Follow-up to #890.
Currently admins are onboarded via the password reset flow rather than the Invite table. When POST /users (createUser) runs, the backend generates a random password, creates the User row, and sends the invited admin a reset link with adminInvite: true. The admin sets their real password via that link and the token is marked used.
Because the Invite table is bypassed entirely, OrgAdmins have no way to view pending admin invitations, revoke or resend them, or see which admins haven't completed setup. All of that functionality exists for participants via ParticipantsController.
Per @ignatiusm's comment in #890, this looks like a shortcut from when the feature was first built. Making admin invites first-class (tracked, revocable, resendable) would be worth doing.
Considerations
- Deployment-level admin invites (OrgAdmins invited to the platform)
- Study-scoped admin invites (StudyAdmins for specific studies)
- The current
Invite model has a required studyId, so it's participant-focused. Would need to either generalise the model or add a parallel AdminInvite table.
- New admin-client UI to list, revoke, and resend admin invites.
Follow-up to #890.
Currently admins are onboarded via the password reset flow rather than the Invite table. When
POST /users(createUser) runs, the backend generates a random password, creates the User row, and sends the invited admin a reset link withadminInvite: true. The admin sets their real password via that link and the token is marked used.Because the Invite table is bypassed entirely, OrgAdmins have no way to view pending admin invitations, revoke or resend them, or see which admins haven't completed setup. All of that functionality exists for participants via
ParticipantsController.Per @ignatiusm's comment in #890, this looks like a shortcut from when the feature was first built. Making admin invites first-class (tracked, revocable, resendable) would be worth doing.
Considerations
Invitemodel has a requiredstudyId, so it's participant-focused. Would need to either generalise the model or add a parallelAdminInvitetable.