access_service.go
index 4f5b705e3..00f6784a9 100644
--- a/pkg/complianceportal/visitor/portal_access_service.go
+++ b/pkg/complianceportal/visitor/portal_access_service.go
@@ -396,9 +396,8 @@ func (s *Service) GrantPortalAccessByIDs(
 			}
 
 			if shouldSendEmail {
-				profile.State = coredata.ProfileStateActive
+				profile.MarkActive(now)
 
-				profile.UpdatedAt = now
 				if err := profile.Update(ctx, tx, scope); err != nil {
 					return fmt.Errorf("cannot update profile: %w", err)
 				}
diff --git a/pkg/complianceportal/visitor/service.go b/pkg/complianceportal/visitor/service.go
index 803fa4632..17cc6c430 100644
--- a/pkg/complianceportal/visitor/service.go
+++ b/pkg/complianceportal/visitor/service.go
@@ -394,6 +394,7 @@ func (s *Service) ProvisionPortalMember(
 					EmailAddress:   identity.EmailAddress,
 					Source:         coredata.ProfileSourceManual,
 					State:          coredata.ProfileStateActive,
+					ActivatedAt:    &now,
 					FullName:       identity.FullName,
 					CreatedAt:      now,
 					UpdatedAt:      now,
diff --git a/pkg/coredata/membership_profile.go b/pkg/coredata/membership_profile.go
index d974b79ed..70366c3e1 100644
--- a/pkg/coredata/membership_profile.go
+++ b/pkg/coredata/membership_profile.go
@@ -70,6 +70,8 @@ type (
 		EnterpriseOrganization   *string       `db:"enterprise_organization"`
 		Division                 *string       `db:"division"`
 		ManagerValue             *string       `db:"manager_value"`
+		ActivatedAt              *time.Time    `db:"activated_at"`
+		DeactivatedAt            *time.Time    `db:"deactivated_at"`
 		CreatedAt                time.Time     `db:"created_at"`
 		UpdatedAt                time.Time     `db:"updated_at"`
 	}
@@ -96,6 +98,26 @@ func (p MembershipProfile) CursorKey(orderBy MembershipProfileOrderField) page.C
 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }
 
+func (p *MembershipProfile) MarkPending(now time.Time) {
+	p.State = ProfileStatePending
+	p.ActivatedAt = nil
+	p.DeactivatedAt = nil
+	p.UpdatedAt = now
+}
+
+func (p *MembershipProfile) MarkActive(now time.Time) {
+	p.State = ProfileStateActive
+	p.ActivatedAt = &now
+	p.DeactivatedAt = nil
+	p.UpdatedAt = now
+}
+
+func (p *MembershipProfile) MarkDeactivated(now time.Time) {
+	p.State = ProfileStateDeactivated
+	p.DeactivatedAt = &now
+	p.UpdatedAt = now
+}
+
 func (p *MembershipProfile) AuthorizationAttributes(
 	ctx context.Context,
 	conn pg.Querier,
@@ -192,6 +214,8 @@ SELECT
     p.enterprise_organization,
     p.division,
     p.manager_value,
+    p.activated_at,
+    p.deactivated_at,
     p.created_at,
     p.updated_at
 FROM
@@ -269,6 +293,8 @@ SELECT
     p.enterprise_organization,
     p.division,
     p.manager_value,
+    p.activated_at,
+    p.deactivated_at,
     p.created_at,
     p.updated_at
 FROM
@@ -350,6 +376,8 @@ SELECT
     p.enterprise_organization,
     p.division,
     p.manager_value,
+    p.activated_at,
+    p.deactivated_at,
     p.created_at,
     p.updated_at
 FROM
@@ -430,6 +458,8 @@ SELECT
     p.enterprise_organization,
     p.division,
     p.manager_value,
+    p.activated_at,
+    p.deactivated_at,
     p.created_at,
     p.updated_at
 FROM
@@ -507,6 +537,8 @@ WITH profiles AS (
         p.enterprise_organization,
         p.division,
         p.manager_value,
+        p.activated_at,
+        p.deactivated_at,
         p.created_at,
         p.updated_at
     FROM
@@ -550,6 +582,8 @@ SELECT
     enterprise_organization,
     division,
     manager_value,
+    activated_at,
+    deactivated_at,
     created_at,
     updated_at
 FROM profiles
@@ -620,6 +654,8 @@ WITH profiles AS (
         p.enterprise_organization,
         p.division,
         p.manager_value,
+        p.activated_at,
+        p.deactivated_at,
         p.created_at,
         p.updated_at
     FROM
@@ -662,6 +698,8 @@ SELECT
     p.enterprise_organization,
     p.division,
     p.manager_value,
+    p.activated_at,
+    p.deactivated_at,
     p.created_at,
     p.updated_at
 FROM profiles p
@@ -743,6 +781,8 @@ profiles AS (
         mp.enterprise_organization,
         mp.division,
         mp.manager_value,
+        mp.activated_at,
+        mp.deactivated_at,
         mp.created_at,
         mp.updated_at
     FROM
@@ -785,6 +825,8 @@ SELECT
     p.enterprise_organization,
     p.division,
     p.manager_value,
+    p.activated_at,
+    p.deactivated_at,
     p.created_at,
     p.updated_at
 FROM profiles p
@@ -1000,6 +1042,8 @@ INSERT INTO
         enterprise_organization,
         division,
         manager_value,
+        activated_at,
+        deactivated_at,
         created_at,
         updated_at
     )
@@ -1035,6 +1079,8 @@ VALUES (
     @enterprise_organization,
     @division,
     @manager_value,
+    @activated_at,
+    @deactivated_at,
     @created_at,
     @updated_at
 )
@@ -1072,6 +1118,8 @@ VALUES (
 		"enterprise_organization":    p.EnterpriseOrganization,
 		"division":                   p.Division,
 		"manager_value":              p.ManagerValue,
+		"activated_at":               p.ActivatedAt,
+		"deactivated_at":             p.DeactivatedAt,
 		"created_at":                 p.CreatedAt,
 		"updated_at":                 p.UpdatedAt,
 	}
@@ -1130,6 +1178,8 @@ SET
     enterprise_organization = @enterprise_organization,
     division = @division,
     manager_value = @manager_value,
+    activated_at = @activated_at,
+    deactivated_at = @deactivated_at,
     updated_at = @updated_at
 WHERE
     id = @id
@@ -1168,6 +1218,8 @@ WHERE
 		"enterprise_organization":    p.EnterpriseOrganization,
 		"division":                   p.Division,
 		"manager_value":              p.ManagerValue,
+		"activated_at":               p.ActivatedAt,
+		"deactivated_at":             p.DeactivatedAt,
 		"updated_at":                 p.UpdatedAt,
 	}
 	maps.Copy(args, scope.SQLArguments())
diff --git a/pkg/coredata/membership_profile_filter.go b/pkg/coredata/membership_profile_filter.go
index 8d2d28f79..2830e3f3a 100644
--- a/pkg/coredata/membership_profile_filter.go
+++ b/pkg/coredata/membership_profile_filter.go
@@ -37,7 +37,7 @@ type (
 		email                      *mail.Addr
 		userName                   *string
 		externalID                 *string
-		state                      *ProfileState
+		states                     ProfileStateValues
 		source                     *ProfileSource
 		query                      *string
 		role                       *MembershipRole
@@ -82,12 +82,17 @@ func (f *MembershipProfileFilter) WithExternalID(externalID string) *MembershipP
 }
 
 func (f *MembershipProfileFilter) WithState(state ProfileState) *MembershipProfileFilter {
-	f.state = &state
+	f.states = ProfileStateValues{state}
 	return f
 }
 
-func (f *MembershipProfileFilter) State() *ProfileState {
-	return f.state
+func (f *MembershipProfileFilter) WithStates(states ...ProfileState) *MembershipProfileFilter {
+	f.states = ProfileStateValues(states)
+	return f
+}
+
+func (f *MembershipProfileFilter) States() []ProfileState {
+	return f.states
 }
 
 func (f *MembershipProfileFilter) WithSource(source ProfileSource) *MembershipProfileFilter {
@@ -146,7 +151,7 @@ func (f *MembershipProfileFilter) SQLArguments() pgx.StrictNamedArgs {
 		"with_trust_center_access": f.withCompliancePortalAccess,
 		"contract_ended":           f.contractEnded,
 		"current_date":             f.currentDate,
-		"filter_state":             f.state,
+		"filter_states":            f.states,
 		"filter_source":            f.source,
 		"filter_query":             filterQuery,
 		"filter_role":              f.role,
@@ -192,8 +197,8 @@ AND (
 )
 AND (
 	CASE
-		WHEN @filter_state::text IS NOT NULL THEN
-			p.state = @filter_state::membership_state
+		WHEN @filter_states::membership_state[] IS NOT NULL THEN
+			p.state = ANY(@filter_states::membership_state[])
 		ELSE TRUE
 	END
 )
diff --git a/pkg/coredata/migrations/20260728T143246Z.sql b/pkg/coredata/migrations/20260728T143246Z.sql
new file mode 100644
index 000000000..feb276948
--- /dev/null
+++ b/pkg/coredata/migrations/20260728T143246Z.sql
@@ -0,0 +1,55 @@
+-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+ALTER TABLE iam_membership_profiles
+    ADD COLUMN activated_at TIMESTAMP WITH TIME ZONE,
+    ADD COLUMN deactivated_at TIMESTAMP WITH TIME ZONE;
+
+ALTER TABLE iam_membership_profiles
+    ALTER COLUMN state DROP DEFAULT;
+
+ALTER TYPE membership_state RENAME TO membership_state_old;
+CREATE TYPE membership_state AS ENUM ('PENDING', 'ACTIVE', 'DEACTIVATED');
+
+ALTER TABLE iam_membership_profiles
+    ALTER COLUMN state TYPE membership_state
+    USING CASE
+        WHEN state::text = 'ACTIVE' THEN 'ACTIVE'::membership_state
+        ELSE 'DEACTIVATED'::membership_state
+    END;
+
+DROP TYPE membership_state_old;
+
+UPDATE iam_membership_profiles
+SET state = 'PENDING'
+WHERE state = 'DEACTIVATED'
+  AND source != 'SCIM'
+  AND EXISTS (
+      SELECT 1
+      FROM iam_invitations i
+      WHERE i.user_id = iam_membership_profiles.id
+        AND i.accepted_at IS NULL
+        AND (
+            i.expires_at >= NOW()
+            OR i.created_at >= NOW() - INTERVAL '7 days'
+        )
+  );
+
+UPDATE iam_membership_profiles
+SET activated_at = updated_at
+WHERE state = 'ACTIVE';
+
+UPDATE iam_membership_profiles
+SET deactivated_at = NOW()
+WHERE state = 'DEACTIVATED';
diff --git a/pkg/coredata/profile_state.go b/pkg/coredata/profile_state.go
index 6a3e579d1..05d00fb2b 100644
--- a/pkg/coredata/profile_state.go
+++ b/pkg/coredata/profile_state.go
@@ -21,15 +21,21 @@
 package coredata
 
 import (
+	"database/sql/driver"
 	"encoding"
 	"fmt"
+	"strings"
 )
 
-type ProfileState string
+type (
+	ProfileState       string
+	ProfileStateValues []ProfileState
+)
 
 const (
-	ProfileStateActive   ProfileState = "ACTIVE"
-	ProfileStateInactive ProfileState = "INACTIVE"
+	ProfileStatePending     ProfileState = "PENDING"
+	ProfileStateActive      ProfileState = "ACTIVE"
+	ProfileStateDeactivated ProfileState = "DEACTIVATED"
 )
 
 var (
@@ -40,16 +46,18 @@ var (
 
 func ProfileStates() []ProfileState {
 	return []ProfileState{
+		ProfileStatePending,
 		ProfileStateActive,
-		ProfileStateInactive,
+		ProfileStateDeactivated,
 	}
 }
 
 func (v ProfileState) IsValid() bool {
 	switch v {
 	case
+		ProfileStatePending,
 		ProfileStateActive,
-		ProfileStateInactive:
+		ProfileStateDeactivated:
 		return true
 	}
 
@@ -74,3 +82,24 @@ func (v *ProfileState) UnmarshalText(text []byte) error {
 
 	return nil
 }
+
+func (states ProfileStateValues) Value() (driver.Value, error) {
+	if len(states) == 0 {
+		return nil, nil
+	}
+
+	var result strings.Builder
+	result.WriteString("{")
+
+	for i, state := range states {
+		if i > 0 {
+			result.WriteString(",")
+		}
+
+		fmt.Fprintf(&result, "%q", state.String())
+	}
+
+	result.WriteString("}")
+
+	return result.String(), nil
+}
diff --git a/pkg/iam/auth_service.go b/pkg/iam/auth_service.go
index 09a3615d2..437de5b7f 100644
--- a/pkg/iam/auth_service.go
+++ b/pkg/iam/auth_service.go
@@ -179,9 +179,8 @@ func (s *AuthService) ActivateAccount(
 				return NewUserManagedBySCIMError(profile.ID)
 			}
 
-			if profile.State == coredata.ProfileStateInactive {
-				profile.State = coredata.ProfileStateActive
-				profile.UpdatedAt = now
+			if profile.State == coredata.ProfileStatePending {
+				profile.MarkActive(now)
 
 				if err := profile.Update(ctx, tx, scope); err != nil {
 					return fmt.Errorf("cannot update user: %w", err)
diff --git a/pkg/iam/organization_service.go b/pkg/iam/organization_service.go
index 2224c7784..d250b29d6 100644
--- a/pkg/iam/organization_service.go
+++ b/pkg/iam/organization_service.go
@@ -438,9 +438,8 @@ func (s *OrganizationService) ArchiveUser(
 
 			now := time.Now()
 
-			if profile.State != coredata.ProfileStateInactive {
-				profile.State = coredata.ProfileStateInactive
-				profile.UpdatedAt = now
+			if profile.State != coredata.ProfileStateDeactivated {
+				profile.MarkDeactivated(now)
 
 				if err := profile.Update(ctx, tx, scope); err != nil {
 					return fmt.Errorf("cannot update profile state: %w", err)
@@ -505,6 +504,14 @@ func (s *OrganizationService) InviteUser(
 				return NewUserManagedBySCIMError(profile.ID)
 			}
 
+			if profile.State == coredata.ProfileStateDeactivated {
+				profile.MarkPending(now)
+
+				if err := profile.Update(ctx, tx, scope); err != nil {
+					return fmt.Errorf("cannot update profile state: %w", err)
+				}
+			}
+
 			err = invitation.Insert(ctx, tx, scope)
 			if err != nil {
 				return fmt.Errorf("cannot insert invitation: %w", err)
@@ -583,6 +590,7 @@ func (s *OrganizationService) CreateOrganization(
 			OrganizationID: organization.ID,
 			Source:         coredata.ProfileSourceManual,
 			State:          coredata.ProfileStateActive,
+			ActivatedAt:    &now,
 			CreatedAt:      now,
 			UpdatedAt:      now,
 		}
@@ -1038,8 +1046,8 @@ func (s *OrganizationService) CreateUser(ctx context.Context, scope coredata.Sco
 				Kind:                     req.Kind,
 				AdditionalEmailAddresses: req.AdditionalEmailAddresses,
 				Position:                 req.Position,
-				// User is created inactive
-				State:     coredata.ProfileStateInactive,
+				// User is pending until they accept an invitation.
+				State:     coredata.ProfileStatePending,
 				CreatedAt: now,
 				UpdatedAt: now,
 			}
@@ -1192,14 +1200,22 @@ func (s *OrganizationService) UpdateUserState(
 				return fmt.Errorf("cannot load profile: %w", err)
 			}
 
-			profile.State = state
-			profile.UpdatedAt = time.Now()
+			now := time.Now()
+
+			switch state {
+			case coredata.ProfileStatePending:
+				profile.MarkPending(now)
+			case coredata.ProfileStateActive:
+				profile.MarkActive(now)
+			case coredata.ProfileStateDeactivated:
+				profile.MarkDeactivated(now)
+			}
 
 			if err := profile.Update(ctx, tx, scope); err != nil {
 				return fmt.Errorf("cannot update profile: %w", err)
 			}
 
-			if state == coredata.ProfileStateInactive {
+			if state == coredata.ProfileStateDeactivated {
 				signatures := &coredata.DocumentVersionSignatures{}
 				if err := signatures.DeleteRequestedBySignatory(ctx, tx, scope, profile.ID); err != nil {
 					return fmt.Errorf("cannot delete requested signatures: %w", err)
diff --git a/pkg/iam/saml/service.go b/pkg/iam/saml/service.go
index 7edac5323..abfb8987a 100644
--- a/pkg/iam/saml/service.go
+++ b/pkg/iam/saml/service.go
@@ -322,6 +322,7 @@ func (s *Service) HandleAssertion(
 					OrganizationID: config.OrganizationID,
 					Source:         coredata.ProfileSourceSAML,
 					State:          coredata.ProfileStateActive,
+					ActivatedAt:    &now,
 					FullName:       fullname,
 					CreatedAt:      now,
 					UpdatedAt:      now,
@@ -332,7 +333,7 @@ func (s *Service) HandleAssertion(
 					return fmt.Errorf("cannot insert membership profile: %w", err)
 				}
 			} else {
-				if profile.State == coredata.ProfileStateInactive {
+				if profile.State == coredata.ProfileStateDeactivated {
 					return NewUserInactiveError(profile.ID)
 				}
 			}
diff --git a/pkg/iam/scim/service.go b/pkg/iam/scim/service.go
index c45d4bc1e..7e433a9e7 100644
--- a/pkg/iam/scim/service.go
+++ b/pkg/iam/scim/service.go
@@ -150,7 +150,7 @@ func (s *Service) CreateUser(
 
 	profileState := coredata.ProfileStateActive
 	if !attrs.Active {
-		profileState = coredata.ProfileStateInactive
+		profileState = coredata.ProfileStateDeactivated
 	}
 
 	var externalIdPtr *string
@@ -536,8 +536,8 @@ func (s *Service) updateUser(
 			previousMembership := *membership
 			previousUser := webhooktypes.NewUser(&previousProfile, &previousMembership)
 
-			shouldReactivate := attrs.Active != nil && *attrs.Active && profile.State == coredata.ProfileStateInactive
-			shouldDeactivate := attrs.Active != nil && !*attrs.Active && profile.State == coredata.ProfileStateActive
+			shouldReactivate := attrs.Active != nil && *attrs.Active && profile.State == coredata.ProfileStateDeactivated
+			shouldDeactivate := attrs.Active != nil && !*attrs.Active && profile.State != coredata.ProfileStateDeactivated
 
 			if attrs.FullName != "" {
 				profile.FullName = attrs.FullName
@@ -748,11 +748,9 @@ func (s *Service) updateUser(
 			}
 
 			if shouldReactivate {
-				profile.State = coredata.ProfileStateActive
-				profile.UpdatedAt = now
+				profile.MarkActive(now)
 			} else if shouldDeactivate {
-				profile.State = coredata.ProfileStateInactive
-				profile.UpdatedAt = now
+				profile.MarkDeactivated(now)
 			}
 
 			if profile.Source != coredata.ProfileSourceSCIM {
@@ -826,7 +824,15 @@ func applyUserAttributes(
 	now time.Time,
 ) {
 	profile.Source = coredata.ProfileSourceSCIM
-	profile.State = state
+	switch {
+	case state == coredata.ProfileStateActive && profile.State != coredata.ProfileStateActive:
+		profile.MarkActive(now)
+	case state == coredata.ProfileStateDeactivated && profile.State != coredata.ProfileStateDeactivated:
+		profile.MarkDeactivated(now)
+	default:
+		profile.State = state
+	}
+
 	profile.FullName = attrs.FullName
 	profile.Position = &attrs.Title
 	profile.UserName = &attrs.UserName
@@ -956,15 +962,14 @@ func (s *Service) deactivateProfileInTx(
 	profile *coredata.MembershipProfile,
 	membership *coredata.Membership,
 ) error {
-	if profile.State == coredata.ProfileStateInactive {
+	if profile.State == coredata.ProfileStateDeactivated {
 		return nil
 	}
 
 	previousUser := webhooktypes.NewUser(profile, membership)
 
 	now := time.Now()
-	profile.State = coredata.ProfileStateInactive
-	profile.UpdatedAt = now
+	profile.MarkDeactivated(now)
 
 	if err := profile.Update(ctx, tx, scope); err != nil {
 		return fmt.Errorf("cannot deactivate profile: %w", err)
diff --git a/pkg/iam/session_service.go b/pkg/iam/session_service.go
index 56257b4e2..4ac0b3016 100644
--- a/pkg/iam/session_service.go
+++ b/pkg/iam/session_service.go
@@ -364,7 +364,7 @@ func (s SessionService) OpenPasswordChildSessionForOrganization(
 				return fmt.Errorf("cannot load profile: %w", err)
 			}
 
-			if profile.State == coredata.ProfileStateInactive {
+			if profile.State == coredata.ProfileStateDeactivated {
 				return NewUserInactiveError(profile.ID)
 			}
 
@@ -469,7 +469,7 @@ func (s SessionService) OpenSAMLChildSessionForOrganization(
 				return fmt.Errorf("cannot load profile: %w", err)
 			}
 
-			if profile.State == coredata.ProfileStateInactive {
+			if profile.State == coredata.ProfileStateDeactivated {
 				return NewUserInactiveError(profile.ID)
 			}
 
@@ -562,7 +562,7 @@ func (s SessionService) OpenOIDCChildSessionForOrganization(
 				return fmt.Errorf("cannot load profile: %w", err)
 			}
 
-			if profile.State == coredata.ProfileStateInactive {
+			if profile.State == coredata.ProfileStateDeactivated {
 				return NewUserInactiveError(profile.ID)
 			}
 
@@ -651,7 +651,7 @@ func (s SessionService) AssumeOrganizationSession(
 				return fmt.Errorf("cannot load profile: %w", err)
 			}
 
-			if profile.State == coredata.ProfileStateInactive {
+			if profile.State == coredata.ProfileStateDeactivated {
 				return NewUserInactiveError(profile.ID)
 			}
 
diff --git a/pkg/server/api/connect/v1/graphql/profile.graphql b/pkg/server/api/connect/v1/graphql/profile.graphql
index 94fd24d5b..7128be63b 100644
--- a/pkg/server/api/connect/v1/graphql/profile.graphql
+++ b/pkg/server/api/connect/v1/graphql/profile.graphql
@@ -30,9 +30,10 @@ type Profile implements Node {
 
 enum ProfileState
   @goModel(model: "go.probo.inc/probo/pkg/coredata.ProfileState") {
+  PENDING @goEnum(value: "go.probo.inc/probo/pkg/coredata.ProfileStatePending")
   ACTIVE @goEnum(value: "go.probo.inc/probo/pkg/coredata.ProfileStateActive")
-  INACTIVE
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ProfileStateInactive")
+  DEACTIVATED
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ProfileStateDeactivated")
 }
 
 enum ProfileSource
@@ -71,6 +72,7 @@ enum ProfileOrderField
 input ProfileFilter {
   contractEnded: Boolean
   state: ProfileState
+  states: [ProfileState!]
   query: String
   role: MembershipRole
   kind: String
diff --git a/pkg/server/api/connect/v1/identity_resolvers.go b/pkg/server/api/connect/v1/identity_resolvers.go
index 37f373bbb..60ccd9136 100644
--- a/pkg/server/api/connect/v1/identity_resolvers.go
+++ b/pkg/server/api/connect/v1/identity_resolvers.go
@@ -32,6 +32,10 @@ func (r *identityResolver) Profiles(ctx context.Context, obj *types.Identity, fi
 	if filter != nil {
 		filters = coredata.NewMembershipProfileFilter(filter.ContractEnded).WithMembership()
 
+		if len(filter.States) > 0 {
+			filters.WithStates(filter.States...)
+		}
+
 		if filter.State != nil {
 			filters.WithState(*filter.State)
 		}
diff --git a/pkg/server/api/connect/v1/organization_resolvers.go b/pkg/server/api/connect/v1/organization_resolvers.go
index c06767a24..6b6421325 100644
--- a/pkg/server/api/connect/v1/organization_resolvers.go
+++ b/pkg/server/api/connect/v1/organization_resolvers.go
@@ -188,6 +188,10 @@ func (r *organizationResolver) Profiles(ctx context.Context, obj *types.Organiza
 	if filter != nil {
 		filters = coredata.NewMembershipProfileFilter(filter.ContractEnded).WithMembership()
 
+		if len(filter.States) > 0 {
+			filters.WithStates(filter.States...)
+		}
+
 		if filter.State != nil {
 			filters.WithState(*filter.State)
 		}
diff --git a/pkg/server/api/connect/v1/profile_resolvers.go b/pkg/server/api/connect/v1/profile_resolvers.go
index e455207f0..02797e82a 100644
--- a/pkg/server/api/connect/v1/profile_resolvers.go
+++ b/pkg/server/api/connect/v1/profile_resolvers.go
@@ -71,7 +71,7 @@ func (r *mutationResolver) DeactivateUser(ctx context.Context, input types.Deact
 	_, err := r.iam.OrganizationService.UpdateUserState(
 		ctx,
 		input.ProfileID,
-		coredata.ProfileStateInactive,
+		coredata.ProfileStateDeactivated,
 	)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot deactivate profile", log.Error(err))
diff --git a/pkg/server/api/console/v1/graphql/organization.graphql b/pkg/server/api/console/v1/graphql/organization.graphql
index b35267706..6466d8d82 100644
--- a/pkg/server/api/console/v1/graphql/organization.graphql
+++ b/pkg/server/api/console/v1/graphql/organization.graphql
@@ -9,9 +9,10 @@ type OrganizationContext {
 
 enum ProfileState
   @goModel(model: "go.probo.inc/probo/pkg/coredata.ProfileState") {
+  PENDING @goEnum(value: "go.probo.inc/probo/pkg/coredata.ProfileStatePending")
   ACTIVE @goEnum(value: "go.probo.inc/probo/pkg/coredata.ProfileStateActive")
-  INACTIVE
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ProfileStateInactive")
+  DEACTIVATED
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ProfileStateDeactivated")
 }
 
 enum MembershipRole
@@ -69,6 +70,7 @@ input ProfileOrder
 input ProfileFilter {
     contractEnded: Boolean
     state: ProfileState
+    states: [ProfileState!]
     query: String
     role: MembershipRole
     kind: String
diff --git a/pkg/server/api/console/v1/organization_resolvers.go b/pkg/server/api/console/v1/organization_resolvers.go
index f8d2546db..42ce667f7 100644
--- a/pkg/server/api/console/v1/organization_resolvers.go
+++ b/pkg/server/api/console/v1/organization_resolvers.go
@@ -119,6 +119,10 @@ func (r *organizationResolver) Profiles(ctx context.Context, obj *types.Organiza
 	if filter != nil {
 		filters = coredata.NewMembershipProfileFilter(filter.ContractEnded).WithMembership()
 
+		if len(filter.States) > 0 {
+			filters.WithStates(filter.States...)
+		}
+
 		if filter.State != nil {
 			filters.WithState(*filter.State)
 		}
diff --git a/pkg/server/api/mcp/v1/schema.resolvers.go b/pkg/server/api/mcp/v1/schema.resolvers.go
index bd1496af1..741398559 100644
--- a/pkg/server/api/mcp/v1/schema.resolvers.go
+++ b/pkg/server/api/mcp/v1/schema.resolvers.go
@@ -2776,6 +2776,10 @@ func (r *Resolver) ListUsersTool(ctx context.Context, req *mcp.CallToolRequest,
 	if input.Filter != nil {
 		filter = coredata.NewMembershipProfileFilter(input.Filter.ContractEnded).WithMembership()
 
+		if len(input.Filter.States) > 0 {
+			filter.WithStates(input.Filter.States...)
+		}
+
 		if input.Filter.State != nil {
 			filter.WithState(*input.Filter.State)
 		}
diff --git a/pkg/server/api/mcp/v1/specification.yaml b/pkg/server/api/mcp/v1/specification.yaml
index 687fcb0a6..318d0940b 100644
--- a/pkg/server/api/mcp/v1/specification.yaml
+++ b/pkg/server/api/mcp/v1/specification.yaml
@@ -184,8 +184,9 @@ components:
     ProfileState:
       type: string
       enum:
+        - PENDING
         - ACTIVE
-        - INACTIVE
+        - DEACTIVATED
       go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ProfileState
 
     ProfileKind:
@@ -526,7 +527,7 @@ components:
           description: Profile source (MANUAL, SCIM, or SAML)
         state:
           $ref: "#/components/schemas/ProfileState"
-          description: Profile state (ACTIVE or INACTIVE)
+          description: Profile state (PENDING, ACTIVE, or DEACTIVATED)
         position:
           type:
             - string
@@ -578,7 +579,12 @@ components:
               description: Filter by contract status. True returns only users with ended contracts, false returns only users with active or no contract.
             state:
               $ref: "#/components/schemas/ProfileState"
-              description: Filter by profile state (ACTIVE or INACTIVE)
+              description: Filter by profile state (PENDING, ACTIVE, or DEACTIVATED)
+            states:
+              type: array
+              items:
+                $ref: "#/components/schemas/ProfileState"
+              description: Filter by profile states (PENDING, ACTIVE, or DEACTIVATED)
             query:
               type: string
               description: Search by full name, email address, or position