Inviting and removing staff

The roster shows pending, expired, active, inactive and admin states distinctly, so who has access is never a guess.

Invitations are bound to an address

An invite can only be accepted by an account whose verified email matches exactly. This is what stops a forwarded invitation granting access to somebody else.

Because the binding is to the address rather than to the link, an invitee who already has a Fidella account never needs the email. Once they sign in, a banner offering to accept appears on every screen, including the screens of a venue they already work at.

That banner depends on the address being confirmed, so an invitee who has not finished signing up will not see one. The emailed link handles that case. It names the venue and tells them to confirm the address first. The invitation email says the same thing for anyone who never reaches the app at all.

Chasing one that has gone quiet

A pending row says how long the invitation has been waiting and when it lapses. Invitations last 48 hours. Resend when the address is right and they simply let it run out. Cancel and reissue when the address itself was wrong, because no amount of resending will make an invitation reach a different mailbox.

Once it lapses the row stays where it is and says the invitation expired. It is not removed, because an invitation that disappeared on expiry would leave you believing you had invited somebody and nothing had happened. Resend puts the same address back on a fresh 48 hours, and remove clears the row when the person is not joining. Expired rows drop off by themselves after 30 days.

Deactivate against remove

Deactivate keeps the site assignment and history, so the person can be reactivated. Remove deletes the assignment; returning needs a new invite.

Do it on the last day

Attribution is only worth something if the access list is current. An ex-employee who still has access can still scan customers.