fix: removing someone who never redeemed their invitation

A member row appears only when a code is consumed, so revoking someone
invited to the wrong group was refused for having no row — and the node's
refusal aborted the browser's removal before its hub half, leaving them a
member everywhere with a live code. Revoking now cancels unredeemed codes
for that group, and a node refusal no longer cancels the hub removal.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 104 insertions, 0 deletions

diff --git a/packages/meshbay-node/tests/test_roster_pairing.py b/packages/meshbay-node/tests/test_roster_pairing.py
index 82336e2..91191c1 100644
--- a/packages/meshbay-node/tests/test_roster_pairing.py
+++ b/packages/meshbay-node/tests/test_roster_pairing.py
@@ -1160,6 +1160,110 @@ async def test_revoking_is_confined_to_the_group_it_was_asked_for(tmp_path, rost
         "the pinned identity was dropped; that is `member unpin`, not this")
 
 
+async def test_revoking_someone_who_never_redeemed_their_code(tmp_path, roster):
+    """
+    An invitation sent to the wrong person is the case removal has to cover.
+
+    A member row exists only once a code is consumed, so until then there is
+    nothing for `set_status` to update, and this answered "no such member in
+    that group" — a refusal that stopped the browser before it reached the hub
+    half, leaving the person a member there and their code live. Nothing else
+    offered to take either back.
+    """
+    from meshbay_common.adminop import admin_transcript
+
+    sk_op, pk_op, pk_x_op = _keypair()
+    await roster.pin_identity("grenet", "grenet", pk_op, pk_x_op, "code")
+    await roster.set_member("", "grenet", ROLE_OPERATOR, "active", "local-cli")
+
+    code = await roster.create_invite(
+        group_id="g1", user_id="misinvited", role=ROLE_MEMBER,
+        created_by="grenet", username="misinvited")
+    assert await roster.get_member("g1", "misinvited") is None
+
+    session = _session(tmp_path, roster, group_id="g1", gek=generate_gek())
+    session._admin_ops = {}
+    session._ctx["has_admin_authority"] = True
+    session._ctx["peers"] = {}
+
+    transcript = admin_transcript(
+        op="member_revoke", node_pk_b64=session._node_pk_b64(), group_id="g1",
+        subject="misinvited", nonce=b"\x55" * 32, ts=int(time.time()))
+    await session._admin_exec_member_revoke(
+        {"op": "member_revoke", "subject": "misinvited"}, transcript,
+        sk_op.sign(transcript))
+
+    assert _last(session)["type"] == "member_revoke_ack", (
+        f"the node refused: {_last(session).get('detail')!r}")
+    # The half that matters: the code that was emailed out no longer works.
+    assert await roster.consume_invite(code, "misinvited") is None
+    assert [i for i in await roster.list_invites()
+            if i["user_id"] == "misinvited"] == []
+
+
+async def test_revoking_does_not_cancel_their_invitation_to_another_group(
+        tmp_path, roster):
+    """
+    Inviting somebody to the wrong group and then to the right one is one
+    errand, not two, and undoing the first must not undo the second — the
+    second code has usually not been redeemed yet when the mistake is noticed.
+    """
+    from meshbay_common.adminop import admin_transcript
+
+    sk_op, pk_op, pk_x_op = _keypair()
+    await roster.pin_identity("grenet", "grenet", pk_op, pk_x_op, "code")
+    await roster.set_member("", "grenet", ROLE_OPERATOR, "active", "local-cli")
+
+    await roster.create_invite(group_id="g1", user_id="misinvited",
+                               role=ROLE_MEMBER, created_by="grenet")
+    keeper = await roster.create_invite(group_id="g2", user_id="misinvited",
+                                        role=ROLE_MEMBER, created_by="grenet")
+
+    session = _session(tmp_path, roster, group_id="g1", gek=generate_gek())
+    session._admin_ops = {}
+    session._ctx["has_admin_authority"] = True
+    session._ctx["peers"] = {}
+
+    transcript = admin_transcript(
+        op="member_revoke", node_pk_b64=session._node_pk_b64(), group_id="g1",
+        subject="misinvited", nonce=b"\x66" * 32, ts=int(time.time()))
+    await session._admin_exec_member_revoke(
+        {"op": "member_revoke", "subject": "misinvited"}, transcript,
+        sk_op.sign(transcript))
+
+    assert _last(session)["type"] == "member_revoke_ack"
+    assert await roster.consume_invite(keeper, "misinvited") is not None, (
+        "the invitation to the other group was cancelled as well")
+
+
+async def test_revoking_a_stranger_is_still_refused(tmp_path, roster):
+    """
+    Neither a member row nor a code: the 404 is what tells an operator they
+    named the wrong person or the wrong group, and dropping it would make every
+    typo look like a removal.
+    """
+    from meshbay_common.adminop import admin_transcript
+
+    sk_op, pk_op, pk_x_op = _keypair()
+    await roster.pin_identity("grenet", "grenet", pk_op, pk_x_op, "code")
+    await roster.set_member("", "grenet", ROLE_OPERATOR, "active", "local-cli")
+
+    session = _session(tmp_path, roster, group_id="g1", gek=generate_gek())
+    session._admin_ops = {}
+    session._ctx["has_admin_authority"] = True
+    session._ctx["peers"] = {}
+
+    transcript = admin_transcript(
+        op="member_revoke", node_pk_b64=session._node_pk_b64(), group_id="g1",
+        subject="nobody", nonce=b"\x77" * 32, ts=int(time.time()))
+    await session._admin_exec_member_revoke(
+        {"op": "member_revoke", "subject": "nobody"}, transcript,
+        sk_op.sign(transcript))
+
+    assert _last(session)["type"] == "error"
+    assert "No such member" in _last(session)["detail"]
+
+
 async def test_an_operator_cannot_revoke_themselves(tmp_path, roster):
     """It would leave the group with nobody able to invite or remove."""
     session = _session(tmp_path, roster, group_id="g1", gek=generate_gek())