Approve or Reject a Pending Invite Link

A pending QCFUM Invite Link has not yet become a normal recipient-facing setup link. Approval is the point at which QCFUM generates a fresh secure token, stores only its hash, and activates delivery.

Rejection preserves the invitation record but moves it to a rejected state. The reviewer never needs to view or copy a plaintext invite token.

Approve a Pending Invite

The reviewer must have qcfum.admin.approvals, and the Invite Link must still have status pending. QCFUM then generates a new 32-byte token, writes its HMAC-SHA256 hash to token_hash, clears the pending-token hash, and builds the setup URL only for the delivery step.

Delivery After Approval

If the Invite Pack is configured to send the invitation email, QCFUM sends the selected Invite Link email template to the recipient with the newly generated link. It then changes the invitation status to sent. If mail delivery is queued or fails, the approval still completes and QCFUM reports that email can be retried through the email workflow.

Reject a Pending Invite

Reject clears the pending-token hash, changes the invitation to rejected, keeps the historical record, sends the applicable rejection outcome notice to the original creator when available, and writes an audit event.

Why a Fresh Token Matters

  • No stored plaintext token has to be revealed to the reviewer.
  • The approved recipient link is generated at decision time rather than exposing an earlier secret.
  • A rejected pending invitation has no approved recipient token to use.

Verify the Result

After approval, confirm the Invite Link shows Sent and verify delivery through QCFUM’s email/tracker evidence rather than asking staff to copy a secret URL. After rejection, confirm the record remains visible as Rejected for history.

Community Discussion

Want to compare Joomla user-onboarding workflows, share practical QCFUM tips, or discuss how other administrators use this feature? Visit the QC Frontend User Manager Community. For private support, bug reports, account-specific entitlement problems, or feature requests, use the QuantaCade support system.