Administration

Users

Route: User menu › Users — /admin/users

Purpose: create and maintain employee accounts. Each user gets a login identity, an interface language, default branch/warehouse, and one or more roles that define exactly what they may see and do. Use it whenever an employee joins, changes duties, or leaves.

The list

Columns: avatar, username, email, roles. Row actions:

• Edit (pencil): opens the full-page editor.
• Lock / Unlock (padlock): immediately blocks or restores login without deleting the account. The company's protected super admin can never be locked (the button is hidden and the server refuses it).

Field reference (user editor)

Worked example — create a user

1. User menu › Users › Create.
2. Username: m.ali — the hint shows the final login: m.ali@yourcode.com.
3. Fill first/last name; pick Language = English if the employee prefers English.
4. Choose the default branch and warehouse he works in.
5. Enter an initial password of at least 10 characters and tell it to him privately.
6. Tick his role(s), e.g. "Storekeeper", then Save (or Save & New to add the next employee).

Language preference propagation

The app ships in three languages: Arabic (RTL), English and Indonesian. Two mechanisms cooperate:

• User preference (this screen): the Language field is stored on the account. At every login the interface switches to that language automatically.
• Top-bar language dropdown (ع / EN / ID): any user can switch on the fly; the choice is remembered in that browser until the next login re-applies the account preference. Switching to Arabic also flips the whole layout to right-to-left.

Troubleshooting

FAQ

• Can I delete a user? No — lock or deactivate instead, so his document history stays attributed.
• Can one user have several roles? Yes; permissions accumulate (union).
• Why can't I lock a certain user? That is the protected company super admin — it can never be locked out.
• Does changing a role take effect immediately? On the user's next login / token refresh.

Roles (permissions)

Route: User menu › Roles / Permissions — /admin/roles

Purpose: a role is a named permission bundle (Accountant, Storekeeper, Cashier…) assigned to users. The editor has a name, a description, and three permission levels shown as tabs:

Level 1 — Modules

One card per sidebar module: Administration, Accounting, Inventory, Sales, Purchasing, Imports, Assets, Restaurants, Land, Agriculture, Fleet, Reports. Ticking a card grants entry to that module.

Level 2 — the permission matrix

Rows are screens, grouped under the same headings you see in the sidebar (click a group header to fold it). Reports appear as their own rows with their registry names. Columns are the six actions — a checkbox exists only where the screen actually supports the action, and each row has an "all" checkbox:

Level 3 — data scopes

Worked example — a "Storekeeper" limited to 2 warehouses

1. User menu › Roles › Create. Name: Storekeeper.
2. Tab Level 1: Modules — tick Inventory only (Sales/Purchasing come with it as one commercial module; leave Accounting, Administration etc. off).
3. Tab Level 2: Screens & Reports — under Inventory grant: Items (View), Goods receipts (View/Create/Post), Stock adjustments (View/Create), Inventory transfers (View/Create/Post). Leave Delete and Unpost unticked.
4. Tab Level 3: Data — in Allowed warehouses pick exactly the two warehouses, e.g. "01 - Main warehouse" and "03 - Spare parts".
5. Save. Open Users, edit the storekeeper's account, tick the new role.
6. Result: after his next login he sees only the Inventory module, only the granted screens/actions, and every list, lookup and document is filtered to those two warehouses.

FAQ

• Screen grants are ticked but the user still sees nothing? The module itself is off in Level 1 — Level 1 always wins.
• Do scopes affect reports? Yes — data restrictions apply on top of everything the role opens.
• Best practice? Build functional roles (Accountant, Salesman…) instead of one per employee — change the role once and it applies to everyone holding it.
• Who can approve documents? That is configured per document type in the Approvals screen (below), by pointing an approval rule at a role.

Settings

Route: User menu › Settings — /settings

Purpose: company-wide configuration, organized in five tabs:

The Accounts tab — every link and what it drives

Each field is a searchable chart-of-accounts picker (posting accounts; the two "parent" fields list group accounts). Grouped in four sections:

The Restore defaults button (after confirmation) re-applies the standard chart template codes; accounts missing from your chart are left unchanged.

Email (SMTP) details

• Host, port (587 default), username, password, From address, From name, STARTTLS switch.
• Leave the host empty to use the platform default sender.
• The stored password is write-only: the field shows dots — leave it empty to keep the current one.
• STARTTLS on = port 587; untick it for implicit-SSL port 465.

FAQ

• Who can open Settings? Any role holding the Settings View permission (Administration module).
• Why is the company code read-only? It is the tenant identity and part of every login address.
• An account link is empty — what happens? Posting the affected document fails with a clear message; set the link first.
• Where are module options like the restaurant service charge? Module settings live as tabs of this same screen — no separate screens.

E-Invoicing (ZATCA)

Route: User menu › E-Invoicing — /zatca

Purpose: the 4-step wizard that connects your company to ZATCA's Fatoora platform (Saudi e-invoicing, Phase 2 integration). Opening the screen asks for a daily access code — request it from your system administrator/support; it protects the certificates from accidental changes.

Environment

Pick the target environment at the top; the progress indicator shows how many of the 4 steps are done:

Company data panel

Organization name, VAT number, city and industry are read-only here — they come from Settings › Company profile. The VAT number must be 15 digits, starting and ending with 3. You choose on this screen only: the invoice types (Standard & simplified / Standard only / Simplified only) and the OTP.

The four steps and what each produces

1. Create CSR + private key. Generates the EC private key and the certificate signing request locally, per ZATCA specifications. Nothing is sent to ZATCA yet. Produces: private key + CSR (visible in the credentials panel).
2. Get the compliance CSID. Sends the CSR with your OTP to ZATCA. Produces: compliance certificate + compliance secret — the temporary credentials used for the tests.
3. Compliance checks. The system signs and submits 6 sample invoices (standard/simplified: invoice, credit note, debit note) using the embedded signing engine. All six must pass. Produces: a cleared compliance record unlocking Step 4.
4. Production certificate (final CSID). Exchanges the compliance CSID for the production one. Produces: production certificate + production secret + token, saved to the database — from now on invoices are signed and reported with these.

Below the wizard, a collapsible Keys, secret & certificate panel shows every stored credential (private key, CSR, compliance/production secret and certificate) read-only with copy buttons.

Worked example — sandbox onboarding end-to-end

1. Verify Settings › Company profile has the legal name, a valid 15-digit VAT number and the city; then open E-Invoicing.
2. Environment = Developers. The OTP fills with 12345 automatically.
3. Step 1 › Create CSR + private key → "CSR created successfully".
4. Step 2 › Get CSID → compliance CSID stored.
5. Step 3 › Run compliance checks → all 6 sample documents pass.
6. Step 4 › Get production certificate → final cert/secret/token saved.
7. Turn on Settings › Sales & e-invoicing › Auto-send on posting, post a test sales invoice and confirm it reports successfully.

Troubleshooting

FAQ

• Company data changed (name/VAT) — what now? Re-onboard: switch/reselect the environment and run the 4 steps again to issue fresh certificates.
• Do invoices send automatically? Only if the auto-send toggle is on; otherwise they are sent from the invoice send screen.
• Is the private key sent anywhere? No — it is generated and stored locally; only the CSR goes to ZATCA.
• Can I test without affecting real invoicing? Yes — that is exactly what the Developers environment is for.

Document counters

Route: User menu › Counters — /system/counters

Purpose: one registry controlling the numbering of every document type, organized in module tabs: Accounting, Sales, Purchasing, Inventory, Imports, Fleet, Agriculture, Land, Restaurants. Numbers are allocated under a transaction lock, so no gaps or duplicates can occur.

Columns

Document types per module

Worked example — sales invoices as INV with yearly reset

1. Open Counters › tab Sales.
2. On the "Sales invoices" row set Prefix = INV.
3. Keep method = Continuous sequential and tick Yearly reset.
4. Press Save (top of the page — it saves all rows at once) and check the "Next number" column.
5. Result: invoices number INV-00001, INV-00002… and restart from 1 on January 1st. For branch-independent series instead, choose "Per branch & year" — e.g. INV01-26-00001 for branch 01 in 2026.

Troubleshooting — counter collision

• Status shows Duplicates (red): two documents share a number — typically after an external data import. The counter itself cannot produce duplicates; renumber/fix the imported documents, then re-check.
• Status shows Gaps (yellow): numbers missing from the sequence, usually deleted drafts or an import that skipped numbers. Gaps are informational; new numbers continue after the last one.
• Changed a prefix and old documents still show the old one: prefixes apply to newly issued numbers only — existing documents keep theirs.

FAQ

• Can two document types share a prefix? Technically yes, but avoid it — distinct prefixes keep search and archiving unambiguous.
• Can I make the counter start from a specific number? The next number follows the highest existing document; there is no manual override — this protects the no-gaps guarantee.
• Does the yearly reset delete anything? No — it only restarts the numbering; previous years' documents are untouched.

Print Designer

Route: User menu › Print Designer — /system/print-designer

Purpose: a drag-and-drop designer for the printed layout of every transaction document (invoice, voucher, quotation…). Templates are stored in the database per document type; the template marked default is the one used when users print that document.

Toolbar

• Document type — pick which document you are designing (same list as the Counters screen).
• Template selector, New template, template name, Save, Set default, Delete.
• Preview (with sample data) and Print from the preview.
• Publish to gallery / Gallery — share and reuse designs across companies (see below).
• Zoom in/out of the A4 canvas.

Palette (side panel)

Canvas editing

• Drag to move; bottom handle to resize; arrow keys nudge 1px (Shift = 10px).
• Click selects; Shift/Ctrl-click multi-selects; Ctrl+A selects all — a selected group moves together.
• Double-click an element to jump to its properties tab; Delete removes the selection.

Shared gallery

Publish puts a layout-only copy of your template in the cross-company gallery. Gallery lets you preview any published design and Clone it into your own templates — only the design is copied, never data.

Worked example — an official sales invoice layout

1. Document type = Sales invoices › New template › name it "Official layout".
2. Drag the logo to the top corner, then company name, VAT number and invoice number/date fields into the header.
3. Drag the items table, open its properties and tick exactly the columns you want.
4. Drag the QR code near the footer, add a totals field and a signature image.
5. Preview with sample data, adjust, Save, then Set default — all invoice printing now uses it.

FAQ

• Multiple templates per document? Yes — keep several and switch the default at any time.
• Signature upload rejected? Images are limited to 1 MB — compress and retry.
• Does cloning from the gallery expose my numbers? No — gallery entries carry the layout only.
• Custom database fields? They appear automatically in the "Custom fields" group, no rebuild needed.

Approvals

Route: Sidebar › Approvals — /approvals

Purpose: the document approval workflow: an inbox of approval requests plus (for administrators) the rules that create them. When a rule is enabled, posting a matching document does not post it directly — it becomes a pending approval request, and the document posts automatically upon final approval. The page title shows a badge counting requests awaiting you.

Inbox tabs

Each row shows: document type, document number, amount, requested by, date, status (Pending — with "level 2" when at the second stage — Approved or Rejected) and any notes. Pending rows you may act on offer Approve and Reject buttons.

Defining rules

The Rules tab lists one row per supported document type — Sales invoice, Purchase invoice, Receipt voucher, Payment voucher — with:

The flow, end to end

1. Admin enables a rule — e.g. Purchase invoice, approver role "Finance Manager", second level "General Manager", min amount 10,000.
2. A clerk posts a purchase invoice of 15,000 → instead of posting, a Pending request appears (his "My requests" tab).
3. Every Finance Manager sees it under Awaiting me with a badge. One clicks Approve, optionally adds a note, and confirms Approve & post.
4. Because a second level exists, the request stays Pending "(level 2)" and moves to the General Manager's inbox.
5. On final approval the document posts automatically (journal entry, stock, numbering). On Reject — a rejection reason is mandatory — the document stays unposted and the requester sees the reason.

FAQ

• Can I approve my own document? If your role is the approver role, yes — assign approver roles so that this doesn't happen where separation of duties matters.
• What happens to a rejected document? Nothing is posted; correct it and post again to create a fresh request.
• Documents below the threshold? They post immediately, no request is created.
• Why don't I see the Rules tab? It appears only for users permitted to manage roles/settings.