# Users

Users are stored in `admin/config/admin.json` (file-based, no database). Each user has a **role** that determines which admin routes and sidebar items are visible.

## Roles

CodePress has four roles, defined in `AdminAuth::ROLE_PERMISSIONS`:

| Role | Label | Permissions |
|------|-------|-------------|
| `admin` | Admin | Everything (`*`) |
| `content-manager` | Content Manager | Content management, guide |
| `bi-manager` | BI Manager | Statistics, logs, guide |
| `site-admin` | Site Admin | Theme, plugins, statistics, logs, update, guide |

Roles are displayed with their label via `AdminAuth::ROLE_LABELS`.

## Users list (`/admin/users`)

The users list shows all users with their username, role, login email and creation date.

### Search and filter

- **Search field**: search by username, email or author name
- **Role filter**: filter by a specific role via the dropdown
- Click **Filter** to apply the results

### Adding a new user

1. Click **New user** (top right of the list)
2. Enter username, password (minimum 8 characters), email, author name and author email
3. Select a role
4. Click **Add user**
5. You will be automatically redirected to the profile page of the new user

## Editing a profile (`/admin/users-edit?user=<name>`)

Click on a user in the list to edit their profile. The profile page contains three sections:

### Profile information
- Login email, author name and author email can be changed
- The username cannot be changed

### Change password
- Enter a new password (minimum 8 characters)
- Confirm the password
- The password is stored as a bcrypt hash

### Change role
- Shows the current role with a colored badge
- Select a new role from the dropdown
- The change immediately affects the visible admin routes and sidebar items

### Delete user (Danger zone)
- Only visible for other users (not for your own account)
- Confirmation via JavaScript dialog
- After deletion you return to the users list

## Admin password reset via CLI

If the admin is locked out (e.g. due to brute-force lockout or forgotten password), the password can be reset via the CLI:

```bash
# Reset with a specific password
php cli/reset-admin-password.php admin NewPassword123

# Reset with an automatically generated password
php cli/reset-admin-password.php admin
```

The command:
- Changes the password (as a bcrypt hash)
- Clears the brute-force lockout for the user
- Displays the new password in the terminal

## Access control

- Route access is checked in `public/admin.php` via `AdminAuth::hasPermission()`
- Unauthorized routes return a **403 error**
- Sidebar items are conditionally shown via the `has_permission()` Twig function in `admin.twig`