new workspace members are provisional until they log in for the first time

tests/domain/test_workspaces.py

@@ -86,6 +86,23 @@ def test_can_create_workspace_user(workspace, workspace_owner):
 
     new_member = Workspaces.create_member(workspace_owner, workspace, user_data)
     assert new_member.workspace == workspace
+    assert new_member.user.provisional
+
+
+def test_can_add_existing_user_to_workspace(workspace, workspace_owner):
+    user = UserFactory.create()
+    user_data = {
+        "first_name": "New",
+        "last_name": "User",
+        "email": "new.user@mail.com",
+        "workspace_role": "developer",
+        "dod_id": user.dod_id,
+    }
+
+    new_member = Workspaces.create_member(workspace_owner, workspace, user_data)
+    assert new_member.workspace == workspace
+    assert new_member.user.email == user.email
+    assert not new_member.user.provisional
 
 
 def test_need_permission_to_create_workspace_user(workspace, workspace_owner):

tests/test_auth.py

@@ -211,3 +211,17 @@ def test_redirected_on_login(client, monkeypatch):
     target_route = url_for("requests.requests_form_new", screen=1)
     response = _login(client, next=target_route)
     assert target_route in response.headers.get("Location")
+
+
+def test_invited_user_finalized_on_login(monkeypatch, client):
+    user = UserFactory.create(provisional=True)
+    monkeypatch.setattr(
+        "atst.domain.authnid.AuthenticationContext.authenticate", lambda *args: True
+    )
+    monkeypatch.setattr(
+        "atst.domain.authnid.AuthenticationContext.get_user", lambda *args: user
+    )
+
+    resp = _login(client)
+
+    assert not user.provisional