WemX

WemX uses roles to give people access to the admin area. A user who has at least one role counts as staff and can open /admin. What they can see and do there depends on the permissions in their roles.

Who has access

Account type	Access
Primary administrator	The first account, created by the installer. It always has every permission and can't be restricted.
Super admin role	A role with All permissions enabled. Members have full access, like the primary admin.
Staff	Any user with one or more roles. They have exactly the permissions their roles grant.
Customer	A user with no roles. They can only use the client area.

Staff are asked for their password again when they first open the admin area in a new session. If someone steals a customer-side session cookie, they still can't reach the admin panel with it.

Create a role

Go to Admin → Staff Roles → Create.
Enter a name and an optional description, for example Support Agent.
Optionally choose a parent role. The new role inherits all of its parent's permissions, and you add extra ones on top. If the parent is a super admin role, the child is one too.
Either turn on All permissions to make it a super admin role, or tick the individual permissions it needs.
Save the role.

Assign a role to a user

Open the user under Admin → Customers, go to the Roles tab, and add the role. Only the primary admin and staff with the admin.users.manage_roles permission can assign roles. Give that permission to very few people, because anyone who has it can give themselves full access.

Your license plan may limit how many staff accounts you can have.

Permission reference

Dashboard

Permission	Allows
`admin.dashboard`	Open the admin dashboard
`admin.dashboard.statistics`	See earnings, orders and other statistics
`admin.dashboard.world_map`	See the customer location map
`admin.dashboard.recent_orders`	See recent orders
`admin.dashboard.recent_payments`	See recent payments
`admin.dashboard.online_users`	See who is online
`admin.dashboard.application_logs`	See application and scheduler logs

Customers & roles

Permission	Allows
`admin.users`	List customers
`admin.users.view`	View a customer's details
`admin.users.create`	Create customers
`admin.users.update`	Edit account details, address, password and sessions, and send emails
`admin.users.delete`	Delete customers
`admin.users.impersonate`	Log in as a customer
`admin.users.manage_roles`	Assign and manage roles (high privilege)
`admin.roles`	List staff roles
`admin.roles.create`	Create roles
`admin.roles.update`	Edit roles and their permissions

Orders & payments

Permission	Allows
`admin.orders`	List orders
`admin.orders.view`	View an order
`admin.orders.update`	Edit order details
`admin.orders.perform_actions`	Suspend, unsuspend, terminate, extend, transfer and upgrade orders
`admin.orders.delete`	Delete orders
`admin.payments`	List payments
`admin.payments.view`	View a payment and download its invoice
`admin.payments.update`	Edit payments
`admin.payments.refund`	Refund payments
`admin.payments.complete_manually`	Mark unpaid payments as paid
`admin.payments.delete`	Delete payments

Content, email & data

Permission	Allows
`admin.pages.index` / `.view` / `.create` / `.update` / `.delete`	Manage custom pages
`admin.emails.index`	View the sent email log
`admin.emails.configure`	Change SMTP settings
`admin.emails.templates`	Edit email templates
`admin.emails.mass-mails`	Send mass emails
`admin.data-export`	Download data exports (each dataset also needs its own area's permission)
`admin.integrated-marketplace`	Browse and install from the marketplace
`admin.settings.index`	Manage the license and run updates

Checkout

Permission	Allows
`use-sandbox-gateways`	Check out with sandbox (test) gateways

Extensions can add their own permissions. The Tickets module, for example, adds admin.tickets.* and admin.ticket-departments.* (see Tickets). They show up in the role editor automatically.

In the current beta, some admin sections aren't protected by a specific permission and are open to every staff member: Categories, Packages, Gateways, Servers, Currencies, Tax Countries, Settings, Images and Installed Extensions. Only give staff roles to people you trust with those areas.

Staff Roles & Permissions