fix: make administrative user offboarding irreversible and complete (WI-1308)

Offboarding could be undone through pending invitations: user_invitations
survived the anonymization and invitation acceptance activated any inactive
user, resurrecting the retained row with an attacker-chosen password. The
admin activate endpoint and the RECOVER_USER tool could also reactivate an
offboarded account, and the cleanup missed several user-owned stores.

- add an irreversible users.offboarded_at lifecycle state, set by
  OffboardUser and never cleared; every activation path rejects it
  (invitation verify/accept/generate, admin activate, password reset,
  RECOVER_USER)
- extend the offboarding transaction to delete pending invitations,
  integration OAuth tokens, Todoist sync config and task links, integration
  OAuth state, calendar feed tokens, portal request drafts, team
  memberships, leave periods (releasing substitute slots), on-call layer
  memberships and overrides, and asset set roles
- collect encrypted SCM and integration OAuth grant material before the
  rows are deleted and revoke the grants best-effort after commit where
  providers support it (GitHub OAuth Apps, Todoist); Gitea and Notion have
  no revocation API and expire unused
- regression coverage: invitation reactivation, per-table cleanup,
  revocation collection, migration upgrade, and HTTP-level activation and
  password-reset denial contracts

Author: stefan-ernst

internal/database/migrations.go

@@ -551,6 +551,14 @@ var Catalog = []Migration{
 			ALTER TABLE notifications ADD COLUMN referenced_workspace_permission TEXT;
 		`,
 	},
+	{
+		Version:       "20260911_users_offboarded_at",
+		Name:          "Add irreversible offboarded lifecycle state to users",
+		CheckSQLite:   sqliteColumnCheck("users", "offboarded_at"),
+		CheckPostgres: pgColumnCheck("users", "offboarded_at"),
+		SQLite:        `ALTER TABLE users ADD COLUMN offboarded_at DATETIME`,
+		Postgres:      `ALTER TABLE users ADD COLUMN IF NOT EXISTS offboarded_at TIMESTAMPTZ`,
+	},
 	{
 		Version:       "20260905_notification_email_claims",
 		Name:          "Add recoverable notification email claims",

internal/database/schema/base_tables_postgres.sql

@@ -22,6 +22,7 @@ CREATE TABLE IF NOT EXISTS users (
 	email_verification_expires TIMESTAMPTZ, -- Expiry time for verification token
 	scim_external_id TEXT, -- SCIM externalId from identity provider
 	scim_managed BOOLEAN DEFAULT false, -- If true, user is managed via SCIM
+	offboarded_at TIMESTAMPTZ, -- Set when the account is administratively offboarded; never cleared, every activation path must reject it
 	is_agent BOOLEAN DEFAULT false, -- If true, user is a non-human agent (API-only; cannot log in)
 	agent_owner_user_id INTEGER REFERENCES users(id) ON DELETE CASCADE, -- NULL = service user (admin-provisioned); non-NULL = owned agent
 	-- Distinguishes how an agent row got created. 'user' covers both the

internal/database/schema/users.sql

@@ -15,6 +15,7 @@
 		email_verification_expires DATETIME, -- Expiry time for verification token
 		scim_external_id TEXT, -- SCIM externalId from identity provider
 		scim_managed BOOLEAN DEFAULT false, -- If true, user is managed via SCIM
+		offboarded_at DATETIME, -- Set when the account is administratively offboarded; never cleared, every activation path must reject it
 		is_agent BOOLEAN DEFAULT FALSE, -- If true, user is a non-human agent (API-only; cannot log in)
 		agent_owner_user_id INTEGER REFERENCES users(id) ON DELETE CASCADE, -- NULL = service user (admin-provisioned); non-NULL = owned agent (inherits owner permissions)
 		-- Distinguishes how an agent row got created. 'user' covers both the
@@ -164,4 +165,6 @@ CREATE INDEX IF NOT EXISTS idx_user_invitations_token ON user_invitations(token)
 CREATE INDEX IF NOT EXISTS idx_user_invitations_user_id ON user_invitations(user_id);
 
 
+-- migration: 20260911_users_offboarded_at
+
 -- migration: 0014_users_is_agent

internal/handlers/users.go

@@ -527,6 +527,13 @@ func (h *UserHandler) ResetPassword(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Password material on an offboarded account is meaningless state; refuse
+	// instead of writing credentials onto a retired row.
+	if target.Offboarded {
+		respondConflict(w, r, "User has been offboarded and cannot be reactivated")
+		return
+	}
+
 	if err := h.repo.SetPassword(id, string(hashedBytes), requiresReset); err != nil {
 		respondInternalError(w, r, err)
 		return
@@ -618,6 +625,13 @@ func (h *UserHandler) ActivateUser(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Offboarding is irreversible; activation must never resurrect the
+	// anonymized account.
+	if target.Offboarded {
+		respondConflict(w, r, "User has been offboarded and cannot be reactivated")
+		return
+	}
+
 	if err := h.repo.SetActive(id, true); err != nil {
 		respondInternalError(w, r, err)
 		return

internal/integrations/todoist/client.go

@@ -2,6 +2,7 @@
 package todoist
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -15,7 +16,8 @@ import (
 
 const (
 	authorizeURL   = "https://todoist.com/oauth/authorize"
-	tokenURL       = "https://todoist.com/oauth/access_token" // #nosec G101 -- OAuth token endpoint URL, not a credential
+	tokenURL       = "https://todoist.com/oauth/access_token"               // #nosec G101 -- OAuth token endpoint URL, not a credential
+	revokeURL      = "https://api.todoist.com/sync/v9/access_tokens/revoke" // #nosec G101 -- OAuth revoke endpoint URL, not a credential
 	requestTimeout = 10 * time.Second
 )
 
@@ -73,3 +75,31 @@ func AuthorizeURL(clientID, scope, state string) string {
 	}
 	return authorizeURL + "?" + q.Encode()
 }
+
+// RevokeToken invalidates a user's Todoist OAuth access token at the provider.
+// A 2xx response counts as revoked; Todoist returns 204 on success.
+func RevokeToken(ctx context.Context, clientID, clientSecret, accessToken string) error {
+	form := url.Values{
+		"client_id":     {clientID},
+		"client_secret": {clientSecret},
+		"access_token":  {accessToken},
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, revokeURL, strings.NewReader(form.Encode()))
+	if err != nil {
+		return fmt.Errorf("creating revoke request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	client := utils.NewHTTPClient(requestTimeout)
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("revoking token: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	_, _ = io.Copy(io.Discard, resp.Body)
+
+	if resp.StatusCode < 200 || resp.StatusCode > 299 {
+		return fmt.Errorf("todoist revoke error (status %d)", resp.StatusCode)
+	}
+	return nil
+}

internal/repository/user_repository.go

@@ -687,18 +687,19 @@ func (r *UserRepository) GetDeleteSnapshot(id int) (*DeleteSnapshot, error) {
 
 // PasswordResetTarget is the small subset the password-reset audit needs.
 type PasswordResetTarget struct {
-	Username string
-	Email    string
+	Username   string
+	Email      string
+	Offboarded bool
 }
 
 // GetPasswordResetTarget returns username+email for the reset audit.
 // Returns ErrNotFound when missing.
 func (r *UserRepository) GetPasswordResetTarget(id int) (*PasswordResetTarget, error) {
 	var t PasswordResetTarget
 	err := r.db.QueryRow(
-		"SELECT username, email FROM users WHERE id = ?",
+		"SELECT username, email, offboarded_at IS NOT NULL FROM users WHERE id = ?",
 		id,
-	).Scan(&t.Username, &t.Email)
+	).Scan(&t.Username, &t.Email, &t.Offboarded)
 	if err != nil {
 		return nil, notFoundOrWrap(err, fmt.Sprintf("get user %d for password reset", id))
 	}
@@ -716,21 +717,22 @@ func (r *UserRepository) SetPassword(id int, passwordHash string, requiresReset
 }
 
 // ActivationTarget carries username/email/is_active for the activate/deactivate
-// audit + idempotence check.
+// audit + idempotence check, plus the irreversible offboarding state.
 type ActivationTarget struct {
-	Username string
-	Email    string
-	IsActive bool
+	Username   string
+	Email      string
+	IsActive   bool
+	Offboarded bool
 }
 
 // GetActivationTarget reads the activate/deactivate audit fields.
 // Returns ErrNotFound when missing.
 func (r *UserRepository) GetActivationTarget(id int) (*ActivationTarget, error) {
 	var t ActivationTarget
 	err := r.db.QueryRow(
-		"SELECT username, email, is_active FROM users WHERE id = ?",
+		"SELECT username, email, is_active, offboarded_at IS NOT NULL FROM users WHERE id = ?",
 		id,
-	).Scan(&t.Username, &t.Email, &t.IsActive)
+	).Scan(&t.Username, &t.Email, &t.IsActive, &t.Offboarded)
 	if err != nil {
 		return nil, notFoundOrWrap(err, fmt.Sprintf("get user %d activation target", id))
 	}

internal/server/server.go

@@ -51,6 +51,7 @@ import (
 	"windshift/internal/scm"
 	"windshift/internal/services"
 	"windshift/internal/smtp"
+	"windshift/internal/sso"
 	"windshift/internal/standardagent"
 	"windshift/internal/utils"
 	"windshift/internal/webauthn"
@@ -131,17 +132,21 @@ type Server struct {
 	tokenTracker                 *services.TokenTracker
 	webhookSender                *webhook.WebhookSender
 	scmSyncStopChan              chan struct{}
-	issueSyncStopChan            chan struct{}
-	magicLinkStopChan            chan struct{}
-	cleanupStopChan              chan struct{}
-	jiraHostStopChan             chan struct{}
-	cleanupTicker                *time.Ticker
-	pluginManager                *plugins.Manager
-	databaseDiagRepo             *repository.DatabaseDiagnosticsRepository
-	databasePoolMonitor          *services.DatabasePoolMonitor
-	channelService               *services.ChannelService
-	memoryBudget                 config.MemoryBudget
-	metrics                      *appmetrics.Metrics
+	// secretEncryption is the at-rest secret cipher shared by the SCM and
+	// integration OAuth surfaces; set during wiring, used to revoke provider
+	// grants when a user is offboarded.
+	secretEncryption    *sso.SecretEncryption
+	issueSyncStopChan   chan struct{}
+	magicLinkStopChan   chan struct{}
+	cleanupStopChan     chan struct{}
+	jiraHostStopChan    chan struct{}
+	cleanupTicker       *time.Ticker
+	pluginManager       *plugins.Manager
+	databaseDiagRepo    *repository.DatabaseDiagnosticsRepository
+	databasePoolMonitor *services.DatabasePoolMonitor
+	channelService      *services.ChannelService
+	memoryBudget        config.MemoryBudget
+	metrics             *appmetrics.Metrics
 
 	loginRateLimiter      *middleware.RateLimiter
 	runnerRegisterLimiter *middleware.RateLimiter
@@ -577,9 +582,14 @@ func (s *Server) initialize() error {
 		invitationService,
 		services.NewUserReadService(s.db),
 		func(id int) error {
-			tokenIDs, err := services.OffboardUser(s.db, id, s.notificationService, authorizationCacheInvalidator)
-			tokenManager.InvalidateTokens(tokenIDs)
+			result, err := services.OffboardUser(s.db, id, s.notificationService, authorizationCacheInvalidator)
+			if len(result.RevokedAPITokenIDs) > 0 {
+				tokenManager.InvalidateTokens(result.RevokedAPITokenIDs)
+			}
 			sessionManager.InvalidateUserSessionValidation(id)
+			if err == nil {
+				s.revokeUserRemoteGrants(result.RemoteRevocations)
+			}
 			return err
 		},
 		userDeactivationService.DeactivateUser,
@@ -774,6 +784,7 @@ func (s *Server) initialize() error {
 	ssoHandler := handlers.NewSSOHandler(s.db, sessionManager, permService, emailVerificationService, s.pluginManager, cfg.Auth.SessionSecret, baseURL, cfg.AllowedHosts, cfg.DisableCSRF, ipExtractor, cfg.UseProxy, additionalProxyList)
 
 	scmProviderHandler := handlers.NewSCMProviderHandler(s.db, cfg.Auth.SessionSecret, baseURL)
+	s.secretEncryption = scmProviderHandler.GetEncryption()
 	scmWorkspaceRepo := repository.NewSCMWorkspaceRepository(s.db)
 	scmWorkspaceHandler := handlers.NewSCMWorkspaceHandler(scmWorkspaceRepo, scmProviderHandler.GetEncryption(), scmProviderHandler, scm.NewCredentialResolver(s.db, scmProviderHandler.GetEncryption()), permService, baseURL)
 	scmItemLinksHandler := handlers.NewSCMItemLinksHandler(s.db, scmProviderHandler.GetEncryption(), permService)
@@ -1922,13 +1933,20 @@ func (s *Server) recoverUser(username string) {
 	var id int
 	var userEmail string
 	var isActive bool
+	var offboarded bool
 	err := s.db.QueryRow(
-		`SELECT id, email, is_active FROM users WHERE username = ?`, username,
-	).Scan(&id, &userEmail, &isActive)
+		`SELECT id, email, is_active, offboarded_at IS NOT NULL FROM users WHERE username = ?`, username,
+	).Scan(&id, &userEmail, &isActive, &offboarded)
 	if err != nil {
 		slog.Error("RECOVER_USER: user not found", "username", username)
 		return
 	}
+	if offboarded {
+		// Offboarding is irreversible; the recovery tool must not resurrect
+		// an anonymized account.
+		slog.Error("RECOVER_USER: refusing to re-enable offboarded user", "username", username, "id", id)
+		return
+	}
 	if isActive {
 		slog.Info("RECOVER_USER: user is already active, no action needed", "username", username, "email", userEmail)
 		return