RenewCMS/docs/design/screens/accept-invite.md

Accept invite

• Route: /invite/accept?c=CODE
• API: GET /v1/auth/invite?c=CODE (pending) · POST /v1/auth/invite/accept (pending)
• Visual reference: source/RenewCMS Screens Auth.dc.html, group "Accept invite" (open it in a browser; each state is drawn at desktop and mobile, with a light/dark toggle).

Opened from the invitation email. The link carries only the code, so the invited email is looked up on load and shown read-only. Username and password follow the Register rules, including PasswordStrengthHint, with no confirm field. On success the person is logged in and sent to /home with a toast. The account is already verified, because the invite went to their email, so it skips the pending and verify screens.

Neither endpoint exists yet:

• GET /v1/auth/invite?c=CODE returns { email }, or 404 or 410.
• POST /v1/auth/invite/accept takes { code, username, password }. It returns 200 with the session cookie, 409 for a taken username, or 404 or 410 as above.

Registration stays closed to everyone else: register.md "Registration closed" still applies to /register. The board does not draw the case of a logged-in person opening the link; it is not specified.

States

Checking the link

Trigger: On load, while the invite is looked up.

• Full-card spinner: "Checking your invite…"

Default

Trigger: The code is valid and unused.

• Heading: Accept your invite
• Description: "Choose a username and password to finish setting up your account."
• Field Email: placeholder "you@example.com"; value "lea.martin@renew.example"; read-only; help "From your invitation."
• Field Username: placeholder "e.g. lea"; counter "0 / 20"; help "Letters and numbers, 3 to 20 characters. You'll use it to log in."
• Field Password: password with show/hide; checklist "At least 8 characters" (unmet)
• Submit button: "Accept invite"
• Footer: Already have an account? [Log in]

Validation errors

Trigger: Checked on blur and on submit, using the same rules as Register. Nothing is sent.

• Heading: Accept your invite
• Description: "Choose a username and password to finish setting up your account."
• Field Email: placeholder "you@example.com"; value "lea.martin@renew.example"; read-only; help "From your invitation."
• Field Username: placeholder "e.g. lea"; value "ma"; counter "2 / 20" in error; error "Use 3 to 20 characters."
• Field Password: value "lime"; password with show/hide; checklist "At least 8 characters" (err)
• Submit button: "Accept invite"
• Footer: Already have an account? [Log in]

Filled, valid

Trigger: Every rule is met and the checklist item turns green.

• Heading: Accept your invite
• Description: "Choose a username and password to finish setting up your account."
• Field Email: placeholder "you@example.com"; value "lea.martin@renew.example"; read-only; help "From your invitation."
• Field Username: placeholder "e.g. lea"; value "lea"; counter "3 / 20"; help "Letters and numbers, 3 to 20 characters. You'll use it to log in."
• Field Password: value "limewash2026"; password with show/hide; password shown; checklist "At least 8 characters" (met)
• Submit button: "Accept invite"
• Footer: Already have an account? [Log in]

Submitting

Trigger: Fields and button are disabled.

• Heading: Accept your invite
• Description: "Choose a username and password to finish setting up your account."
• Field Email: placeholder "you@example.com"; value "lea.martin@renew.example"; read-only; help "From your invitation."
• Field Username: placeholder "e.g. lea"; value "lea"; counter "3 / 20"; help "Letters and numbers, 3 to 20 characters. You'll use it to log in."
• Field Password: value "limewash2026"; password with show/hide; checklist "At least 8 characters" (met)
• Submit button: "Creating account…", loading
• Footer: Already have an account? [Log in]

Username taken (409)

Trigger: Another user has that username. The value is kept and the field gets focus.

• Heading: Accept your invite
• Description: "Choose a username and password to finish setting up your account."
• Field Email: placeholder "you@example.com"; value "lea.martin@renew.example"; read-only; help "From your invitation."
• Field Username: placeholder "e.g. lea"; value "marta"; counter "5 / 20"; focused; error "That username is taken. Try another."
• Field Password: value "limewash2026"; password with show/hide; checklist "At least 8 characters" (met)
• Submit button: "Accept invite"
• Footer: Already have an account? [Log in]

Invalid or used link (404)

Trigger: The code is wrong, was already accepted, or is missing from the URL. No form is shown.

• ResultPanel (error, link-2-off): This invite link doesn't work; text "It may be incomplete, or it may already have been used. If you already set up your account, log in instead."; note "Open the link from your email again, or copy the full address into your browser."; actions "Go to log in" (primary)

Expired link (410)

Trigger: The invite is older than 3 days.

• ResultPanel (error, clock): This invite has expired; text "Invites work once, for 3 days. Ask the person who invited you to send a new one."; actions "Go to log in" (secondary)

Server error

Trigger: A 500 or no response. The values are kept.

• Alert (error, circle-x): Couldn't create the account "Something went wrong on the server. Try again in a moment."
• Heading: Accept your invite
• Description: "Choose a username and password to finish setting up your account."
• Field Email: placeholder "you@example.com"; value "lea.martin@renew.example"; read-only; help "From your invitation."
• Field Username: placeholder "e.g. lea"; value "lea"; counter "3 / 20"; help "Letters and numbers, 3 to 20 characters. You'll use it to log in."
• Field Password: value "limewash2026"; password with show/hide; checklist "At least 8 characters" (met)
• Submit button: "Accept invite"
• Footer: Already have an account? [Log in]

Success

Trigger: 200 sets the session cookie → /home after 800 ms, with a toast. No verification step.

• ResultPanel (success, circle-check): Your account is ready; text "Taking you to your dashboard…"
• Toast (circle-check): Welcome to RenewCMS "You're logged in as lea."