Chapter 4 Users, Roles & Permissions

This chapter is about "who can open which menu, edit which data, and see which prices." Get permissions wrong and you either lack access or over-expose cost.

Your workspace comes first

Registration creates an owner account with its own workspace. Products, stock, purchasing, sales and finance are separate from other owners. The owner creates subaccounts for colleagues; those accounts share the workspace with the roles and data visibility assigned to them. A colleague who registers separately creates another workspace.

Free includes 1 owner, 0 subaccounts and 50 active products. Open System Admin → Account & Agents to check capacity and manage members. The owner also creates Agent API Keys here, with read access and optional write access. An Agent operates within the connected workspace and cannot manage members or keys. See account and Agent setup and the connection guide.

4.1 System Roles

The system ships with built-in roles per job function. Different roles see different menus, can act on different data, and can view different price fields after login. Common roles:

Role	Default responsibility
Operations	Oversees business; usually broad menu & data access
Purchasing	Supplier & supply-chain order related
Sales	Merchant & sale order related
Warehouse	All warehouse operations
Finance	Payable/receivable, settlement, tax invoices
CS	Assists merchants, views orders (no price/status write)
Merchant	Portal only, data limited to itself

Your workspace administrator assigns your role and data visibility. Members cannot grant themselves permissions.

The four-layer permission model — from role to the final visible interface:

st=>start: Role determines
a=>operation: 1. Page permission (menu show/hide)
b=>operation: 2. Data read/write (field-level operations)
c=>operation: 3. Data scope (supplier/merchant whitelist)
d=>operation: 4. Price masking (no permission -> *)
e=>end: What menus / what data / which prices you see
st->a->b->c->d->e

4.2 Roles & Permissions

Permissions have two layers: page permission and data read/write permission.

Page permission (page_*)

Each left sub-menu maps to one page permission. With it, the menu shows and the page opens. Examples:

page_supply_order — supply-chain order
page_sale_order — sale order management
page_finance_board — finance dashboard
page_warehouse_in_out — stock in/out

If you don't see a menu on the left, you almost certainly lack its page permission. Ask admin to add it.

Data read/write permission

Some modules, beyond "can open the page", further split read/write and sensitive-field permissions — mainly on the supply-chain and sale sides:

Code	Name	Effect
`supplier_read`	Supplier read	View suppliers
`supplier_write`	Supplier write	Create/edit suppliers
`supplier_order_read`	Supply order read	View purchase orders
`supplier_order_write`	Supply order write	Create/edit purchase orders
`supplier_order_cost_read`	Supply order cost read	View purchase cost price
`supplier_order_cost_write`	Supply order cost write	Edit purchase cost price
`supplier_order_status`	Supply order status	Advance order fulfillment state
`store_read`	Merchant read	View merchants
`store_write`	Merchant write	Create/edit merchants
`sale_order_read`	Sale order read	View sale orders
`sale_order_write`	Sale order write	Create/edit sale orders
`sale_order_price_write`	Sale order price & discount write	Edit sale price/discount
`sale_order_status`	Sale order status	Advance sale order state

Product / brand / warehouse / finance modules have page permission only — opening the page means read/write, no finer field-level split. The system pre-sets roles per job function. Typical default permissions by role (subject to your actual configuration):

Role	Typical visible menus	Typical data / price permission
Purchasing	Supply board, Supplier mgmt, Supply order, Purchase board, Container loading	supplier r/w, supply order r/w, cost r/w, status advance
Sales	Sale board, Sale order mgmt, Sale return, Merchant mgmt	merchant r/w, sale order r/w, price&discount write, status advance
Warehouse	All warehouse sub-menus	Usually page permission only
Finance	Finance board, Supply/Sale/Return finance ops, Finance type, Tax invoice	Usually page permission only
CS	Merchant Purchase, Sale order mgmt (read)	View only, no price/status write

Least-privilege: a role that shouldn't see cost won't have purchase-price read permission.

4.3 Data Visibility Scope

Beyond "which menus", you can also limit "which data":

By supplier: a buyer sees only their own suppliers and orders.
By merchant: a salesperson sees only their own merchants and orders.

This is horizontal data isolation, complementary to the vertical menu permission. Both are set in role/user config.

4.4 Field Masking

Price is the most sensitive field. The system masks by permission:

An account without supplier_order_cost_read sees the cost price as * in orders/lists.
An account without sale_order_price_write cannot edit sale price/discount.

Masking is enforced server-side, not just hidden in the UI — even a direct API call won't return the plaintext price. So "can't see price" is a permission issue, not a bug.

4.5 Approval Mechanism

Orders involving money (supply-chain order, sale order) go through an approval flow by default:

Creator submits → state becomes Pending approval (1).
Approver sees the to-do in System Admin → Pending approval; approves or rejects.
On approval, state becomes Approved (2); creator then "confirms order" to enter fulfillment (Ordered 3).
On reject, it returns; creator can edit and resubmit.

Who can approve is decided by your role. The approval center is one unified to-do entry — no need to hunt through each order list. Not every order must be approved — whether the flow is enabled, and which roles approve, is set in system config.

Chapter Summary

Roles: operations / purchasing / sales / warehouse / finance / CS / merchant; menus & data scope after login are decided by role.
Two permission layers: page permission (menu show/hide) + data read/write (edit & sensitive fields).
Sensitive field (purchase price) masked by permission; no permission shows *, enforced server-side.
Data scope can be isolated horizontally by supplier/merchant.
Money orders go through approval; the approval center handles to-dos.

Part 1 "Understanding the System" ends here. You now know: what the system is (Ch.1), core terms (Ch.2), module map & relationships (Ch.3), permission model (Ch.4). Part 2 "Usage Guide" starts at Ch.5, teaching operations by scenario.