Users, roles and sign-in rules
On this page
Everybody who signs in is a user: your head-office staff and your dealers alike. One box on the user form, Belongs to dealer, separates them. A user without a dealer is staff and signs in at admin/login.php; a user attached to a dealer is a dealer-portal login and signs in at dealer/login.php. Each sign-in page turns the other kind away with a short note. What a staff member may do is decided by their role.
Users
Admin → Users lists every account. Search by name, e-mail or phone, pick a role, or narrow it to Head-office staff or Dealer logins. The list shows the role, which dealer the account belongs to, its login window, the last sign-in and the status.
+ Add a user opens the form:
| Field | What it is for |
|---|---|
| Full name, E-mail | Both required. The e-mail is the sign-in name and must be unique. |
| Password | At least 6 characters. When editing, leave it empty to keep the current one. |
| Phone, WhatsApp, Photo | Optional. The photo shows in the top bar and in lists. |
| Role | The permission set (see below). A staff user without a role cannot open the panel. |
| Belongs to dealer | Leave on staff (head office), or pick a dealer to make this a dealer-portal login. |
| Status | Active, Pending, Suspended or Inactive. Only an Active user can sign in. |
Two ticks sit under the form. Ask this user to change their password at the next sign-in shows them a reminder on their profile page until they choose a new password. E-mail the sign-in details to this user (only when adding) sends the account created e-mail with the address, the password and the right sign-in link.
Beside each user: Edit, Suspend or Activate, and × to delete. You cannot suspend or delete your own account from this page (use My profile), and the last active Super Admin cannot be deleted until another one exists.
Dealer logins are usually made on the dealer's own form under Dealer login (optional), see Dealer Network. They get the built-in Dealer role.
Roles and permissions
Admin → Roles & Permissions lists the roles, how many permissions each carries and how many users hold it (click the number to see them). Five roles are built in:
| Role | Out of the box |
|---|---|
| Super Admin | Everything. It always keeps full access, whatever you tick. |
| Administrator | Everything except roles, Authorized Users, Addons and the License page. |
| Manager | Dealers (but not approving them), products, serials, free products, price lists, invoices and payments, warranty and claims, tickets. |
| Staff | Views dealers and products; writes invoices, registers warranties, answers tickets. |
| Dealer | Nothing in the admin panel. Used by dealer-portal logins. |
Built-in roles cannot be deleted and their slug is fixed, but you may change their permissions; a script update keeps your changes (only Super Admin is put back to full access).
+ Add a role asks for a Role name, an optional Slug (made from the name when empty), and the permissions. Full access to everything is a shortcut that ticks the lot, including permissions added in later versions. A role that is still given to somebody cannot be deleted: move those users first.
The permissions, grouped as on the screen:
| Group | Permissions |
|---|---|
| Admin Panel | Open the admin panel · See dashboard statistics |
| Dealers | View dealers · Add / edit / delete dealers · Approve or suspend dealers · Manage sub-dealers |
| Catalogue | View brands & products · Add / edit / delete brands · Add / edit / delete products · Add / edit / delete product serials · Manage free / gift products · Create & publish price lists |
| Sales | View invoices · Create / edit / delete invoices · Send invoices by email / SMS / WhatsApp · Record invoice payments |
| Warranty | View warranty registrations · Register / edit warranties · Approve, replace or reject claims |
| Support | View support tickets · Reply to and close tickets · Compose & send newsletters · Send dashboard notifications |
| System | Add / edit / delete users · Add / edit / delete roles · Set allowed login times per user · View login history & activity logs · Enable / disable / upload addons · Change system settings · Customise theme, logo & icons · Configure e-mail (PHPMail / SMTP) · Configure & run data synchronisation · View & manage the script license |
Without Open the admin panel a staff user is turned away, whatever else is ticked. Menu entries the role cannot use are hidden.
Authorized Users: when and from where
Admin → Authorized Users decides when each person may sign in. Every user has one row:
- From and To: the allowed hours. Overnight windows such as 22:00 – 06:00 work. Leave both empty for any time.
- Days: tick Mon to Sun. No day ticked means every day.
- Allowed networks: IP addresses, separated by commas. A star matches the rest, so
103.5.*allows a whole office range and192.168.0.10one machine. Empty means anywhere.
Press Save on the row, or Clear to remove every restriction. To give a whole team the same hours, tick their rows, fill in the times and days in the bottom bar (Apply to the ticked users:) and press Apply. The bulk bar sets hours and days only, not networks.
The rules are checked at sign-in, by your site's clock (Admin → Settings → General → Timezone, Asia/Dhaka by default). A person who tries outside their hours sees a Login time is over box with the allowed hours, a line in Bengali and a WhatsApp support button to the Support WhatsApp number from Settings → Support contacts (or your company phone).
Login History
Admin → Login History records every attempt. The tiles count Successful, Failed, Blocked (outside allowed hours, wrong network, suspended, waiting for approval, wrong sign-in page) and Today; click one to filter. Each row shows the time, the user, the e-mail typed, the IP, the browser and the reason. Clean up deletes records older than the days you give (90 by default).
Activity Logs
Admin → Activity Logs lists what people did: users added, roles changed, settings saved, invoices saved and so on. Filter by words, user or action. Rows without a person are marked System. Clean up works as on Login History.
When the script author signs in for support through the License Center's login as bridge, nothing is written to either log. The panel shows a yellow banner for the whole visit, and the user menu offers End "login as" session. See The licence key and addon keys.
My profile
Every staff member opens their own page from the picture at the top right → My profile: Your details (name, e-mail, phone, WhatsApp, photo), Change your password, an Account card (role, status, login window, last sign-in), and their last ten sign-ins and actions. Dealers have their own profile in the portal, see The dealer portal and the front page.