fix: removing someone who never redeemed their invitation

A member row appears only when a code is consumed, so revoking someone
invited to the wrong group was refused for having no row — and the node's
refusal aborted the browser's removal before its hub half, leaving them a
member everywhere with a live code. Revoking now cancels unredeemed codes
for that group, and a node refusal no longer cancels the hub removal.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2 files changed, 82 insertions, 2 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/group-settings.js b/packages/meshbay-hub/src/meshbay_hub/static/group-settings.js
index 4d67348..16f6901 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/group-settings.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/group-settings.js
@@ -727,11 +727,23 @@ function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef,
    * wrapped for them; if the hub removal then fails, they are a member on paper
    * with no key. The other order would leave them able to reach a node that
    * still serves them.
+   *
+   * **A node that refuses does not cancel the hub half.** It used to: the node
+   * call threw, the whole removal ended there, and the person stayed a member
+   * everywhere — the list here (the hub answers it), the owner's other
+   * sessions, the administrator's view — with nothing said about which half
+   * had failed. Someone invited to the wrong group hit it every time, because
+   * a node holds no member row for an invitation nobody has redeemed and
+   * answered "no such member in that group" to the only button offering to
+   * take them back out. The hub half only ever removes access, so it is not
+   * the half to skip when the other is in doubt; what the node said is
+   * reported once the removal has been done, rather than in place of it.
    */
   const removeMember = useCallback(async (member) => {
     const transport = transportRef && transportRef.current;
     setError('');
     setRemoving(member.user_id);
+    let nodeError = '';
     try {
       if (platform.node.available) {
         try {
@@ -747,14 +759,17 @@ function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef,
         const signFn = (sk && window.MeshBayKeys)
           ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript)
           : null;
-        await transport.revokeMember(member.user_id, signFn);
+        try {
+          await transport.revokeMember(member.user_id, signFn);
+        } catch (err) { nodeError = err.message; }
       }
       await hubFetch(`/v1/groups/${groupId}/members/${member.username}`, {
         method: 'DELETE', token,
       });
       loadMembers();
+      if (nodeError) setError(nodeError);
     } catch (err) {
-      setError(err.message);
+      setError(nodeError ? `${nodeError} — ${err.message}` : err.message);
     } finally {
       setRemoving('');
     }
diff --git a/packages/meshbay-hub/tests/test_member_removal.py b/packages/meshbay-hub/tests/test_member_removal.py
new file mode 100644
index 0000000..609ef6a
--- /dev/null
+++ b/packages/meshbay-hub/tests/test_member_removal.py
@@ -0,0 +1,65 @@
+"""
+Removing a member is two halves, and one must not be able to cancel the other.
+
+Source-level, for the reason `test_spa_ordering.py` gives at more length: no
+other test in this tree can see inside a callback in the SPA, and this class of
+defect reached a live browser. The node half and the hub half each remove a
+different kind of access — the group key, and the ability to reach the node at
+all — and the node's refusal used to `throw` out of the whole callback, so
+somebody invited to the wrong group could not be removed from anywhere: the
+node holds no member row for a code nobody has redeemed, answered "no such
+member in that group", and the hub row survived every attempt while the list
+(which the hub answers) went on showing them.
+
+If `removeMember` is restructured, check the invariant still holds — a failing
+node call still reaches the hub call — and then move the markers.
+"""
+
+from pathlib import Path
+
+import pytest
+
+SETTINGS = (Path(__file__).resolve().parents[1]
+            / "src" / "meshbay_hub" / "static" / "group-settings.js")
+
+pytestmark = pytest.mark.skipif(
+    not SETTINGS.exists(), reason="SPA sources not present")
+
+
+def _remove_member_body() -> str:
+    source = SETTINGS.read_text()
+    start = source.find("const removeMember = useCallback(")
+    assert start != -1, "removeMember is gone from group-settings.js"
+    end = source.find("\n  }, [", start)
+    assert end != -1, "removeMember's dependency list is gone — update this test"
+    return source[start:end]
+
+
+def test_the_hub_half_runs_even_when_the_node_refuses():
+    body = _remove_member_body()
+    node_call = body.find("transport.revokeMember(")
+    hub_call = body.find("method: 'DELETE'")
+    assert node_call != -1, "the node is no longer asked to revoke"
+    assert hub_call != -1, "the hub membership is no longer deleted"
+    assert node_call < hub_call, (
+        "the hub removal now runs first — a failure between the two would "
+        "leave them able to reach a node that still serves them")
+    # What the fix is: the node call carries its own catch, so the statements
+    # after it run whatever the node answered. Anything else — no catch, or one
+    # that only closes after the hub call — is the shape that shipped.
+    caught = body.find("catch", node_call)
+    assert caught != -1 and caught < hub_call, (
+        "a node refusal escapes past the hub removal: the person stays a "
+        "member on the hub, in this list and in every other session")
+
+
+def test_a_refusal_is_still_reported():
+    """
+    Swallowing it would be the opposite mistake — the group key is what the
+    node half withdraws, and an operator who is not told it failed believes
+    they have taken it back.
+    """
+    body = _remove_member_body()
+    assert "nodeError" in body and "setError(nodeError" in body, (
+        "the node's refusal is discarded; removal would report success while "
+        "the node goes on serving them the group key")