User Management: Create, Edit, and Manage Accounts

The User Management page is an admin-only interface served at pages/user-management.html. It loads the complete account list from Local Storage via AuthService.getUserManagementList(), renders each record in a sortable table, and provides inline controls for creating, editing, password-resetting, toggling status, and deleting accounts. Non-admin sessions are redirected to pages/dashboard.html before any content is rendered.

Account Object Structure

Every record in the warehouseAuthAccounts array conforms to the following shape after passing through the internal normalizeAccount() function:

{
  "userId": "emp002",
  "password": "Employee@123",
  "role": "employee",
  "name": "Jane Doe",
  "employeeId": "EMP-002",
  "position": "Warehouseman",
  "status": "active",
  "lastLogin": "2024-06-01T08:00:00.000Z",
  "createdAt": "2024-01-02T00:00:00.000Z"
}

Field	Type	Notes
`userId`	`string`	Unique login identifier. Used as the primary key across all `AuthService` methods.
`password`	`string`	Plaintext password. See the warning below.
`role`	`string`	Either `"admin"` or `"employee"`. Normalised to lowercase on every write.
`name`	`string`	Display name shown in the UI and stored in the session object.
`employeeId`	`string`	Unique HR identifier (e.g. `"EMP-002"`). Immutable after account creation.
`position`	`string`	Job title. `createUser` sets this to `"Administrator"` for admin accounts and `"Warehouseman"` for employee accounts. The internal `normalizeAccount()` function defaults to `"Warehouseman"` when the field is absent.
`status`	`string`	Either `"active"` or `"inactive"`. Inactive accounts are still stored but the UI marks them visually.
`lastLogin`	`string \| null`	ISO 8601 timestamp written by `authenticateUser` on each successful login. `null` if the account has never logged in.
`createdAt`	`string \| null`	ISO 8601 timestamp set by `createUser` at creation time. `null` for the built-in seeded accounts that predate the field.

User Table Features

The table rendered on pages/user-management.html exposes the following controls:

Search — the #userSearchInput field filters rows by partial match against name, userId, or employeeId.
Role filter — the #userRoleFilter dropdown filters to All Roles, Admin, or Employee.
Status filter — rows can be filtered by active or inactive status.
Column sorting — clicking any column header (Employee ID, Full Name, Username, Role, Status, Last Login) toggles ascending/descending sort for that column.

The table is populated by calling AuthService.getUserManagementList(), which returns the full account array with each record’s status field normalised to a lowercase string.

Admin Operations

1. Create User — `AuthService.createUser(userData)`

Adds a new account to warehouseAuthAccounts. The caller must supply a userData object with the following fields:

Field	Required	Validation
`employeeId`	✅	Must be non-empty and unique across all existing accounts (case-insensitive).
`name`	✅	Must be non-empty.
`userId`	✅	Must be non-empty and unique across all existing accounts (case-insensitive).
`password`	✅	Must be non-empty. If `confirmPassword` is also provided, the two must match.
`role`	Optional	`"admin"` or `"employee"`. Defaults to `"employee"`.
`status`	Optional	`"active"` or `"inactive"`. Defaults to `"active"`.
`confirmPassword`	Optional	When present, must equal `password`.

const result = AuthService.createUser({
  employeeId: 'EMP-003',
  name: 'Maria Santos',
  userId: 'emp003',
  password: 'Warehouse@2024',
  role: 'employee',
  status: 'active'
});
// { success: true, user: { userId: 'emp003', ... }, message: 'User added successfully.' }

On success: Returns { success: true, user: <newAccount>, message: 'User added successfully.' } and persists the updated account array. On failure: Returns { success: false, message: '<reason>' }. Possible messages include 'Please complete all required fields.', 'Passwords do not match.', 'Employee ID must be unique.', and 'Username must be unique.'.

2. Update User — `AuthService.updateUser(userId, updates)`

Applies field-level updates to an existing account identified by userId. The updates object may contain any combination of name, userId (rename), role, status, and password. The employeeId field is always preserved from the original record and cannot be changed via this method.

const result = AuthService.updateUser('emp003', {
  name: 'Maria Reyes',
  role: 'admin'
});
// { success: true, user: { userId: 'emp003', name: 'Maria Reyes', role: 'admin', ... }, message: 'User updated successfully.' }

Blocked case — own role demotion: If the currently logged-in admin attempts to change their own role to "employee", the method returns:

{ success: false, message: 'You cannot change your own role to Employee while logged in.' }

Blocked case — duplicate userId: If the new userId value is already in use by a different account, the method returns { success: false, message: 'Username must be unique.' }.

3. Reset Password — `AuthService.resetPassword(userId)`

Resets the target account’s password to the hard-coded default 'Password123' and persists the updated account array.

const result = AuthService.resetPassword('emp003');
// { success: true, message: 'Password reset successfully.' }

The user identified by userId will be able to log in immediately with Password123. There is no forced-change prompt built into the current implementation — the admin should notify the user verbally to update their password from the Profile page (AuthService.changePassword()).

The default password after a reset is 'Password123' — a well-known, predictable value that is stored as plaintext in Local Storage. Users whose passwords have been reset should change them immediately via their Profile page. Leaving accounts on the reset default in a shared environment is a significant risk.

4. Toggle Status — `AuthService.toggleUserStatus(userId)`

Flips the status field of the target account between "active" and "inactive" and persists the change.

const result = AuthService.toggleUserStatus('emp003');
// { success: true, message: 'User deactivated successfully.', status: 'inactive' }

AuthService.toggleUserStatus('emp003');
// { success: true, message: 'User activated successfully.', status: 'active' }

The return value includes a status field containing the new status string, which the UI uses to update the table row without a full re-render. Note that toggling a user’s status does not invalidate their current session — if the user is logged in at the time of deactivation, their warehouseAuthSession remains valid until they log out or the session is manually cleared.

5. Delete User — `AuthService.deleteUser(userId)`

Removes the target account from warehouseAuthAccounts permanently. The deletion is blocked in two scenarios: Cannot delete self: If userId matches the currently logged-in admin’s userId, the method returns:

{ success: false, message: 'You cannot delete the currently logged-in admin account.' }

Cannot delete the last admin: If the target account has role: 'admin' and deleting it would leave zero admin accounts, the method returns:

{ success: false, message: 'You cannot delete the last remaining admin account.' }

On success:

const result = AuthService.deleteUser('emp003');
// { success: true, message: 'User deleted successfully.' }

Safeguard Summary

Operation	Blocked condition	Error message
`createUser`	`employeeId` already exists	`'Employee ID must be unique.'`
`createUser`	`userId` already exists	`'Username must be unique.'`
`updateUser`	Admin demoting own role	`'You cannot change your own role to Employee while logged in.'`
`updateUser`	New `userId` already taken	`'Username must be unique.'`
`deleteUser`	Deleting own account	`'You cannot delete the currently logged-in admin account.'`
`deleteUser`	Deleting the last admin	`'You cannot delete the last remaining admin account.'`

`AuthService.getUserManagementList()`

Returns the full account array as stored in warehouseAuthAccounts, with each record’s status field explicitly normalised to a lowercase string. Use this method as the data source for the user table rather than getAccounts() directly, since getUserManagementList() guarantees the status field is always present and lowercase for reliable filtering and comparison.

const users = AuthService.getUserManagementList();
// [
//   { userId: 'admin001', role: 'admin', status: 'active', ... },
//   { userId: 'emp001', role: 'employee', status: 'active', ... }
// ]

Getting Started

Core Features

Authentication & Users

QR Scanning

Data & Storage

User Management: Create, Edit, and Manage Accounts

Account Object Structure

User Table Features

Admin Operations

1. Create User — `AuthService.createUser(userData)`

2. Update User — `AuthService.updateUser(userId, updates)`

3. Reset Password — `AuthService.resetPassword(userId)`

4. Toggle Status — `AuthService.toggleUserStatus(userId)`

5. Delete User — `AuthService.deleteUser(userId)`

Safeguard Summary

`AuthService.getUserManagementList()`

Build docs developers (and LLMs) love

Getting Started

Core Features

Authentication & Users

QR Scanning

Data & Storage

Documentation Index

​Account Object Structure

​User Table Features

​Admin Operations

​1. Create User — AuthService.createUser(userData)

​2. Update User — AuthService.updateUser(userId, updates)

​3. Reset Password — AuthService.resetPassword(userId)

​4. Toggle Status — AuthService.toggleUserStatus(userId)

​5. Delete User — AuthService.deleteUser(userId)

​Safeguard Summary

​AuthService.getUserManagementList()

Build docs developers (and LLMs) love

Account Object Structure

User Table Features

Admin Operations

1. Create User — `AuthService.createUser(userData)`

2. Update User — `AuthService.updateUser(userId, updates)`

3. Reset Password — `AuthService.resetPassword(userId)`

4. Toggle Status — `AuthService.toggleUserStatus(userId)`

5. Delete User — `AuthService.deleteUser(userId)`

Safeguard Summary

`AuthService.getUserManagementList()`