> ## Documentation Index
> Fetch the complete documentation index at: https://docs.younegotiate.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Invited User Password Setup

> Allow an invited creditor user to set their password from a secure email link before logging in.

## Real-World Example

ABC Collections adds Sarah as a creditor user. Sarah receives a secure setup link by email.

Sarah opens the link, sets and confirms her password, and submits the form. The system marks her email as verified and redirects her to the creditor login page.

When Sarah logs in, she should only have the permissions assigned by ABC Collections.

## Visual Flow

```mermaid placement="top-right" actions={true} theme={"system"}
flowchart TD
    A["Authorized creditor user creates new creditor user"] --> B["Setup link is sent to employee"]
    B --> C["Employee opens secure link"]
    C --> D{"Setup link valid?"}
    D -->|No| E["Block setup"]
    D -->|Yes| F["Employee sets and confirms password"]
    F --> G{"Password valid?"}
    G -->|No| H["Show validation error"]
    G -->|Yes| I["Save password and mark email verified"]
    I --> J["Redirect to creditor login"]
    J --> K["Employee logs in with assigned access"]
    classDef default fill:#F8FAFC,stroke:#64748B,stroke-width:1.5px,color:#0F172A;
    classDef actor fill:#E0F2FE,stroke:#0284C7,stroke-width:2px,color:#0C4A6E;
    classDef system fill:#F8FAFC,stroke:#64748B,stroke-width:1.5px,color:#0F172A;
    classDef decision fill:#FEF3C7,stroke:#D97706,stroke-width:2px,color:#78350F;
    classDef risk fill:#FEE2E2,stroke:#DC2626,stroke-width:2px,color:#7F1D1D;
    classDef outcome fill:#DCFCE7,stroke:#16A34A,stroke-width:2px,color:#14532D;
    class A actor;
    class B,I,J outcome;
    class C,F,K system;
    class D,G decision;
    class E,H risk;
    linkStyle default stroke:#94A3B8,stroke-width:2px;
```

## How It Should Work

* The setup link should identify the invited user securely.
* The invited user should set and confirm a new password.
* The password should follow the system's password rules.
* After the password is saved, the user's email should be marked verified.
* The user should then be directed to the creditor login page.
* The user should only receive access assigned by the creditor account.

## How It Should Not Work

* It should not allow password setup for an unrelated email address.
* It should not allow expired, invalid, or already-used setup links.
* It should not save a password that fails the password rules.
* It should not verify the user before the password is successfully saved.
* It should not give the invited user access outside the creditor account they were invited into.

## Developer Notes

* Protect login, registration, verification, and password reset redirects from sending users to the wrong portal state.
* Preserve creditor company ownership and email verification behavior across all auth paths.
* Treat setup links as single-use and scoped to the invited user.

## Related App Areas

* `routes/creditor/auth.php`
* `app/Livewire/Creditor/Auth`