Admin Team Management

Overview

The Admin Team Management section allows Super Admins to create and manage platform administrator accounts. Each admin is assigned a role that defines their permissions across the platform. SehaFile supports role-based access control (RBAC) with predefined roles (Super Admin, Support Agent, Data Analyst, Finance Manager) and the ability to create custom roles. Two-factor authentication (2FA) via TOTP adds an extra security layer for all admin accounts.

Viewing the Admin Team

1. Navigate to Team > Admins from the sidebar. Requires the admins.view permission.
2. Admin table columns: Name (Arabic), Email, Role, Status (active/deactivated), 2FA Status, and Last Login.
3. Click on an admin row to view their full profile, activity history, and permission details.

Creating a New Admin

1. Click "Add Admin" at the top of the Admins page. Requires admins.manage permission.
2. Fill in the form:
   • Email — Must be unique across all platform admins
   • Name (Arabic) — Required display name
   • Name (English) — Optional
   • Password — Minimum 12 characters, must include uppercase, lowercase, number, and special character
   • Role — Select from existing roles (Super Admin, Support Agent, Data Analyst, Finance Manager, or custom)
3. Click "Create" — The admin account is created and active immediately. The new admin can log in at admin.sehafile.com.

Managing Roles

1. Navigate to Team > Roles to view all defined roles.
2. System roles (cannot be deleted):
   • Super Admin — Full access to all platform features
   • Support Agent — View clinics/citizens, manage support tickets
   • Data Analyst — Access analytics, export data, manage reports
   • Finance Manager — Manage payments and subscriptions
3. Create a custom role — Click "Create Role", provide a name and description, then select permissions from the full permission list.
4. Edit a role — Click on any role to modify its name, description, or permission set. Changes take effect immediately for all admins assigned to that role.

Available Permissions

The platform defines these permission groups:

1. Clinics — view, edit, create, toggle_status, onboard
2. Citizens — view, verify
3. Doctors — view, verify, suspend
4. Subscriptions — view, manage
5. Payments — view, confirm
6. Analytics — view, export
7. Admins — view, manage
8. Settings — view, edit
9. Audit — view
10. Notifications — send
11. Support — view, manage
12. Taxonomy — view, manage
13. Insurance — manage
14. Reports — manage

Two-Factor Authentication (2FA)

1. Each admin sets up 2FA individually from their profile by navigating to Profile > Security > Setup 2FA.
2. Setup process: A QR code is displayed for scanning with an authenticator app (Google Authenticator, Authy, etc.). Enter the 6-digit code to confirm setup.
3. Login with 2FA: After entering email/password, a second screen requests the TOTP code from the authenticator app.
4. Backup codes: Generated during setup for emergency access if the authenticator device is lost.
5. Disable 2FA: Requires entering a current valid TOTP code to confirm identity before disabling.

Deactivating and Reactivating Admins

1. Deactivate — Click "Deactivate" on an admin's profile. They are immediately locked out and cannot log in. Their past actions remain in the audit log.
2. Reactivate — Click "Reactivate" on a deactivated admin's profile to restore their access.
3. Reset Password — Click "Reset Password" to generate a new temporary password for an admin who has been locked out.

FAQ

Can I require 2FA for all admins?

Currently, 2FA is optional per admin. However, it is strongly recommended for all accounts, especially Super Admins. A platform-wide 2FA requirement feature is planned.

What happens when I change an admin's role?

The permission change takes effect on their next API request. If they are currently logged in, they may need to refresh the page to see the updated UI reflecting their new permissions.

Can a deactivated admin's data be deleted?

No. Deactivated admins retain their audit history. The account cannot be fully deleted while it has associated audit log entries, ensuring accountability and traceability.