1. The Identity Model
The single most important thing to understand as an admin:
A person's identity in this app is their user record — not their Microsoft account, and not their email. Signing in only matches someone onto a user record that already exists. It never creates one.
Everything a person owns hangs off that user record: their van stock, their notifications, their requisitions, their employee profile, their saved credentials and their entries in the activity log.
When someone signs in (Microsoft or email/password), the app resolves who they are in this order:
A user record already linked to this sign-in (from a previous successful sign-in) — instant match.
A user record whose sign-in email an admin has set (Settings → User Management). First sign-in with that email completes the link permanently.
No match → entry is refused: "…is not linked to a PAFS Internal user yet. An administrator needs to link it under Settings → User Management."
Why refusing is correct
If the app auto-created an account for an unrecognised sign-in, that person would get a blank identity — silently detached from their van stock, vehicle, credentials and accreditations. And the name on their Microsoft account ("Rob" vs "Robert") could quietly orphan records keyed on their real name. So: unknown sign-ins bounce, and the fix is always an admin linking the email to the right existing user.
2. Creating a Login (Settings → User Management)
Enter the person's full name, pick a role (Admin / Office / Engineer / Sub-Contractor) and click "Add User".
The username is derived automatically: first initial + last name, lowercase (Amy Smith → asmith). The default password is first initial (capital) + last name + "1!" (→ ASmith1!) — have them change it.
Then link their sign-in (next section) and, if they're staff, connect their employee profile via Employees → Access & Login.
Naming matters: the user's name is the key that scopes their fleet record, passwords and assets. Use their real, consistent name — and never "fix" it to match what Microsoft shows.
3. Linking Microsoft & Password Sign-ins
Each row in User Management has a sign-in email field with two buttons:
"Link" — saves the email against the user. The next time that email signs in (Microsoft or password), it is matched to this user and the link becomes permanent. The row's status moves Not set → Pending → Linked.
"Set password" — creates an email/password login for that address (for anyone without a company Microsoft account, e.g. sub-contractors). The generated password is shown once for you to pass on — creating it does not disturb your own session.
• Microsoft sign-in is restricted to the PAFS tenant — @proactfiresafe.co.uk accounts only. Accounts in any other organisation are rejected by Microsoft itself; those people use email/password instead.
• If "Set password" reports the address already has a password login, the person should just use "Forgot password?" on the sign-in screen.
Link before they try to sign in. The refusal message a new starter sees on day one nearly always means this step was missed.
4. Employee → Access & Login
The Employees page is the day-to-day hub for a person's access. Open an employee and the admin-only Access & Login section (purple) manages:
• "Login enabled" — ticked means they can sign in; unticking deactivates their login without deleting anything (see section 11).
• Role — changing it re-ticks that role's default pages below.
• Pages they can see — the permission checkboxes (next section).
• Notification Teams — which team alerts they receive (section 7).
• Reset Password — puts their password back to the default pattern.
• The section also shows their derived username, and links the employee profile to the user record so "own record" scoping works.
5. Permissions & What "Scoped" Means
Every page is a real checkbox: unticked means denied — the tile disappears, direct navigation is blocked, and notification links to that page refuse. There are no force-shown pages.
| Page | What an engineer / sub-contractor sees inside it (scoping) |
|---|---|
| Stock Management | Own van + the warehouse only |
| Stock List | Full catalogue (no per-user data) |
| Suppliers | Full list (no per-user data) |
| Requisitions | Office page — field staff normally request via the Request button instead |
| History | Office page |
| Fleet | Own vehicle, fuel card and incidents only |
| Assets | Own equipment only, read-only |
| Employees | Own record only |
| On-Call Rota | Full rota (read-only for field staff) |
| Passwords | Own credentials only |
| Settings | Admin tools are further gated inside the page |
• Role defaults — admin and office default to everything; engineers and sub-contractors default to Stock Management, Fleet, Assets, Employees, Rota and Passwords (all scoped to them).
• A user with no explicit ticks saved simply follows their role's defaults. Once you save explicit ticks, those win.
• Scoping applies everywhere the data appears — tables, summary cards, search results and CSV exports all show the same reduced set.
Before granting a tile to a scoped role, check what that page renders. Employees, for instance, shows DOB and NI number to anyone who can open a record — scoping to "own record" is what makes that safe.
6. Role Defaults & the Permission Repair
When a role's defaults gain a new page, profiles saved before the change still have their old explicit tick-lists — so they miss the new page. Settings → Data Repair → "Check & Repair Permissions" fixes exactly that:
• It compares every profile's saved ticks against the current role defaults and lists exactly who gains what before anything is written.
• It only ever adds — nothing already ticked is removed, and pages you deliberately unticked for someone stay unticked only if they were never in their role's defaults; review the preview before confirming.
• Admins are skipped (they already see everything), as are profiles with no explicit list (they follow defaults automatically).
• Affected users see the change next time they reload.
7. Notification Teams
Team-targeted alerts go to whoever has that team ticked in their Access & Login section. Personal alerts (e.g. "your materials arrived") always reach their target regardless of teams.
| Team | Receives |
|---|---|
| procurement | Material requests and low-stock alerts |
| fleet | Vehicle MOT/tax/service/insurance due alerts and incident reports |
| employee | Accreditation expiry alerts |
Admins receive every team notification automatically — no ticks needed. For everyone else, no team ticked means no team alerts (personal alerts still arrive).
8. Category Management
Settings holds the option lists, each a simple add/remove card. New entries appear in the relevant dropdowns immediately:
• Material Categories and Material Sub Categories — used across Stock List, Stock Management and search.
• Asset Categories — equipment types on the Assets page.
• Buying Categories — the groups used by the Buying Guide on Requisitions (stationery, PPE, services…).
• Quality Document Categories — how the QMS register is grouped (needs Manage QMS Documents).
• Firestopping Dropdown Options — every survey and installation dropdown, ~25 lists behind one picker (needs Manage Firestopping; see section 12).
A value in use cannot be deleted — move or edit the records first.
9. Data Repair
The Data Repair card (admin-only) fixes specific historical faults. Each one shows exactly what it will write before it writes anything, and each is safe to run more than once:
• "Check & Repair Stock Locations" — stock locations must be saved in a canonical lowercase form. A CSV import once saved "Warehouse" with a capital W, which silently hid those rows from every location filter. The repair scans for wrongly-cased locations and normalises them. Safe to run any time; it only touches what it finds and reports what it did.
• "Check & Migrate Accreditations" — accreditations used to be stored as a list on the employee record, so renewing one overwrote the certificate it replaced and two people editing the same employee could overwrite each other. They are now versioned records in their own right, and renewing keeps the old certificate and its scans. This copies the existing certificates across. It only ever adds, skips anyone already migrated, and leaves the employee record untouched. Run it once after the update — until you do, certificates still display from the old list and the first edit to any employee migrates just that person.
10. The Daily 7am Job
A scheduled Cloud Function runs at 07:00 UK time every day (it tracks BST/GMT automatically). Nobody needs to be logged in for it to fire, and it can never run twice in parallel. It does three things:
Accreditation alerts — anything expired or expiring within 30 days → notification to the employee team.
Fleet alerts — MOT, road tax, service or insurance overdue or due within 30 days → notification to the fleet team.
Housekeeping — deletes notifications older than 5 days (an alert whose date is still outstanding is kept however old it is), activity-log entries older than 365 days, and mail-queue documents older than 180 days.
• Each alert fires once. A de-duplication key (record + field + date + stage) stops the same warning repeating every morning. Renew the date — e.g. after an MOT — and the alert re-arms for the new date automatically.
• The 90-day prune deliberately keeps alerts that are still live (the underlying date is still due); deleting one would just let it re-raise itself the next morning.
11. Deactivate, Never Delete
When someone leaves, deactivate their login — don't delete the user. Untick "Login enabled" on their employee record.
• Deactivation takes effect immediately — if they're signed in, they are signed out on the spot with "Your access has been disabled. Please contact an administrator.", and any later sign-in attempt is refused.
• Their history stays intact: van stock records, requisitions, activity log, assets they held, accreditation history.
• Deleting is blocked anyway while stock is assigned to their van — you'd see "Cannot delete — there are N stock item(s) assigned to their van." Transfer the stock first if a delete is ever genuinely required.
• Deactivation is reversible in one tick if they come back.
Deleting a user record breaks every reference to it — van location, notifications, requisition history, the employee link. That damage is permanent. Deactivate.
12. Firestopping (BMTrada) Administration
Two permissions run the module: Firestopping is the whole field job (field staff hold it by default); Manage Firestopping is the destructive remainder — option lists, deleting jobs and clients, reopening completed jobs. Admin-only until granted deliberately.
Approved installers. The "Installed by" dropdown only offers people ticked "FS approved installer" in their Employee record's Access & Login section — enter their BMTrada approved installer number there too; it prints on the certified RIA report. This tick is what "linked to competency approval status" means in practice: keep it aligned with the person's actual scheme card.
Default surveyor. The Firestopping Settings card sets who new jobs pre-select as the surveying Approved Person.
Dropdown options. One Settings card manages every survey/installation list (~25, grouped Substrate / Opening / Services / Seal record / Installation). Changes reach every signed-in device live — including a surveyor already on site; the new option appears the next time they open a seal form. An option in use on recorded seals cannot be deleted, and a deleted option never blanks a recorded answer.
Seal templates. The Firestopping Seal Templates card holds named starting points — "Copper pipe through masonry wall" — each a full set of dropdown answers (category, fire resistance, risk factor, products, all 18 aspects). Add Seal then opens with a choice: a template or blank. Leave a template's fire resistance unset and each new seal takes its own job's specified rating; an option deleted from its list stops appearing via templates too. Four things are never templated by design: location, quantity, photos, and the certified / uncertified choice, which is mandatory on every seal because it decides which report the seal is printed on.
Signatures. Each person draws theirs once (they're prompted at first sign-off). Sign-offs stamp a frozen copy onto the job, so re-drawing a signature later never alters an issued record.
Reports. The BMTrada/non-certified split follows each seal's "Certified works" tick — untested solutions must not carry BMTrada content, so check the ticks before issuing. The preview's edits save to the records themselves; there is no separate report copy to drift.
Photos & backups. Photo files live in Firebase Storage under firestopping/{job}/. The nightly backup covers the database records; photo files rely on Storage itself and have no second copy.