No way to view status or cancel outstanding owner invitations

[Nemo157]

After inviting someone to be an owner of a crate there is no way to see the status of this invitation, other than remembering you sent the invitation and querying owners to see whether they have accepted it. Also, until the invitation is accepted there is no way to cancel/revoke the permission, so if at some point after sending you realise the invited user is untrustworthy, there is no way to stop them from accepting the invite and removing your ownership permission.

[Shnatsel]

Related: invitations never expire (#2869)

[pietroalbini]

Opened #3763 to provide the required data to the frontend. Once that's merged, the frontend needs to display the data and the backend needs to authorize crate owners to decline invitations on their crate.

Note that to prevent abuse the endpoint doesn't publicly expose invitations. An invitation is going to be accessible through the API only if you're authenticated and you're the invited person or an owner of the affected crate.

[Shnatsel]

A one use case such privacy prevents is detailed listing of all owners by cargo supply-chain, but this is probably a reasonable trade-off.

[cuviper]

When it comes to supply-chain, you also don't know who the current owners may invite tomorrow. I think a pending invitation is not so different, just a step closer, as the invited person is not an owner yet.