Staff & Onboarding

Inviting staff

Owners invite new staff members from the app. An automated, branded email is sent to the invitee with an activation link.

Activation

The invited staff member clicks the link, verifies their identity via an emailed OTP code, and sets their own password.

Onboarding states

A staff record moves through:


INVITATION_PENDING → EMAIL_VERIFIED → PROFILE_INCOMPLETE → ONBOARDING_COMPLETED → ACTIVE

The final ONBOARDING_COMPLETED → ACTIVE step is admin-gated, not automatic — once a staff member finishes their profile, an admin must explicitly approve them (a tick-icon action in the Staff Directory table, next to the onboarding-state badge) before they show as fully active.

This was previously a real gap: nothing in the codebase ever transitioned a staff member out of ONBOARDING_COMPLETED, even though the UI already had a badge expecting that eventual state. Fixed by adding the explicit approval action rather than making the transition automatic — the existing UI already implied a deliberate gate was intended.

Admin auditing

Owners receive automated security-alert emails whenever a staff member accepts an invite, verifies their identity, or resets/changes their password.

Staff management UI & Administration

Admins have a dedicated Staff Detail page (/admin/staff/:id) showing personal/work info, workload stats, assigned customers, and administrative controls (role, department, commission tier, active/inactive toggle).

Permanent Staff Deletion: Admin controls include a "Delete Account Permanently" button under the Danger Zone section in StaffAdminTab, backed by DELETE /api/v1/admin/staff/{id} to permanently remove staff records with a confirm modal dialog.
Status Column & Disabled Badge: The Staff Directory table features a "Status" column header rendering a red "DISABLED" badge when staff.isActive === false.
Active Staff Stats Filtering: Dashboard metrics filter staff counts strictly by isActive === true so disabled accounts are excluded from active staff totals.