Admin & Access
How permissions shape what you see in the Luxury UI — module menus, project scoping, timesheet date policies, and application configuration. Scenario pages document the same flags with step-by-step workflows in the Scenario User Guide.
Access overview
Tracopus uses role-based access control enforced on both client and server. The UI hides menus and actions you cannot use rather than showing disabled controls. Access is evaluated at multiple levels:
- Module level — can you see HRMS, Sales, or Project directories at all?
- Page level — which routes within a module appear in the sidebar?
- Persona level — which persona views you may switch into, and which pages each persona can open (org map + kill switches)
- Action level — create, edit, delete, assign, mark attendance, etc.
- Record level — project membership, team scope, shared vs private visibility
- Field level — timesheet date windows, report type availability
Mobile receives an encrypted access control payload on login; web evaluates permissions from the authenticated user session.
Persona access & navigation
Tracopus separates who may use a persona (role) from org-wide page mapping and kill switches (organization).
| Surface | Route | Stores in | What you configure |
|---|---|---|---|
| Roles & permissions | /admin/roles |
role.json → HRMS → personaModules |
Allowed personas, default persona, switcher; page preview writes the shared org page map. Screen guide: Roles & permissions. Simulator: Roles data flow. |
| Persona navigation | /admin/persona-navigation |
org.json → HRMS → personaNavigationAdditional |
Turn off personas/modules/pages; Page access — one page at a time, Product default vs Custom. Screen guide: Persona Navigation. Scenario: Turn off org access. |
Defaults
- Org seed: empty
pagePersonaMapand empty disable lists — catalog sidebarpersonas[]apply until you customize a page. - Site Admin role seed: all personas allowed,
defaultPersona: ADMIN, switcher on.
Evaluation order
- Role module / menu flags
- Role
personaModules(or Automatic heuristic if never saved) - Org
pagePersonaMapoverride when present - Org
disabledPersonas/disabledPaths/disabledModules— always win
Permission matrix on Roles stays under Advanced. Full key reference: personaNavigationAdditional and personaModules. Interactive: Roles simulator · Persona navigation simulator.
Interactive data flow
Trace personaModules (role layer) and personaNavigationAdditional (org layer) with live flag toggles.
Module access
The left sidebar shows HRMS, Sales, and Project directories only when menuAccessControl flags them active for your user:
| Module | Flag | Typical roles |
|---|---|---|
| HRMS | hrmsModules.active | All employees; HR admins see full directory |
| Sales | salesModules.active | Sales, account managers, leadership |
| Project | projectModules.active | Delivery, PMs, contributors |
Access-controlled routes
These pages require additional permission flags beyond module access:
- File manager (
/project/filemanager) - Chat (
/project/chat) - Calendar (
/project/calendar) - Search (
/project/search) - Settings (
/hrms/settings) - Application config (
/hrms/appconfig)
Icon rail entries for these features hide when access is denied.
Project access
Team scope
Team selection filters on list pages limit data to projects and records associated with selected teams. Your default team appears in the sidebar company chip.
Project membership
Project details enforce membership and team rules:
- Non-members may see read-only or denied views depending on shared visibility settings
- Cross-team access without membership renders read-only project details
- Members tab manages invitations, roles, and access chips
Shared vs private projects
Project list "Shared visibility" donut reflects how many projects are shared across teams vs restricted. Private projects appear only to members and elevated roles.
Create permissions
Create buttons on lists (projects, bids, POs, employees) and planner assign actions require explicit create permissions. Executive planner view is read-only when create is disabled.
Timesheet access rules
Timesheet permissions (timeSheet branch of access control) govern web and mobile equally.
| Rule | Effect |
|---|---|
enableTimeSheetEntry false | No days allow entry — entire week disabled |
| Project work item windows | Billable entry only within min/max create dates derived from working-day offsets |
| Non-project work item windows | Separate date range for non-billable entries |
| Leave/holiday rules | allowLeaveAndHolidayForFuture / ForPast control leave booking direction |
| Hour thresholds | Rules like disable create before Y working days after X hours logged |
On mobile, disabled days show grey titles in the week list and blocked add buttons on the Record screen with snackbar message: "Time entry is not allowed for this date."
Managers with multi-employee timesheet permission can switch employees on the web Timesheet page header.
Work-Time Governance adds a default-off catalog (validation, approval chain, reminders, import/export, estimates, swipe evidence) configured on Admin → Feature flags. It does not replace the timesheet rules in the table above. Scenario: Enable work-time catalog features.
Application configuration
/hrms/appconfig — hierarchical configuration tree per team (admin access required).
What admins configure
- Application configuration (org.json) — dropdown lists, service line trees, notification emails, feature toggles,
personaNavigationAdditional - Access control (role.json) — module visibility, CRUD permissions, timesheet windows, report access,
personaModules - Team-scoped overrides inherited from parent org nodes with lock/hide/inherit controls
- Role bar for assigning role templates to org units during editing
- Dedicated UIs: Admin → Roles (persona-first) and Admin → Persona navigation (simplified Turn off / Page access)
Open full Application Configuration reference → — every key from org.json and role.json with descriptions, sample values, and UI workflow notes.
Organization settings
/hrms/settings — Lux settings sections:
Mobile devices
Register and manage employee mobile device connections.
Schedulers
Cron job configuration for automated tasks.
Service health
Monitor integrated service status.
Company
Organization profile and branding metadata.
Localization
Locale and regional preferences.
Notifications
Org-wide notification defaults.
Personal UI preferences (palette, font) live in the Settings right sidebar and localStorage — not org-wide.
Reports & feedback permissions
Report types in the REPORT dropdown are filtered by permission — users only see reports they can run. Feedback template configuration and campaign launch similarly require elevated project permissions.
External feedback and invoice document routes (/document/…) use tokenized links that bypass full app auth for respondents while keeping responses scoped.