Inviting people
Getting a colleague into the workspace, and what happens on the other end of the link.
Invitations live at Settings, Members, next to the member list. Issuing, resending and revoking are all admin only.
Sending an invitation
Invite member asks for an email address and a role. Both are required. The role has no default, because the role is named in the email the invitee reads, so somebody has to choose it deliberately.
You cannot invite anyone above your own role. It is the same rule that governs changing a role, so an invitation can never be a way around it.
The invitation email carries the only copy of the link. The token is not in the response, is not in the list, and cannot be fetched afterwards. If the mail does not arrive, resend.
The pending list
Pending invitations show the address, the role, who invited them, when the invitation expires and how delivery went.
An invitation is in one of four states: pending, expired, accepted or
revoked. The state is worked out when you ask rather than stored, so one that
has run out of time reads as expired without anything having touched it.
Expired invitations stay in the list, because an expired invitation still holds its address's slot and is the record an admin has to act on.
Delivery is reported separately from the record. A failed delivery with an error means the invitation exists and the mail did not go. The fix is to resend, not to invite again.
Inviting the same address twice is a resend
Inviting an address that already has a pending invitation is treated as a resend rather than refused. It issues a fresh token, takes the role and the issuer from the new request, and resets the expiry. The response says which of the two happened.
Revoking first is different: that frees the address, so inviting afterwards is a genuinely new invitation.
Resending and revoking
Resend sends the invitation again with a fresh link. The old link stops working.
Revoke kills the outstanding link. Anyone holding that email can no longer join, and there is no window: the next attempt after the revoke is refused. It does not remove anyone, and it cannot be used on an invitation that has already been accepted or revoked.
The invitation row is kept and stamped rather than deleted, because it is the record of how somebody came to be in a workspace, or of an admin deciding they should not.
Expiry
An invitation stays acceptable for a fixed number of days after it is issued, set by the deployment. Resending resets the clock.
What the invitee does
They follow the link and land on an accept page that shows the workspace and the role before they commit to anything.
What happens next depends on whether they already have an account.
They already have an account. They sign in and accept. The address they sign in as must be the address the invitation was issued to. A different address is refused, and the refusal names the invited address so the page can offer to sign in as that person instead.
They have no account anywhere. They set a password on the accept page and become a member in one step. The address is fixed by the invitation and cannot be changed on that page.
Whoever opens the link becomes the member
An unaccepted invitation forwarded to somebody else gives that person the membership. What bounds it: the link works once, it expires, it can be revoked, and the address is fixed by the invitation and unchangeable. Treat an invitation link as a credential.
Already a member
Accepting is safe to attempt when somebody is already a member. The response says so, and says whether the invitation raised their role.
An invitation never lowers a role. An existing owner invited as a viewer stays an owner.
A link works once
A second use of the same token is refused, and that is also what the loser of two simultaneous acceptances sees. Nothing is written unless every check passes, so a refusal leaves the invitation usable.
The issuer's authority is re-checked at the moment of acceptance, not only when the invitation was sent. An invitation issued by somebody who has since lost the authority to grant that role does not still grant it.