Users & Permissions¶

Control who can access FilaOps and what each person can do.

What You'll Learn¶

• The two account types (Admin and Operator) and what each can access
• How to add, edit, and deactivate team members
• How to reset a password and what happens to the user's session
• How to run the built-in Security Audit and export the report

Prerequisites¶

• You must be signed in as an Admin. Operators cannot access user management.

Understanding Account Types¶

FilaOps has two account types for internal staff:

The sidebar automatically hides admin-only sections (ADMIN group, MONEY group) for Operator accounts. Operators cannot reach user management or the Security Audit page at all.

Managing Team Members¶

Navigate to Admin > Team Members in the sidebar.

Summary Cards¶

Four cards at the top of the page give a quick headcount:

Filtering the List¶

Three controls sit above the user table:

• Search field — filters by email address or display name (first + last name) as you type
• Role dropdown — choose All Roles, Admin, or Operator
• Show Inactive checkbox — when checked, deactivated and suspended accounts appear in the table

The User Table¶

Adding a Team Member¶

1. Click + Add User (top-right of the Team Members page).

2. Fill in the Add New User form:

   Field	Required	Notes
   Email	Yes	Must be unique across all accounts. This is the login username.
   Temporary Password	Yes	Minimum 8 characters. Share this with the new user so they can sign in for the first time.
   First Name	No	Shown in the user list and navigation bar
   Last Name	No	Shown in the user list
   Role	Yes	Select Admin or Operator

3. Click Create User.

Editing a Team Member¶

1. Find the user in the table and click Edit.

2. The Edit User form opens. You can update:

   • Email (must remain unique)
   • First Name / Last Name
   • Role (Admin or Operator)
   • Status (Active, Inactive, or Suspended) — this field appears only when editing an existing user, not when creating one

3. Click Save Changes.

Resetting a Password¶

Use this when a team member forgets their password or you need to force a credential change.

1. Find the user in the table and click Reset PW.

2. In the Reset Password dialog, enter a new password in the New Password field.

   

3. Optionally click Generate random password to let FilaOps create a secure 12-character password and fill the field automatically.

4. Click Reset Password.

5. Share the new password with the user through a secure channel.

Deactivating and Reactivating Users¶

Deactivating¶

When a team member leaves or no longer needs access:

1. Find the user in the table.
2. Click Deactivate.
3. Confirm the browser prompt.

The account status changes to Inactive and all active sessions are revoked. The account and its full history are preserved — this is a soft deactivation, not a deletion.

Reactivating¶

To restore a previously deactivated (or suspended) account:

1. Check Show Inactive to reveal inactive accounts in the table.
2. Find the user and click Reactivate.

The account returns to Active and the user can sign in again with their existing password.

Security Audit¶

Navigate to Admin > Security Audit in the sidebar.

The audit runs automatically when you open the page, scanning your FilaOps installation for configuration issues.

Overall Status¶

A large status card at the top shows one of three states:

Four count tiles below show Total Checks, Passed, Warnings, and Failed.

Check Categories¶

Results are grouped into three sections:

• Critical Security Checks — issues to fix before exposing the installation to the internet
• Warning Checks — improvements that are recommended but not immediately urgent
• Informational — status notes that require no action

Each check shows its name, a status badge (pass / fail / warn / info), a message explaining the result, and — for non-passing checks — a Fix / Recommendation block describing what to do.

"Fix This" — Guided Remediation¶

For checks that support it, a Fix This button appears in the fix block. Clicking it opens a step-by-step remediation modal that can:

• Generate a new SECRET_KEY and write it to backend/.env automatically
• Install the slowapi rate-limiting library via pip
• Scan and upgrade vulnerable Python packages using pip-audit
• Configure Caddy as a reverse proxy for HTTPS and create a desktop launcher

Security Checks Reference¶

Re-running the Audit¶

Click Refresh to re-run all checks without leaving the page.

Exporting the Report¶

Click Export Report to download the full audit results as a timestamped JSON file (filaops_security_audit_YYYY-MM-DD.json). The file includes every check result, system information (OS, Python version, database, reverse proxy), and a generation timestamp. Use this for compliance documentation or to share with an IT team.

Best Practices¶

• Change the default admin password immediately after setup. The Security Audit flags this as a critical failure.
• Give each person their own account. Shared credentials prevent meaningful audit trails.
• Keep at least two active Admin accounts. If the only admin is locked out, password reset requires direct database access.
• Deactivate, do not delete. Deactivating preserves all activity history. There is no delete button by design.
• Run the Security Audit after any server change — new deployment, updated configuration, certificate renewal — to catch regressions before they become incidents.

Quick Reference¶

What's Next?¶

• System Settings — company information, tax rates, and email configuration
• Installation and Setup — server-level configuration that affects most security checks
• Your First Day — initial setup walkthrough including creating the first admin account