Users & Roles

Manage your team's access to MedRegia through users and roles.

Permission required: Admin access or User:* / Role:* permissions

Understanding Access Control

User → Role → Policies → Permissions

• Every user is assigned exactly one role
• A role has one or more policies attached
• Each policy is a bundle of permissions
• A permission is a Collection:Action pair (e.g. Vendor:Read)
• Permissions can also be assigned directly to a user (bypassing their role)

Managing Users

Navigate to Settings → Users (admin section).

Viewing Users

The user list shows all active users with their name, email, and assigned role.

Creating a User

1. Click + New User
2. Fill in:
   • First Name and Last Name (required)
   • Email (required, must be unique)
   • Password (required, minimum 8 characters)
   • Role (required) — select the appropriate role
3. Click Save

The user can immediately log in with the provided credentials.

Editing a User

Click any user → click Edit → update fields → Save.

Changing a Password

Admins can update a user's password via the edit form.
Users can change their own password from their Profile page.

Deactivating a User

Click the user → click Deactivate. The user can no longer log in.
Their historical data (invoices they created, etc.) is preserved.

---

Managing Roles

Navigate to Settings → Roles.

Built-in System Roles

Role	Description
Admin	Full access — is_admin = true, bypasses all permission checks
Pharmacist	Standard operator — access to vendor management

System roles (marked with 🔒) cannot be deleted.

Creating a Custom Role

1. Click + New Role
2. Enter a Name and Description
3. Click Save

After creating the role, attach policies to it (see below).

Attaching Policies to a Role

1. Open the role detail page
2. Go to the Policies tab
3. Click + Add Policy and select from available policies
4. The change takes effect on the user's next login (new JWT)

---

Managing Policies

Navigate to Settings → Policies.

A policy is a reusable bundle of permissions. Instead of assigning permissions one-by-one to roles, you group them into a policy and attach the policy.

Creating a Policy

1. Click + New Policy
2. Enter a name and description
3. Select the permissions to include
4. Click Save

Example Policies

Policy	Included Permissions
Vendor Full Access	Vendor:Read, Vendor:Create, Vendor:Update, Vendor:Delete
Invoice Read Only	Invoice:Read
Reports Access	Report:Read, Vendor:Read, Invoice:Read, Transaction:Read

---

Direct User Permissions

You can assign policies directly to a user — useful for granting one-off access without changing their role:

1. Open the user detail page
2. Go to the Direct Policies tab
3. Add or remove policies

Direct policies are merged with role-based policies when the JWT is issued.

---

Permission Changes Take Effect on Next Login

WARNING

Changes to roles, policies, and permissions are applied when the user logs in again (new JWT).
Existing tokens are not invalidated — users must log out and back in to receive updated permissions.