Security
A focused administrator toolkit that sits on top of ERPat's always-on core protection layer — grant temporary off-network sign-ins, recover locked accounts, control live login sessions, and keep a log of your physical access devices.
The Security module groups three related administrator screens into one Security sidebar section: Offsite Access, Locked Accounts & Active Sessions, and Access Device Logs. It is the tooling on top of ERPat's protection layer — it does not replace it. Authentication guards, the request middleware pipeline (secure headers, CSRF, rate-limiting, IP restriction, file-upload security), the Roles/permissions RBAC editor, and the system audit log all remain in ERPat core. This module gives administrators the day-to-day levers those controls need.
The three tools
Grant a named staff member a temporary window (start and end date) to sign in from outside your approved office IP addresses. The core IP-restriction middleware checks these grants on every request. Menu: Security → Offsite Access.
A two-tab page. Locked Accounts lists accounts locked by too many failed sign-ins so you can clear the attempts and unlock them. Active Sessions shows each user's live logins so you can end one session or log them out everywhere.
A three-tab page — Logs · Devices · Categories. Register the physical door/access devices (each with an API key & secret it uses), sort them into categories, and review the history of who accessed what and when. Menu label: Access Logs.
What this module owns — and what it doesn't
The line between tooling (this module) and the protection layer (core) matters, because it tells you where to look when something needs changing.
| Concern | Lives in |
|---|---|
| Offsite Access, Locked Accounts / Active Sessions, Access Device Logs screens | This module — modules/Security/ |
| Authentication guards (staff / client / customer / guest) | Core — application/guards/ |
| Request middleware (secure headers, input sanitization, CSRF, rate-limit, IP restriction, file security) | Core — application/middleware/ |
| Roles / permissions RBAC editor | Core — Settings → Roles |
| System audit log (the store) | Core — system_logs; this module writes to it |
| The office-IP whitelist that Offsite Access grants relax | Core — IP-restriction settings / middleware |
module_security setting that is seeded on and locked (it cannot be
disabled in Manage Modules), so the Security tools never disappear. Two finer sub-toggles —
module_offsite_access and module_access — do let you switch off
the Offsite Access and Access Device Logs menu items individually. See
Administration.
Explore the guide
Enable the module, run migrations, and grant the four permission groups.
Click-by-click SOPs for each of the three tools.
Toggles, permissions, the menu group, and audit logging.
Controllers, routes, tables, permission keys, and log events.
The live source files this guide was verified against.
Common questions and the fixes for them.
Who this module is for
- System administrators & IT — grant offsite windows, unlock stuck accounts, end suspicious sessions, and manage door devices.
- HR / support staff — unlock a colleague who is locked out after too many wrong passwords.
- Compliance & security officers — every sensitive action lands in the tenant's audit log for review.
- Facilities / physical-security teams — register the access devices and read the access-log history.