Fix user invites preventing tokens list

api/types/provisioning_test.go

@@ -965,3 +965,10 @@ func TestProvisionTokenV2_CaseInsensitiveRoles(t *testing.T) {
 		require.Equal(t, SystemRoles{RoleNode, RoleAuth}, tok.GetRoles())
 	})
 }
+
+func TestProvisionTokenV2_SignupRole(t *testing.T) {
+	t.Parallel()
+	tok, err := NewProvisionToken("token", SystemRoles{RoleSignup}, time.Now())
+	require.NoError(t, err)
+	require.Equal(t, SystemRoles{RoleSignup}, tok.GetRoles())
+}

api/types/system_role.go

@@ -264,11 +264,11 @@ func (r *SystemRole) Set(v string) error {
 	return nil
 }
 
-// String returns debug-friendly representation of this teleport role.
+// String returns the system role string representation. Returned values must
+// match (case-insensitive) the role mappings; otherwise, the validation check
+// will fail.
 func (r *SystemRole) String() string {
 	switch *r {
-	case RoleSignup:
-		return "Password"
 	case RoleTrustedCluster:
 		return "trusted_cluster"
 	default:

lib/auth/auth_test.go

@@ -3339,3 +3339,25 @@ func TestInstallerCRUD(t *testing.T) {
 	require.Error(t, err)
 	require.True(t, trace.IsNotFound(err))
 }
+
+func TestGetTokens(t *testing.T) {
+	t.Parallel()
+	s := newAuthSuite(t)
+	ctx := context.Background()
+
+	_, _, err := CreateUserAndRole(s.a, "username", []string{"username"}, nil)
+	require.NoError(t, err)
+	_, err = s.a.CreateResetPasswordToken(ctx, CreateUserTokenRequest{
+		Name: "username",
+		TTL:  time.Minute,
+		Type: UserTokenTypeResetPasswordInvite,
+	})
+	require.NoError(t, err)
+
+	for _, role := range types.LocalServiceMappings() {
+		generateTestToken(ctx, t, types.SystemRoles{role}, s.a.GetClock().Now().Add(time.Minute*30), s.a)
+	}
+
+	_, err = s.a.GetTokens(ctx)
+	require.NoError(t, err)
+}