User Management
Users
The Users page (/app/users) manages user accounts: creation, listing, updates, branch-role assignment, and
three separate POS-specific credentials:
- POS PIN - used to authorize a supervised action at the till (a void, a discount, a cancel)
- POS login PIN - used to log the cashier into the terminal itself
- POS card enrollment/revocation (
/api/users/{id}/pos-card) - ties a physical card to the user for card-tap authorization at supported terminals
Roles
Roles (/app/roles) define the permission set a user is granted. Each permission follows a
<resource>.<verb> convention (for example goods_receipt.post, fixed_asset.dispose,
approval_request.decide) - a role is really just a named bundle of these.
Changing a role’s permissions is itself a sensitive action: the backend exposes an admin unlock password
verification step (/api/roles/verify-admin-unlock), a step-up-authentication pattern requiring a second,
admin-level credential before a role’s permissions can be edited.
Employee Grades & Positions
Configured under Settings, Grades and Positions exist primarily to drive grade/position-based approval routing - rather than naming a specific approver on a template, a stage can route to “whoever holds Grade X” or “whoever holds Position Y.”