# Troubleshooting Guide - Permissions System

## Issue: Cannot Access settings.php

### Symptoms
- Clicking on Settings redirects to dashboard
- Getting "Access Denied" message
- Settings menu item not visible

### Solution Steps

#### Step 1: Check Database Setup
Run the setup checker to diagnose the issue:

```
http://your-domain/client/check_permissions_setup.php
```

This will tell you exactly what's missing.

#### Step 2: Run Migration (If Needed)

If the checker says "Migration Required", you need to add the permission columns to your database.

**Option A: Using phpMyAdmin**
1. Open phpMyAdmin
2. Select your database
3. Click "SQL" tab
4. Copy and paste the contents of `client/database_migration_permissions.sql`
5. Click "Go"

**Option B: Using MySQL Command Line**
```bash
mysql -u your_username -p your_database < client/database_migration_permissions.sql
```

**Option C: Manual SQL**
Run these queries in your database:

```sql
-- Add userRole column
ALTER TABLE `tblclient` 
ADD COLUMN `userRole` enum('admin','user') DEFAULT 'user' 
AFTER `pspId`;

-- Add permissions column
ALTER TABLE `tblclient` 
ADD COLUMN `permissions` TEXT DEFAULT NULL 
AFTER `userRole`;

-- Set existing users as admin
UPDATE `tblclient` 
SET `userRole` = 'admin',
    `permissions` = '{"enrollment":true,"calls":true,"reimbursement":true,"tasks":true,"documents":true,"reports":true}'
WHERE `userRole` IS NULL;
```

#### Step 3: Verify Your User is Admin

Check your user's role in the database:

```sql
SELECT clientId, clientName, email, userRole, permissions 
FROM tblclient 
WHERE email = 'your-email@example.com';
```

If `userRole` is NULL or 'user', update it to 'admin':

```sql
UPDATE tblclient 
SET userRole = 'admin',
    permissions = '{"enrollment":true,"calls":true,"reimbursement":true,"tasks":true,"documents":true,"reports":true}'
WHERE email = 'your-email@example.com';
```

#### Step 4: Clear Browser Cache
After making database changes:
1. Clear your browser cache
2. Close all browser tabs
3. Re-login to the portal

---

## Issue: Settings Page Shows Migration Warning

### Symptoms
- Can access settings.php but see yellow warning box
- Warning says "Database Migration Required"

### Solution
This means the permission columns don't exist yet. Follow Step 2 above to run the migration.

---

## Issue: Users Can't See Any Modules

### Symptoms
- User logs in but only sees Overview
- No other menu items visible

### Possible Causes & Solutions

**Cause 1: User has no permissions set**
```sql
-- Check user's permissions
SELECT clientName, email, userRole, permissions 
FROM tblclient 
WHERE email = 'user@example.com';

-- Grant permissions
UPDATE tblclient 
SET permissions = '{"enrollment":true,"calls":true,"reimbursement":true,"tasks":true,"documents":true,"reports":true}'
WHERE email = 'user@example.com';
```

**Cause 2: User account is inactive**
```sql
-- Check if user is active
SELECT clientName, email, isActive 
FROM tblclient 
WHERE email = 'user@example.com';

-- Activate user
UPDATE tblclient 
SET isActive = 'Y'
WHERE email = 'user@example.com';
```

**Cause 3: Permissions stored incorrectly**
Permissions must be valid JSON. Check format:
```json
{
  "enrollment": true,
  "calls": true,
  "reimbursement": false,
  "tasks": false,
  "documents": false,
  "reports": false
}
```

---

## Issue: "Access Denied" When Clicking Module

### Symptoms
- Menu item is visible
- Clicking it shows "Access Denied" on dashboard

### Solution
The user doesn't have permission for that module. Admin needs to:
1. Go to Settings
2. Click edit (pencil icon) next to the user
3. Check the box for the module they need
4. Click "Update User"

---

## Issue: Can't Delete a User

### Symptoms
- Delete button doesn't appear
- Delete fails with error

### Possible Causes

**Cause 1: Trying to delete yourself**
You cannot delete your own account. Login as a different admin to delete users.

**Cause 2: User is from different PSP**
You can only delete users from your own PSP (Patient Support Program).

---

## Issue: Added User Can't Login

### Symptoms
- Created user in Settings
- User can't login with their email

### Solution
The Settings page only creates user accounts - it doesn't set up login credentials. You need to:

1. **Option A**: User must use "Forgot Password" or OTP system
2. **Option B**: Manually set up their login in the main system

Note: The client portal uses OTP (One-Time Password) authentication via email.

---

## Backward Compatibility

The system is designed to work even without the migration:

- **Before Migration**: All users have full access to everything
- **After Migration**: Permissions are enforced based on settings

This means you can:
1. Use the portal normally before running migration
2. Run migration when ready to implement permissions
3. No data loss or downtime required

---

## Quick Diagnostic Queries

### Check if migration is needed
```sql
SHOW COLUMNS FROM tblclient LIKE 'userRole';
SHOW COLUMNS FROM tblclient LIKE 'permissions';
```

### List all users and their permissions
```sql
SELECT clientId, clientName, email, userRole, 
       CASE 
         WHEN userRole = 'admin' THEN 'All Modules'
         ELSE permissions 
       END as access
FROM tblclient
ORDER BY userRole DESC, clientName;
```

### Count users by role
```sql
SELECT 
  userRole,
  COUNT(*) as total,
  SUM(CASE WHEN isActive='Y' THEN 1 ELSE 0 END) as active
FROM tblclient
GROUP BY userRole;
```

### Find users with no permissions
```sql
SELECT clientId, clientName, email, userRole, permissions
FROM tblclient
WHERE userRole = 'user' 
  AND (permissions IS NULL OR permissions = '{}' OR permissions = '');
```

---

## Still Having Issues?

1. Run the checker: `client/check_permissions_setup.php`
2. Check PHP error logs
3. Check browser console for JavaScript errors
4. Verify database connection in `connect.php`
5. Ensure you're logged in as an admin user

## Support Files

- `check_permissions_setup.php` - Diagnostic tool
- `database_migration_permissions.sql` - Migration script
- `PERMISSIONS_SETUP_GUIDE.md` - Full setup guide
- `PERMISSIONS_SUMMARY.md` - Feature overview
