plugin-auth: the environment-user host seam cannot cancel a pending person's invitation, and has no durable retry or per-row invitation status #33228

domain:server#7 · os-tesla · session_01L9qibzuZJBQY4wUQFJbkfx

Filing gate: a maintainer-ruled execution term not yet built (objectstack-ai/cloud#4465, quoted on #33181 comment 6870710213); follow-up of #33181 / draft PR #33227. ⛔ Not a claim; triage sets the lane and grade.

What is missing

#33181 adds pending, SSO-only people on a cloud-managed environment (POST /admin/add-sso-user, POST /admin/import-sso-users) and a host seam, the auth plugin's environmentUserHost option (environment-user-host.ts). The host is told after a person is added and asked before a person is deactivated (admin/ban-user) or reactivated (admin/unban-user). It can refuse with a typed 409 / 403. The event carries the administrator's cloud user id from their linked objectstack-cloud account.

Two execution terms from the rulings that #33181 does not cover:

1. Cancel on delete. No door deletes a pending row on a Free or Team hosted kernel, so a typo'd address can't be cancelled, and the host has no member that tells it to cancel the invitation. Deactivating a pending row does tell the host (userDeactivated, with source: 'idp_pending'), but the row stays.
2. Durable outbox with retry, and per-row invitation status. Today the seam is one call per operation. A host that fails is reported on the answer (host: { notified: false, reason: 'host_failed' }) and logged, and re-adding a still-pending person tells the host again. Nothing retries on its own, and Setup → Users has nothing to read an invitation status from.

The rulings this follows

Rulings relayed on #33181, comment 6870710213 (objectstack-ai/cloud#4465). Execution terms for the environment, verbatim:

• A durable outbox with retry (mirror sys_environment_revocation), with per-row invitation status in Setup → Users.
• Deleting or deactivating a pending row cancels its cloud invitation (the email-typo case).
• No database transaction is held across the invite call. The cap calls back into the environment (GET /_admin/environments/:id/ai-seats, which fails closed with 503).

Edge path, verbatim:

• A pending row that never accepts: it stays pending, can be re-sent, and can be deleted, which cancels the invitation.

What this card would decide and build

• A pending-only remove door (for example POST /admin/remove-sso-user): platform-admin gated, cloud-managed only, refused for any row that is not idp_pending, removing the row with its grants and membership. Plus a host member (for example userRemoved) that cancels the invitation, with the same typed-refusal and fail-open rules as the other members.
• Where the outbox lives. Either it's host-owned: the cloud enqueues into its own outbox when the seam calls it, and keeps the invitation status. Or it's a framework object: an environment-side outbox platform object mirroring sys_environment_revocation, with retry and a status Setup → Users reads. That choice is the maintainer's. The second option adds a platform object and a worker.
• The Setup → Users status column and console entries stay with Managed environments: re-show the add-people actions in Setup → Users (reverse #25295 / #25309's visible predicates for adding) #33186 / Setup → Users on a managed environment: add-person and CSV-import UI with per-row invitation status (reverses objectui#13330 for adding) #33187.

Seam

Seam: plugin-auth:environment-user-host.ts (EnvironmentUserHost) → cloud host (invitation create / cancel).

Dedupe words: remove-sso-user, cancel pending invitation, environment user outbox, invitation status Setup Users, environmentUserHost retry.