Phase 3: org & member onboarding - #17
Closed
ArneeMe wants to merge 1 commit into
Closed
Conversation
The wall for adopting attester.no was entirely at provisioning — org
creation and member linking were raw SQL in the Hasura console, and the
admin empty-state told users to 'ask an admin to add you' with no such
feature existing. Now:
- Members admin page ('Medlemmer' tab): list members (emails resolved
from Nhost auth users), add by email, remove with confirm dialog.
API at /api/org/[slug]/members with the usual requireOrgMemberBySlug
guard, plus a lockout guard so the last member can't be removed.
- Password reset: 'Glemt passord?' on the login page → /login/glemt
requests Nhost's reset email → /login/reset exchanges the emailed
refreshToken and sets the new password (all sessions revoked).
- scripts/create-org.ts: assisted org creation — creates the org row
and links the first admin (who must already have an Nhost account).
export {} added to the two arg-style scripts so their top-level consts
don't collide in tsc's global scope.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BFHkXUuHJME4cF9AJWbavB
Deploying inf319-certificate with
|
| Latest commit: |
16427d5
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://eb1f90f7.inf319-certificate.pages.dev |
| Branch Preview URL: | https://claude-phase-3-onboarding.inf319-certificate.pages.dev |
This was referenced Jul 9, 2026
Owner
Author
|
Superseded by the review-ordered stack #25 → #29 (members/reset/create-org landed in #29, the core & security tier). Closing. Generated by Claude Code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #16 (base is
claude/page-market-readiness-x35fdxso the diff shows only phase 3 — retarget tomainafter #16 merges).Removes the biggest adoption blocker: org creation and member linking were raw SQL in the Hasura console, and the admin empty-state told users to "ask an admin to add you" with no such feature existing.
Member management
GET/POST/DELETE /api/org/[slug]/members, guarded by the existingrequireOrgMemberBySlug. A lockout guard refuses to remove the last member of an org.src/lib/server/authUsers.tsreads (never writes)auth.usersvia the Hasurausersroot field.Password reset
/login/glemtsends Nhost's reset email → the emailed link lands on/login/reset, which exchanges therefreshTokenand sets the new password (Nhost revokes all sessions; the user signs in again).Assisted org creation
scripts/create-org.ts <slug> "<Name>" <admin-email>creates the org row and links the first admin (who must already have an Nhost account). Everything after that — templates, assets, form — is self-serve in the app.Deploy notes (one-time, Nhost dashboard)
/login/resetto Auth → Redirect URLs (ALLOWED_REDIRECT_URLS) so the reset email may redirect there.auth.usersis tracked in Hasura asusers(Nhost default) and thatuser_organizationsinsert/delete root fields are tracked (its select already is).Verification
🤖 Generated with Claude Code
https://claude.ai/code/session_01BFHkXUuHJME4cF9AJWbavB
Generated by Claude Code