Module · Staff & HRM
The cashier sees payments. Not the network.
Staff accounts under any reseller tier, each carrying an explicit permission list. What someone can see and do is a checked property of every API call — not a tab you hoped they wouldn't find.
What it does
Built in, not bolted on.
Staff accounts
Every employee gets their own login under their reseller — no more one shared password for the whole office.
Granular permissions
Permissions are a JSONB list checked per endpoint. Grant customer-read without customer-delete, payments without policies.
Two-factor authentication
TOTP-based MFA with a challenge/verify flow — for staff and resellers alike. A leaked password alone opens nothing.
Forced password change
New accounts and resets land on a mandatory password change before anything else. Default credentials never survive day one.
Idle session timeout
Sessions slide on a 15-minute idle window, enforced server-side in Redis. The terminal left open at the shop locks itself.
Activity log
Every action records the staff member who performed it. 'Who disabled this customer?' has an answer with a timestamp.
Permission check
Authority is a list, checked on every call.
kamran @ faisal-tradersrole ............. staff (cashier)mfa .............. verified · TOTP permissions["customers.view", "payments.create", "topups.view", "reports.sales"] POST /payments ............ allowedGET /customers ........... allowed (own subtree)POST /customers/disable ... deniedGET /nas ................. denied every call logged → activity_log- 01
Scoped twice
A staff member is bounded by their reseller's subtree and by their permission list. The cashier in one franchise can't see another franchise — or their own franchise's network settings.
- 02
Deny by default
A permission not on the list is a 403, enforced by middleware on the backend. UI hiding is a courtesy; the API check is the security.
- 03
Accountability built in
Actions carry the actor. When a customer was deleted or a discount appeared, the activity log names the person, not the shared login.
Screenshot coming — the staff permission editor, captured from the live product.
What it replaces
Retire the workaround.
The whole office logging in as 'admin' with the password on a sticky note.
Personal accounts with personal permissions and MFA. The sticky note retires.
An ex-employee who still knows the one password everyone uses.
Disable their account. Everyone else keeps working; the audit trail keeps their history.
Finding out 'someone' waived a month of bills, with no way to learn who.
Every waiver, edit and delete is attributed in the activity log — name, action, timestamp, origin.
Keep exploring