Admin User Management Guide

Product: Lofty Golden Oil ERP
URL: https://loftygoldenoil.com
Applicable Roles: Admin

---

Overview

The User Management module allows administrators to create, edit, deactivate, and delete user accounts. Each user is assigned a role that determines their access permissions across the entire ERP system. User data is stored in the users table with passwords hashed using bcrypt.

Access: Navigate to Users in the left sidebar. Only users with the Admin role can access this module.

---

User List

1. Click Users in the left sidebar.
2. The User Management page loads with a DataTable displaying all registered users.

Table Columns

Column	Description
Name	Full name of the user
Email	Email address used for login
Role	Assigned role (Admin, Production, Sales, Accountant)
Status	Account status (Active or Inactive)
Created	Date and time the account was created
Actions	Edit, Delete, and other available actions

Search and Filter

• Search: Use the search bar to filter users by name or email.
• Role Filter: Select a specific role from the dropdown to view only users with that role.
• Status Filter: Filter by Active or Inactive status.

---

User Roles Explained

Each user is assigned exactly one role. The role determines which modules and features the user can access.

Admin

Full access to everything.

Access Area	Permissions
Dashboard	View
Users	Create, Read, Update, Delete
Settings	Full access
Inventory	Full access
Purchases	Full access
Production	Full access
Sales	Full access
Customers	Full access
Accounting	Full access
Expenses	Full access
Requisitions	Full access (all levels)
Activity/Audit Log	View
Reports	Full access

Production

Focus: Inventory management and production operations.

Access Area	Permissions
Dashboard	View
Inventory	Create, Read, Update
Production Runs	Create, Read, Update
Purchases	View
Requisitions	Create (as Requester)

Sales

Focus: Customer management, sales, and invoicing.

Access Area	Permissions
Dashboard	View
Customers	Create, Read, Update
Sales	Create, Read, Update
Invoicing	Create, Read, Update
Inventory	View
Requisitions	Create (as Requester)

Accountant

Focus: Financial management and expense tracking.

Access Area	Permissions
Dashboard	View
Expenses	Full access
Accounting	Full access (GL, Vouchers, Journal Entries, Trial Balance, P&L)
Invoicing	View
Requisitions	Approve (as Accounts level)

Requisition Roles

The requisition approval workflow uses a four-level hierarchy. Users can be assigned one or more of these roles:

Role	Level	Permissions
Requester	1	Create requisitions, view own requisitions
Supervisor	2	Approve/reject requisitions from Requesters
Manager	3	Approve/reject requisitions from Supervisors
Accounts	4	Approve/reject requisitions from Managers (financial review)
MD (Managing Director)	5	Final approval authority for all requisitions

Requisition Workflow:

Requester → Supervisor → Manager → Accounts → MD

Each level must approve before the requisition advances to the next level.

---

Adding a New User

Step-by-Step

1. Click + New User on the User Management page.
2. The user creation form opens.
3. Fill in the following fields:

Field	Required	Description
Full Name	Yes*	Enter the user's full name (e.g., "Adebayo Johnson")
Email	Yes*	Enter a valid email address (used for login and notifications)
Password	Yes*	Enter a password (minimum 6 characters)
Confirm Password	Yes*	Re-enter the password to confirm
Role	Yes*	Select from the dropdown: Admin, Production, Sales, Accountant
Status	Yes*	Select Active (user can log in) or Inactive (user is blocked)

4. Review all fields for accuracy.
5. Click Save to create the user.
6. A welcome email is automatically sent to the new user's email address via the Resend email service.
7. The new user appears in the User Management table.

Password Requirements

• Minimum 6 characters
• Passwords are hashed using bcrypt before storage
• Passwords are never stored in plain text
• The system enforces password confirmation to prevent typos

Welcome Email

When a new user is created, the system sends a branded welcome email containing:

• A greeting with the user's name
• Their login email address
• A link to the login page at https://loftygoldenoil.com
• Instructions to use the password provided by the administrator
• A prompt to change their password after first login

---

Editing a User

1. Click Users in the sidebar to view the user list.
2. Locate the user you want to edit.
3. Click the Edit button (pencil icon) in the Actions column.
4. The user edit form opens with current values pre-filled.
5. Modify any fields as needed:
   • Name: Update the user's full name
   • Email: Change the email address (this also changes their login credential)
   • Role: Change the user's role (takes effect on next login)
   • Status: Toggle between Active and Inactive
6. Click Save to apply changes.
7. Changes are logged to the audit trail.

Note: If you change a user's email, inform the user of their new login email. If you change their role, inform them of their new access permissions.

---

Deleting a User

1. Click Users in the sidebar to view the user list.
2. Locate the user you want to delete.
3. Click the Delete button (trash icon) in the Actions column.
4. A confirmation dialog appears:

   "Are you sure you want to delete this user? This action cannot be undone."

5. Click Confirm to permanently delete the user.
6. The user is removed from the system and the database.

Important Restrictions

• You cannot delete your own account. The Delete button is disabled for your own user record.
• Deletion is permanent. There is no undo. The user's data may be retained in historical records (sales, requisitions, etc.) but the user account is removed.
• Consider deactivating instead. If you may need to restore the user later, use the Inactive status instead of deletion.

---

Password Management

Resetting a User's Password

1. If a user forgets their password, they can use the Forgot Password link on the login page.
2. The system sends a password reset email via Resend with a secure reset link.
3. The user clicks the link and creates a new password (minimum 6 characters).
4. The new password is hashed with bcrypt and stored securely.

Admin Password Reset

1. As an Admin, you can reset a user's password directly:
   • Edit the user account.
   • Enter a new password in the Password field.
   • Confirm the new password.
   • Save the changes.
2. Inform the user of their new temporary password.
3. Recommend they change it after logging in.

Password Security

• All passwords are hashed using bcrypt with salt before storage.
• Plain-text passwords are never stored in the database.
• Password reset links expire after a limited time for security.
• The system enforces a minimum password length of 6 characters.

---

Role-Based Access Control (RBAC)

The sidebar navigation and available features change dynamically based on the logged-in user's role.

How RBAC Works

1. When a user logs in, the system checks their assigned role.
2. The sidebar only displays modules the user has access to.
3. API endpoints verify the user's role before processing requests.
4. Unauthorized access attempts are logged to the audit trail.

Sidebar Navigation by Role

Module	Admin	Production	Sales	Accountant
Dashboard	✓	✓	✓	✓
Users	✓	—	—	—
Settings	✓	—	—	—
Inventory	✓	✓	View	—
Purchases	✓	View	—	—
Production	✓	✓	—	—
Sales	✓	—	✓	—
Customers	✓	—	✓	—
Invoicing	✓	—	✓	View
Accounting	✓	—	—	✓
Expenses	✓	—	—	✓
Requisitions	✓	✓ (Requester)	✓ (Requester)	✓ (Accounts)
Activity Log	✓	—	—	—
Reports	✓	—	—	—

---

User Status

Active

• User can log in and access all modules permitted by their role.
• Displayed with a green badge or indicator.
• This is the default status for new users.

Inactive

• User cannot log in. Login attempts are rejected.
• Displayed with a red badge or indicator.
• The user's account and data are preserved.
• Use this status for:
  • Temporarily suspending access
  • Employees on leave
  • Departed employees (before deletion)

Toggling Status

1. Edit the user account.
2. Change the Status dropdown between Active and Inactive.
3. Save the changes.
4. If set to Inactive, the user is immediately logged out (if currently logged in) and cannot log back in.

---

Bulk Actions

1. Select multiple users by clicking the checkboxes next to their names in the table.
2. Bulk action buttons appear (e.g., Delete Selected).
3. Click the desired bulk action.
4. A confirmation dialog shows the number of users affected.
5. Confirm to apply the action to all selected users.

Caution: Bulk delete is irreversible. Double-check your selection before confirming.

---

CSV Export

1. Navigate to the User Management page.
2. Click the Export button.
3. A CSV file is generated containing all user records with the following fields:
   • Name
   • Email
   • Role
   • Status
   • Created Date
4. Save the file for external reporting or auditing.

---

Security Best Practices

Strong Passwords

• Require all users to use strong passwords (minimum 6 characters, include a mix of letters, numbers, and symbols).
• Encourage users to change their password after first login.
• Never share passwords over unsecured channels.

Minimum Required Role

• Assign users the minimum role necessary for their job function.
• A salesperson does not need Admin access.
• A production worker does not need Accounting access.
• Review role assignments quarterly.

Regular User List Reviews

• Review the user list monthly to ensure only authorized personnel have access.
• Deactivate accounts for departed employees immediately.
• Remove accounts for contractors or temporary workers when their engagement ends.
• Verify that role assignments are still appropriate.

Immediate Deactivation

• When an employee departs, immediately set their status to Inactive.
• Do not wait to delete the account — Inactive status is sufficient to block access.
• Review and revoke any API keys or external access the user may have had.

Audit Trail

• All user management actions (create, edit, delete) are logged to the audit trail.
• Regularly review the Activity Log for unauthorized changes.
• Investigate any unexpected user creation or role changes.

---

Troubleshooting

Issue	Solution
Cannot see Users in sidebar	Verify your role is Admin
Welcome email not received	Check spam/junk folder; verify Resend API key is configured in System Settings
User cannot log in	Verify their status is Active; check email address matches exactly
Password reset email not arriving	Check Resend configuration; verify user's email address
Cannot delete own account	This is by design — Admin cannot delete themselves
Role change not taking effect	User may need to log out and log back in for sidebar to update