Staff Can't Log In

"Not authorized" after previously working fine

Cause: A change to the staff Clerk application's production domain invalidates the underlying Clerk user ID for anyone who signed in before that change. Clerk issues a new user ID; the old one 404s, and the app correctly reports the staff member as not found — because, from its point of view, their old identity no longer exists.

Fix:

1. Confirm it: look up the affected StaffMember's stored Clerk user ID against Clerk directly. A "resource not found" response confirms this is the cause.
2. Clear that StaffMember's stored Clerk user ID back to empty — the same state a pending invite is in.
3. Have them sign in again normally. The existing "claim by matching email" logic re-links their new Clerk identity to their existing StaffMember record automatically — no other change needed, and none of their history (past actions, role, audit log entries) is affected.

If this happens to one staff member right after a known domain change, check every active staff member at once rather than fixing them one at a time as each person happens to complain.

Invited but the invite link doesn't work

Confirm the invite hasn't expired or already been used, and that whoever's clicking it is signing in with the exact email address the invite was sent to — a mismatch here is the most common cause, not a broken link.

Signed in, but blocked from an action they should be able to do

This is very likely an approval gate, not a login problem — a FRONT_DESK account is supposed to be blocked from issuing a refund unsupervised, for example. Check whether a PendingApproval was actually created for the attempted action before assuming something's broken.