Users, roles and permissions

Everybody who signs in — the owner, audiologists, the front desk, the lab, accounts, and every dealer — is a user with a role. The role decides which screens they see and what they may change; a sign-in rule can also decide when and from where they may sign in.

Users

Network → Users lists every login with its role, status and last sign-in. Two groups are shown separately: Head-office staff and Dealer logins.

Adding or editing a user asks for Full name, E-mail (the sign-in name), Password, Phone, WhatsApp, Photo, Role and Status. Belongs to dealer attaches the login to a dealer — attaching a dealer turns this into a dealer-portal login: the person then signs in at /dealer/ and sees only that dealer's world. With the Multi-Branch addon a user also belongs to a branch.

A user who leaves is best Suspended rather than deleted: their name stays on everything they did, and Activate brings them back.

Each person changes their own name, photo, phone, WhatsApp and password under the account menu → My profile.

Roles

Network → Roles & Permissions holds the roles. Five come with the script:

You can change what the built-in roles may do and add your own — Audiologist, Front desk, Lab technician, Accounts — with a Role name, a Slug and a tick for every permission. Under Shortcut, Full access to everything gives a role every permission, including the ones future addons will bring. The slug of a built-in role cannot be changed.

The permissions

Permissions are grouped the way the panel is:

Every addon adds its own group when it is switched on — See the diary and Book, move and cancel appointments from Appointments, Read hearing test results and Record and edit hearing test results from Audiology, See salary figures and the payroll from Employees, Adjust stock and run a stock-take and Move stock between branches from Inventory, and so on. A menu entry the role may not use is simply not shown, and a page opened by its address answers not allowed.

Authorized Users — when and where people may sign in

Network → Authorized Users sets Sign-in rules for each user:

• Login window — the hours they may sign in, for example 09:30 to 20:30.
• Days — the days of the week, for example Saturday to Thursday.
• Allowed networks — IP addresses or ranges; leave empty for anywhere.

Tick several users and Apply gives them all the same rules (handy for the whole front desk). Clear removes a user's rules so they may sign in at any time. A user outside their window is refused at the sign-in page with a message saying why, and the attempt is logged.

Login History

System → Login History records every sign-in: When, the User, the Result (Successful, Failed, Blocked), the address and the Device. Filter by user, result and date. Clean up with Delete entries older than keeps the table small.

Several failed attempts on one account in a row deserve a look — and probably a new password.

Activity Logs

System → Activity Logs records what people did: patients added, invoices saved, payments recorded, sales completed, stock adjusted, appointments confirmed, settings changed, addons switched on, licence keys added. Each row has the time, the user, the Action and the Detail. Filter by user, by action and by date; Delete records older than cleans up.

Dealers' own users

Each dealer's portal login is a user with the Dealer role and Belongs to dealer set. From the dealer's page (Network → Dealers → View) you can see their portal users and Add a login. With the Dealer Network addon a dealer can run sub-dealers, each with their own login. See Dealer Network.

Good practice

• Give each person their own login. A shared "reception" account makes the activity log useless.
• Keep the Super Admin role to one or two people.
• Use sign-in rules for staff who only work in the centre: a login that only works during opening hours, from the centre's own connection, is a login that cannot be misused from home.