Adds fetching expired invitations so we can track when an invitaiton is invalid in C1 (#150)

* Adds fetching expired invitations so we can track when an invitaiton is no longer valid in c1

* Treat 404 as success when cancelling an expired invitation

CancelInvite now returns success on 404 so that deleting an already-expired
(or previously cancelled) invitation does not fail. Consistent with the
idempotent grant/revoke pattern used elsewhere in the connector.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Javier David Carnelli <javier.carnelli@conductorone.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 3 people

pkg/connector/invitation.go

@@ -7,32 +7,62 @@ import (
 	"net/http"
 	"strconv"
 	"strings"
+	"time"
 
 	v2 "github.com/conductorone/baton-sdk/pb/c1/connector/v2"
 	"github.com/conductorone/baton-sdk/pkg/annotations"
 	"github.com/conductorone/baton-sdk/pkg/connectorbuilder"
+	"github.com/conductorone/baton-sdk/pkg/pagination"
 	resourceSdk "github.com/conductorone/baton-sdk/pkg/types/resource"
 	"github.com/google/go-github/v69/github"
 	"github.com/grpc-ecosystem/go-grpc-middleware/logging/zap/ctxzap"
 	"go.uber.org/zap"
 )
 
-func invitationToUserResource(invitation *github.Invitation) (*v2.Resource, error) {
+const (
+	// Profile keys for invitation status metadata.
+	invitationProfileKeyStatus    = "invitation_status"
+	invitationProfileKeyExpiresAt = "invitation_expires_at"
+
+	// Values exposed via invitation_status.
+	invitationStatusPendingAcceptance = "invitation_pending_acceptance"
+	invitationStatusExpired           = "invitation_expired"
+
+	// Pagination bag states used to drive the two upstream listing endpoints.
+	invitationStatePending = "invitation:pending"
+	invitationStateFailed  = "invitation:failed"
+
+	// GitHub returns the literal string "expired" in failed_reason when an
+	// invitation has expired without being accepted.
+	githubInvitationFailedReasonExpired = "expired"
+
+	// Organization invitations expire 7 days after creation.
+	// https://github.blog/changelog/2020-02-05-self-expiring-repository-and-organization-invitations/
+	invitationLifetime = 7 * 24 * time.Hour
+)
+
+func invitationToUserResource(invitation *github.Invitation, status string) (*v2.Resource, error) {
 	login := invitation.GetLogin()
 	if login == "" {
 		login = invitation.GetEmail()
 	}
 
+	profile := map[string]interface{}{
+		"login":                    login,
+		"inviter":                  invitation.GetInviter().GetLogin(),
+		invitationProfileKeyStatus: status,
+	}
+	if expiresAt, ok := invitationExpiresAt(invitation, status); ok {
+		profile[invitationProfileKeyExpiresAt] = expiresAt.UTC().Format(time.RFC3339)
+	}
+
 	ret, err := resourceSdk.NewUserResource(
 		login,
 		resourceTypeInvitation,
 		invitation.GetID(),
 		[]resourceSdk.UserTraitOption{
 			resourceSdk.WithEmail(invitation.GetEmail(), true),
-			resourceSdk.WithUserProfile(map[string]interface{}{
-				"login":   login,
-				"inviter": invitation.GetInviter().GetLogin(),
-			}),
+			resourceSdk.WithUserProfile(profile),
 			resourceSdk.WithStatus(v2.UserTrait_Status_STATUS_UNSPECIFIED),
 			resourceSdk.WithUserLogin(login),
 		},
@@ -43,6 +73,22 @@ func invitationToUserResource(invitation *github.Invitation) (*v2.Resource, erro
 	return ret, nil
 }
 
+// invitationExpiresAt returns the moment the invitation expired (for already
+// expired invitations) or will expire (for pending invitations). GitHub does
+// not surface an expires_at field on the org invitation payload, so for
+// pending invitations we derive it from created_at + 7 days.
+func invitationExpiresAt(invitation *github.Invitation, status string) (time.Time, bool) {
+	if status == invitationStatusExpired {
+		if t := invitation.GetFailedAt(); !t.IsZero() {
+			return t.Time, true
+		}
+	}
+	if t := invitation.GetCreatedAt(); !t.IsZero() {
+		return t.Add(invitationLifetime), true
+	}
+	return time.Time{}, false
+}
+
 type invitationResourceType struct {
 	client   *github.Client
 	orgCache *orgNameCache
@@ -54,7 +100,6 @@ func (i *invitationResourceType) ResourceType(_ context.Context) *v2.ResourceTyp
 }
 
 func (i *invitationResourceType) List(ctx context.Context, parentID *v2.ResourceId, opts resourceSdk.SyncOpAttrs) ([]*v2.Resource, *resourceSdk.SyncOpResults, error) {
-	var annotations annotations.Annotations
 	if parentID == nil {
 		return nil, &resourceSdk.SyncOpResults{}, nil
 	}
@@ -68,44 +113,106 @@ func (i *invitationResourceType) List(ctx context.Context, parentID *v2.Resource
 	if err != nil {
 		return nil, nil, err
 	}
-	invitations, resp, err := i.client.Organizations.ListPendingOrgInvitations(ctx, orgName, &github.ListOptions{
+
+	listOpts := &github.ListOptions{
 		Page:    page,
 		PerPage: opts.PageToken.Size,
-	})
-	if err != nil {
-		if isNotFoundError(resp) {
-			return nil, &resourceSdk.SyncOpResults{}, nil
-		}
-		return nil, nil, wrapGitHubError(err, resp, "github-connector: failed to list pending org invitations")
 	}
 
-	restApiRateLimit, err := extractRateLimitData(resp)
-	if err != nil {
-		return nil, nil, err
-	}
+	var (
+		invitationResources []*v2.Resource
+		respAnnos           annotations.Annotations
+	)
 
-	nextPage, _, err := parseResp(resp)
-	if err != nil {
-		return nil, nil, err
-	}
+	switch bag.ResourceTypeID() {
+	case resourceTypeInvitation.Id:
+		// First call: fan out into the two listing states. Pending is pushed
+		// last so it is processed first; failed/expired runs after pending
+		// fully drains.
+		bag.Pop()
+		bag.Push(pagination.PageState{ResourceTypeID: invitationStateFailed})
+		bag.Push(pagination.PageState{ResourceTypeID: invitationStatePending})
+
+	case invitationStatePending:
+		invitations, resp, err := i.client.Organizations.ListPendingOrgInvitations(ctx, orgName, listOpts)
+		if err != nil {
+			if isNotFoundError(resp) {
+				if err := bag.Next(""); err != nil {
+					return nil, nil, err
+				}
+				break
+			}
+			return nil, nil, wrapGitHubError(err, resp, "github-connector: failed to list pending org invitations")
+		}
 
-	pageToken, err := bag.NextToken(nextPage)
-	if err != nil {
-		return nil, nil, err
-	}
+		nextPage, annos, err := parseResp(resp)
+		if err != nil {
+			return nil, nil, err
+		}
+		respAnnos = annos
+
+		if err := bag.Next(nextPage); err != nil {
+			return nil, nil, err
+		}
 
-	invitationResources := make([]*v2.Resource, 0, len(invitations))
-	for _, invitation := range invitations {
-		ir, err := invitationToUserResource(invitation)
+		invitationResources = make([]*v2.Resource, 0, len(invitations))
+		for _, invitation := range invitations {
+			ir, err := invitationToUserResource(invitation, invitationStatusPendingAcceptance)
+			if err != nil {
+				return nil, nil, err
+			}
+			invitationResources = append(invitationResources, ir)
+		}
+
+	case invitationStateFailed:
+		invitations, resp, err := i.client.Organizations.ListFailedOrgInvitations(ctx, orgName, listOpts)
+		if err != nil {
+			if isNotFoundError(resp) {
+				if err := bag.Next(""); err != nil {
+					return nil, nil, err
+				}
+				break
+			}
+			return nil, nil, wrapGitHubError(err, resp, "github-connector: failed to list failed org invitations")
+		}
+
+		nextPage, annos, err := parseResp(resp)
 		if err != nil {
 			return nil, nil, err
 		}
-		invitationResources = append(invitationResources, ir)
+		respAnnos = annos
+
+		if err := bag.Next(nextPage); err != nil {
+			return nil, nil, err
+		}
+
+		invitationResources = make([]*v2.Resource, 0, len(invitations))
+		for _, invitation := range invitations {
+			// The failed_invitations endpoint includes failures other than
+			// expirations (e.g. user_was_inactive, unexpected_failure). Only
+			// surface invitations that explicitly expired.
+			if invitation.GetFailedReason() != githubInvitationFailedReasonExpired {
+				continue
+			}
+			ir, err := invitationToUserResource(invitation, invitationStatusExpired)
+			if err != nil {
+				return nil, nil, err
+			}
+			invitationResources = append(invitationResources, ir)
+		}
+
+	default:
+		return nil, nil, fmt.Errorf("github-connector: unexpected invitation page state %q", bag.ResourceTypeID())
 	}
-	annotations.WithRateLimiting(restApiRateLimit)
+
+	pageToken, err := bag.Marshal()
+	if err != nil {
+		return nil, nil, err
+	}
+
 	return invitationResources, &resourceSdk.SyncOpResults{
 		NextPageToken: pageToken,
-		Annotations:   annotations,
+		Annotations:   respAnnos,
 	}, nil
 }
 
@@ -195,7 +302,7 @@ func (i *invitationResourceType) CreateAccount(
 	var annotations annotations.Annotations
 	annotations.WithRateLimiting(restApiRateLimit)
 
-	r, err := invitationToUserResource(invitation)
+	r, err := invitationToUserResource(invitation, invitationStatusPendingAcceptance)
 	if err != nil {
 		return nil, nil, nil, fmt.Errorf("github-connectorv2: cannot create user resource: %w", err)
 	}
@@ -229,6 +336,12 @@ func (i *invitationResourceType) Delete(ctx context.Context, resourceId *v2.Reso
 		resp, err = i.client.Organizations.CancelInvite(ctx, org, invitationID)
 		if err == nil {
 			isRemoved = true
+			continue
+		}
+		if isNotFoundError(resp) {
+			// Invitation is already gone (expired or previously cancelled).
+			// Desired state is achieved, so treat as success.
+			isRemoved = true
 		}
 	}
 
@@ -315,7 +428,7 @@ func (i *invitationResourceType) lookupPendingInvitation(ctx context.Context, or
 		}
 		for _, inv := range invitations {
 			if invitationMatches(inv, login, email) {
-				return invitationToUserResource(inv)
+				return invitationToUserResource(inv, invitationStatusPendingAcceptance)
 			}
 		}
 		if resp.NextPage == 0 {