Pending invitations
I've just noticed that I can cancel pending invitations, and see invited potential members email addresses in the Loomio Community for people I did not invite.
This raises some privacy and security concerns for me and I suggest that the access controls get adjusted so only administrators and people who have issued the invitations can see them, and act on them. Options could be given to groups to set the levels of access they are comfortable with.
So the stories here would be:
- Member cannot cancel an invitation sent by another member
- Coordinator cancels an invitation sent by another member
So group coordinators will still have this ability. Do we all agree with these stories? If so we can add them to Pivotal (our project management system).
And that the pending invitations be private to the person who invited them and the group coordinator.
Hrrrmmm... lets just remove manage memberships/pending invitations stuff from non coordinators.
So if allowed members can send invitations but they cannot perform any management stuff.
Hmmm that does seem wrong doesn't it. This is a group that is set up as 'anyone can invite new members', but it doesn't make sense for one member to cancel another's invitation.