Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/raceliciouss/YUSEN-LIMO-WAREHOUSE/llms.txt

Use this file to discover all available pages before exploring further.

The YUSEN LIMO Warehouse System has two roles: admin and employee. The role is stored as a string on the session object under warehouseAuthSession and is read on every page load via AuthService.getCurrentUser().role. Role enforcement is done entirely in the browser — pages that require admin access inspect the session at runtime and redirect non-admins away before rendering any protected content.
Admin users have unrestricted access to every page in the application. After a successful login, the session object carries "role": "admin", which unlocks the following:Page access
  • All pages available to the Employee role (Dashboard, Inbound/Outbound, Inventory, Profile)
  • pages/user-management.html — the admin-only user management interface
AuthService methods Admin callers can invoke every method on AuthService. The following operations are blocked at the method level for non-admin sessions:
MethodGuard message when called without admin role
AuthService.createUser(userData)'Only admins can create users.'
AuthService.updateUser(userId, updates)'Only admins can update users.'
AuthService.deleteUser(userId)'Only admins can delete users.'
AuthService.resetPassword(userId)'Only admins can reset passwords.'
AuthService.toggleUserStatus(userId)'Only admins can change user status.'
Each guarded method calls AuthService.getCurrentUser() internally and checks currentUser.role !== 'admin' before performing any write to Local Storage.Navigation UI The topbar profile dropdown includes a User Management link that is only visible to admin sessions. This link carries the .admin-only-nav CSS class:
<a href="user-management.html" class="dropdown-item admin-only-nav">
  <i class="bi bi-people-fill"></i> User Management
</a>
On page initialisation, assets/app.js reads the current role and applies display: none to all .admin-only-nav elements for employee sessions.

​
Page Access Summary

PageAdminEmployee
Dashboard (pages/dashboard.html)✅✅
Inbound/Outbound (pages/inbound-outbound.html)✅✅
Inventory (pages/inventory.html)✅✅
Profile (pages/profile.html)✅✅
User Management (pages/user-management.html)✅❌

​
How Role Enforcement Works at Runtime

Every authenticated page follows the same pattern at DOMContentLoaded:
  1. AuthService.isAuthenticated() is called. If it returns false (no session, or session has no userId), the user is redirected to ../index.html.
  2. AuthService.getCurrentUser() is called to retrieve the session object.
  3. For admin-only pages, the code checks currentUser.role !== 'admin'. If the check fails, the user is redirected to dashboard.html.
  4. If the role check passes, page initialisation continues and restricted UI sections are rendered.
const user = AuthService.getCurrentUser();

if (!user) {
  window.location.href = '../index.html';
  return;
}

if (user.role !== 'admin') {
  window.location.href = 'dashboard.html';
  return;
}

// safe to render admin content
The role value is read directly from the warehouseAuthSession key in Local Storage on every call to getCurrentUser(). There is no in-memory cache that persists between page navigations — each page load re-reads the session independently.

​
Admin-Only Navigation with .admin-only-nav

Elements that should only appear for admin users carry the CSS class .admin-only-nav. The User Management link in the topbar dropdown is the primary consumer of this class: 
<a href="user-management.html" class="dropdown-item admin-only-nav">
  <i class="bi bi-people-fill"></i> User Management
</a>
assets/app.js queries document.querySelectorAll('.admin-only-nav') on page load and toggles visibility based on the current session role. This means the link is absent from the DOM visually for employees, but the class-based hiding is a presentational layer only — it does not replace the URL-level redirect guard described above.
All role enforcement in the YUSEN LIMO Warehouse System is client-side only. Because there is no backend, a technically motivated user could manipulate warehouseAuthSession in DevTools to spoof an admin role, or navigate directly to any URL. This is a known limitation of the fully static architecture. For production use, role checks must be enforced by a server that independently validates the caller’s identity on every request. See the migration path for a recommended upgrade path.

Build docs developers (and LLMs) love

Get started for freeTalk to us