30 lines
2.8 KiB
Markdown
30 lines
2.8 KiB
Markdown
# Accept invite
|
|
|
|
**Not designed yet.** The export has no screen for this route. The invitation email links to it, so it has to exist, but nothing in the boards fixes its layout, fields or copy. Do not implement it from this file. Get it designed first (see the prompt at the end), export it, and replace this file with the real spec.
|
|
|
|
- **Route:** `/invite/accept?c=CODE`
|
|
- **Layout:** AuthShell (public, like Register)
|
|
- **API:** not defined. It needs to read the invite behind the code and to create the account from it.
|
|
|
|
## What the rest of the design already fixes
|
|
|
|
- The link is `{{.Host}}/invite/accept?c={{.VerificationCode}}`. It carries no email parameter.
|
|
- The Invite modal says: "We'll email them a link to choose a username and password. The link expires after 3 days."
|
|
- The email says: "Accept to choose a username and password. You'll sign in with your own account." and "This invite was sent to {{.Email}}. It expires in 3 days and works once."
|
|
- The email also says: "If the invite has expired, ask {{.InvitedBy}} to send a new one." Nobody else can revive an invite.
|
|
- The Users list calls the invite Accepted once the account is created.
|
|
- Registration stays closed to everyone else: [register.md](register.md) "Registration closed" (403 "This site already has an owner. Log in instead.") still applies to `/register`.
|
|
|
|
## What has to be decided in the design
|
|
|
|
- Fields: username and password, with the same rules as Register (username 3 to 20, password at least 8, with the PasswordStrengthHint)? Is there a confirm field? Is the invited email shown read-only?
|
|
- What the screen does after success: log the user in and go to Home with a toast, or go to the login screen.
|
|
- States for a code that is invalid, already used, or expired (3 days), and how each one is worded.
|
|
- The submitting, validation, username-taken and server-error states.
|
|
- Whether an account created this way is verified straight away. The email address is proven by the link, so it can skip the pending and verify screens.
|
|
- Behavior when someone who is already logged in opens the link.
|
|
|
|
## Prompt for Claude Design
|
|
|
|
> Add an "Accept invite" screen to the Auth board of RenewCMS, at `/invite/accept?c=CODE`, inside AuthShell. It opens from the invitation email (emails/invitation.html). The invited person chooses a username and a password, with the same rules and PasswordStrengthHint as Register. Show the invited email read-only if that reads well. Draw every state at desktop and mobile, in light and dark: default, validation errors, submitting, username already taken, invalid or already-used link, expired link (tell them to ask the person who invited them), and server error. Decide what happens on success (logged in and sent to Home with a toast is my preference) and draw the toast. Reuse the existing Register and Verify components and copy style. Then export the boards and the handoff again.
|