One-Click Tech Setup Link in Invite Emails

Overview

When admins invite technicians via user.create, the welcome email now includes a one-click setup link instead of "sign in with the password you were given." The tech clicks the link, sets their own password, and is signed in automatically - no out-of-band password handoff required.

How It Works

For Admins Inviting Techs

When you create a new tech user:

1. Create the user via user.create mutation with email and temporary password
2. Tech receives welcome email with a "Set Up Your Account" button
3. Setup link is valid for 7 days (vs. 30 minutes for forgot-password resets)
4. Temporary password still works as a fallback if the email gets caught in spam

For Techs Receiving Invites

When you receive a welcome email:

1. Click "Set Up Your Account" in the email
2. Set your own password on the setup page
3. You're automatically signed in after setting password
4. No need to contact admin for credentials

Technical Details

Token Expiry

• Setup links expire in 7 days - longer than normal password resets since this is a fresh invite
• Reuses passwordResetToken infrastructure - same security model as forgot-password flow
• One-time use - token is invalidated after password is set

Fallback Option

The admin-typed temporary password still works:

• Tech can sign in manually with email + temp password if they prefer
• Useful if email is delayed or caught in spam folders
• Both methods work - setup link or manual login

Questions

Q: What if the setup link expires? A: The tech can use the forgot password flow to request a new reset link, or sign in with the temporary password the admin set initially.

Q: Can the same setup link be used twice? A: No - the token is invalidated after the password is set successfully.

Q: What happens if the tech doesn't set a password? A: The temporary password set by the admin remains active, so they can still sign in manually anytime.