Users and Authentication
Users are the system accounts that allow people to access Rona ERP. Each user has authentication credentials, roles that determine permissions, and can be linked to employee records.
JWTRBACSESSIONS
Key concepts
- Users have login credentials (email/password or OAuth)
- Roles determine what users can do in the system
- Permissions are granular actions (read, create, update, delete)
- Users can be linked to employee records for HR integration
- Multi-factor authentication available for security
- Session management with automatic timeout
User creation
User fields
| Unique email address, used for login | |
| Password | Secure password, hashed before storage |
| Name | Display name |
| Roles | One or more roles that grant permissions |
| Employee link | Optional link to an employee record |
| Status | ACTIVE or INACTIVE |
Authentication methods
Supported methods
| Email / password | Traditional username and password |
| Google OAuth | Sign in with a Google account |
| Multi-factor | Additional security layer (optional) |
User status
ACTIVEINACTIVE
Inactive users cannot log in, but their data is preserved. Deactivate users when an employee leaves, when temporary access is no longer needed, or during a security incident requiring account lockout.
User–employee link
Link benefits
| Attendance | Attendance records tied to the employee |
| Departments | Department-based data access |
| Identity | Single source of truth for user identity |
| Management | Streamlined user management |
Password management
Password security
| Hashing | Passwords are never stored in plain text |
| Minimum length | Enforced minimum password length |
| Reset flow | Secure password reset via email |
| Session timeout | Automatic logout after inactivity |
Security best practices
- Use strong passwords (minimum 8 characters, mix of types)
- Enable multi-factor authentication for sensitive roles
- Deactivate users immediately when they leave
- Review user access regularly
- Apply the principle of least privilege for role assignment
Session management
Session features
| Automatic timeout | Sessions expire after inactivity |
| Manual logout | Users can log out explicitly |
| Session invalidation | Admins can invalidate all sessions |
| Remember me | Optional extended session — not recommended for shared devices |
User audit trail
Logged events
| Lifecycle | User creation and modification |
| Roles | Role assignment changes |
| Logins | Login attempts — successful and failed |
| Passwords | Password changes |
| Sessions | Session invalidation |
Continue
Roles and permissions
How RBAC controls what each user can do — default roles, permission format, and least privilege.