Security
A focused administrator toolkit that sits on top of ERPat's always-on core protection layer — ban a device someone signs in from, grant temporary off-network sign-ins, recover locked accounts, control live login sessions, and keep a log of your physical access devices.
The Security module groups four related administrator screens into one Security sidebar section: Device Management, Offsite Access, Locked Accounts & Active Sessions, and Access Device Logs. It is the tooling on top of ERPat's protection layer — it does not replace it. Authentication guards, the request middleware pipeline (secure headers, CSRF, rate-limiting, IP restriction, file-upload security), the Roles/permissions RBAC editor, and the system audit log all remain in ERPat core. This module gives administrators the day-to-day levers those controls need.
The four tools
A two-tab page. Entries shows the most recent sign-in per person per browser, so you can ban a device and stop that person signing in from it — without touching their account or their other devices. Groups lets you name user-agent groups to filter the list by. Menu: Security → Device Management.
Grant a named staff member a temporary window (start and end date) to sign in from outside your approved office IP addresses. The core IP-restriction middleware checks these grants on every request. Menu: Security → Offsite Access.
A two-tab page. Locked Accounts lists accounts locked by too many failed sign-ins so you can clear the attempts and unlock them. Active Sessions shows each user's live logins so you can end one session or log them out everywhere.
A three-tab page — Logs · Devices · Categories. Register the physical door/access devices (each with an API key & secret it uses), sort them into categories, and review the history of who accessed what and when. Menu label: Access Logs.
What this module owns — and what it doesn't
The line between tooling (this module) and the protection layer (core) matters, because it tells you where to look when something needs changing.
| Concern | Lives in |
|---|---|
| Device Management, Offsite Access, Locked Accounts / Active Sessions, Access Device Logs screens | This module — modules/Security/ |
| The sign-in check that rejects a banned device | Core sign-in — reads this module's ban list |
| Authentication guards (staff / client / customer / guest) | Core — application/guards/ |
| Request middleware (secure headers, input sanitization, CSRF, rate-limit, IP restriction, file security) | Core — application/middleware/ |
| Roles / permissions RBAC editor | Core — Settings → Roles |
| System audit log (the store) | Core — system_logs; this module writes to it |
| The office-IP whitelist that Offsite Access grants relax | Core — IP-restriction settings / middleware |
module_security, and it is seeded on and locked — it cannot be switched
off in Manage Modules, so the Security tools never disappear. There are no per-tool
on/off switches: who sees Device Management, Offsite Access, Locked Accounts or Access Logs
is purely a permissions decision in Settings → Roles. See
Administration.
Explore the guide
Find the module, run migrations, and grant each tool's permission groups.
Click-by-click SOPs for each of the four tools.
Toggles, permissions, the menu group, and audit logging.
Controllers, routes, tables, permission keys, and log events.
The live source files this guide was verified against.
Common questions and the fixes for them.
Who this module is for
- System administrators & IT — ban a lost or untrusted device, grant offsite windows, unlock stuck accounts, end suspicious sessions, and manage door devices.
- HR / support staff — unlock a colleague who is locked out after too many wrong passwords.
- Compliance & security officers — every sensitive action lands in the tenant's audit log for review.
- Facilities / physical-security teams — register the access devices and read the access-log history.