Skip to content

MOP 2.1 — Administrative Hierarchy: Security & Support Staff

Audience: society_admin Outcome: Security guards and society support staff are onboarded with their own login (web for guards, mobile for support staff), can scan QR passes, mark attendance and stay scoped to the society.

1. Pre-requisites

  • A society exists; you are mapped as society_admin (MOP 1.2).
  • For guards: phone-based login is the canonical channel.

2. Workflow

2.1 Add a security guard

Sidebar → Security Guards → + Add Guard. Fields: name, phone (becomes the login), society_id (auto-set for society admins; super admin can pick any), optional email, aadhar_id (masked in UI), address. Backend creates a users row with role=security_guard plus a security_guards document.

2.2 Verify & activate

  • New guards land as Pending Verification → is_verified = false.
  • Tap Verify in the row to mark them ready for QR scans.
  • Disable flips is_active = false (denies login but preserves history).

2.3 Reset password

Use Reset Pwd → admin types a new password (the API hashes it). Guard re-logs in via /security-login (/api/admin-dashboard/security-login.html).

2.4 Sub-admins (custom roles)

For non-guard support staff, use Roles & Sub-Admins → + Sub-Admin. You can grant a curated set of capabilities (e.g. only Vendor approvals, only Event payments) — capability list lives in custom_permissions.

3. APIs touched

Method Endpoint
GET /api/admin/security-guards?society_id=...&status=...
POST /api/admin/security-guards
PUT /api/admin/security-guards/{guard_id}/verify
PUT /api/admin/security-guards/{guard_id}/status
PUT /api/admin/security-guards/{guard_id}/reset-password
DELETE /api/admin/security-guards/{guard_id}
GET / POST /api/admin/sub-admins

4. Edge cases & FAQ

  • Guard scans a QR for an event in a different society → backend rejects (403) because guard is bound to one society_id.
  • Phase-bound admin can only verify guards in their phase. Re-assign by editing the guard's mapping.
  • Sub-admins use the dashboard, not the mobile app — they have an admins row with is_sub_admin = true.
  • MOP 1.2 — Admin Provisioning
  • MOP 2.3 — Committee Formation
  • MOP 4.3 — Temporary Permits (vendor passes use the same QR scanner)