Users, Roles and Groups (USR)

A classification of users.

A user account.

A named permission grouping. Used by the acl submodule to grant object access; this submodule only stores the role identities.

A group whose members all share its assigned roles.

Direct role assignment to an individual user.

Role attached to a group. Every member of the group inherits the role.

User membership in a group.

SYS_USR_BootstrapApi.bootstrap runs at system bootstrap and idempotently provisions a baseline set of records when they are missing: a default UserType (001), a default User (admin), a default UserGroup (001), a default Role (sys_ope), and the UserGroupMember and UserGroupRole rows that bind the admin user to the group and the role to the group. Existing records are never overwritten. The bootstrap pulls the default locale and time zone from sys.loc and fails fast if those are missing.

The defaults that govern this step are constants on SYS_USR_Constant:

UserReaderService.getLoggedInUser reads the current username from the Spring Security context (VenloContext.getUserDetails()) and looks up the matching User row. It raises a business exception when the username does not resolve to a user — used by every action that needs to attribute work to "the current user" (audit fields, theme preferences, etc.).

BatchUserReaderService provides the technical user the system runs as for background jobs that have no interactive session. loginBatchJobUser registers the configured batch-job credentials with VenloContext.setBackgroundUserDetails; getBatchJobUser returns the corresponding User entity. Credentials come from SystemSettingService, which reads the erp.sys.usr.batchJobUserName and erp.sys.usr.batchJobPassword properties and trims them.

UserPreferenceViewModel exposes two actions that flip the dark-theme preference on the currently logged-in user. Both actions are always enabled and persist immediately — the user does not need to save the preference page.

Two view models render a dynamic checkbox matrix so administrators can manage role and group bindings without scrolling through long lists of link rows:

Read-side facade.

Currently an empty placeholder — no cross-module write operations are exposed. User and group records are maintained through their default UI pages and the dynamic matrix view models.

Single entry point bootstrap(HasTrace) — see Bootstrap of default user, group, and role above. Called by the system-wide bootstrap sequence, not by end users.