Administration
How the module is enabled, which toggles control which menu items, who can do what, and how every sensitive action is recorded. This is the control panel for the whole Security section.
Enablement model
Security uses a three-level enablement model: one umbrella that is always on, and two legacy sub-toggles that individually gate two of the three tools.
| Setting | Default | Controls | Can turn off? |
|---|---|---|---|
module_security umbrella |
On (seeded) | Whether the Security module and its whole menu slice are available. | No — can_disable = false. It is listed in Manage Modules but has no disable switch, so the Security tools are always present. |
module_offsite_access sub-toggle |
Per install | The Offsite Access menu item and screen. | Yes — turning it off hides Offsite Access without affecting the other tools. |
module_access sub-toggle |
Per install | The Access Logs (Access Device Logs) menu item and screen. | Yes — turning it off hides Access Device Logs. |
locked_accounts permission (and the umbrella). So the three menu items are
gated as: Offsite Access = permission + module_offsite_access; Locked Accounts
= permission only; Access Logs = permission + module_access.
module_security is seeded on and cannot be disabled.
The tooling / protection-layer boundary
This module is the admin tooling. The protection layer it operates on stays in ERPat core — do not expect to configure guards, middleware, or RBAC inside this module:
| Control | Where it lives | This module's relationship |
|---|---|---|
| Authentication guards | Core (application/guards/) | Not owned here. |
| Request middleware (secure headers, input sanitization, CSRF, rate-limit, IP restriction, file security) | Core (application/middleware/) | The IP-restriction middleware reads this module's Offsite Access grants. |
| Roles / permissions RBAC editor | Core (Settings → Roles) | This module contributes its four permission groups into it. |
| System audit log | Core (system_logs) | This module writes to it on every sensitive action. |
| Office-IP whitelist | Core IP-restriction settings | Offsite Access grants are time-boxed exceptions to it. |
Permissions
While the module is active, the Roles editor gains four Security permission groups. The keys are unchanged from before modularization, so existing role grants keep working.
| Group (Roles editor) | Keys | Style | Governs |
|---|---|---|---|
| Security: Offsite Access | offsite_access, offsite_access_create, offsite_access_update, offsite_access_delete |
Dropdown — All / Specific members | Viewing and managing offsite grants; "Specific" scopes the list to allowed members. |
| Security: Locked Accounts | locked_accounts |
Simple View (no children) | Opening the Locked Accounts page and clearing failed attempts. The core staff_support permit also grants entry. |
| Security: Active Sessions | active_sessions, active_sessions_create, active_sessions_update, active_sessions_delete |
Manage (module-level) | Viewing and terminating live login sessions. |
| Security: Access Logs | access_logs, access_logs_create, access_logs_update, access_logs_delete |
Enabled (module-level) | The whole Access Device Logs page — Logs, Devices, and Categories tabs. |
The Security menu group
The module contributes a Security sidebar section with three items. Its header coalesces with the core Security group, which also carries the separate core Device Management feature — that item is not part of this module.
| Item | Icon | URL | Gated by |
|---|---|---|---|
| Offsite Access | fa-globe | offsite_access | perm offsite_access + setting module_offsite_access |
| Locked Accounts | fa-shield | Locked_Accounts | perm locked_accounts |
| Access Logs | fa-history | access_logs | perm access_logs + setting module_access |
Each item also ships a hover description (its nav_desc_* line) for the smart
sidebar and the Left Menu Customization editor. "Restore to default" reproduces exactly this
three-item slice under the Security header.
Audit logging
Every sensitive action in the module writes to the tenant's own system audit log, categorized Security. Nothing sensitive happens silently. The events, with their severities:
| Action | Severity | Logged as |
|---|---|---|
| Offsite window granted / updated / revoked | warning | "Offsite access window was granted / updated / revoked" |
| Account unlocked (attempts cleared) | warning | "Account was unlocked (failed login attempts cleared)" |
| All sessions terminated for a user | warning | "All active sessions for a user were terminated" |
| Single session terminated | warning | "A single active session was terminated" |
| Access device registered / updated | info | "Access device was registered / updated" |
| Access device deleted | warning | "Access device was deleted" |
| Device API secret regenerated | critical | "Access device API secret was regenerated" |
| Device category created / updated / deleted | info / warning | "Access device category was created / updated / deleted" |
| Access log entry deleted | warning | "Access log entry was deleted" |