Getting Started
The Security module is always available — but the individual tools and who can use them still need a little setup. This page takes an administrator from a fresh install to a working Offsite Access, Locked Accounts / Active Sessions, and Access Device Logs.
Prerequisites
- PHP ≥ 8.2 and ERPat core ≥ 1.10.0 — required by the module manifest.
- Admin access to the Roles editor (Settings → Roles) for granting permissions.
- Staff users must already exist — Offsite Access windows and access-device passes are assigned to active staff members.
- Your office IP whitelist should be configured (a core setting) for Offsite Access to be meaningful — a grant is an exception to that whitelist. If no IP restriction is enforced, an offsite grant simply has nothing to relax.
The module is on by default
Unlike most modules, Security cannot be turned off. Its umbrella setting
module_security is seeded on and locked — it is listed in
Settings → Manage Modules under the Security category but has no disable
switch (can_disable = false). That guarantees the Security tools are always
reachable. See Administration for the full toggle map.
Activation — two steps
-
Run the module migrations
From the project root. The migrations are idempotent (CREATE-IF-NOT-EXISTS) and are tracked in the module's own
migrations_securitytable. On an existing database they do nothing; on a fresh install or a newly provisioned tenant they create the four tables.php erpat migrate:modules # (or) php erpat migrate:latest -
Grant permissions in Roles
Go to Settings → Roles and give the right roles the four Security permission groups (below). Administrators see everything by default. That's it — there is no module to "switch on".
What the migrations create
Four tables, one per feature area. All four already exist in the base-install schema, so on an existing tenant these run as no-ops:
| Table | Feature | Holds |
|---|---|---|
offsite_access | Offsite Access | One row per grant — user, start date, end date. |
access_device_categories | Access Device Logs | Device category — title, detail, status. |
access_devices | Access Device Logs | Each device — name, category, API key/secret, its "passes" (allowed staff), status. |
access_logs | Access Device Logs | Each access event — device, user, remark, timestamp. |
Locked Accounts & Active Sessions has no table of its own — it reads existing
columns on the users table (failed-attempt counters) and the core session store
(ci_sessions). Full schema on the Reference page.
Granting access in Roles
While the module is active, four Security permission groups appear in the Roles editor. Grant them to the roles that need each tool:
| Roles-editor group | Base key | Style | Unlocks |
|---|---|---|---|
| Security: Offsite Access | offsite_access (+ _create / _update / _delete) |
Dropdown — All / Specific members | The Security → Offsite Access page and the grant/edit/revoke actions. |
| Security: Locked Accounts | locked_accounts |
Simple View | The Security → Locked Accounts page (its Browse tab) and the "Clear Attempts" unlock action. (Holders of the core staff_support permit can also reach it.) |
| Security: Active Sessions | active_sessions (+ _create / _update / _delete) |
Manage (module-level) | The session-management capability on the Active Sessions tab — view, terminate a single session, log a user out of all devices. |
| Security: Access Logs | access_logs (+ _create / _update / _delete) |
Enabled (module-level) | The whole Access Device Logs page — all three tabs (Logs, Devices, Categories). |
With the permissions granted, a Security section appears in the left sidebar. This module contributes three items (a fourth, Device Management, is a separate core feature that shares the same "Security" header):
| Menu item | Opens | Shown when |
|---|---|---|
| Offsite Access | The Offsite Access grants page. | offsite_access permission and the module_offsite_access sub-toggle is on. |
| Locked Accounts | The two-tab Locked Accounts / Active Sessions page. | locked_accounts permission (no sub-toggle). |
| Access Logs | The three-tab Access Device Logs page. | access_logs permission and the module_access sub-toggle is on. |
First-run checklist
Who: an administrator.
Preconditions: migrations run, at least one active staff user.
Run the migrations
php erpat migrate:modules— confirms the four tables exist.Grant the four permission groups
In Roles, give IT/admin roles Offsite Access, Locked Accounts, Active Sessions, and Access Logs. Give HR/support at least Locked Accounts.
Confirm the sidebar
Reload and check the Security group shows Offsite Access, Locked Accounts, and Access Logs. If one is missing, check its sub-toggle (Administration page).
Seed your access-device categories
Only if you use door/access devices: open Access Logs → Categories and add a category or two before registering devices.
Try one action end-to-end
Follow a procedure on Daily Operations — e.g. grant a short offsite window to yourself — and confirm it appears in the tenant's audit log.