Managing Organizations and Users

How Range Lab admins set up a partner organization, configure what it can use, and get its people signed in.

Overview

Pathfinder is multi-tenant. Every partner agency is an organization, every person is a user with one base role, and organization roles always belong to exactly one organization.

As a Range Lab admin you can:

  • Create organizations and set their tier and modules
  • Invite users by email, or create accounts with a temporary password
  • Edit roles, organization assignment, names, emails, and passwords
  • Archive and restore users
  • Let each organization's admin manage their own staff

Accessing the Admin Area

  1. Sign in with a Range Lab admin account
  2. Click Admin in the navigation
  3. Use Organizations and Users in the sidebar

Direct links: /admin/organizations and /admin/users

Setting Up a New Organization

This is the flow for onboarding an agency that wants to try Pathfinder. It takes about two minutes and never leaves the Organizations page.

1. Create the organization

  • Go to Admin → Organizations and click Add Organization
  • Fill in the name, type, and contact details
  • Pick a tier. The tier decides which modules the organization gets by default:
    • Basic: Clients, Intake
    • Standard: adds Resources, Jobs, Events, Referrals, Vault
    • Premium and Enterprise: add Grants and Reports
  • Click Create Organization

2. Invite the first org admin

As soon as the organization is created, the Add User panel opens with the organization already filled in and the role set to Organization Admin.

  • Enter the person's email and name
  • Leave Send an invite email selected
  • Click Send Invite

They receive an email with a link to choose their password. Once signed in, they can add their own caseworkers from Admin → Users without involving Range Lab.

You can click Skip for now and do this later from the organization's row.

3. Adjust modules (optional)

Click Modules on the organization's row to change the tier or override the default module set. Most trial organizations can stay on the tier defaults.

Adding more people to an organization later

  • On the Organizations page, click Add user on the organization's row. The organization is pre-filled.
  • Or click the member count on the row to see everyone in that organization, then click Add User.

User Roles

Pathfinder has two kinds of base role.

Range Lab roles (network-wide, no organization)

Admin

  • Full access to every organization and all admin tools
  • Creates organizations and users of any role

Staff

  • Curates shared catalogs such as the resource library
  • Sees across organizations but cannot manage users

Organization roles (belong to one organization)

Organization Admin

  • Manages the organization's settings and users
  • Can add Supervisors, Caseworkers, and Viewers to their own organization
  • Cannot create other org admins or Range Lab roles

Supervisor

  • Everything a caseworker can do, plus archiving and inventory management

Caseworker

  • Day-to-day client management inside the organization

Viewer

  • Read-only access inside the organization

Resources module roles

When an organization has the Resources module, Supervisors, Caseworkers, and Viewers can also be given a resources role: Ranger (own drafts), Senior Ranger (approve and publish), or Steward (full management). Org admins do not need one; they bypass module role checks.

Adding a User

Open Admin → Users and click Add User. The same panel is used everywhere a user can be added.

Who

  • Email address (required, unique, normalized to lowercase)
  • First and last name

Access

  • Base role. Range Lab admins can assign any role. Org admins see only Supervisor, Caseworker, and Viewer.
  • Organization. Required for every organization role. Hidden for Range Lab roles.
  • Resources role, when the organization has the Resources module and the base role is not org admin.

How they sign in

  • Send an invite email (recommended). They get a link to set their own password. Nothing to hand over.
  • Set a temporary password. The account is active immediately and you share the password with them securely. Minimum 6 characters. The panel shows the password once after creation.

After creation the panel confirms what happened and offers Add another user, which keeps the organization and role selected so a batch of invites is quick.

Everything is created in one server call: the sign-in account, the profile, and the resources role. If any step fails, nothing is left behind and you can retry with the same email.

Editing a User

From Admin → Users, click Edit on the user's row.

Can change:

  • First and last name
  • Email address (synced to sign-in and normalized to lowercase)
  • Password (set a new one directly)
  • Base role
  • Organization
  • Resources role

Rules enforced on save:

  • Organization roles must have an organization
  • Range Lab roles never point at a partner organization
  • Org admins can only edit Supervisors, Caseworkers, and Viewers inside their own organization, and cannot change their own role

Archiving and Restoring

Users are archived, not deleted. Archived users cannot sign in, keep their history, and can be restored.

  1. Find the user in Admin → Users
  2. Click Archive in the Actions column
  3. Confirm on the next page

To restore, tick Show Archived, find the user, and click Restore.

Users Table

  • Search by name or email
  • Filter by role and by organization
  • Sort any column by clicking its header
  • Show Archived toggles archived users into the list
  • Rows per page: 10, 25, 50, or 100

Opening /admin/users?org=<organization id> filters to one organization. The member count on each organization's row links there.

Troubleshooting

The invite email never arrives

  • Check spam, then confirm the address on the user's row is correct
  • The invite link points at /auth/reset-password on the site URL. That URL must be in the Supabase project's redirect allowlist, and NEXT_PUBLIC_SITE_URL must match the deployed domain
  • Invite links expire. Archive and re-create the user to send a fresh one

"A user with this email already exists"

The email is already on a profile or sign-in account. Search the Users list with Show Archived ticked. Restore or edit the existing user instead of creating a new one.

"Organization roles require an organization"

Pick an organization for Supervisor, Caseworker, Viewer, or Organization Admin. Only Range Lab roles go without one.

"The Resources module is not enabled for this organization"

Open the organization's Modules panel and enable Resources, or leave the resources role empty.

"Permission denied" or 403

Creating users requires a Range Lab admin or an org admin. Org admins can only add Supervisor, Caseworker, and Viewer inside their own organization. On a self-hosted install, confirm SUPABASE_SERVICE_ROLE_KEY is set on the server. It is never exposed to the browser.

Quick Reference

Onboarding checklist for a trial organization

  • [ ] Organization created with the right tier
  • [ ] First org admin invited
  • [ ] Org admin confirmed they can sign in
  • [ ] Modules reviewed if the tier defaults are not right
  • [ ] Org admin shown how to add their own caseworkers

Who can do what

| Task | Range Lab Admin | Org Admin | |------|-----------------|-----------| | Create organization | Yes | No | | Change tier and modules | Yes | No | | Add Org Admin | Yes | No | | Add Supervisor, Caseworker, Viewer | Any organization | Own organization | | Edit or archive users | Anyone | Own organization, non-admin roles | | Add Range Lab Admin or Staff | Yes | No |

Next Steps