Invite and manage members

> Requires: Fundations Pro

Owners and admins can invite people by email, WhatsApp, or a shareable magic link to join a campaign, event, or team, then manage and remove members afterwards. Each container can be open to anyone, invite only, or a mix of both. The free plugin ships the membership setting and the upsell; Pro adds the invitation engine, the owner panel, and the admin Members page.

Why use this

Open peer-to-peer fundraising lets anyone start a page under a campaign. That is the right default for a public drive, but plenty of campaigns are not public: a company team, a school class, an event with a vetted roster. Those need to control who joins. Invitations give an owner a way to bring specific people in by email or link, decline list and all, while still leaving the page authoring to the invitee.

How it works at a glance

There are two sides to this feature, by design.

• Membership mode is a free setting on each container. It decides whether the container is open, invited_only, or hybrid. With the free plugin alone, everything stays open.
• The invitation engine is Pro. It enforces the mode, sends invites, accepts them safely, and lets owners manage their members.

An accepted member is just a normal child page. When someone accepts an invite, they land in the wizard and author their own get_fund_action, joined to the container through the usual _get_fund_campaign_id, _get_fund_event_id, or _get_fund_team_id meta. The invite record is a gate and an audit trail, never the source of truth for “is this person a member”. That means removing a member detaches their page from the container without deleting the page or its donations.

The free side

Even without Pro, the building blocks are present, so turning the feature on is just a matter of activating Pro:

• _get_fund_membership_mode is registered on get_fund_action, get_fund_event, and get_fund_team, with values open, invited_only, and hybrid (default open).
• Fundations > Settings > Members exposes get_fund_invites_enabled and get_fund_invite_permission_mode (owner_manage or admin_only).
• An upsell card explains what Pro adds.
• The wizard fires do_action( 'get_fund_wizard_campaign_options' ) where Pro injects the membership field.

A related free control, _get_fund_children_disabled, locks a campaign so no new children can join it at all, which is enforced everywhere a join can happen (wizard, frontend edit, group assignment).

The Pro side

Membership modes

Mode	Who can join
open	Anyone, the standard P2P behaviour.
invited_only	Only people with a valid invite.
hybrid	Both: open to the public and to invitees.

The owner sets the mode from the block editor panel on the container, or an admin sets it from the Members page.

Permission modes

get_fund_invite_permission_mode decides who may invite and manage:

• owner_manage: the container owner manages their own members, plus admins.
• admin_only: only administrators.

Invitation channels

An invite can be delivered three ways: a direct email from the site, a WhatsApp share, or a magic link the owner copies and sends however they like. All three carry the same token.

Token model

Invites are built to resist abuse:

• The token is 256 bits from random_bytes(32).
• Only the SHA-256 hash is stored; the raw token lives in the link.
• It expires after 72 hours (filterable with get_fund_invite_token_ttl).
• It is single use, redeemed atomically.
• It is bound to the invited email address.

Account-takeover guard

Accepting an invite never logs you into, or creates, someone else’s account. If the invited email already belongs to a user, that user must log in to accept. The engine refuses to invite addresses that belong to users with the edit_others_posts capability, so an invite can never be used to step into an admin account.

Removing members and revoking invites

These are two different actions:

• Revoke cancels a pending invite that has not been accepted.
• Remove detaches an accepted member. It deletes only the join meta, leaving the member’s page and donations intact, and fires get_fund_member_removed. It is reversible: the page can be reassigned later.

A declined invite is suppressed permanently, so a person who said no is never re-invited.

Bulk invites

Both the admin page and the owner panel accept a list of addresses separated by new lines, commas, or semicolons. The list is parsed, then each address goes through the same per-invite checks. The batch is capped (get_fund_invite_bulk_max, default 50) and rate limited per owner.

Where you manage members

The owner panel (front end)

Pro adds a get-fund/manage-members block that renders for the owner through the frontend edit flow and from the My Fundations and My Teams sub-pages. From it an owner sets the membership mode, sends single or bulk invites, copies a share link, resends or revokes pending invites, and removes accepted members. See the Manage Members block reference.

The admin Members page

Pro registers a Members page under the Fundations menu (at admin_menu priority 25, replacing the free stub). It lists invites and members per container, with a picker for campaigns, events, and teams, and server-side forms to invite, resend, revoke, and remove.

How to set it up

1. Activate and license Fundations Pro.
2. Go to Fundations > Settings > Members and enable invitations.
3. Choose the permission mode (owner_manage or admin_only).
4. Open a campaign, event, or team in the block editor and set its membership mode.
5. Invite people from the owner panel on the front end, or from Fundations > Members in the admin.

What you can and cannot do

You can run open, invite-only, and hybrid containers side by side; invite by email, WhatsApp, or link; invite in bulk; resend, revoke, and remove; and let owners manage their own people without an admin account. Removing a member keeps their page and history.

You cannot use an invite to take over an existing account: the recipient logs in to accept. You cannot invite an administrator-level email. Invites expire after 72 hours by default, and a declined invite will not be sent again.

Privacy

Pending invites store the invitee email, a consent basis, and a consent timestamp and IP for audit. These are included in the WordPress personal-data export and erasure tools through the get_fund_export_personal_data and get_fund_erase_personal_data filters. The invites table is dropped on uninstall.

Developer reference

Symbol	Type	Notes
_get_fund_membership_mode	post meta	open, invited_only, or hybrid, on all three container CPTs.
get_fund_invites_enabled	option	Master toggle (free setting, Pro enforces it).
get_fund_invite_permission_mode	option	owner_manage or admin_only.
get_fund_member_removed	action	Fires when an accepted member is detached.
get_fund_wizard_campaign_options	action	Where Pro renders the wizard membership field.
get_fund_invite_token_ttl	filter	Token lifetime in seconds (default 72h).
get_fund_invite_bulk_max	filter	Maximum addresses per bulk invite (default 50).
{prefix}get_fund_invites	table	Pro invites table; created on init when licensed, dropped on uninstall.

The Pro engine is Get_Fund_Member_Invites_Pro; the owner block is Get_Fund_Manage_Members_Block; the admin page is Get_Fund_Invites_Admin_Page.