4.9 KiB
Team access and hotel setup
Owners manage colleagues in Your team. The Hotel setup page shows progress derived from the hotel's saved MongoDB settings, approved answers, mailbox synchronization and active staff accounts. It does not enable any external action. Preview accounts and progress are temporary.
Invite and recover staff
- Enter the colleague's name and work email in Your team and create an invitation link.
- Verify the intended recipient and share the link privately through your established workplace channel. GuestOps does not email the link. The link grants access to set that account's password; treat it as a temporary credential.
- The colleague opens the link, chooses and confirms a unique password of 14–128 characters, then signs in normally. Staff cannot manage hotel controls or team accounts.
Invitations expire after 48 hours. Reset password issues a 30-minute link for an active staff account. The current password and sessions continue to work until the reset is accepted; then previous sessions are invalidated on their next request. Revoke link invalidates an outstanding link without changing an active account's password. Issuing another link replaces the previous one.
Disable access invalidates existing sessions and outstanding links. Restore access issues a 48-hour link that requires a new password before the disabled account becomes active. It does not restore access using the old password. Owner accounts cannot be disabled or recovered through staff controls.
An email belongs to one hotel account. Existing active accounts cannot be reassigned through an invitation. The 50-account pilot limit is a best-effort administrative limit, not an atomic quota. Roles in this release are Owner and Staff; granular roles, per-user preferences, MFA, public registration and self-service email recovery are future work.
Owner recovery on the Linux server
The server administrator must verify the owner's identity before issuing a recovery link. On the server, in the directory containing the deployed Compose file and its private environment file:
read -r -p 'Verified owner email: ' RECOVERY_EMAIL
export RECOVERY_EMAIL
docker compose run --rm --no-deps -e RECOVERY_EMAIL api --recover-owner
unset RECOVERY_EMAIL
The command uses the configured database, generates a private link, prints it to the administrator's terminal and exits. Share it only with the verified owner. Do not paste it into tickets, chat logs, build logs or source control; avoid running this command in a recorded terminal. It expires in 30 minutes and can be consumed once. Running the command again invalidates the earlier link. Bootstrap remains a create-only command and cannot reset passwords.
PublicUrl must be the configured HTTPS origin, normally https://sandbox-guestops.futuresens.co.uk. Request Host headers never determine recovery-link origins. The Development-only preview uses http://127.0.0.1:5173.
Storage and session behavior
MongoDB stores the SHA-256 hash of a random 256-bit token, its purpose and expiry. The raw token is returned only when issuing the link. Expiry is checked during inspection and again during atomic acceptance. Account records are not TTL-deleted when a link expires. Password hashing, version checks and a new security stamp prevent concurrent reuse and invalidate older sessions. Existing pre-migration accounts default to an empty stamp; their cookies remain valid until reset, disablement or normal expiry.
Tokens travel in URL fragments and are removed from browser history as the account page opens; submission uses POST with CSRF validation. API responses are not cached and referrer policy is no-referrer. The frontend holds the token only in component memory. Reloading after the fragment was removed requires reopening the original link. No analytics or third-party scripts are included on this page.
Account endpoints have rate limits. Because the reverse proxy currently forwards HTTPS status but not client IP addresses, anonymous recovery limits are shared behind that proxy. This can temporarily limit concurrent users; per-client limiting requires a separately reviewed trusted-proxy configuration.
Account changes appear in workspace activity without links, password hashes or tokens. Automated notification emails are not implemented, including password-change alerts. Recovery is an administrator-assisted process until verified transactional email is added. This is not a claim of production identity-provider completeness.
Acceptance
Automated tests cover invitation/recovery acceptance, concurrent single-use enforcement with real MongoDB, expiry, reissue/revocation, session invalidation, staff restrictions, owner protection, cross-hotel access, configured origins and secret-free API views. Before inviting real staff, verify the deployed HTTPS link, private handoff process, owner recovery command and backup/restore procedure with test accounts.