Skip to main content

Overview

Beils Dashboard provides comprehensive user management capabilities for beauty center staff and administrators. You can create, update, and manage user accounts with different permission levels.
User management is restricted to administrators (ADMIN role) only. Regular users cannot access these features.

User Roles

The system supports two primary roles defined in the database schema:

ADMIN

Full system access with permissions to:
  • Manage all users
  • Configure system settings
  • Access all modules and features
  • View and manage all data

USER

Standard staff access with permissions to:
  • Manage clients and appointments
  • Process sales and checkouts
  • Create and edit catalog items
  • View assigned data

User Status

Each user account has a status that controls access:
  • ON - User is active and can log into the system
  • OFF - User is inactive and cannot authenticate
Deactivating a user (setting status to OFF) immediately prevents them from logging in and invalidates their current session.

Accessing User Management

Navigate to the Users section from the main navigation menu. This page displays all system users with their key information.

User List View

The user management interface provides:
  • Search and filtering - Find users by name, email, or role
  • Status indicators - Visual badges showing active/inactive status
  • Quick actions - Edit, delete, or toggle user status
  • Pagination - Navigate through large user lists (10 users per page)

Creating Users

To add a new user to the system:
1

Open User Form

Click the Create User button in the user management interface
2

Enter Basic Information

Provide required fields:
  • Full name and surname
  • Email address (must be unique)
  • Phone number
  • Password (default: 123456 if not specified)
3

Assign Role and Status

Select the appropriate role:
  • ADMIN for administrators
  • USER for standard staff (default)
Set initial status (defaults to ON)
4

Add Personal Details

Complete optional fields:
  • Address, city, country, postal code
  • Gender and birth date
  • Document type (DNI, PASSPORT, NIE)
  • Document number
5

Save User

Click Create to add the user to the system

API Endpoint

POST /api/users
See the Create User API documentation for details.

Editing Users

To update an existing user account:
  1. Click the Edit icon next to the user in the list
  2. Modify any fields in the user form
  3. Update the password if needed (automatically hashed with bcrypt)
  4. Click Update to save changes
Password changes take effect immediately. The user must use the new password for their next login.

API Endpoint

PUT /api/users/:id

Toggling User Status

Quickly activate or deactivate users without opening the edit form:
  1. Locate the user in the list
  2. Click the Status Toggle button
  3. Confirm the action if prompted
The system updates the status optimistically in the UI and syncs with the server.

Deleting Users

Deleting a user is permanent and cascades to related data (consents, questionnaires, revokes). Use with caution.
To remove a user from the system:
  1. Click the Delete icon next to the user
  2. Confirm the deletion in the modal dialog
  3. The user and associated data are permanently removed

API Endpoint

DELETE /api/users/:id

User Authentication

Users authenticate using their email and password:

Login Process

  1. User enters email and password at /login
  2. System validates credentials using bcrypt password comparison
  3. Checks if user status is ON
  4. Generates JWT token containing:
    • User ID
    • Email address
    • Role (ADMIN or USER)
  5. Returns user data (excluding password) and authentication token

Session Management

Authentication tokens:
  • Valid for 24 hours by default
  • Stored in HTTP-only cookie (auth_token)
  • Can be sent via Authorization header: Bearer <token>
  • Automatically validated by server middleware on protected routes
The JWT secret is configurable via the JWT_SECRET environment variable. Use a strong secret in production.

User Data Model

Each user record contains:
FieldTypeDescription
user_idUUIDUnique user identifier
emailStringUnique email address (max 50 chars)
passwordStringBcrypt hashed password
nameStringFirst name (max 50 chars)
surnameStringLast name (max 50 chars)
phoneStringContact phone number
addressStringStreet address
cityStringCity name
countryStringCountry name
postal_codeStringPostal/ZIP code
genderStringGender identifier
birth_dateDateDate of birth
roleEnumADMIN or USER
statusEnumON or OFF
avatarStringAvatar URL (auto-generated if not provided)
document_typeEnumDNI, PASSPORT, or NIE
document_numberStringID document number
refresh_tokenStringOAuth refresh token (nullable)
created_atDateTimeAccount creation timestamp
updated_atDateTimeLast update timestamp
The user management interface supports advanced filtering:

Available Filters

  • Search Query - Search by name, email, or role
  • Role Filter - Show only ADMIN or USER accounts
  • Status Filter - Display active (ON) or inactive (OFF) users
  • Document Type - Filter by DNI, PASSPORT, or NIE
Filters are applied in real-time as you type or select options. The page automatically resets to page 1 when filters change.

Avatar Generation

If no avatar is provided during user creation, the system automatically generates one using the UI Avatars service:
`https://ui-avatars.com/api/?name=${encodeURIComponent(name)}&background=random`
This creates a colorful initial-based avatar for each user.

Security Considerations

Follow these security best practices when managing users:
  • Strong Passwords - Enforce password complexity requirements
  • Regular Audits - Review user accounts periodically and deactivate unused accounts
  • Least Privilege - Assign USER role by default; only promote to ADMIN when necessary
  • Secure Storage - All passwords are hashed with bcrypt (10 rounds)
  • Token Security - JWT tokens contain minimal user data (ID, email, role)
  • HTTPS Only - Always use HTTPS in production for secure cookie transmission

Best Practices

  1. Unique Emails - Each user must have a unique email address
  2. Document Verification - Collect and verify document information for compliance
  3. Regular Updates - Keep user contact information current
  4. Status Management - Use OFF status instead of deletion when possible
  5. Role Assignment - Carefully control who receives ADMIN privileges

Roles & Permissions

Learn about role-based access control

User API Reference

View API endpoints for user management

Configuration

Configure authentication and security settings

Data Management

Backup and export user data

Build docs developers (and LLMs) love