User Management

User Management

Roles

Role	Description	Permissions
Admin	Full control	Everything — users, locations, writers, genres, publishers, backup, settings
User	Regular user	Add/edit/delete books, lend, scan, view reports, update own profile
Viewer	Read-only	View books, reports, locations (cannot add, edit, or delete anything)

Creating Users (Admin)

1. Go to 👥 Users → ➕ Add User
2. Fill in:
   • Full Name
   • Username (unique)
   • Email (unique)
   • Password (min 10 chars, uppercase + lowercase + number)
   • Role (User, Admin, or Viewer)
3. Click Create User

Managing Users (Admin)

Action	How
Disable a user	Click Disable — prevents login
Enable a user	Click Enable — restores access
Delete a user	Click Delete — permanent, cannot delete yourself

Registration

By default, anyone can register at the login page (rate-limited to 3 per hour per IP). New registrations get the User role.

Disabling Public Registration

To restrict registration to admin-only, edit backend/routes/api.php:

// Change:
$router->post('/api/auth/register', [AuthController::class, 'register']);
// To:
$router->post('/api/auth/register', [AuthController::class, 'register'], [AdminMiddleware::class]);

Permission Matrix

Feature	Admin	User	Viewer
View books & reports	✅	✅	✅
Add/edit/delete books	✅	✅	❌
Scan books (camera)	✅	✅	❌
Lend/return books	✅	✅	❌
Manage writers	✅	❌	❌
Manage genres	✅	❌	❌
Manage publishers	✅	❌	❌
Manage locations	✅	❌	❌
Manage users	✅	❌	❌
Backup/restore	✅	❌	❌
Update own profile	✅	✅	✅
Change own password	✅	✅	✅

---

Next: Reports & Export