# Users

Users are stored in `admin/config/admin.json` (file-based, no database). Each user has a **role** that determines which admin routes and sidebar items are visible.

## Roles

CodePress has four roles, defined in `AdminAuth::ROLE_PERMISSIONS`:

| Role | Label | Permissions |
|------|-------|-------------|
| `admin` | Admin | Everything (`*`) |
| `content-manager` | Content Manager | Content management, guide |
| `bi-manager` | BI Manager | Statistics, logs, guide |
| `site-admin` | Site Admin | Theme, plugins, statistics, logs, update, guide |

Roles are displayed with their label via `AdminAuth::ROLE_LABELS`.

## Adding a user

1. Go to **Users**
2. Enter username
3. Choose password (stored as bcrypt hash)
4. Select a role
5. Click **Add**

## Editing a user

- Change password (new bcrypt hash)
- Change role (immediately affects visible routes and sidebar items)

## Deleting a user

- Not possible for own account
- Confirm with password

## Access control

- Route access is checked in `public/admin.php` via `AdminAuth::hasPermission()`
- Unauthorized routes return a **403 error**
- Sidebar items are conditionally shown via the `has_permission()` Twig function in `admin.twig`