fix(relay): revoke invitations and restrict claims (#8237)

scripts/reconcile-schema-after-pgschema.sql

@@ -281,3 +281,37 @@ BEGIN
         RAISE EXCEPTION 'replica_heartbeat must contain its singleton row after pgschema apply';
     END IF;
 END $$;
+
+DO $$
+BEGIN
+    IF NOT EXISTS (
+        SELECT 1
+        FROM information_schema.columns
+        WHERE table_schema = current_schema()
+          AND table_name = 'relay_invites'
+          AND column_name = 'revoked_at'
+          AND data_type = 'timestamp with time zone'
+          AND is_nullable = 'YES'
+          AND column_default IS NULL
+    ) THEN
+        RAISE EXCEPTION 'relay_invites.revoked_at must remain nullable without a default';
+    END IF;
+    IF NOT EXISTS (
+        SELECT 1
+        FROM information_schema.columns
+        WHERE table_schema = current_schema()
+          AND table_name = 'relay_invites'
+          AND column_name = 'legacy_admission'
+          AND data_type = 'boolean'
+          AND is_nullable = 'NO'
+          AND column_default = 'true'
+    ) THEN
+        RAISE EXCEPTION 'relay_invites.legacy_admission must default to true and be not null';
+    END IF;
+    IF (SELECT count(*) FROM pg_trigger WHERE NOT tgisinternal
+        AND tgname IN ('invite_restriction_lock', 'invite_issuer_revocation',
+                       'invite_owner_lock', 'invite_owner_revocation')) <> 0 THEN
+        RAISE EXCEPTION 'invitation revocation must use supported application writers, not triggers';
+    END IF;
+END
+$$;

scripts/run-tests.sh

@@ -287,6 +287,12 @@ run_unit_tests() {
       api::bridge::postgres_tests::bridge_search_mode_extension_accepts_prefix_snake_or_camel_case \
       api::bridge::postgres_tests::bridge_search_sort_extension_selects_newest_only_when_named
 
+  # Infra-free guard for the destructive invite fixture's database ownership
+  # check, by exact name: the rest of api::invites::postgres_tests needs a database.
+  run_test_step "buzz-relay invite fixture guard test" \
+    cargo test -p buzz-relay --lib -- --exact --nocapture \
+      api::invites::postgres_tests::restriction_tests::postgres_tests::destructive_fixture_rejects_shared_database_urls
+
   run_test_step "buzz-relay readiness tests" \
     cargo test -p buzz-relay --lib readiness::tests:: -- --nocapture
 
@@ -406,6 +412,14 @@ run_unit_tests() {
   run_test_step "buzz-relay binary tests" \
     cargo test -p buzz-relay --bin buzz-relay -- --nocapture
 
+  run_test_step "buzz-relay invitation token and cutoff contracts" \
+    cargo test -p buzz-relay --lib invite_token:: -- --nocapture
+  run_test_step "buzz-relay invitation cutoff configuration" \
+    cargo test -p buzz-relay --lib config::invite_cutoff_tests:: -- --nocapture
+
+  run_test_step "buzz-relay mesh receive lifetime regression" \
+    cargo test -p buzz-relay --lib mesh_boot::tests::demo_echo_retains_pending_receive_across_housekeeping_ticks -- --exact --nocapture
+
   run_test_step "buzz-relay boot lifecycle tests" \
     cargo test -p buzz-relay --test boot_lifecycle -- --nocapture
 }