@@ -0,0 +1,19 @@
+---
+'@objectstack/plugin-auth': patch
+'@objectstack/platform-objects': patch
+---
+
+fix(plugin-auth)!: Copy Invite Link is no longer offered or answered for a pending invitation whose expiry has passed
+
+Clause-②: no (narrowing) — the `sys_invitation.copy_invitation_link` handler refuses, `409 RESOURCE_CONFLICT`, an invitation that still reads `pending` after its `expires_at`, a call it answered before; the action's `visible` predicate hides it on such a row. Nothing is widened.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped, and no metadata an author writes changes meaning: one platform action's handler narrows which rows it answers, and that action's own visible predicate follows it. The refusal is the handler's existing 409 RESOURCE_CONFLICT with a sentence naming expiry, so there is nothing for a migration to rewrite and no tombstone. -->
+
+**BREAKING** row narrowing on `sys_invitation.copy_invitation_link` (`@objectstack/plugin-auth`, `@objectstack/platform-objects`).
+
+- **The rule.** An expired invitation's link is no longer offered or answered. A row can still read `pending` after its `expires_at` has passed, because nothing moves it to `expired`; the handler now refuses it with `409 RESOURCE_CONFLICT`, as it refuses a non-pending row, and the row menu and record header no longer offer the action there. A missing or unreadable `expires_at` counts as expired.
+- **Unchanged.** The other gates and their order (cloud-managed, the record, the caller, invite reach, pending), the link a pending invitation before its expiry answers, and Resend Invitation, which stays offered on an expired row.
+- **Who sees it.** An organization admin who opens the row menu of an invitation past its expiry.
+
+**The remedy.** Resend the invitation, then copy the link of the invitation Resend answers.
@@ -12,6 +12,9 @@
 //    `target`, its answer shown in a copyable text result dialog, offered on a
 //    pending row to the grades that reach invite-member and hidden while the
 //    environment is cloud-managed;
+//  - #28384: it is not offered on a row that still reads `pending` after its
+//    `expires_at` has passed (the handler refuses it too, plugin-auth
+//    `invitation-delivery-outcome.test.ts`), while Resend stays offered there;
 //  - the translated bundles carry a translation of every new leaf, never the
 //    English source `--fill=default` seeds a new key with.
 //
@@ -134,8 +137,13 @@ const DELEGATE = user(['delegated_admin']);
 const MEMBER = user(['org_member']);
 const ON = { organization: true, cloudManaged: false };
 
-function offered(record: Record<string, unknown>, current: unknown, features: Record<string, unknown>): boolean | string {
-  const raw = action(SysInvitation, 'copy_invitation_link').visible;
+function offered(
+  record: Record<string, unknown>,
+  current: unknown,
+  features: Record<string, unknown>,
+  name = 'copy_invitation_link',
+): boolean | string {
+  const raw = action(SysInvitation, name).visible;
   const source = typeof raw === 'string' ? raw : raw?.source;
   const r = celEngine.evaluate(
     { dialect: 'cel', source },
@@ -145,8 +153,13 @@ function offered(record: Record<string, unknown>, current: unknown, features: Re
   return typeof r.value === 'boolean' ? r.value : `NON-BOOLEAN ${JSON.stringify(r.value)}`;
 }
 
+/** ISO text a day from now, or a day ago: what a list row carries for a datetime. */
+const DAY_MS = 24 * 60 * 60 * 1000;
+const inADay = () => new Date(Date.now() + DAY_MS).toISOString();
+const aDayAgo = () => new Date(Date.now() - DAY_MS).toISOString();
+
 describe('sys_invitation.copy_invitation_link — who is offered it', () => {
-  const pending = { id: 'inv_1', status: 'pending' };
+  const pending = { id: 'inv_1', status: 'pending', expires_at: inADay() };
 
   it.each([
     ['owner', OWNER],
@@ -168,6 +181,20 @@ describe('sys_invitation.copy_invitation_link — who is offered it', () => {
     expect(offered({ id: 'inv_1' }, OWNER, ON)).toBe(false);
   });
 
+  it('#28384 — is not offered on a row still pending after its expires_at', () => {
+    expect(offered({ id: 'inv_1', status: 'pending', expires_at: aDayAgo() }, OWNER, ON)).toBe(false);
+  });
+
+  it('#28384 — is not offered on a pending row projected without, or holding no, expires_at', () => {
+    expect(offered({ id: 'inv_1', status: 'pending' }, OWNER, ON)).toBe(false);
+    expect(offered({ id: 'inv_1', status: 'pending', expires_at: null }, OWNER, ON)).toBe(false);
+  });
+
+  it('#28384 — Resend stays offered on a pending row past its expires_at: it is the remedy', () => {
+    const expired = { id: 'inv_1', status: 'pending', expires_at: aDayAgo(), email: 'b@example.com', role: 'member' };
+    expect(offered(expired, OWNER, ON, 'resend_invitation')).toBe(true);
+  });
+
   it('is hidden while the environment is cloud-managed', () => {
     expect(offered(pending, OWNER, { organization: true, cloudManaged: true })).toBe(false);
   });
 
@@ -190,10 +190,13 @@ export const SysInvitation = ObjectSchema.create({
       target: 'copy_invitation_link',
       // The gates of `resend_invitation` (the organization capability and the
       // grades that reach invite-member), hidden while cloud-managed as the
-      // invite mirrors are, and offered on a pending row only. `has()` opens
-      // the status operand for the sparse `list_item` face (#8990), as on the
-      // recipient-side actions below.
-      visible: "features.cloudManaged != true && has(record.status) && record.status == 'pending'",
+      // invite mirrors are, and offered on a pending row only, before its
+      // `expires_at`: a row can still read `pending` after it expires, and
+      // its link admits no one (the handler refuses it too). `has()` opens
+      // each operand for the sparse `list_item` face (#8990), as on the
+      // recipient-side actions below; `expires_at` is compared by ordering,
+      // so it also needs its `!= null` half (`materializeDeclaredFields`).
+      visible: "features.cloudManaged != true && has(record.status) && record.status == 'pending' && has(record.expires_at) && record.expires_at != null && datetime(record.expires_at) > now()",
       requiresFeature: 'organization',
       requiresMembershipReach: 'invite_member',
       resultDialog: {
 
@@ -17,6 +17,9 @@
 //      non-pending row.
 //  (d) the action is refused while the environment is cloud-managed (the
 //      declaration hides it there too, pinned in platform-objects).
+//  (e) #28384: a row that still reads `pending` after its `expires_at` has
+//      passed is refused 409 (the declaration hides it there too, pinned in
+//      platform-objects), while Resend still answers for it.
 //
 // Every invitation is issued, resent, canceled and accepted through the
 // vendor's own routes on a real `AuthManager` over the installed better-auth,
@@ -356,6 +359,61 @@ describe('#27843 (c) — copy_invitation_link is answered only inside the invite
   });
 });
 
+describe('#28384 (e) — copy_invitation_link refuses a pending invitation past its expires_at', () => {
+  /** Move a pending row's `expires_at` into the past, leaving its status as it is. */
+  const expire = (row: Record<string, any>) => {
+    row.expires_at = new Date(Date.now() - 60_000);
+  };
+
+  it('a row still pending after expires_at is refused 409, and is not handed a link', async () => {
+    const { invite, owner, copyLink, invitationRow } = await stage();
+    const id = String((await invite('bob.builder@acme.test')).body.id);
+    expire(invitationRow(id));
+    expect(invitationRow(id).status).toBe('pending');
+
+    const v = await refusalOf(copyLink(id, owner.userId));
+    expect([v.status, v.code]).toEqual([409, 'RESOURCE_CONFLICT']);
+    expect(v.message.split('. ')[0]).toBe('This invitation has expired, so its link no longer lets anyone join');
+  });
+
+  it('a pending row with no readable expires_at is refused the same way', async () => {
+    const { invite, owner, copyLink, invitationRow } = await stage();
+    const id = String((await invite('bob.builder@acme.test')).body.id);
+    invitationRow(id).expires_at = 'not a date';
+    const v = await refusalOf(copyLink(id, owner.userId));
+    expect([v.status, v.code]).toEqual([409, 'RESOURCE_CONFLICT']);
+  });
+
+  it('a pending row before expires_at still answers its link, whatever shape the driver returns', async () => {
+    const { invite, owner, copyLink, invitationRow } = await stage();
+    const id = String((await invite('bob.builder@acme.test')).body.id);
+    const later = Date.now() + 60 * 60 * 1000;
+    for (const shape of [new Date(later), new Date(later).toISOString(), later]) {
+      invitationRow(id).expires_at = shape;
+      expect((await copyLink(id, owner.userId)).acceptUrl).toContain(`/accept-invitation/${id}`);
+    }
+  });
+
+  it('reach is judged before expiry: a plain member learns nothing about an expired row', async () => {
+    const { invite, member, copyLink, invitationRow } = await stage();
+    const id = String((await invite('bob.builder@acme.test')).body.id);
+    expire(invitationRow(id));
+    const v = await refusalOf(copyLink(id, member.userId));
+    expect([v.status, v.code]).toEqual([403, 'PERMISSION_DENIED']);
+  });
+
+  it('Resend still answers for the invitee, and its answer has a link to copy', async () => {
+    const { invite, owner, copyLink, invitationRow } = await stage();
+    const id = String((await invite('bob.builder@acme.test')).body.id);
+    expire(invitationRow(id));
+
+    const resent = await invite('bob.builder@acme.test', { resend: true });
+    expect(resent.status, resent.text).toBe(200);
+    const answered = String(resent.body.id);
+    expect((await copyLink(answered, owner.userId)).acceptUrl).toContain(`/accept-invitation/${answered}`);
+  });
+});
+
 describe('#27843 (d) — copy_invitation_link on a cloud-managed environment', () => {
   it('is refused 409 with the cloud-managed sentence, even for the owner of a pending row', async () => {
     const { invite, owner, copyLink } = await stage();
 
@@ -43,6 +43,13 @@
  *    `membership-reach-table.test.ts`. Before the status gate, so a caller
  *    outside the reach learns nothing about the row.
  * 5. **Pending** — any other status has no link that admits anyone.
+ * 6. **Not expired** — a row can still read `pending` after its `expires_at`
+ *    has passed (nothing moves it to `expired`), and its link admits no one:
+ *    the vendor's accept route refuses an invitation past `expires_at`. Refused
+ *    `409 RESOURCE_CONFLICT`, as a non-pending row is, so the admin is never
+ *    handed a link that fails when the invitee opens it. A missing or
+ *    unreadable `expires_at` is read as expired, the way the vendor reads it.
+ *    `resend_invitation` is not gated on expiry: it is the remedy.
  *
  * The invitation and the membership are re-read from the store under the
  * system context, never taken from the record the door projected for the
@@ -101,6 +108,18 @@ function nonEmptyString(value: unknown): string | undefined {
   return typeof value === 'string' && value.length > 0 ? value : undefined;
 }
 
+/**
+ * Is now still before the invitation's `expires_at`? The stored value may come
+ * back as a `Date`, ISO text or epoch milliseconds, depending on the driver.
+ * Anything that does not read as a date answers `false`, as the vendor's own
+ * `new Date(expiresAt) > new Date()` check does.
+ */
+function isBeforeExpiry(expiresAt: unknown): boolean {
+  if (!(expiresAt instanceof Date) && typeof expiresAt !== 'string' && typeof expiresAt !== 'number') return false;
+  const ms = new Date(expiresAt).getTime();
+  return Number.isFinite(ms) && ms > Date.now();
+}
+
 /** The grades that reach `/organization/invite-member`. */
 const INVITE_REACH_GRADES: readonly string[] = MEMBERSHIP_REACH.invite_member.grades;
 
@@ -128,7 +147,7 @@ export function createCopyInvitationLinkHandler(deps: CopyInvitationLinkDeps) {
 
     const invitation: any = await sys.findOne(INVITATION_OBJECT, {
       where: { id: invitationId },
-      fields: ['id', 'organization_id', 'status'],
+      fields: ['id', 'organization_id', 'status', 'expires_at'],
     });
     if (!invitation) {
       throw refusal(404, 'RECORD_NOT_FOUND', `No invitation '${invitationId}' exists.`);
@@ -160,6 +179,15 @@ export function createCopyInvitationLinkHandler(deps: CopyInvitationLinkDeps) {
       );
     }
 
+    if (!isBeforeExpiry(invitation.expires_at)) {
+      throw refusal(
+        409,
+        'RESOURCE_CONFLICT',
+        'This invitation has expired, so its link no longer lets anyone join. '
+          + 'Resend the invitation to give the person a link that works.',
+      );
+    }
+
     return { acceptUrl: deps.consoleUrl(invitationAcceptPath(String(invitation.id))) };
   };
 }