Preconditions
Organizer can add guests; fixture includes existing contacts, access types, and ticket blocks.
Happy path / Lifecycle
Open Add individual guest.
Organizer can search contacts or type a new email, choose access type, ticket block, notes, and send behavior.
Save with send enabled.
System creates guest row, mints token, and queues invitation email.
Save without send.
System creates an admin-added guest with no token and no outbound invitation.
Failure modes
Permission denied at the right boundary
Trigger: viewer/support attempts organizer-only operation.
Resolution: the write request returns 403, the editable surface remains closed or read-only, and the response does not leak hidden guest, event, or tenant fields.
Cross-tenant isolation
Trigger: tenant-A user guesses tenant-B resource id.
Resolution: the server returns 404 instead of 403, masks existence, and the UI renders a generic not-found state.
Soft-delete leaves audit trail
Trigger: organizer removes or deactivates the configured object.
Resolution: the row is marked inactive/deleted with actor, timestamp, and prior state preserved in audit.
Archive vs delete distinction
Trigger: organizer chooses between reversible archive and destructive delete.
Resolution: archive stays reversible and copy/export labels it archived; delete requires separate destructive confirmation and changes copy behavior.
Edit lock during publish
Trigger: publish snapshot begins while an edit is open.
Resolution: publish wins; stale save receives a deterministic conflict modal and does not mutate the published snapshot silently.
Audit log row written on every state change
Trigger: organizer saves any state transition.
Resolution: each state mutation writes an audit row with actor, timestamp, entity id, and before/after payload.
Two organizers concurrent
Trigger: two organizers edit the same state from stale versions.
Resolution: the second save gets conflict UI, both sessions refresh to the same final state, and there is no silent overwrite.
Undo window for destructive actions
Trigger: organizer deletes, cancels, or clears the object.
Resolution: a visible undo affordance lasts 10 seconds and restores the exact prior state when used.
Contact reuse vs new contact
Trigger: organizer enters an email already in contacts.
Resolution: autocomplete offers the existing contact; choosing it reuses contact_id, while new email creates a new contact explicitly.
Idempotent invite resend within 60 seconds
Trigger: organizer double-clicks send/resend.
Resolution: duplicate sends within 60 seconds reuse the same operation and do not mint multiple active tokens or emails.
Invite with no token is admin add only
Trigger: organizer adds guest but disables send invitation.
Resolution: guest row is created without an invite token, status copy says admin-added, and no invitation email API is called.
Ticket-block scope enforcement
Trigger: organizer selects a ticket block outside the chosen access type.
Resolution: save is blocked with scoped validation and no guest row is created with mismatched ticket_block_id.
Stable test attributes
Visibility teeth. Each attribute must be effectively visible when active and must match the agent probes.
| data-test | Where | Purpose |
|---|---|---|
individual-invite-drawer | surface | drawer |
individual-invite-form | surface | form |
individual-invite-contact-picker | surface | contact picker |
individual-invite-email-input | surface | email input |
individual-invite-access-type-picker | surface | access type picker |
individual-invite-ticket-block-picker | surface | ticket block picker |
individual-invite-notes-input | surface | notes input |
individual-invite-send-cta | surface | send cta |
individual-invite-archive-invite-cta | surface | archive invite cta |
individual-invite-delete-guest-cta | surface | delete guest cta |
individual-invite-undo-toast | surface | undo toast |
individual-invite-conflict-modal | surface | conflict modal |
individual-invite-validation-error | surface | validation error |
Agent test plan
- individual-invite-opens
- individual-invite-saves
- individual-invite-audit-visible
- permission-denied-boundary
- cross-tenant-404
- soft-delete-audit
- archive-delete-distinction
- publish-edit-lock
- audit-row-every-change
- concurrent-organizers-conflict
- destructive-undo-window
- contact-reuse-vs-new-contact
- resend-idempotent-sixty-seconds
- invite-with-no-token-admin-add
- ticket-block-scope-enforcement
- evaluate-individual-invite