Access control documented

API/v1/servers/POST Create or update server.md

@@ -1,6 +1,5 @@
 # POST Create or update server
 This API call creates a server or updates it with the given information.
-
 #### Location
 ```
 /api/v1/servers/

Installation.md

@@ -1,19 +1,20 @@
 # Installation
 This guide explains how to install Sentri on a Linux server.
-# Requirements
+## Requirements
 Before continuing, make sure your server meets the following requirements:
+
 - A Linux server (Linux is officially tested and supported)
 - Basic Linux and web hosting experience
-- A web server of your choice (Apache, Nginx, Caddy, etc.)
+- A web server of your choice (Apache, Nginx, etc.)
 - MariaDB or MySQL
 - PHP 8.3 or newer
 - Git installed on the server
 
 >[!info]
 >This guide uses `/var/www/sentri/` as the installation directory. You can change this to any location you prefer.
-# Installation
+## Installation
 
-## Configure the document root
+### Configure the document root
 Sentri stores all publicly accessible files inside the `pub/` directory.
 If your current virtual host document root is:
 ```
@@ -24,7 +25,7 @@ Change it to:
 /var/www/sentri/pub/
 ```
 After updating the document root, reload or restart your web server.
-## Download the Sentri files
+### Download the Sentri files
 Run the following commands to download the latest version of Sentri:
 ```bash
 cd /var/www/sentri/
@@ -36,7 +37,7 @@ mv Sentri/.[!.]* . 2>/dev/null
 
 rmdir Sentri
 ```
-## Database setup
+### Database setup
 Log in to MariaDB/MySQL and create the database and user:
 ```sql
 CREATE DATABASE sentri;  
@@ -50,7 +51,7 @@ Next, import the database schema:
 mariadb -u sentri -p sentri < /var/www/sentri/install.sql
 ```
 When prompted, enter the password for the `sentri` database user.
-## Configuring
+### Configuring
 Copy the example configuration file:
 ```bash
 cp /var/www/sentri/pub/config-sample.php /var/www/sentri/pub/config.php
@@ -59,7 +60,7 @@ Then edit the configuration file and update the database credentials:
 ```
 /var/www/sentri/pub/config.php
 ```
-### First Login
+#### First Login
 Open your website in a browser and log in with the default credentials:
 ```
 Username: superuser
@@ -68,13 +69,13 @@ Password: changethispassword
 
 > [!WARNING]
 > After logging in change the superuser password!
-### Global settings
+#### Global settings
 Go to [[Global|Global]] under Portal Management and rename the portal to your preference.
 
 Next, configure the SMTP connection in [[Mail|Mail]] under Portal Management so Sentri can send emails.
 
 Finally, enable the [[index#Modules|modules]] you want to use in [[Portal Management/Settings/Modules|Modules]] under Portal Management.
-### Create users and check permissions
+#### Create users and check permissions
 Go to the 
-### Getting started 
+#### Getting started 
 After completing the installation, continue with the [[Getting Started]] guide to configure and begin using Sentri.

Portal Management/Access Control/Admins.md

@@ -1 +1,31 @@
 # Admins
+Admins are users who are not tied to specific companies and are responsible for administering Sentri.
+## View admin
+To view admins, you need the `admin-access-admins` RO permission.
+
+In the admins list, click the **view** icon to open an admin and see additional details.
+## Add admin
+To create a new admin, you need the `admin-access-admins` RW permission.
+
+Complete the form and click **Add admin**. The admin will be created in a **Pending** state.
+
+After creation, an invitation email is sent. The recipient must verify their account and set a password. Once completed, the admin becomes **Active**.
+## Modify admin
+To manage admins, you need the `admin-access-admins` RW permission.
+
+You can edit an admin by clicking the **edit** icon in the admin list or by selecting **Edit** while viewing the admin details.
+### Send password reset email
+To send a password reset email, you need the `admin-access-admins-resetpassword` RW permission.
+
+Open the admin details and click **Send password reset email** in the user management section.
+### Disable two factor authentication
+To disable two-factor authentication for another admin, you need the `admin-access-admins-mfa` RW permission.
+
+Open the admin details and click **Disable two-factor authentication** in the user management section.
+# Admin status
+An admin can have one of the following statuses:
+
+- **Active** – The admin is active and can log in.
+- **Pending** – The admin has been created but has not yet verified their account or set a password via the invitation email.
+- **Banned** – The admin is blocked due to suspicious or policy-violating behavior and cannot log in.
+- **Inactive** – The admin account is disabled and cannot log in.

Portal Management/Access Control/Permissions.md

@@ -1 +1,17 @@
-# Permissions
+# Permissions
+Many actions in Sentri require specific permissions. These permissions are configured per user group and can be set to one of the following levels:
+
+- NA (Not Available)
+- RO (Read Only)
+- RW (Read Write)
+
+> [!INFO]
+> The **superuser** account has RW access to all permissions by default. This behavior is intentional and cannot be changed.
+## Viewing or modifying permissions
+To view permissions, you need the `admin-access-control-permissions` RO permission.
+
+To modify permissions, you need the `admin-access-control-permissions` RW permission.
+
+Navigate to **Access control** > **Permissions** and click the **view** icon. You will see the permission set assigned to each user group.
+
+If you want to view or modify all permissions for a specific user group, go to **Access control** > **User groups**, then click the **view icon** next to the user group you want to view or modify. This will display the full list of permissions configured on that group.

Portal Management/Access Control/User groups.md

@@ -1 +1,20 @@
-# User groups
+# User groups
+All users in Sentri are assigned to a user group. There are currently two types of user groups:
+
+- **Administrator** – Users not tied to specific companies. They are responsible for administering Sentri and are created [[Admins|here]].
+- **User** – Intended for future use for users linked to specific companies. This group type is not yet active in Sentri.
+
+## User group weight
+Each user group has an associated **weight**, which is used to enforce hierarchy and prevent privilege escalation.
+
+For example, if your current user group has a weight of **10**, you cannot create or assign a user to a group with a lower weight (e.g. **1**) if that would result in higher permissions than your own. This ensures users cannot create accounts with greater access than their own.
+## Adding a user group
+To add a user group, you need the `admin-access-control-user-groups` RW permission.
+
+Navigate to **Access Control** > **User groups** and click **Add user group**. Enter a name and select the group type.
+
+After creation, you will be able to configure the group’s [[Permissions|permissions]]. To modify permissions, you also need the `admin-access-control-permissions` **RW** permission.
+## Viewing user groups
+To view user groups, you need the `admin-access-control-user-groups` RO permission.
+
+Go to **Access Control** > **User groups** and click the **view icon** next to a user group. This will show detailed information about the group, including all configured [[Permissions|permissions]].

Portal Management/Settings/Global.md

@@ -1,14 +1,14 @@
 # Global
-# Portal name
+## Portal name
 This setting allows you to change the name of the portal.  
 Currently, this setting has limited functionality, but it will be used in future versions to support white-labeling.
-# Portal provider name
+## Portal provider name
 This setting allows you to change the provider name displayed by the portal.  
 Currently, this setting has limited functionality, but it will also be used in future versions to support white-labeling.
-# Admin authentication methods
+## Admin authentication methods
 This setting will later support multiple administrator authentication methods.  
 Currently, the only available option is `database_auth`.
-# CA certificate URL
+## CA certificate URL
 This URL points to the Certificate Authority (CA) certificate used by the auto-provisioning module, which is currently under development.
-# Autoprovisioning URL
+## Autoprovisioning URL
 This URL is used by the auto-provisioning system to retrieve configuration data by the auto-provisioning module, which is currently under development..

Portal Management/Settings/Mail.md

@@ -6,11 +6,11 @@ Sentri sends emails in the following situations:
 - When a new user is created, an invitation email is sent to the user.
 - When a user requests a password reset.
 - When an administrator sends a password reset email.
-# From Name
+## From Name
 This is the sender name displayed in emails sent by Sentri.
-# From Address
+## From Address
 This is the email address used by Sentri to send emails.
-# SMTP Server Configuration
+## SMTP Server Configuration
 ### Host
 The hostname or IP address of your SMTP server.
 ### Secure

Portal Management/Settings/Modules.md

@@ -1,6 +1,6 @@
 # Modules
 Sentri allows modules to be enabled or disabled. Each module provides its own functionality, which can be viewed [[../../index|here]].
-# Enabling and Disabling Modules
+## Enabling and Disabling Modules
 To enable or disable modules, navigate to **Settings** > **Modules** and toggle the modules you want to enable or disable.
 
 > [!Note]  

Release notes.md

@@ -4,6 +4,7 @@ To be announced
 ### Changes
 - Changed portal management page to Settings and changed System in the sidebar to Portal management.
 - Removed vc_ prefix from certain database tables.
+- Display user group weight in user groups view.
 
 ## v.1.2
 `06-05-2026`
@@ -19,6 +20,11 @@ To be announced
 - Filtering and ordering on backup types fixed in server overview.
 ### Known issues
 - Sidebar text is showing when sidebar is wrapped.
+- Avatar upload button is dark
+- non-superuser admins can update the permission name and description, this should be limited to the superuser.
+- Problem with enabling and disabling modules as superuser.
+- Administrator can change superuser permissions. 
+- problem with redirect after creating a user-group. When creating a group it does not create the permissions for the new user group. also a 500 error is displayed.
 ## v.1.1
 `07-01-2026`
 ### Changes

index.md

@@ -2,7 +2,7 @@
 >[!note]
 >The making of the this documentation is still in progress. 
 # What is Sentri
-Sentri is a self-hosted web application built around a modular system. Each module provides a specific feature or solves a particular use case, and was created from practical needs encountered throughout my career as a system and network administrator. Instead of relying on multiple separate services or portals for smaller operational tasks, Sentri centralizes them into a single platform.
+Sentri is a self-hosted web application built as a modular system. Each module provides a specific feature or solves a particular use case, and was created from practical needs encountered throughout my career as a system and network administrator. Instead of relying on multiple separate services or portals for smaller operational tasks, Sentri centralizes them into a single platform.
 
 Its modular structure keeps the platform lightweight and flexible by allowing you to enable only the components you actually use. Sentri is open-source, performance-focused, and designed to remain minimal and simple. Because Sentri is fully self-hosted, all data remains under your control without depending on third-party providers.