# Tenant admin invites (Profile → Admin team)

Inviting staff uses **PHP + service account** (`api/tenant-admin-create.php`, etc.) to:

1. Create a Firebase Auth user (`accounts:signUp`).
2. Write `clients/{clientId}/admins/{newUid}` with `role: "staff"` and a `permissions` map.
3. Patch `userSites/{uid}/{clientId}` and `usersByEmail/{emailKey}/{clientId}` so the user can resolve the store on login (same pattern as `setup.html`).

## RTDB rules

Client devices **cannot** safely write arbitrary `admins/{otherUid}` nodes if your rules follow the common pattern:

```json
"admins": {
  "$uid": {
    ".write": "auth != null && auth.uid === $uid"
  }
}
```

That is OK: **only the server** (service account) performs admin writes. Ensure your deployed rules allow service-account (admin SDK) writes (default) and that end users are not granted overly-broad `.write` on `clients/{clientId}`.

The example snippets in `database.rules.example.json` are minimal; align with your full `database.rules.json`.
