Permission model
Module
Administration
This page describes all the rules that determine what a user sees and what they can do in CoreX ERP. The rules are enforced on the server: whether or not the user interface hides a button, a request without permission is rejected on the server.
License ──► Module Management ──► Permission (roles ∪ unit roles ∪ additional permissions) ──► Data restrictions
(scope) (installation's choice) opens the screen, the button, the API request (warehouse, work center,
channel, price, cost)
Screen catalog ──► only what appears in the menu (does not grant permissions)
Permission
A permission is the key to a single action. Its format is <resource>.<action>:
| Part | Example | Meaning |
|---|---|---|
| Resource | erp-sales-orders | What it applies to: sales orders. ERP resources are named erp-<area>-<object> (erp-procurement-orders, erp-inventory-counts). Administration resources have no prefix: users, roles, organization, company-profile, audit, outbox, alerts, email-settings. |
| Action | create | What is done: create. |
In the Yetkiler (Permissions) tree of the role window, a permission appears with the name Kaynak · İşlem
(Resource · Action): erp-sales-orders.create → Satış Siparişleri · Oluştur (Sales Orders · Create). All
permissions in the installation: Permission list.
Actions and what they open
| Action | Name in the tree | What it typically opens | Note |
|---|---|---|---|
view | Görüntüle (View) | List and detail screens, the menu leaf, the record being visible in pickers | Read permission. |
create | Oluştur (Create) | The Yeni… (New…) button in the list, the "… Oluştur" (Create …) menu leaf, actions that open documents | Some creation screens also require a second read permission (e.g. erp-partners-cards.view for a sales order). |
edit | Düzenle (Edit) | Düzenle (Edit), most status actions on the document (e.g. Siparişi Onayla (Approve Order), Gönder (Send)) | Its scope varies by resource; the ⓘ icon in the tree states the scope. |
delete | Sil (Delete) · on some resources İptal (Cancel) or Listeden kaldır (Remove from list) | Deleting, cancelling or removing from the list | Documents are not deleted; the name in the tree states the actual meaning. |
import | İçe Aktar (Import) · Dosyadan yükle (Load from file) | Bulk loading from an Excel workbook | A separate permission from editing a single record. |
approve | Onayla (Approve) | Onayla (Approve) / Reddet (Reject) in the approval step | Not sufficient on its own: if the approval template's step requires a specific role, the user must also hold that role. |
close | Kapat (Close) | Closing a document manually (giving up the unfulfilled remainder) | A fully shipped document closing automatically does not depend on this permission. |
release | Serbest Bırak (Release; on some resources Blokeyi çöz — Remove block) | Releasing an allocation, a block or a lot | |
issue | Çekme (Mal Ver) (Pick (Issue Goods)) | Issuing goods from a reservation or from project stock | It is separate so that the person who opens the reservation and the person who issues the goods can be different. |
transfer | Aktar · Transfer (Transfer) | Stock transfer between warehouses | |
finalize | Kesinleştir (Finalize) | Finalizing an invoice | |
activate | Etkinleştir (Activate) | Putting an e-Document live | |
reopen · backdate | Yeniden Aç (Reopen) · Geçmiş Tarihli Kayıt (Backdated Posting) | Reopening a posting period, posting a backdated document | Belongs to the accounting period. |
Action not shown
If an action does not appear under a resource in the tree, that action does not exist for that resource (the note at the bottom of the window: "Bir sayfada görünmeyen işlem, o sayfada böyle bir işlem olmadığı anlamına gelir." — An action that does not appear on a page means that the page has no such action.).
Is the button hidden or disabled?
- Without permission, the button or menu item is not drawn at all. Example: with the Demo — Satış Temsilcisi (Demo
— Sales Representative) role, only Dışa Aktar (Export) appears on the Fiyat Listeleri (Price Lists) screen;
the Satın Alma Siparişleri (Purchase Orders) list has no Yeni Sipariş (New Order) button (the role does not
have
erp-sales-price-lists.createanderp-procurement-orders.create). - If the permission exists but a rule prevents the action, the button is visible but disabled, and the reason is shown when you hover over it. Example: on the Roller (Roles) screen, the Sil (Delete) item of the Yönetici (Administrator) row is disabled — "Yerleşik rol silinemez" (A built-in role cannot be deleted).
- On a row that has no actions left in the actions menu, the cell remains empty.
- Hiding something from the menu is not a security boundary: a user who types the address manually is stopped by the screen's gate and by the server (see Rejection messages).
Role
A role is a named set of permissions. Permissions are not granted to a user one by one, but through a role.
- A user can have multiple roles. The effective permissions are the union of the roles' permissions; one role does not restrict another role's permissions, and there is no "denying" role.
- A role also has a screen catalog (see below).
- A role's name cannot be changed after it is created ("Rol adı bu sürümde değiştirilemiyor." — The role name cannot be changed in this release.).
- A permission change saved in the role window applies to everyone who holds the role immediately.
Predefined roles (role templates)
The installation comes with 26 predefined roles; each is bound to a role template. The role's area and level (Eleman (Staff), Müdür (Manager), Yönetim (Executive)) appear in the list. Full list and permission counts: Role examples.
| Rule | Details |
|---|---|
| The Administrator is built-in | It appears in the list with the Yerleşik (Built-in) badge, cannot be deleted ("Yerleşik Yönetici rolü silinemez." — The built-in Administrator role cannot be deleted.) and holds all permissions. Permissions that come with a new release are also added to it during the installation upgrade. |
| Template permissions are locked | The template permissions of a role that comes from a template are shown with a lock icon in the tree and cannot be removed; they are restored with every release upgrade. Additional permissions can be granted to the role. |
| Narrower role = copy | If you do not want one of the template's permissions, Kopyala (Copy) the role from the list; the copy is not bound to the template and all of its permissions can be changed. |
| Screens are not locked | The screen catalog of a template role can be changed. |
| Read baseline | All templates other than Administrator carry a common set of 93 view permissions: master data, document lists and definitions can be read. The real difference between roles is the write permissions; the Kapsam (yazma) (Scope (write)) column in the list shows this. |
Effective permissions: four sources
A user's effective permissions are calculated on the server on every request as the union of:
- Their own roles — Kullanıcılar › İşlemler › Kullanıcıyı Düzenle › Roller (Users › Actions › Edit User › Roles).
- The roles of their organizational unit — if the user is attached to a unit, the roles assigned to that unit (Organizasyon Şeması › Rolleri yönet — Organization Chart › Manage roles). Only the user's own unit counts; the roles of parent units are not inherited.
- The unit manager's automatic permission — the unit manager automatically receives only the permission to view
and edit service calls (
erp-service-desk-tickets.view,.edit). - Extra permissions — permissions granted directly to the person through Kullanıcılar › İşlemler › Ekstra Yetkiler (Users › Actions › Extra Permissions).
Then the permissions of features that are turned off in the installation are subtracted (see Module management). The user window also states this: "Etkili izinler seçilen rollerin ve birimin rollerinin birleşimidir." (The effective permissions are the union of the selected roles and the unit's roles.)
Extra permissions cannot remove what comes from a role
In the Ekstra Yetkiler (Extra Permissions) window, permissions that come from roles are locked ("kullanıcının rolünden gelir" — comes from the user's role). To take one of a role's permissions away from a person, give them a different (narrower) role.
Screen catalog (menu)
The role's Ekranlar (Screens) tab determines which screens appear in the menu of the person who holds the role.
- The catalog does not grant permissions: a screen that is in the catalog but has no permission does not appear in the menu; a screen that has permission but is not in the catalog does not appear in the menu, but it can be opened by its address, and read surfaces such as reports and pickers work.
- If Bütün ekranlar — katalog yok (All screens — no catalog) is checked, every screen with permission is in the menu (Administrator and Auditor work this way).
- If the catalog is empty, the menu is drawn with the screens of the resources the role has write permission for.
- When you grant a new write permission on the role's Yetkiler (Permissions) tab, the screens of that resource are checked automatically in the catalog; Yazdığı Ekranları İşaretle (Mark the Screens It Writes To) adds any missing ones in bulk.
- For a user, Ekstra Yetkiler › Bütün ekranları göster (Extra Permissions › Show all screens) opens all permitted screens in the menu regardless of the role's catalog; it does not grant permissions either.
- The menu order is the same for everyone; the role only prunes it. If all screens of an area drop out, the area is also removed from the menu.
Example: with the Demo — Satış Temsilcisi (Demo — Sales Representative) role, the top menu shows Satış, Stok Yönetimi, Lojistik Yönetimi, Üretim, Ana Veriler, Finans (Sales, Inventory Management, Logistics Management, Production, Master Data, Finance); Satın Alma (Purchasing) and Yönetim (Administration) do not appear. Even so, when the address of the purchase order list is opened, the list can be read (read baseline), but the Yeni Sipariş (New Order) button does not appear.
Data restrictions
A permission opens an action; the rules below narrow which records that action can be performed on.
| Restriction | Where it is set | Effect | Rejection message |
|---|---|---|---|
| Warehouse restriction | Kullanıcılar › İşlemler › Organizasyon Kısıtlaması › Depolar (Users › Actions › Organizational Restriction › Warehouses) | The user posts stock only to the selected warehouses; opens physical inventory counts, warehouse tasks, waves, transfers and reservations only there; sees only those warehouses in the work queues. If nothing is selected, there is no restriction. | '<depo kodu>' deposunda işlem yetkiniz yok. (You are not authorized to perform transactions in warehouse '…'.) |
| Work center restriction | The same window › İş Merkezleri (Work Centers) | Confirmations, consumption, output, capacity scheduling and backflush only at the selected work centers. A restriction on a parent work center covers the subtree. | '<iş merkezi kodu>' iş merkezinde işlem yetkiniz yok. (You are not authorized to perform transactions at work center '…'.) |
| Sales channel | Members of the sales channel | A user who is a member of a channel sees only the documents of their own channels; cannot open documents in another channel. | '<kanal kodu>' satış kanalında belge açma yetkiniz yok. (You are not authorized to open documents in sales channel '…'.) |
| Sales price visibility | By permission | In sales documents, prices and amounts are visible only if one of these permissions exists: erp-sales-price-lists.view, erp-sales-orders.create/.edit, erp-sales-quotations.create/.edit, erp-invoicing-invoices.view, erp-invoicing-references.create (for returns, additionally erp-sales-free-returns.create). Otherwise the amounts are hidden; quantity, item and status remain visible. | — |
| Purchase price visibility | By permission | In purchasing documents, prices are visible only with erp-procurement-item-suppliers.view, erp-procurement-orders.create/.edit/.approve, erp-invoicing-references.create or erp-invoicing-incoming-invoices.view (for a request for quotation, additionally erp-procurement-rfqs.edit). | — |
| Cost visibility | erp-inventory-costs.view | Stock value, moving average unit cost, movement cost, employee hourly rate and cost reports are visible only with this permission; the values are not sent to a user without it. | — |
| Document history | The role's level | A document's change history is visible to the person who created the record, the area's Müdür (Manager) level role (in Master Data and Logistics, the master data specialist) and holders of audit.view. | Belgenin geçmişini kaydı açan kişi, alanın müdürü (Ana Veriler ve Lojistik'te ana veri uzmanı) ve Yönetici görür. (The document's history is visible to the person who created the record, the area's manager (in Master Data and Logistics, the master data specialist) and the Administrator.) |
A restriction does not grant permissions; it only narrows them: if the user's role has no stock write permission, selecting a warehouse does not give them that permission. There is no user restriction by company or sales organization.
When does a change take effect?
| Change | Effect |
|---|---|
| The role's permissions or screens | Immediately for everyone who holds the role: the server decides with the new permissions on the next request, and the menu of open sessions is refreshed. Signing in again is not required. |
| The user's roles, extra permissions, unit, restriction | Immediately for that user (on the next request). |
| The unit's roles | Immediately for everyone in the unit ("Değişiklik tüm üyelere anında yansır." — The change applies to all members immediately.). |
| Module Management | Immediately for the user who saved it, within 30 seconds at the latest for other users. |
| The role of an approval step, the document history area | These two checks look at the session's role names; role names are updated when the session information is read again (when the page is refreshed). After a role assignment, tell the user to refresh the page. |
| Disabling, password change | The open session ends on the next request; the user returns to the sign-in screen. |
The session is kept in a cookie: it stays open for 8 hours while in use, or 30 days if Beni hatırla (Remember me) is checked.
Account security
| Topic | Rule |
|---|---|
| Password | At least 8 characters; at least one digit and one lowercase letter. Uppercase letters and symbols are not required. |
| Locking | After 5 consecutive failed attempts the account is locked for 15 minutes; it unlocks automatically when the period expires, or an administrator clicks Kilidi Kaldır (Unlock). It can be turned off per user (Hatalı şifre denemelerinde hesabı kilitle — Lock the account on failed password attempts). |
| Attempt limit | More than 10 sign-in attempts per minute from the same address are temporarily rejected: "Çok fazla deneme yapıldı. 60 saniye sonra tekrar deneyin." (Too many attempts. Try again in 60 seconds.) |
| Invitation link | Valid for 3 days, single use; when a new one is sent, the old one no longer works. |
| Reset link | Valid for 30 minutes. |
| Password change at first sign-in | If the administrator set the password manually and İlk girişte şifre değiştirilmesi zorunlu olsun (Require password change at first sign-in) is checked, the user first sees the Parolanızı değiştirin (Change your password) screen; they cannot perform any action without changing it. |
| Two-factor authentication, session list | Not available. To close a user's open session, disable their account or change their password. |
| License user limit | If the license's active user limit is full, no new account can be created and a disabled account cannot be restored (message below). |
Segregation of duties
When roles are selected for a user, the system shows a Görevler ayrılığı uyarısı (Segregation of duties warning) for certain pairs of roles. The warning does not block saving ("Kayıt engellenmez; küçük ekipte bilerek verilebilir." — Saving is not blocked; in a small team the roles can be assigned knowingly.).
| Roles assigned together | Reason (text in the window) | Meaning |
|---|---|---|
| Depo Memuru (Warehouse Clerk) + Stok Yöneticisi (Inventory Manager) | belgeyi yazan stok farkını da kapatır | the person who posts the document also closes the stock difference |
| Depo Memuru + Satın Alma Uzmanı (Purchasing Specialist) | siparişi veren malı da teslim alır — üçlü eşleşme çöker | the person who places the order also receives the goods — three-way matching collapses |
| Depo Memuru + Satış Temsilcisi (Sales Representative) | satış siparişini yazan malı da çıkarır | the person who enters the sales order also issues the goods |
| Depo Memuru + Üretim Operatörü (Production Operator) | mal kabulle plan üstü sarf gizli bir çıkış olur | with goods receipt, unplanned consumption becomes a hidden issue |
| Depo Memuru + Kalite Uzmanı (Quality Specialist) | malı içeri alan kendi kabulünü serbest bırakır | the person who receives the goods releases their own receipt |
| Stok Yöneticisi + Kalite Uzmanı | stok farkını yazan kalite kararını da verir | the person who posts the stock difference also makes the quality decision |
| Ürün Ana Veri Uzmanı (Item Master Data Specialist) + Stok Yöneticisi | depo ve hareket nedeni sözlüğünü yazan düzeltmeyi de yazar | the person who maintains the warehouse and movement reason dictionary also posts the adjustment |
| Satın Alma Uzmanı + İş Ortağı Ana Veri Uzmanı (Business Partner Master Data Specialist) | tedarikçi kartını açan ona sipariş de yazar — hayalet tedarikçi | the person who creates the supplier record also places orders with it — ghost supplier |
| Satış Temsilcisi + İş Ortağı Ana Veri Uzmanı | müşteri kartını açan ona sipariş de yazar — hayalet müşteri | the person who creates the customer record also enters orders for it — ghost customer |
| Satın Alma Uzmanı + Faturalama Uzmanı (Invoicing Specialist) | siparişi yazan faturayı da bağlar — sipariş → fatura zinciri tek elde | the person who enters the order also links the invoice — the order → invoice chain is in one person's hands |
| Satış Temsilcisi + Faturalama Uzmanı | siparişi yazan faturayı da keser — satış zinciri tek elde | the person who enters the order also issues the invoice — the sales chain is in one person's hands |
| Satın Alma Uzmanı + Satın Alma Müdürü (Purchasing Manager) | siparişi yazan onay merciine de sahip olur | the person who enters the order also holds the approval authority |
| Satış Temsilcisi + Satış Müdürü (Sales Manager) | teklifi yazan onay merciine de sahip olur | the person who enters the quotation also holds the approval authority |
| Satış Temsilcisi + Kredi Yöneticisi (Credit Manager) | satışçı kendi siparişinin kredi blokesini kaldırır | the salesperson removes the credit block on their own order |
| Satın Alma Uzmanı + Üretim Planlayıcı (Production Planner) | hizmet siparişini yazan hizmet kabulünü de yazar | the person who enters the service order also posts the service acceptance |
| Üretim Planlayıcı + Üretim Operatörü | ürün ağacını değiştirebilen operatör sarf farkını yok eder | an operator who can change the bill of materials makes consumption differences disappear |
| Stok Yöneticisi + Üretim Operatörü | sarfı yazan stok farkını da kapatır | the person who posts consumption also closes the stock difference |
| Denetçi (Salt Okunur) (Auditor (Read-Only)) + any role that writes | denetçinin salt okunur kalması gerekir | the auditor must remain read-only |
| Yönetici (Administrator) + any role | yönetici hesabı her kesimi aşar — günlük operasyon ayrı bir hesapla yapılmalı | the administrator account overrides every separation — daily operations should be done with a separate account |
The warning looks at role names: no warning appears for roles you copied from predefined roles and saved under a different name; you maintain the separation in the role design yourself.
Rejection messages
| Situation | What is shown on the screen |
|---|---|
| The address of a screen without permission was opened | "Bu işlemi gerçekleştirmek için yetkiniz bulunmuyor." (You are not authorized to perform this action.) · "Erişim gerekiyorsa sistem yöneticinizle iletişime geçin." (If you need access, contact your system administrator.) · Ana Sayfa'ya dön (Return to Home Page) |
| The permission exists in the role but the feature is turned off in the installation | "Bu özellik kuruluşunuzda etkin değil." (This feature is not active in your organization.) (A user who has no permission at all is not told the feature status.) |
| An action without permission reached the server | "Bu işlemi gerçekleştirmek için yetkiniz bulunmuyor." (You are not authorized to perform this action.) |
| Restricted warehouse / work center | '<kod>' deposunda işlem yetkiniz yok. (You are not authorized to perform transactions in warehouse '…'.) · '<kod>' iş merkezinde işlem yetkiniz yok. (You are not authorized to perform transactions at work center '…'.) |
| Action without changing the password | "Devam etmeden önce parolanızı değiştirmeniz gerekiyor — bu parolayı sizden başka biri de biliyor." (You must change your password before continuing — someone other than you also knows this password.) |
| Wrong email or password | "E-posta veya parola hatalı." (Email or password is incorrect.) |
| Sign-in with a locked account | "Hesap … başarısız giriş denemesi nedeniyle kilitlendi. … dakika sonra tekrar deneyebilir, beklemek istemiyorsanız yöneticinizden kilidi kaldırmasını ya da parola sıfırlama bağlantısı göndermesini isteyebilirsiniz." (The account was locked because of … failed sign-in attempts. You can try again in … minutes; if you do not want to wait, you can ask your administrator to remove the lock or to send a password reset link.) |
| License read-only | E.g. "Kurulum lisansı etkin değil — sistem salt okunur. Lütfen sistem yöneticinizle iletişime geçin." (The installation license is not active — the system is read-only. Please contact your system administrator.) (records cannot be saved; reading continues) |
| License user limit | "Lisans en çok … etkin kullanıcıya izin veriyor; şu an … etkin kullanıcı var. Kullanılmayan bir hesabı kapatın ya da lisansı genişletin." (The license allows at most … active users; there are currently … active users. Close an unused account or extend the license.) |
Monitoring
- Yönetim › İzleme › Erişim Günlüğü (Administration › Monitoring › Access Log) records sign-ins, failed sign-ins, lockouts, attempts while locked, sign-outs and terminated sessions (kept for 2 years; passwords are not stored).
- Yönetim › İzleme › İşlem Kayıtları (Administration › Monitoring › Audit Log) keeps the trail of record creation, update and deletion, with the changed fields.
Details: Monitoring screens.