Overview
Quality Hub GINEZ implements a role-based access control (RBAC) system with 8 predefined roles. Each role has specific permissions across 5 main modules, with three access levels: Complete (AC), Partial (AP), and Restricted (AR).Available Roles
The system includes 8 predefined roles designed for different organizational functions:Administrator (admin)
Administrator (admin)
Description: Full system access with all permissionsUse Cases: System administrators, IT staff, general managersModule Access:
- Catalog: Full access (view, download, create, edit, delete, export)
- Log Book: Full access with all filters including branch selection
- Quality Control: Full access with delete permissions
- Reports: Full access with export capabilities and all tabs
- Configuration: Full access to all settings including user management
Preparer (preparador)
Preparer (preparador)
Description: Access to product catalog and log book for product preparationUse Cases: Product preparers, mixing personnel, formulation techniciansModule Access:
- Catalog: Full access (view, download) - no modification rights
- Log Book: Full access (view, create, edit) - can register and edit batches
- Quality Control: Partial access (view only) - cannot edit quality parameters
- Reports: Partial access (view only, quality control tab only)
- Configuration: Partial access (profile settings only)
- Can consult catalog for formulas and specifications
- Can register batches in log book
- Can edit their own log book entries
- Cannot perform quality control tasks
- Cannot view commercial analysis reports
Branch Manager (gerente_sucursal)
Branch Manager (gerente_sucursal)
Description: Branch-level management and quality oversightUse Cases: Branch managers, regional supervisorsModule Access:
- Catalog: Full access (view, download)
- Log Book: Restricted (no access)
- Quality Control: Partial access (view only)
- Reports: Partial access (view only, quality control tab)
- Configuration: Partial access (profile only)
Operations Director (director_operaciones)
Operations Director (director_operaciones)
Description: Operations oversight with quality monitoring capabilitiesUse Cases: Operations directors, production managersModule Access:
- Catalog: Full access (view, download)
- Log Book: Restricted (no access)
- Quality Control: Partial access (view only)
- Reports: Partial access (view only, quality control tab)
- Configuration: Partial access (profile only)
Quality Manager (gerente_calidad)
Quality Manager (gerente_calidad)
Description: Quality and development management with full quality control accessUse Cases: Quality managers, R&D directors, laboratory managersModule Access:
- Catalog: Full access (view, download)
- Log Book: Restricted (no access)
- Quality Control: Full access (view, edit, delete) with branch filter
- Reports: Partial access (view only, quality control tab)
- Configuration: Partial access (profile only)
- Only non-admin role with edit/delete permissions in Quality Control
- Has access to branch filter in Quality Control module
- Can manage quality parameters across all branches
Counter Staff (mostrador)
Counter Staff (mostrador)
Description: Limited access for counter/front desk personnelUse Cases: Counter staff, customer service representativesModule Access:
- Catalog: Full access (view, download)
- Log Book: Restricted (no access)
- Quality Control: Restricted (no access)
- Reports: Restricted (no access)
- Configuration: Partial access (profile only)
Cashier (cajera)
Cashier (cajera)
Description: Minimal access for cashier functionsUse Cases: Cashiers, payment processing staffModule Access:
- Catalog: Full access (view, download)
- Log Book: Restricted (no access)
- Quality Control: Restricted (no access)
- Reports: Restricted (no access)
- Configuration: Partial access (profile only)
Purchasing Director (director_compras)
Purchasing Director (director_compras)
Description: Access to quality data for purchasing decisionsUse Cases: Purchasing directors, procurement managersModule Access:
- Catalog: Full access (view, download)
- Log Book: Restricted (no access)
- Quality Control: Partial access (view only)
- Reports: Partial access (view only, quality control tab)
- Configuration: Partial access (profile only)
Access Levels
The system uses three access levels to control module permissions:AC - Complete Access (Acceso Completo)
- Full viewing permissions
- Can download, create, edit, and delete records
- All filters available
- All tabs/sections visible
- Export capabilities enabled
AP - Partial Access (Acceso Parcial)
- View-only permissions with restrictions
- Limited filters (no branch filter)
- Limited tabs (e.g., only “Quality and Control” tab, not “Commercial Analysis”)
- Cannot modify data
- Export typically disabled
AR - Restricted Access (Acceso Restringido)
- No access to the module
- Module not visible in navigation
- All operations blocked
Permission Matrix
Catalog Module
| Role | Access Level | View | Download | Create | Edit | Delete | Export |
|---|---|---|---|---|---|---|---|
| Administrator | AC | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Preparer | AC | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Branch Manager | AC | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Operations Director | AC | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Quality Manager | AC | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Counter Staff | AC | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Cashier | AC | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Purchasing Director | AC | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
Log Book Module
| Role | Access Level | View | Create | Edit | Delete | Export |
|---|---|---|---|---|---|---|
| Administrator | AC | ✓ | ✓ | ✓ | ✓ | ✓ |
| Preparer | AC | ✓ | ✓ | ✓ | ✗ | ✗ |
| Branch Manager | AR | ✗ | ✗ | ✗ | ✗ | ✗ |
| Operations Director | AR | ✗ | ✗ | ✗ | ✗ | ✗ |
| Quality Manager | AR | ✗ | ✗ | ✗ | ✗ | ✗ |
| Counter Staff | AR | ✗ | ✗ | ✗ | ✗ | ✗ |
| Cashier | AR | ✗ | ✗ | ✗ | ✗ | ✗ |
| Purchasing Director | AR | ✗ | ✗ | ✗ | ✗ | ✗ |
Quality Control Module
| Role | Access Level | View | Edit | Delete | Export | Filters |
|---|---|---|---|---|---|---|
| Administrator | AC | ✓ | ✓ | ✓ | ✓ | All (including branch) |
| Preparer | AP | ✓ | ✗ | ✗ | ✗ | Date, status, category, product |
| Branch Manager | AP | ✓ | ✗ | ✗ | ✗ | Date, status, category, product |
| Operations Director | AP | ✓ | ✗ | ✗ | ✗ | Date, status, category, product |
| Quality Manager | AC | ✓ | ✓ | ✓ | ✓ | All (including branch) |
| Counter Staff | AR | ✗ | ✗ | ✗ | ✗ | None |
| Cashier | AR | ✗ | ✗ | ✗ | ✗ | None |
| Purchasing Director | AP | ✓ | ✗ | ✗ | ✗ | Date, status, category, product |
Reports Module
| Role | Access Level | View | Export | Filters | Visible Tabs |
|---|---|---|---|---|---|
| Administrator | AC | ✓ | ✓ | All (including branch) | Quality Control, Commercial Analysis |
| Preparer | AP | ✓ | ✗ | Date, category, product | Quality Control only |
| Branch Manager | AP | ✓ | ✗ | Date, category, product | Quality Control only |
| Operations Director | AP | ✓ | ✗ | Date, category, product | Quality Control only |
| Quality Manager | AP | ✓ | ✗ | Date, category, product | Quality Control only |
| Counter Staff | AR | ✗ | ✗ | None | None |
| Cashier | AR | ✗ | ✗ | None | None |
| Purchasing Director | AP | ✓ | ✗ | Date, category, product | Quality Control only |
Configuration Module
| Role | Access Level | Visible Tabs | Permissions |
|---|---|---|---|
| Administrator | AC | Profile, Users, Audit | Full system configuration |
| All Other Roles | AP | Profile only | Can only edit own profile |
Role Comparison
| Feature | Admin | Preparer | Quality Manager | Others |
|---|---|---|---|---|
| View Dashboard | ✓ | ✓ | ✓ | ✓ |
| View Catalog | ✓ | ✓ | ✓ | ✓ |
| Register Log Book | ✓ | ✓ | ✗ | ✗ |
| Edit Log Book | ✓ | ✓ | ✗ | ✗ |
| Edit Quality Control | ✓ | ✗ | ✓ | ✗ |
| Delete Quality Records | ✓ | ✗ | ✓ | ✗ |
| View Reports | ✓ | ✓ | ✓ | Varies |
| Export Data | ✓ | ✗ | ✓ | ✗ |
| Commercial Analysis Tab | ✓ | ✗ | ✗ | ✗ |
| Branch Filter | ✓ | ✗ | ✓ (QC only) | ✗ |
| User Management | ✓ | ✗ | ✗ | ✗ |
| System Configuration | ✓ | ✗ | ✗ | ✗ |
Workflow Example
Scenario: Batch Preparation and Quality Control
Step 1: Preparation (Preparer Role)- ✓ Consults catalog for product formula
- ✓ Prepares batch following specifications
- ✓ Registers batch in log book with basic data
- ✗ Cannot perform quality control tests
- ✓ Views batch registered by preparer
- ✓ Takes samples and performs measurements
- ✓ Records pH, solids, and other parameters
- ✓ Marks batch as conforming/non-conforming
- ✓ Can edit or delete quality records if needed
- ✓ Reviews all records in reports
- ✓ Analyzes trends and control charts
- ✗ Cannot export data (admin only)
- ✗ Cannot edit quality parameters
- ✓ Full access to all modules
- ✓ Manages users and permissions
- ✓ Exports data for external analysis
- ✓ Configures system settings
Best Practices
Assigning Roles
-
Principle of Least Privilege: Assign only the permissions necessary for the job function
- Example: A preparer does not need access to reports module
-
Separation of Duties: Ensure separation between preparation and quality validation
- Who prepares should not be who validates quality
- Prevents conflicts of interest
-
Regular Review: Review permissions every 3-6 months
- Revoke access for inactive users
- Update roles based on job changes
-
Documentation: Maintain records of permission changes
- Document who has what permissions
- Log important permission changes
Security Considerations
- Permission changes take effect immediately
- Users must refresh their browser to see updated permissions
- Only Administrators can manage user permissions
- All permission changes are logged for audit purposes
- Permissions are securely stored in Supabase
Managing Permissions
Administrators can manage user roles through the Configuration module:- Navigate to Configuration → Users
- Click Edit on the desired user
- Select the appropriate role from the dropdown
- Assign a branch (sucursal) if applicable
- Preview the permissions before saving
- Click Save Changes
Troubleshooting
User Cannot Access a Module
- Verify the user has “View” permission enabled
- Ask user to reload the page (F5)
- Check in Configuration → Users → Permissions
Changes Not Reflected
- User must reload the browser page
- Verify changes were saved successfully
- Check browser console (F12) for errors
Manage Permissions Button Not Visible
- Only administrators see this button
- Verify you are in the “Users” tab
- Verify your user has
is_admin = true
API Reference
For developers implementing permission checks, see the Authentication page for details on theusePermissions hook.