Permissions and Menu Management
The platform uses a role → menu / permission code → user authorization model: the role decides what a user can see and do; each user is assigned a single role. Menu path: System Management → Permissions (Role Management) / System Management → Base Data (Menu Management).
For the day-to-day onboarding of operators, create the account in User Management and assign an existing role — this page is for administrators who need to create or adjust roles.
Role Management
- List: role code, role name, client type (roles are isolated between the admin panel and the merchant panel), built-in flag, remark;
- Add / Edit: role code (unique, checked on save), i18n key (the translation key of the role's display name), client type, remark;
- Delete: requires typing
iam/role/{roleCode}to confirm, preventing accidental deletion; built-in roles cannot be edited or deleted.
Copy built-in roles instead of modifying them
Built-in roles (such as the merchant super admin) are the fallback configuration for system features. When you need a similar but different permission set, create a new role and assign permissions to it — do not try to modify the built-in ones.
Assign Permissions
"Assign Permissions" in a role list row opens the authorization drawer, whose tree mixes menu nodes and permission-code nodes (distinguished by small dots).
Toolbar capabilities:
| Control | Purpose |
|---|---|
| Search | Filter by menu name or permission code; matched paths expand automatically |
| Select all / Clear / Expand / Collapse | Batch operations |
| Check menus with permission codes | On by default: checking a menu also checks all permission codes under it (recommended to keep on, to avoid "seeing the page but not being able to click the buttons") |
| Menus only / Checked only | Filtered views for large trees |
Check linkage rules:
- Checking a menu → all of its sub-menus are checked automatically (permission codes follow the toggle);
- Checking a permission code → the parent menu it mounts on is checked automatically (keeping the entry visible);
- When the same permission code is mounted under multiple menus, checking it once applies globally (the node carries a hint marker).
On save, a confirmation shows "will save N menus and N permission codes"; after submitting, users who re-login or refresh see the new permissions rendered.
Menu Management
Maintains the sidebar menu tree and hidden sub-pages. A skeleton tree on the left plus a sub-item panel on the right; the top switches by client (admin panel / merchant panel), and search by name / code / path / component is supported.
Six menu types:
| Type | Purpose |
|---|---|
| Directory | Sidebar grouping container; renders no page |
| Menu | Clickable page entry; requires a path and a component |
| Sub-page | Hidden routed page mounted under a menu (detail / edit pages); never appears in the sidebar |
| Sub-page group | Logical grouping of sub-pages; organizational only, renders nothing |
| Embedded page | Embeds an external page in an iframe |
| External link | Opens an external address in a new window |
Edit form essentials: the menu type decides the fields (embedded pages fill the embed URL, external links fill the external URL); titles resolve through i18n keys (change the wording in the language packs, never hardcode it on the menu); advanced settings include sort order, hidden, cached route, fixed tab, badge, and more.
Usually you should not touch menus
The menu tree is versioned with the system and gets updated on upgrades. Custom menus are only for mounting your own extension pages; casual changes to built-in menus may lose feature entries after an upgrade.
Permission Codes
Permission codes are the smallest unit of button-level permission (e.g. "Reset Password", "Publish"). The codes in the codebase and the records in the database are aligned by the Sync Permission Codes action:
- Menu management toolbar "Sync Permission Codes" → scans backend endpoints → adds / updates / deletes (the result shows the three counts);
- Which permission codes a single menu mounts: view them in the read-only "Permission Codes" drawer in the menu row.
Sync after every upgrade
After a system upgrade introduces new permission codes, skipping the sync makes the new buttons invisible to roles that were already granted the parent menu — run "Sync Permission Codes" in menu management once after every upgrade.
Related Links
- User Management: accounts and role assignment
- Admin Panel Overview: a quick tour of the permission model
LLM-friendly document formats for ChatGPT, Claude, Cursor and other AI tools to read and understand DaxPay docs.
llms-full.txt — Full docs merged, complete content in one file for bulk AI input