v0.48.0
July 12, 2026
Federated identity (Phase 1): you can now invite someone who already works on another FlowSharp tenant — same installation — to operate on yours too, without creating a second account with a separate password. They always remain the owner of their identity: you invite, they accept, and they can move between companies with one click, always keeping it clear "where they are".
-
Feature
Federated external users
**Invite with an email.** From the Users page, an Admin can invite anyone who already has an internal account on another tenant of the same FlowSharp installation, assigning them a role (Admin/FlowDesigner/Operator/ReadOnly) valid only for your tenant. No password needed: the invited user always signs in with their original credentials. **Accept, list, revoke.** In this Phase 1 acceptance happens via API (the invite does not yet appear as a notification in the interface — that arrives in later phases); once accepted, the hosting tenant shows up in the invited user's "workspaces" selector. The hosting tenant's Admin sees who has external access and can revoke it at any time — revocation is immediate, even on an already-open session. **New "External users" section in the Users page:** a list separate from internal users, with status (pending/active/revoked) and one-click revocation.
-
Feature
Workspace switching
**Change tenant with one click.** From their own menu, whoever accepted an invite can move to the hosting tenant and come back to their own without logout/login — the same mechanism already proven for SuperAdmin impersonation, reused here for regular users. **WorkspaceSwitcher + coloured session bar.** While operating on a "borrowed" tenant, a coloured bar (the hosting tenant's brand colour) stays visible at the top, so you never lose track of which company you are working in.
-
Security
Deterministic login
**No more ambiguity on shared emails.** A federated user has, by construction, the same email as their internal account on another tenant. Login now only considers "internal" accounts with their own password — federated users never have a local password and reach a hosting tenant only through the switch from an already-authenticated session, never from a direct login. **Revocation cuts the session immediately.** If an Admin revokes an external user's access while they are already operating on the hosting tenant, the session is invalidated on the next request, without waiting for the token's natural expiry.