Group invite link with expiry: confirm email, skip admin approval #77

New Issue

2026-07-22T12:52:10Z

thatguygriff commented

2026-07-22 12:52:10 +00:00

From the 2026-07-22 user demo.

Wanted

An admin option to generate a group invite link (e.g. to include in a newsletter):

Created from the Invites admin page; the admin sets an expiry date at creation.
The link is multi-use — anyone who has it may register while it is unexpired and not revoked.
The registrant enters their own email (editable field), name, password, and accepts signup policies.
They must confirm their email (same hashed-token flow as open registration), but confirming skips the admin approval step — the account becomes active immediately after confirmation, without appearing in Pending Students.
Group links work regardless of the registration mode (invite-only sites can still run a newsletter campaign).
Links can be revoked from the Invites page like personal invites.

Implementation sketch

us_invites grows kind (personal/group) and expires_at columns; group invites store no email and are never marked accepted.
Registration flow (Auth\RegistrationPage) branches on invite kind: group → create the account pending with an email-confirmation token plus a marker meta so Auth\EmailConfirmationHandler auto-approves on confirmation instead of queueing for approval.

**From the 2026-07-22 user demo.** ## Wanted An admin option to generate a **group invite link** (e.g. to include in a newsletter): - Created from the **Invites** admin page; the admin **sets an expiry date** at creation. - The link is multi-use — anyone who has it may register while it is unexpired and not revoked. - The registrant enters their own email (editable field), name, password, and accepts signup policies. - They **must confirm their email** (same hashed-token flow as open registration), but confirming **skips the admin approval step** — the account becomes active immediately after confirmation, without appearing in Pending Students. - Group links work regardless of the registration mode (invite-only sites can still run a newsletter campaign). - Links can be revoked from the Invites page like personal invites. ## Implementation sketch - `us_invites` grows `kind` (`personal`/`group`) and `expires_at` columns; group invites store no email and are never marked `accepted`. - Registration flow (`Auth\RegistrationPage`) branches on invite kind: group → create the account pending with an email-confirmation token plus a marker meta so `Auth\EmailConfirmationHandler` auto-approves on confirmation instead of queueing for approval.

thatguygriff added the feature label 2026-07-22 12:52:10 +00:00

thatguygriff referenced this issue from a commit

2026-07-22 13:44:17 +00:00

Add multi-use group invite links with expiry and auto-approval on email confirmation

thatguygriff referenced a pull request that will close this issue

2026-07-22 13:45:08 +00:00

Add multi-use group invite links with expiry and auto-approval on email confirmation #83

thatguygriff closed this issue

2026-07-22 13:49:15 +00:00

thatguygriff referenced this issue

2026-07-22 14:34:50 +00:00

Invite creation broken: us_invites schema migration never ran (missing USC_VERSION bump) #87