Administration and Controls
How administrators keep Projects secure, configured, and reliable.
Access and Permissions
Start with least-privilege access. Give users only the permissions required for their actual responsibilities, then test using a non-admin account.
- projects
- projects_create
- projects_update
- projects_delete
- can_add_remove_project_members
- tasks
- tasks_create
- tasks_update
- tasks_delete
- add_task_label
- task_manage_labels
- can_update_only_assigned_tasks_status
- can_comment_on_tasks
- show_assigned_tasks_only
- can_create_milestones
- can_edit_milestones
- can_delete_milestones
- can_delete_files
- timesheet_manage_permission
Settings, Menus, and Configuration
Configuration files found
- default_menu.php
- menu.php
- module_config.php
- permissions.php
- routes.php
- settings.php
- widgets.php
Menu entries found
- Submenu Pms All Projects
- Submenu Pms My Tasks
- Submenu Pms View Gantts
- Submenu Pms Timesheets
Automation and Integrations
Scheduled jobs
2 job(s) found. Review cron, job setting gates, and last-run evidence.
Dashboard widgets
Widget registration or widget helper files were found. Validate source data and visibility.
Public pages
No public page config or public-style route was detected.
API surfaces
Two read-only surfaces, both module-owned since 1.6.0. The Integration API serves 15 endpoints under /api/v1 (projects and their sub-resources, tasks, milestones, task statuses) and is granted through the projects:read OAuth scope. The End-User API serves 12 endpoints under /v1/api/me for the Syntry app, scoped to the caller's own project membership and gated by the module_projects tenant flag. Routes are declared in config/api_routes.php and config/euapi_routes.php.
Seeders
Seeder files found: ProjectsDemoSeeder.php. Use them only for the data purpose documented by the module.
Tests
Two suites, run with php erpat module:test Projects: ProjectsNotificationEmailTest covers the task-reminder email content, and ProjectsApiTest guards both API surfaces (controllers link against their base classes, the manifest and route sidecars agree, and the endpoints stay out of core).
Administrative Controls Checklist
- The module toggle is enabled only for tenants or environments where the workflow is approved.
- Role permissions are assigned by responsibility, not by convenience.
- Menu entries, default menu entries, and routes point users to the intended module-owned screens.
- Users know who is allowed to change settings, templates, status rules, and delete actions.
Change Management
- Announce workflow or permission changes before they affect live users.
- Update module README, CHANGELOG, and this guide when a workflow changes.
- For menu, route, permission, widget, API, or migration changes, validate the module from a non-admin account.
- Keep public pages, API examples, dashboard widgets, and scheduled jobs aligned with the real data model.