User management

/user-management/ (needs users.manage) manages staff accounts: Superadmin, Team Lead, Senior, Consultant, and any custom role. Client-portal accounts are separate; see Managing client access.

Creating a user

User Management → New user (/user-management/create/). Set a username, email, and role. The account is provisioned via the same single-use, 24-hour emailed setup link used everywhere else in RedScribe. You never choose a new user’s password yourself; they set their own from the link, then enroll in TOTP MFA on first login.

Managing an existing user

From a user’s detail page (/user-management/<uuid>/):

Edit changes email, name, or role. You can’t change your own role from here (the field is disabled when editing yourself), so get another Superadmin to do it.
Deactivate signs the account out of every active session immediately and blocks further login. Two guardrails prevent locking yourself out of the instance:
- You can’t deactivate your own account.
- You can’t deactivate the last active Superadmin.
Deactivating a user who still has findings assigned to them for review or QA doesn’t reassign those findings automatically. You’ll see a warning listing up to 5 affected findings (by title and client) plus a count of any more, so you know to reassign them to someone else. The assignments themselves are left as they are until you do.
Reactivate restores login access without touching role or assignments.
Send password reset triggers the same emailed reset link a self-service “Forgot password” would, on the user’s behalf. It’s only available for local accounts, not OAuth.
Clear MFA deletes the account’s confirmed TOTP device, forcing re-enrollment at next login. Also local accounts only.

The same last-active-Superadmin protection applies when changing a role away from Superadmin: RedScribe refuses the change with “This is the last active Superadmin — change another account’s role to Superadmin first” rather than letting an instance end up with zero Superadmins.

Account recovery (lost password / lost MFA device)

If a Superadmin (or any local account) loses their password, their TOTP device, or both, there’s no self-service recovery. Fix it directly via the CLI on the web container. This is the escape hatch for when the in-app tools above aren’t usable (e.g. the only Superadmin is themselves locked out).

Find the username, if you don’t already know it:

docker compose exec web python manage.py shell -c "
from apps.accounts.models import User
for u in User.objects.filter(role__is_superadmin=True):
    print(u.username, u.email)
"

Reset the password (interactive, prompts twice, input hidden):
Terminal window
```
docker compose exec web python manage.py changepassword <username>
```

If MFA access is also lost, delete the confirmed TOTP device so the account is forced back through enrollment on next login:

docker compose exec web python manage.py shell -c "
from apps.accounts.models import User
from django_otp.plugins.otp_totp.models import TOTPDevice
u = User.objects.get(username='<username>')
TOTPDevice.objects.filter(user=u).delete()
"

Log in with the new password. With no confirmed TOTP device, the account is routed straight to MFA enrollment (per apps.accounts.middleware) to set up a fresh authenticator.