Users
Admin → Users (/admin/users) is the member directory. Anyone with
manager, admin, or superadmin role can open it; only admin and above
can change roles or remove members.
The stats row
Across the top: Total Members, Active, Admins, and (when non-zero)
Pending. If the org is at its plan seat limit, a yellow banner reads
“User limit reached ({n} on {plan})” and the Invite user button is
disabled. Seat limits come from ORG_PLAN_LIMITS[plan].maxUsers — for example
Guardian is capped at 5, Tactical at 10, Command at 20, and
Sovereign is unlimited.
List columns
| Column | Source | Notes |
|---|---|---|
| Member | displayName, email | Avatar is the two-letter initial unless a photo is uploaded. |
| Call Sign | callSign | Per-org override; falls back to the global asset callsign. |
| Role | role | superadmin, admin, manager, operator, observer — colour-coded. |
| Status | active, pending | Click the pill to toggle active/inactive (can’t disable yourself). |
| Joined | joinedOn | Date the member accepted the invite. |
| Actions | — | Edit profile, change role, remove member. |
A search box filters by name, email, or callsign. Filters for role and status sit next to it. Toggle table vs cards layout with the icon group on the right — the cards view is handy on small screens.
Inviting a user
Click Invite user. The panel asks for:
- Email (required) — the destination for the invite link.
- Role — defaults to
operator. You can pick any role at or below your own level.
On submit, ARGUS writes a document to
/organizations/{orgId}/invitations/{invId} with a 40-char hex token,
creates a matching /inviteTokens/{token} pointer for fast lookup, and sends
a templated email. The invite expires in 7 days by default.
A Pending invitations section appears once there is at least one open
invite. For each pending row you can Resend (refreshes the expiry and
re-emails) or Revoke (flips status to revoked and invalidates the
token).
If Firebase couldn’t dispatch the email the row shows a red FAILED badge with the error as a tooltip. Resend will retry.
Editing a member
Each row has three icon actions:
- Edit profile — inline panel for
displayName,callSign, and a colour swatch (used on the map and PTT roster). Leave any field blank to fall back to the global asset value. - Change role — swaps the select inline and saves with the green check. You
cannot promote someone above your own level and you cannot demote the last
remaining
superadmin. - Remove member — popover-confirmed. This deactivates the
OrgMemberdoc and revokes their access to any mission they are currently in. The user’s Firebase auth account is not deleted — they can still sign in but will see an empty org picker.
Disable vs. delete
| Action | What happens | Reversible? |
|---|---|---|
| Toggle Active off | OrgMember.active = false. User keeps their invite, mission history, and uploaded media but cannot open missions or publish to TACLINK. | Yes — toggle it back on. |
| Remove member | Soft-deletes the OrgMember doc. Preserves historical data the user authored. | Re-invite them with the same email. |
| Force re-auth (aspirational) | Revokes Firebase auth tokens so the user has to re-login. Shipping in the Command plan audit-hardening release. | — |
| Purge data (aspirational) | GDPR/subject-access delete: strips the user’s PII from audit events, chat transcripts and mission reports. Scheduled for Q3 2026. | No. |
Bulk CSV import (aspirational)
A “Bulk invite” drawer is on the roadmap for Q3 2026. It will accept a CSV
with email,role,callSign,displayName columns and create pending invites in
a single batched write. Until then, use the Firestore admin SDK or invite one
at a time.
Assigning teams
ARGUS models teams as a separate concept — open Teams to move a user between sub-units. Changes there are immediately reflected back here via the member’s team badge count.