Invitations

Nobody is given a password

There is no way in Runjet to set somebody's password. An admin sends an invitation, the invitee chooses a password themselves on the link, and the admin never knows it. The only exception is a workspace's first account, created at registration — that one has nobody to invite it.

Inviting

On the Users screen an admin clicks Invite somebody: an email address, a name and a role (the default is viewer; what the roles mean). The account is created immediately, inactive, and an email goes out: "X has given you access to Runjet as a role. Choose a password." Until it is accepted, the account list shows it as pending.

An invitation meets two limits. An address that already has an account gets that address already has an account. And the plan limits the number of accounts: the pro plan allows 5 account(s), and this workspace already has that many. A blocked account is counted — if it freed its place, the ceiling could be got around by blocking one, inviting another and unblocking the first.

Accepting

The link leads to a Choose a password page with the name the admin typed already filled in, and a field for the password. Saving makes the account active and the invitee is signed in at once — landing on a sign-in screen after choosing a password would be a pointless second step.

How long the link lasts

The link lasts seven days and is spent once. A This link no longer works page means one of three things: it expired, it was used, or a resend replaced it.

Sending it again

An icon on a pending account, labelled Send the invitation again — the previous link stops working. The new link replaces the old one in the same step: there are never two live links to one account, and revoking access means deleting the account rather than hunting for every mail ever sent. An account that is already active cannot be sent one again — you get this account is already active — send a password reset instead (a forgotten password).

Blocking

Block takes an account out of service: open sessions stop working and signing in is refused, but the account, its name in the audit log and its place in the account count all stay. Unblock undoes it. You cannot block yourself.

Deleting

Delete, behind a confirmation: Their sessions end immediately. What they did stays on record. The audit log stores names rather than referencing them, so a deleted account's rows still read its name. You cannot delete yourself, nor the last admin.

Name and role

The pencil on an account opens the same form as the invitation, without the address: the name can be corrected, the role changed. They are two different events and two different rows in the log — user.name and user.role — because correcting a typo and granting the right to delete a run history are not one thing. An email address cannot be changed: it is what a person signs in with and what the log recorded them under; a different address is a different account.