User Entities

This document outlines the different types of user entities within the system. There are two primary categories of users: Authenticated Users who can log in and perform actions, and Unauthenticated Users who represent personnel on a worksite but cannot log in to the platform.

Entity	Description	Can Log In?	Purpose
AuthUser	Users with system access credentials.	Yes	Manage, oversee, and view protection activities.
WorkerUser	On-site personnel without system access.	No	Represent individuals present at a worksite for safety and auditing.

Authenticated Users (AuthUser)

Authenticated users are individuals who have credentials to log in to the application.

All authenticated users extend a BaseUser with the following attributes:

• id: Unique identifier.
• name: Full name.
• mobile: Mobile phone number.
• company: The company they work for.

They also have the following specific attributes:

• email: Email address, used for login.
• lastLoginAt: Timestamp of their last login (optional).
• type: The user's role, which determines their permissions.

There are four distinct roles for authenticated users, each with specific permissions:

Roles and Permissions

1. Admin

• Description: Administrators can log in to the admin portal to manage core system data.
• Permissions:
  • Full CRUD (Create, Read, Update, Delete) operations on all data.
  • Can manage user accounts (AuthUser and WorkerUser).
  • Can manage projects and worksites.

2. Rail Protection Officer (RPO)

• Description: RPOs are responsible for the overall safety and protection of a Protected Work Area (PWA).
• Permissions:
  • Activate, hand over, and "hand back" PWAs.
  • In a single-site PWA, they can activate the worksite directly.
  • In a multi-site PWA, they can authorise Site Protectors to activate their respective worksites.
  • Take over a Worksite within their PWA.
  • View the status of all worksites within their PWA.

3. Site Protector (SP)

• Description: Site Protectors manage the safety of a specific worksite within a multi-site PWA, under the authority of an RPO.
• Permissions:
  • Activate their assigned worksite once it has been authorised by the RPO.
  • Manage workers locking on and off their worksite.
  • Hand over a worksite to another SP or RPO.
  • View the status of their own worksite.
  • Edit site limits.

4. Viewer

• Description: Viewers have read-only access to the system. This role is typically for stakeholders who need to monitor progress without having any operational control.
• Permissions:
  • View projects, PWAs, and worksites.
  • Cannot make any changes to the system state.

Unauthenticated Users (WorkerUser)

Unauthenticated users represent the workforce on the ground. They do not have login credentials for the application. Their presence is recorded in the system when they are "locked on" to a worksite.

All unauthenticated users extend a BaseUser with the following attributes:

• id: Unique identifier.
• name: Full name.
• mobile: Mobile phone number.
• company: The company they work for.

They also have the following specific attributes:

• email: Email address.
• type: The type of worker (Worker or Visitor).
• worker-id-photo: An optional headshot image of the worker

There are two types of unauthenticated users:

User Types

1. Worker

• Description: A standard worker or team member who performs tasks on a worksite.

2. Visitor

• Description: Represents a temporary visitor to a worksite, who might not be part of the regular crew.

Functionally, both Worker and Visitor types are treated the same within the system: their primary purpose is to be part of the headcount and audit trail for a worksite.