Users & Roles

The Five Built-In Roles

Deprixa Plus ships with five predefined roles. Permissions for the Employee, Driver, and Customer roles can be toggled individually from Settings → Roles. The super-admin and admin roles always hold all 94 permissions and cannot be reduced.

Super Admin

Super Administrator

Unrestricted access — synced to Permission::all() at all times (always 100% of permissions)
Only role with access to /admin/*, /my-billing/*, license activation, and OTA updates
Can access system maintenance tools, audit logs, and all organizational settings
Route guard: role:super-admin — bypasses the can: middleware system entirely for guarded admin routes
Cannot be permission-reduced from the Roles matrix

Recommended: assign only to the technical owner of the installation. Do not use for day-to-day operations.

Admin

Administrator

94 of 94 permissions by default — full access to all Plus modules
Can access /api-tokens and /settings/api/* (route guard: role:admin|super-admin)
Can manage all users, shipments, invoices, customers, contracts, commissions, and settings
Can toggle permissions for Employee, Driver, and Customer roles from the Roles matrix
Cannot access super-admin-only routes (/admin/*, /my-billing/*)
Cannot be permission-reduced from the Roles matrix

Employee

Employee (Operational Staff)

40 permissions by default — all operational permissions for daily logistics work
Covers: shipments (full CRUD), dispatch, warehouse, customers, pickups, pre-alerts, lockers (view), import, returns, COD, POD, customs (view), contracts (view + create), locations (view), finance, billing (view), pricing (view), settings for shipment-statuses (view) and services (view)
Cannot manage settings, roles, or API tokens
Permission set is fully customizable by Admin from Settings → Roles

Driver

Driver (Courier)

8 permissions by default — focused on delivery operations only
Permissions: view dashboard, dashboard.kpi.view, dashboard.activity.view, dispatch.view, dispatch.update, dispatch.access, change status shipments, tracking.view
Can view shipments assigned to them and change delivery statuses
Cannot create shipments, access billing, customers, reports, or settings
Permission set is customizable by Admin from Settings → Roles

Customer

Customer (Client Portal)

5 permissions by default: view dashboard, create shipments, tracking.view, pre-alerts.view, pre-alerts.create
Redirected to /my-locker after login and on all dashboard access attempts — never lands on the admin area
All data scoped to customer_id = Auth::id() — cannot see other customers' data
Pre-alerts and shipments automatically filtered to their own records only
Permission set is customizable by Admin from Settings → Roles

Driver Role — Detailed Reference

The Driver role is designed for courier/delivery personnel. Drivers have a dedicated dashboard and can only access their assigned shipments and pickups.

What a Driver Sees

Driver Dashboard — Personal stats: deliveries today, this week, this month, pending deliveries, assigned pickups. NOT the admin logistics dashboard.
My Shipments — Only shipments assigned via their active manifest. Cannot see other shipments. Financial data (prices, revenue, payment status) is hidden.
Dispatch — Only their own location on the map. Cannot see other drivers' GPS locations. Header shows "My Route" instead of "Active Fleet."
Pickups — Only pickups assigned to them. Can mark as "Complete" and upload evidence photos. Cannot create, cancel, or reassign pickups.
Tracking — Public tracking page.

What a Driver Can Do

Change shipment status (out for delivery, delivered, returned, exception)
Upload Proof of Delivery (signature, photos)
Complete assigned pickups with evidence photos
Report GPS location
View their performance stats

What a Driver CANNOT Do

Create, edit, or delete shipments
Access Settings, Users, Customers, Rates, Warehouse, Reports, Finance, Billing
See financial data (prices, revenue, payment status)
View other drivers' locations
Create or reassign pickups
Import data
Access the admin dashboard

Permissions (9 total)

view dashboard, dashboard.activity.view, dispatch.view, dispatch.access, change status shipments, tracking.view, pickups.view, pickups.complete, shipments.view

Customer Role — Detailed Reference

Customers access their own portal (My Locker) and can:

View their assigned locker code and warehouse address
Create pre-alerts for incoming packages
Track their shipments
Manage their recipient contacts (My Recipients)
Register via the Customer Portal link (/register/customer/{org-slug})

Customers are automatically redirected to My Locker on login. They cannot access the admin dashboard, settings, or any operational modules.

Permissions (6 total)

view dashboard, create shipments, tracking.view, pre-alerts.view, pre-alerts.create, customer.portal

Permission Matrix — All 94 Permissions

The table below reflects the default permission sets shipped with Deprixa Plus v1.3.1. All permissions can be customized per role in Settings → Roles (Admin and Employee/Driver/Customer only).

✓ = Allowed ✗ = Denied ~ = Partial / Scoped to own records

Permission	Super Admin	Admin	Employee	Driver	Customer
Dashboard
`view dashboard`	✓	✓	✓	✓	✓
`dashboard.kpi.view`	✓	✓	✓	✓	✗
`dashboard.activity.view`	✓	✓	✓	✓	✗
Shipments
`view shipments`	✓	✓	✓	✗	~
`create shipments`	✓	✓	✓	✗	✓
`edit shipments`	✓	✓	✓	✗	✗
`delete shipments`	✓	✓	✓	✗	✗
`change status shipments`	✓	✓	✓	✓	✗
`shipments.import`	✓	✓	✓	✗	✗
Dispatch
`dispatch.view`	✓	✓	✓	✓	✗
`dispatch.update`	✓	✓	✓	✓	✗
`dispatch.access`	✓	✓	✓	✓	✗
`dispatch.create`	✓	✓	✓	✗	✗
Warehouse
`warehouse.access`	✓	✓	✓	✗	✗
Customers
`customers.access`	✓	✓	✓	✗	✗
`customers.create`	✓	✓	✓	✗	✗
`customers.edit`	✓	✓	✓	✗	✗
`customers.delete`	✓	✓	✓	✗	✗
Pickups
`pickups.view`	✓	✓	✓	✗	✗
`pickups.create`	✓	✓	✓	✗	✗
`pickups.manage`	✓	✓	✗	✗	✗
Lockers
`lockers.view`	✓	✓	✓	✗	✗
`lockers.manage`	✓	✓	✗	✗	✗
Pre-Alerts
`pre-alerts.view`	✓	✓	✓	✗	✓
`pre-alerts.create`	✓	✓	✓	✗	✓
`pre-alerts.manage`	✓	✓	✗	✗	✗
Returns
`returns.view`	✓	✓	✓	✗	✗
`returns.create`	✓	✓	✓	✗	✗
`returns.update`	✓	✓	✓	✗	✗
COD (Cash on Delivery)
`cod.view`	✓	✓	✓	✗	✗
`cod.collect`	✓	✓	✓	✗	✗
`cod.remit`	✓	✓	✗	✗	✗
POD (Proof of Delivery)
`pod.view`	✓	✓	✓	✗	✗
`pod.manage`	✓	✓	✓	✗	✗
Customs & HS Codes
`customs.view`	✓	✓	✓	✗	✗
`customs.manage`	✓	✓	✗	✗	✗
Locations
`locations.view`	✓	✓	✓	✗	✗
`locations.manage`	✓	✓	✗	✗	✗
Finance & Billing
`finance.view`	✓	✓	✓	✗	✗
`billing.view`	✓	✓	✓	✗	✗
`billing.manage`	✓	✓	✗	✗	✗
`billing.export`	✓	✓	✗	✗	✗
Rates & Pricing
`settings.pricing.view`	✓	✓	✓	✗	✗
`settings.pricing.manage`	✓	✓	✗	✗	✗
Reports
`reports.view`	✓	✓	✗	✗	✗
`reports.export`	✓	✓	✗	✗	✗
Tracking
`tracking.view`	✓	✓	✓	✓	✓
Settings — General
`settings.company.view`	✓	✓	✗	✗	✗
`settings.company.update`	✓	✓	✗	✗	✗
`settings.branches.view`	✓	✓	✗	✗	✗
`settings.branches.manage`	✓	✓	✗	✗	✗
`settings.users.view`	✓	✓	✗	✗	✗
`settings.users.manage`	✓	✓	✗	✗	✗
`settings.roles.view`	✓	✓	✗	✗	✗
`settings.roles.manage`	✓	✓	✗	✗	✗
`settings.notifications.view`	✓	✓	✗	✗	✗
`settings.notifications.manage`	✓	✓	✗	✗	✗
`settings.security.view`	✓	✓	✗	✗	✗
`settings.security.manage`	✓	✓	✗	✗	✗
`settings.audit-log.view`	✓	✓	✗	✗	✗
`settings.maintenance.view`	✓	✓	✗	✗	✗
`settings.tracking.view`	✓	✓	✗	✗	✗
`settings.tracking.update`	✓	✓	✗	✗	✗
`settings.shipping-config.view`	✓	✓	✗	✗	✗
`settings.shipping-config.update`	✓	✓	✗	✗	✗
`settings.integrations.view`	✓	✓	✗	✗	✗
`settings.integrations.update`	✓	✓	✗	✗	✗
Settings — Module-Specific
`settings.shipment-statuses.view`	✓	✓	✓	✗	✗
`settings.shipment-statuses.manage`	✓	✓	✗	✗	✗
`settings.services.view`	✓	✓	✓	✗	✗
`settings.services.manage`	✓	✓	✗	✗	✗
`settings.updates.view`	✓	✓	✗	✗	✗
`settings.hs-codes.view`	✓	✓	✗	✗	✗
`settings.hs-codes.manage`	✓	✓	✗	✗	✗

Customizing Permissions

Go to Settings → Roles and click on any role's permission row to toggle individual permissions. Changes take effect immediately. Super-admin and Admin rows are locked and cannot be reduced. Only Employee, Driver, and Customer permission sets are editable.

Settings → Roles — The Permission Matrix UI

The live permission matrix is accessible at Settings → Roles. It displays all 94 permissions organized in 37 groups, with a toggle column for each editable role.

Detail	Value
Total permissions	94
Permission groups	37
Editable roles	Employee, Driver, Customer
Locked roles	Super Admin (always 94/94), Admin (always 94/94)
Access required	`role:admin\|super-admin`

Clicking a permission toggle in the matrix calls PUT /settings/roles/{role}/permissions and updates the role_has_permissions table immediately. Spatie's permission cache is cleared automatically after each change.

Spatie Permission Cache

If a permission change doesn't appear to take effect immediately for a logged-in user, run php artisan permission:cache-reset from the server, or use Settings → Maintenance → Clear Cache. Active sessions reflect new permissions on the next page navigation.

Security Notes

Super-Admin Route Guard

The following routes are guarded exclusively by role:super-admin middleware and cannot be accessed by any other role regardless of permissions:

/admin/* — organizational administration (formerly can:manage organizations)
/my-billing/* — SaaS billing management (formerly can:view saas billing)

Admin-Only Route Guard

The following routes require role:admin|super-admin:

/api-tokens — personal API token management
/settings/api/* — API token administration, clients, webhooks, and logs

Customer Portal Isolation

Customers with the customer role are completely isolated from the admin area:

LoginController redirects customers to /my-locker after login
DashboardController::index() redirects customers to /my-locker as a secondary guard
PreAlertController::index() scopes results to customer_id = Auth::id() for the customer role
ShipmentController::index() scopes results to created_by = Auth::id() for the customer role

Feature-Gated Modules

Two modules require both a can: permission check and an edition: middleware check:

Contracts: can:contracts.view + edition:contracts
Commissions: can:commissions.view + edition:commissions

If the edition gate fails, the route returns a 403 even if the user has the permission. Contact your installation provider to enable these editions.

Creating a New User

1

Navigate to Settings → Users

Click the gear icon in the navigation, then select Users from the settings sidebar. Access requires role:admin|super-admin.
2

Click "Invite User"

Click the Invite User button in the top-right corner. This opens the user creation form.
3

Fill in User Details

Required fields: Full Name, Email Address, Role (Employee, Driver, Customer, Admin, or Super Admin), Branch.

Creating a staff user sends a UserInvitationMail — no password is set by the admin. If SMTP is not configured, the invitation URL is displayed in an amber banner for manual sharing.
4

Save

Click Create User. The invitation token (Str::random(64)) is stored in users.invitation_token and is valid for 7 days.

Deactivating and Deleting Users

Deactivate (Recommended)

Prevents login without deleting the account or historical data. All shipments, audit log entries, and notes created by the user are preserved.

Settings → Users → three-dot menu → Deactivate
Confirm in the dialog. The user's status badge changes to "Inactive".
Their active session is terminated within the next request cycle.

To reactivate: three-dot menu → Activate.

Delete (Permanent)

Permanently removes the user account. Historical records remain but display "Deleted User" in the audit log. This action cannot be undone.

Prefer Deactivation Over Deletion

Deleting a user is irreversible and can cause orphaned references in the audit log. Always deactivate instead of delete, unless you have a legal requirement to remove personal data (GDPR right to erasure).

Password Policies & 2FA

Password requirements are configured in Settings → Security.

Setting	Default	Description
Minimum Length	8 characters	Passwords shorter than this are rejected during creation and reset.
Require Uppercase	Off	When enabled, passwords must contain at least one uppercase letter.
Require Number	Off	When enabled, passwords must contain at least one digit.
Require Symbol	Off	When enabled, passwords must contain at least one symbol.
Password Expiration	Never	If set (e.g. 90 days), users are forced to change their password after expiry.
Prevent Password Reuse	Off	When enabled, users cannot reuse their last N passwords (1–10).
Login Attempt Limit	5 attempts	After N failed attempts, the account is locked for 15 minutes.
Session Timeout	120 minutes	Inactive sessions are automatically terminated after this period.

Two-Factor Authentication (TOTP / RFC 6238) is supported. Users enable it from their profile. Admins can enforce 2FA for specific roles from Settings → Security. Super Admin can disable 2FA for locked-out users — this action is logged in the audit trail.