Users and invites

People join mdlake by invitation. There is no public sign-up and no password. This page shows how to invite people, how they get in, and how you manage them afterwards.

Roles and who can invite whom

There are two roles. What is mdlake? describes what each can do.

The first admin is created from the Seed:AdminEmail setting when the CMS starts (Install the CMS). Everyone else is invited.

Invite people to a workspace

Admins and editors can do this for the workspaces they can open.

1. Open the workspace and choose People in the header. The page lists Members and Pending invitations.
2. Choose Invite people. The dialog Invite people opens.
3. In Email addresses, type one or more addresses. Separate them with commas or new lines. You can add up to 20 at a time.
4. Under Workspaces, tick the workspaces they should get access to. The workspace you are looking at is ticked already. Editors only see their own workspaces here.
5. Choose Send invitations. The page shows “Invitation sent.” or “3 invitations sent.”

Each person gets an email, “<your name> invited you to <workspace names>”, with a link that signs them in.

The dialog checks your input before it sends anything. It tells you if the list is empty, has more than 20 addresses, contains an address that is not valid, or has no workspace chosen.

Invite an admin

Only admins can do this.

1. Choose Users in the account menu at the top right.
2. Choose Invite admin.
3. Enter the email addresses and choose Send admin invitations.

An admin has no workspace list, because admins open every workspace, create workspaces and manage people.

What the person you invited sees

1. They open the email and follow the link. The page Checking your invitation appears, then Joining <workspace names> and “Signing you in…”.
2. Following the link confirms their email address and signs them in. There is nothing to type.
3. They are offered a passkey (Add a passkey?, with Add passkey and Skip for now) and then land in the first workspace they were invited to.

An invitation link works once and expires after 7 days (the setting Invites:ExpiryDays). If it is expired, used or withdrawn, the page Invitation not valid says so and tells them to ask the person who invited them for a new one. If they already have an account, they can sign in with an email link.

If the person already has an account, nothing new is created. The workspaces, and the Admin role if that was invited, are added to the account they have.

What an invitation can give is checked again when it is accepted, against what the inviter is allowed to give at that moment. A demoted inviter can no longer hand out the Admin role, or workspaces they have left. If the invited person or the inviter has been deactivated, the invitation does not work.

Pending invitations

Under Pending invitations on the People page, and under Pending admin invitations on the Users page, each invitation shows:

• the address, a role badge (Editor or Admin) and a state badge (Pending or Expired);
• the workspaces it grants, or “All workspaces” for an admin invitation;
• who invited them, when the email was sent (“Sent 2 hours ago”, or “Email not delivered”), and when it expires.

Two buttons are on each row:

• Resend sends a new link. The old link stops working at once.
• Revoke asks “Revoke invitation?” and then makes the link useless. You can invite the person again later.

Some things to know:

• Inviting an address that already has a pending invitation does not create a second one. The workspaces are merged. An admin invitation upgrades a pending editor invitation. An editor can never change an admin invitation.
• Within 60 seconds of the last send, a repeat only merges the workspaces and sends no second email, so the link in the first email stays valid. This stops accidental double clicks from invalidating links. The setting is Invites:ResendCooldownSeconds. After that, a repeat or Resend mails a new link.
• Resend inside the cooldown is refused with a message to wait.
• Admins see every pending invitation. Editors see only invitations that reach workspaces they belong to, and can only resend or revoke editor invitations whose workspaces they all belong to. Other rows say “Includes workspaces you are not in”.
• A revoked invitation stays in the database for the record. It no longer shows in the list.

Members of a workspace

The Members list on the People page shows everyone who can open the workspace: name and address, role, when they joined, who invited them (“Added directly” if nobody did), and when they last signed in (“Not signed in yet” if never).

To take someone out of a workspace, an admin chooses Remove next to their name and confirms Remove from workspace?. They lose access to that workspace only. Their account and other workspaces stay as they are.

Admin members show “Opens every workspace” instead of a Remove button. An admin’s membership cannot be removed, because admins can open every workspace anyway. To limit an admin’s access, first change their role to Editor on the Users page.

Manage accounts: the Users page

Admins see everyone with an account under Users in the account menu. Each row shows the name, the role, whether the account is Active or Deactivated, which workspaces the person can open (“All workspaces” for admins), when they last signed in, and when they joined.

Each change asks for confirmation first. Two rules protect you from locking everyone out:

• You cannot change your own role or deactivate yourself. The page says “Ask another admin.”
• The last active admin cannot be demoted or deactivated.

If something goes wrong

What’s next

• Create a workspace to invite people to: Create a workspace.
• Give a developer or a tool read access: Workspace tokens.