LOCAL PREVIEWNT
Admin creates the invite. Email contains a single-use activation code only. The temporary password must be given separately; never email it.

Accounts

Verified admin session required

Account records and creation remain unavailable until login, CSRF protection and rate limiting are connected.

First-time setup

Invite sent → user verifies code and temporary password → chooses a unique username and personal password → account becomes active.

Passkey / Face ID sign-in will be offered through the shared authentication origin after WebAuthn verification is implemented.

NusaTimes News Engine · Sprint 0 · Local foundation