Repository navigation
feat(users): email invitations and remove people for good - #286
Merged
Merged
Conversation
Admins' sign-in links can be emailed as an invitation when mail is set up
(?email=true; the web app asks for it). DELETE /users/{id} ends every way
someone signs in, takes their roles and private things, keeps what they
shared, and frees their email. The assistant gets list_people,
invite_person and change_person, which always wait for approval.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013CspHV36KRyiRJ9LsFqK53
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013CspHV36KRyiRJ9LsFqK53
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013CspHV36KRyiRJ9LsFqK53
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013CspHV36KRyiRJ9LsFqK53
This was referenced Oct 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Adeel · project thread
Description
Part 1 of the user manager and RBAC work. People already had list, create, roles per namespace, disable, sign-in links and passkey removal. What was missing:
POST /users/{id}/signin-link?email=trueemails the sign-in link (newinvite.htmltemplate) when mail is set up, and answersemailed. The web app's Create account and Send a sign-in link dialogs ask for it. The link still shows so the admin can share it themselves. Withoutemail=truenothing changes.DELETE /users/{id}(People › Remove for good…) ends every way the person signs in (sessions, passkeys, links, connected accounts, API tokens, app grants, IIIF tokens). It also takes every role and permission, and deletes their private things (chats, own notes and highlights, unshared views and collections, unfinished uploads). What they shared stays under their name. The account is kept only as a marker with an.invalidemail, so the same address can be invited again and the new account inherits nothing. It is refused for yourself and for the Matterbridge account. It is also refused when their passkeys are the last way into a vault, unlesslose_vaults=true. The dialog offers Disable instead, since removing can't be undone.list_people,invite_personandchange_person(role in a namespace, disable or enable). They always wait for approval, even in a setup conversation. The assistant can't remove anyone.Motivation and Context
Adeel asked for a user manager and RBAC. Custom roles with permissions come in the next PR.
Types of changes
Checklist:
test_users.py,test_setup_assistant.py).docs/(authentication.md "Removing someone", api.md, assistant.md).## Unreleased.Done questions
removed_atis only set on removed accounts.make openapi.Refine later: a bulk invite from a list of emails, and showing "invited, not signed in yet" as its own status in People.
🤖 Generated with Claude Code
https://claude.ai/code/session_013CspHV36KRyiRJ9LsFqK53
Generated by Claude Code