Module — Administration

The configuration and governance layer of the ERP. It manages user groups and permission keys, per-user data scoping, the organisational structure (branches, departments, positions, the level/step salary matrix), reference / lookup data, the work calendar, system settings (role-holder assignments, cash-box figures, the attendance IP allow-list), announcements, the activity-log / audit history, and a few cross-module operational tools. It also hosts the public anonymous portals used by suppliers and job candidates.

Source: NKO.Main/NKO.Main/Controllers/{Admin,User,Apps,General,Home,Error}Controller.cs, NKO.Lib/NKO.Shared/Helpers/{BUser,BNotification}.cs, NKO.Lib/NKO.Shared/BAL/{Bsettings,BSign,BCalendar,SharedBAL,Permissionchecker}.cs, NKO.Main/NKO.Main/BAL/{BCommon,BGeneral,BAnnouncement,BBranch,BNote}.cs, NKO.Main/NKO.Main/{Infrastructure,ScheduledTasks}/.

Purpose & scope

• In scope: everything that configures how the rest of the system behaves — roles/permissions, org tree, calendars, reference data, settings, announcements, audit trail, and the tools that bulk-reassign or recompute pending approvals.
• Out of scope: the business workflows themselves (see the other module pages) and the authentication mechanics (see Authentication).
• Database: NKO_DB (core), context NKO_DBEntities1.

Key features

• Groups & permissions — create groups (roles); attach AppPermission keys to a group; assign members and toggle IsEnable; per-user data-scope (All / Location / Custom branch list / Default) per SharedPermissions area; per-user project and group membership. See Permissions.
• Identity administration — user list / details / activity history; enable-login toggle and password reset / generate; PIN enable / disable; the "updated users" review queue.
• Organisation structure — positions (+ attachments, + interview questions), hierarchical departments with a manager position, branches & sub-branches, and the salary Levels / Steps / matrix per calendar profile.
• Reference / lookup data — programs, donors, budget-line categories, and the Common* lookups (countries, degrees, units, languages, education, …).
• Work calendar — calendar profiles per branch (auto-creates 7 day rows), weekend / half-day flags per day, and special holidays with repeat / half-day / per-profile scope.
• System settings — 21 CommonSetting rows: role holders (Procurement Manager, HR Approval, Director Approval, Payroll Allocator, Finance Data Officer, Timesheet FO / Payer, Travel FO and Safety Officer, IT, Administration and Supply-Chain managers, Complaint and Compliance admins, project focal points), the ordinary / emergency cash-box amounts, the e-mail-service on/off switch, and the attendance IP allow-list. Not here: the HR manager, finance manager and general manager that most approval chains route to — those are found by position title (R6-10). The screen's own "HR Manager" field is saved but never read. The rows must already exist — the screen cannot create them (R5-5).
• Announcements — targeted by branch / sub-branch / level / direct-vs-core, immediate or scheduled; on publish, matching employees are notified + e-mailed; shown on the home dashboard.
• Login history — filter UpdatedUser rows by user / method / subsystem / text / date. Despite the table's generic columns, the only code that writes to it is BUser.SetCustomTracking, called on successful sign-in — so it records logins, not changes; export to Excel (delivered over SignalR by a background job).
• Cross-module operations — bulk-reassign every workflow item currently waiting on one user to another; manually trigger the nightly next-user recompute.
• Public portals (AppsController, anonymous) — suppliers answer an RFQ, candidates apply to a job, referees submit a reference.

Screens

Route = /{Controller}/{Action}. GET unless noted; only primary screens are listed (each also has add / edit / delete partials under the same permission key).

Groups, permissions & users

Feature	Route	View	Permission key
Groups (roles) list	/Admin/UserGroups	Admin/UserGroups.cshtml	AdminUserGroups
Attach permission keys to a group	/Admin/UserGroupEdit/{id}	Admin/UserGroupEdit.cshtml	AdminUserGroupEdit
Group members (+ IsEnable)	/Admin/UserGroupUsers	Admin/UserGroupUsers.cshtml	UserUserGroupUsers
Per-user permission overrides	/Admin/UserPermissionsEdit/{id}	Admin/UserPermissionsEdit.cshtml	AdminUserGroupEdit
Data-scope per SharedPermissions area	/Admin/UserSharedPermissions	Admin/UserSharedPermissions.cshtml	AdminUserGroups
User list / details / dashboard / history	/User/Index, /User/ViewUser/{id}, /User/Dashboard/{id}, /User/History/{id}	User/*.cshtml	UserIndex, UserViewUser, UserDashboard
Enable login / reset password	/User/Edit/{id}, /User/Security/{id}, /User/GeneratePassword	User/{Edit,ChangePassword}.cshtml	UserEdit, UserChangePassword, UserManageGroupMember
Membership (groups + project rights)	/User/Membership/{id}, /User/ManagePermission, /User/ManageGroupMember	User/Membership.cshtml	UserMembership, UserManagePermission, UserManageGroupMember
Disable PIN	/User/DisablePinCode	—	UserManageGroupMember
"Updated users" queue	/User/UpdateUser	User/UpdateUser.cshtml	UserUpdatedUser

Organisation, reference data & calendar

Feature	Route	Permission key
Positions (+ attachments, + questions)	/Admin/UserPositions, /Admin/PositionAttachments/{id}, /Admin/PositionQuestions/{positionId}	AdminUserPositions, AdminAddUserPosition
Departments (hierarchical)	/Admin/Departments	AdminDepartments
Branches & sub-branches	/Admin/Locations, /Admin/SubLocations/{id}	AdminLocations
Salary levels / steps / matrix	/Admin/Levels, /Admin/Steps	AdminLevels, AdminUserTeams
Programs / Donors / Budget-line categories	/Admin/Programs, /Admin/Donors, /Admin/Categories	AdminPrograms, AdminDonors, AdminCategories / ProjectCategory
Calendar profiles / day config	/Admin/Profiles/{id}, /Admin/CalenderConfigurations/{id}	AdminIndex, AdminAnnouncement
Special holidays	/Admin/SpecialHolidays	AdminAnnouncement

Settings, announcements, audit & tools

Feature	Route	Permission key
Admin landing (tiles)	/Admin/Index	AdminIndex
General settings (role holders, cash boxes, IPs, e-mail switch)	/Admin/GeneralSettings	AdminGeneralSettings
Announcements	/Admin/Announcement	AdminAnnouncement
Activity log / audit history (+ Excel export)	/Admin/History	AdminAnnouncement
Bulk-reassign one user's pending approvals	/Admin/PendingRequests/{id}	AdminIndex
Trigger next-user recompute	/Admin/TriggerNextUser, /Admin/RunNextUserService	AdminIndex
Staff directory / org chart	/General/Contact, /General/Departments, /General/DepartmentsOrg	HomeIndex
Home dashboard	/ or /Home/Index	HomeIndex
Public portals (anonymous)	/Apps/Apply/{id} (RFQ), /Apps/ApplyJob/{id}, /Apps/ApplyReference/{id}	(none — anonymous, [ValidateAntiForgeryToken])

Business logic

Class	File	Responsibility & notable methods
BUser	NKO.Lib/NKO.Shared/Helpers/BUser.cs (~1900 ln)	The catch-all employee/org service. GetPermission(area, userId, …) → PermissionResultVM (DataPermissionType All/Location/Custom/Default + optional project rows). System-role resolvers: GetHRManager, GetBranchHR, GetCountryDirector, GetFinanceManager, GetSCManager, GetBranchTreasure/Finance/Logistic/Accounting, GetPositionManager, GetProjectsFocalPoints, GetSubstituteUserId. Org tree: GetChildDepts, GetMySupervisionDepts, GetUserDeptTreeAsString. Contract/salary: GetContractAsync, GetNetSalary, GetWorkingDays. Identity: ResetPinCode, VerifyPin, ChangePin, SetCustomTracking (writes the UpdatedUser audit rows). Audit query builder GetFilteredHistory + ExportUserHistory.
Bsettings	NKO.Lib/NKO.Shared/BAL/Bsettings.cs (~400 ln)	CommonSetting reader/writer. SaveSettings updates rows by numeric SettingId 1–21 and never inserts; GetSettings() → GeneralSettingVM reads them by list position (settings[0…20], no ORDER BY) and returns null if any is missing (R5-5). Setting 8 ("Director Approval") is also the SRF country-director step's approver, via GetDirector. Getters GetAllocator, GetProcurementManager, GetHRLeave, GetSafetyOfficer, GetPayrollFO, GetDirector, GetComplianceAdmin, … GetNextIncrement(area, year, project, location) / SetNextIncrement — the per-area running counter (CommonIncrement) that produces document reference numbers.
BSign	NKO.Lib/NKO.Shared/BAL/BSign.cs (~340 ln)	E-signature lifecycle. HasSign(userId) — true only for an AppUserSign that is SignStatus.Approved and within ApproveDate…EndDate (the gate used by procurement, the warehouse flows, leave, advance and overtime — but not by payroll, training, jobs, evaluation, PO justification or destruction, R3-9). Create (notifies HR), Approve (expires the user's other open signs), Reject, GetUserSign, GetSignImage.
BAnnouncement	NKO.Main/NKO.Main/BAL/BAnnouncement.cs	Announce(id) — resolves recipients from AnnouncementRecipients (branch / sub-branch / level, optional direct-vs-core) against db.EnabledEmployee(), then BNotification.Notify (public) + e-mail body.
BNotification	NKO.Lib/NKO.Shared/Helpers/BNotification.cs	Notify(contentUrl, actionType, type, recipients[], creator, reqUser?, isPublic) — one Notification + one NotificationUser per recipient (IsRead = false).
BCalendar	NKO.Lib/NKO.Shared/BAL/BCalendar.cs	Per-profile calendar queries: IsHoliday, GetPublicHolidays (expands IsRepeated into the current year), GetWeekendDays (from CalenderConfiguration).
StaffPermissionchecker	NKO.Lib/NKO.Shared/BAL/Permissionchecker.cs	Org-hierarchy walker over ManagerId / TechManagerId (skips IsPrivate): GetManagersSequence, GetStaff, GetDirectStaff, IsEmployeeOfMyStaff. Resolves "waiting for manager" and DataPermissionType.Default scoping.
SharedBAL	NKO.Lib/NKO.Shared/BAL/SharedBAL.cs	GetMyAdvances, GetBalance (advance = ½ net; loan tenure rules) — see Payroll. GetAnnualBalance here duplicates BLeave.GetAnnualBalance.
BCommon, BGeneral, BBranch, BNote	NKO.Main/NKO.Main/BAL/	Lookup helpers (project/donor/branch/unit/department code lookups, GetStatusName), the staff directory (BGeneral.GetContact), branch/sub-branch reads, and generic (AreaId, ReferenceId) notes with reminder dates.

Background jobs

Job	File	Schedule	Effect
BirthdayGreetingsJob	Infrastructure/BirthdayGreetingsJob.cs	IHostedService, 0 9 * * * (09:00 daily); skipped if inactive	BUser.GetTodayUsersBirthday() → bilingual "Happy Birthday" e-mail each.
UpdateNextUserJob	ScheduledTasks/UpdateNextUserJob.cs	Quartz 0 0 3 ? * * (03:00 daily) and on demand from /Admin/RunNextUserService	Recomputes NextUserId for every non-final pending request (Advance, Training, Leave, Timesheet, Payroll, PR, PO, GRN, SRR, Maintenance, Asset-GRN …) via NextUserHelper.Get*NextUser, so approvals re-route when managers or settings change.
ExportHistoryJob	ScheduledTasks/ExportHistoryJob.cs	Quartz durable, no schedule — triggered from /Admin/History?isExport=1	Builds the activity-log Excel export and pushes a download link over SignalR.

LoanJob (Infrastructure/LoanJob.cs) exists but is never registered and returns immediately in DEBUG — dead code.

Data

• Permissions: AppPermission, AppUserGroup, AppUserGroupMember, AppUserGroupPermission, AppUserProjectPermission, CommonPermission, CommonSharedPermission, SharedPermissionBranch.
• Notifications: Notification, NotificationUser, NotificationType, NotificationActionType.
• Audit & archive: UpdatedUser, ArchiveFile, ArchiveFileType.
• Reference / lookup: all Common* (CommonBranch, CommonSubBranch, CommonDepartment, CommonCategory, CommonMainCategory, CommonSubCategory, CommonCountry, CommonDegree, CommonUnit, CommonLanguageLevel, CommonMajorEducation, CommonGeneralLevel, CommonProgram, CommonManagers, CommonSetting, CommonIncrement), Nationality, Governorate, District.
• Org structure: PositionLevel, PositionLevelMatrix, PositionLevelStep, PositionStep, PositionQuestion, AppUserPosition.
• Calendar: CalendarProfile, CalenderConfiguration, CalendayDays, SpecialHoliday.
• Announcements: Announcements, AnnouncementRecipient.

Full column detail: Administration database.

Permissions

Distinct [ClaimRequirement] keys used by this module: AdminIndex, AdminGeneralSettings, AdminAnnouncement, AdminDeleteAnnouncement, AdminUserGroups, AdminAddUserGroup, AdminUserGroupEdit, UserUserGroupUsers, AdminUserPositions, AdminAddUserPosition, AdminManageTeam, AdminAddUserTeam, AdminUserTeams, AdminDepartments, AdminLocations, AdminLevels, AdminPrograms, AdminDonors, AdminCategories, ProjectCategory, UserIndex, UserUpdatedUser, UserDashboard, UserViewUser, UserEdit, UserChangePassword, UserPermission, UserManagePermission, UserMembership, UserManageGroupMember, HomeIndex, HomeAnnouncement, General. AppsController actions carry no key (anonymous public). /Admin/CopyProfile is currently unguarded.

Screenshots

User groups — /Admin/UserGroups:

Permission keys on a group — /Admin/UserGroupEdit/{id}:

Per-user data scope for an area — /Admin/UserSharedPermissions:

Control Panel landing — /Admin/Index:

General Settings — /Admin/GeneralSettings (system role-holder assignments, document-number increments, cash-box balances, IP / attendance settings):

Related

• Permissions · Authentication — how these settings are enforced.
• HR module — the org structure and calendars configured here drive HR.
• Administration API · Administration database.
• Security & Permissions.