Purpose

The Teams page lets Super Admins manage dashboard users: list users, invite new users by email, deactivate users, and assign roles (viewer, admin, super_admin).

Who Can Access

Only users with role Super Admin see the Teams page and can perform invite/deactivate/role changes. Admins and Viewers do not see Teams in the sidebar.

What You Can Do

List Users

• See all users with email, role, status (active/inactive), and optionally last login or invite date.
• API: GET /api/users (admin/super_admin).

Invite User

• Enter an email address and (optionally) choose a role. The system sends an invite email with a link to claim the account (set password or magic link). After claiming, the user can log in.
• API: POST /api/users/invite (body: email, role?). Requires super_admin (or admin if roles allow).

Deactivate User

• Deactivate a user so they can no longer log in. Their past sync history is unchanged; they simply lose access.
• API: PATCH /api/users/:id with a status or deactivated field. Requires super_admin.

Change Role

• Change a user’s role (e.g. viewer → admin, admin → viewer). Super_admin is typically restricted to one or a few people.
• API: PATCH /api/users/:id with updated role. Requires super_admin.

Roles Summary

Role	Dashboard	Syncs (view)	Syncs (resolve/resync)	Mappings	Square Orders	Mailchimp Settings	Settings	Teams
Viewer	Yes	Yes	No	No	No	No	No	No
Admin	Yes	Yes	Yes	Yes	Yes	Yes	Yes	No
Super Admin	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes

Auth and Invite Flow

• Invite: Super Admin invites by email → invite email sent (via Worker + Mailchannels or configured mailer) with claim link.
• Claim: User clicks link → lands on /auth/claim?token=... → sets password (or is logged in via magic link) → account is linked to that email and role.
• Login: User logs in with email + password (or magic link). JWT is issued and stored; subsequent API calls use Bearer token.