Secure Identity Access & Granular Role Permission Gates
Enforced Endpoint Access Control
Guard system endpoints with secure JWT auth, enforce multi-device lockout limits, configure numeric PIN locks for operators, and generate expiry-tracked share links.
Enforce Multi-Session & IP Restrictions
Prevent credentials leaks, open terminal vulnerabilities, and unauthorized offsite access loops.
Core Safety Modules
A defense-in-depth architecture covering browser cookies, network routers, and database entries.
Device Session Limitation
Control maximum active concurrent login tokens. Restrict operators to 1 session while granting suppliers up to 5.
Auto Lock Screen PINs
Bcrypt-hashed numeric pin entry. Listens to global events for idle timeout lockouts and syncs state across tabs.
IP Whitelisting & Subnets
Gates administrative accounts to office subnets using exact match, wildcard, or bitwise CIDR block checks.
Plan Expiry Gateway
Middleware gates all API requests against plan validity stamps, blocking non-super-admin endpoints if expired.
Granular RBAC Enforcers
Define custom permission matrices (e.g., inventory.edit, billing.cancel) and enforce department scopes.
Storage Anti-Bypass Guard
Monitors storage variables. Terminating or bypassing local flags triggers a hard logout and JWT invalidation.
Active User Sessions & Concurrent Limits
Manage concurrent device thresholds by role to block credentials leakage and simultaneous access.
1. Active Sessions Registry
LIMIT: 1 ACTIVEChrome / Windows Desktop (Office Gateway)
Safari / iPhone 15 Pro (Mobile App)
Chrome / Android Tablet (Workshop Terminal)
2. Set Max Limits
IP Whitelisting & Subnets Gateway
Expose administrative and operational dashboards solely to secured company IP channels.
Corporate Whitelist Rules
MIDDLEWARE: ACTIVEOffice LAN Network
Secured AWS VPN Gateway
Surat Headquarters Static IP
Audit Connection Gateway
Operator PIN Pad & Idle Timer Lock
Lock operations screens instantly during physical absences without closing server sessions.
Set 4-Digit Numeric PIN
Terminal Lockpad Trigger
Locks the ERP interface locally. Synchronizes lock status instantly across open browser tabs using the storage API listener.
Role Permissions & Columns Masking
Define granular access rules for admin, operators, and vendors. Mask pricing fields for external guests.
Access Privileges mapping
"Hiding wholesale costs and margins from external supplier logins is handled automatically by permissions column masks."
Subscription Plan Expiry Gates
Automatically restrict endpoint operations when subscription timelines exceed validation limits.
Subscription Gate Settings
Plan Gate: CLEAR
API requests verified successfully. Subscription is valid or role matches super admin exemptions.
Built For Your Industry
Configure Zero-Trust security settings scoped specifically to diamonds, casting logs, or supply chains.
Field operators quickly unlock shop floor terminal tablets using quick PIN codes without complete re-authentication.
Restrict diamond ledger viewing permissions to vault department members using CIDR IP whitelist checks.
Enforce single-session limits on employee accounts to prevent multi-operator billing revisions.
Restrict transport vendors to compliance-related panels only, hiding global customer catalogs and wholesale pricing.
Gate cash register accounts to localized IP gateways and specific register hardware devices, blocking offsite checkout attempts.
Limit process operators to chemical safety sheets only, blocking unauthorized exports of proprietary chemical recipes.
Log double-operator credentials audit logs for prescription storage lockers, generating notifications for abnormal dispenses.
Generate passcoded, auto-expiring share links for blueprints shared with sub-contractors, locking access when bidding closes.
Module FAQs
What is a Session Override?↓
If a user attempts to log in but has reached their concurrent session limit, the system offers an override screen to log out other devices.
How do ShareLinks work?↓
They are temporary web links generated to share documents. You can configure expiration dates, view limits, and passcode protection.
How does the cross-tab locking system synchronize lock status?↓
The lock screen listens to local storage state events. When any tab changes the 'erp_locked' flag to true, a storage event listener triggers on all other open tabs, locking them synchronously in real-time.
Can a vendor bypass column masking using browser Inspect Element tools?↓
No. Column masking is executed at the server-side API middleware level. The restricted fields (e.g., margins, wholesale purchase costs) are completely omitted from the network payload returned by the database.
How do bitwise CIDR block checks determine IP compliance?↓
The whitelisting middleware parses client IP addresses and converts both the incoming IP and the CIDR whitelisted subnet into binary integers. It then runs a bitwise XOR operation against the mask bits to verify compliance.
What is the purpose of Bcrypt salt rounds in operator PIN locking?↓
When configuring a numeric PIN, the system runs 10 rounds of salt computations. This cost factor ensures brute-force dictionary attacks are computationally unfeasible, safeguarding operational terminal devices.
What happens to active JWT tokens during session revocation?↓
When an administrator terminates an active session, the session ID is added to a high-speed Redis blacklist memory cache. All subsequent API queries verify the token signature against this blacklist before processing.