# User Management & Permissions System

## Overview
The client portal now includes a comprehensive user management and permissions system that allows administrators to control which modules each user can access.

## Features

### 1. User Roles
- **Admin**: Full access to all modules + Settings page for user management
- **User**: Limited access based on assigned permissions

### 2. Module Permissions
Admins can grant/revoke access to these modules:
- **Enrollment** - Patient data entry and management
- **Patient Calls** - Pharmacy call tracking
- **Reimbursement** - Reimbursement management
- **Tasks** - Task management
- **Documents** - File management
- **Reports** - Reporting and analytics

## Installation

### For New Installations
The permissions system is included in `database_setup.sql`. Just run the setup as normal.

### For Existing Installations
Run the migration script to add permissions to your existing database:

```sql
-- Run this SQL file
client/database_migration_permissions.sql
```

This will:
1. Add `userRole` column to tblclient
2. Add `permissions` column to tblclient
3. Set all existing users as admins with full permissions

## Usage

### Accessing Settings (Admin Only)
1. Login as an admin user
2. Click "Settings" in the top navigation
3. You'll see two tabs: User Management and Module Access

### Adding a New User
1. Go to Settings > User Management
2. Click "Add User" button
3. Fill in:
   - Name
   - Email
   - Role (Admin or User)
   - Module Permissions (check boxes for allowed modules)
4. Click "Add User"

### Editing User Permissions
1. Go to Settings > User Management
2. Click the edit icon (pencil) next to the user
3. Modify their:
   - Name
   - Email
   - Role
   - Status (Active/Inactive)
   - Module Permissions
4. Click "Update User"

### Deleting a User
1. Go to Settings > User Management
2. Click the delete icon (trash) next to the user
3. Confirm deletion
4. Note: You cannot delete your own account

## How It Works

### Navigation Menu
The top navigation menu automatically shows/hides items based on user permissions:
- Users only see modules they have access to
- Admins see all modules + Settings
- Overview (Dashboard) is always visible to everyone

### Access Control
Each module page checks permissions before loading:
- If a user tries to access a restricted module via direct URL, they're redirected to the dashboard with an "Access Denied" message
- Permission checks happen server-side for security

### Permission Storage
Permissions are stored as JSON in the database:
```json
{
  "enrollment": true,
  "calls": true,
  "reimbursement": false,
  "tasks": false,
  "documents": false,
  "reports": false
}
```

## Security Notes

1. **Admin Role**: Admins automatically have access to all modules regardless of permission settings
2. **PSP Isolation**: Users can only manage other users within their own PSP (Patient Support Program)
3. **Self-Protection**: Users cannot delete their own accounts
4. **Server-Side Validation**: All permission checks happen on the server, not just in the UI

## Default Permissions

When adding a new user, the default checked permissions are:
- ✅ Enrollment
- ✅ Patient Calls
- ✅ Reimbursement
- ❌ Tasks
- ❌ Documents
- ❌ Reports

You can customize these defaults in the "Add User" form.

## Troubleshooting

### User can't see any modules
- Check if their account is Active (not Inactive)
- Verify they have at least one permission enabled
- Ensure they're logging in with the correct email

### "Access Denied" message appears
- The user tried to access a module they don't have permission for
- Admin needs to grant them access via Settings

### Settings page not visible
- Only Admin users can see the Settings page
- Regular users will not see this menu item

## Technical Details

### Files Modified
- `client/header.php` - Dynamic menu based on permissions
- `client/function.php` - Permission checking functions
- `client/settings.php` - User management interface
- `client/dashboard.php` - Access denied alert
- `client/de/index.php` - Enrollment permission check
- `client/pharmacy/index.php` - Calls permission check
- `client/reimbursement/index.php` - Reimbursement permission check
- `client/tasks.php` - Tasks permission check
- `client/files.php` - Documents permission check
- `client/reports.php` - Reports permission check

### Helper Functions
```php
// Check if user has permission
hasPermission($pdo, $clientId, 'enrollment')

// Require permission or redirect
requirePermission($pdo, $clientId, 'enrollment')
```

## Future Enhancements

Potential additions:
- Email notifications when users are added/modified
- Password reset functionality
- Activity logging for permission changes
- Bulk user import
- Custom permission groups/templates
