Expire invitations when user is deactivated or switches to SAML source

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/iam/saml/service.go

@@ -376,6 +376,19 @@ func (s *Service) HandleAssertion(
 				}
 			}
 
+			// Expire pending invitations for user (in case source switched to SAML)
+			invitations := &coredata.Invitations{}
+			onlyPending := coredata.NewInvitationFilter([]coredata.InvitationStatus{coredata.InvitationStatusPending})
+			if err := invitations.ExpireByUserID(
+				ctx,
+				tx,
+				coredata.NewScopeFromObjectID(profile.OrganizationID),
+				profile.ID,
+				onlyPending,
+			); err != nil {
+				return fmt.Errorf("cannot expire pending invitations: %w", err)
+			}
+
 			return nil
 		},
 	)

pkg/iam/scim/service.go

@@ -211,6 +211,21 @@ func (s *Service) CreateUser(
 			}
 		}
 
+		if !active {
+			// Expire pending invitations for user
+			invitations := &coredata.Invitations{}
+			onlyPending := coredata.NewInvitationFilter([]coredata.InvitationStatus{coredata.InvitationStatusPending})
+			if err := invitations.ExpireByUserID(
+				ctx,
+				tx,
+				coredata.NewScopeFromObjectID(profile.OrganizationID),
+				profile.ID,
+				onlyPending,
+			); err != nil {
+				return fmt.Errorf("cannot expire pending invitations: %w", err)
+			}
+		}
+
 		// Check if membership exists
 		membership = &coredata.Membership{}
 		if err := membership.LoadByIdentityIDAndOrganizationID(
@@ -450,6 +465,21 @@ func (s *Service) updateUser(
 				return fmt.Errorf("cannot update membership profile: %w", err)
 			}
 
+			if shouldDeactivate {
+				// Expire pending invitations for user
+				invitations := &coredata.Invitations{}
+				onlyPending := coredata.NewInvitationFilter([]coredata.InvitationStatus{coredata.InvitationStatusPending})
+				if err := invitations.ExpireByUserID(
+					ctx,
+					tx,
+					coredata.NewScopeFromObjectID(profile.OrganizationID),
+					profile.ID,
+					onlyPending,
+				); err != nil {
+					return fmt.Errorf("cannot expire pending invitations: %w", err)
+				}
+			}
+
 			needsUpdate := shouldReactivate || shouldDeactivate
 
 			if active != nil {