Platform SysAdmin

Overview

The Platform SysAdmin applet is the console a BigLedger platform system administrator uses to run the platform as a whole: create and edit tenants, put existing users into a tenant, look up any platform user, manage applet catalogues, subscriptions and applet stores, and maintain the list of system administrators itself. It is a ROOT-ADMIN applet that reads and writes the shared akaun_master database; it belongs to no tenant module and no customer opens it.

Everything it does is authorised on the caller’s platform system-administrator rank, a claim carried in the login token, and not on the permission sets a tenant administrator manages. That model has one consequence a reader must know before relying on the SysAdmins screen: removing someone from the list, or setting them INACTIVE, does not take their access away until their token expires. The details are under Configuration.

Where it fits

Screens and menus

The left menu has eight entries; the routing file has 28 routes. The table says which screens are wired to the backend and which are not, because the difference is not visible on screen.

Two routed screens have no menu entry and are reachable only by URL: settings/applet-log, an Audit Trail grid over app_login_subject_to_tenant_link_audit_trail (table, action, actor, date, description, status), and personalization/sidebar.

The Settings menu is partly broken. Its landing route redirects to client-side-permission-listing, which is commented out of the routing file, so opening Settings lands on the applet’s 404 page; the Permission Wizard entry points at permission-wizard-listing, which is not routed; and the Personalization → Field Settings entry points at field-settings under personalization, where only personal-default-selection and sidebar exist. Permission Set, User Permission and Role Permission work.

Configuration

Before you can use it

• You must be a platform system administrator. Your login needs a row in akaun_master.app_system_administrator with status ACTIVE, created from this applet’s SysAdmins screen (or by another OWNER / ADMIN). There is no tenant-side permission that substitutes for it.
• You must log in after the row exists. The rank is copied into the login token at sign-in (sysAdminRank, sysAdminGuid). A token issued before you were added carries no rank, and every sysadmin-ep endpoint will answer not authorised until you sign in again.
• The applet must be installed for your login through a catalogue. Measured 2026-09-16: the applet sits in 5 catalogues and is installed in 1 tenant.

How authorisation actually works

Every write in this applet goes to a …/sysadmin-ep endpoint, and every one of those authorises with one of two static checks in UserPermissionService.java (L471–L487). Both read only the token:

Consequences that the screens do not show:

• Revocation is not immediate. Neither check re-reads app_system_administrator, so setting a sysadmin to INACTIVE, DELETED, or letting their End Date pass changes nothing until the token lapses (observed lifetime about 30 days). Measured 2026-09-16 in akaun_master: 28 INACTIVE or DELETED sysadmin rows alongside 61 ACTIVE ones. Filed as blg-intranet#5896. Do not tell a reader that removing a sysadmin here locks them out — today it does not.
• A MEMBER can read everything and create demo tenants, because the read-side check never looks at rank. The applet’s own Rank drop-down offers only OWNER and ADMIN, so MEMBER rows come from the API (4 exist).
• One screen is the exception. User → Edit → SAVE calls PUT …/users/sysadmin-ep, whose handler uses isUserSystemAdmin(subjectGuid, …) — a database query that requires an ACTIVE sysadmin row and an ACTIVE login (UserPermissionService.java L420–L435). It is the only action in this applet a revoked administrator loses at once.
• Rank rules on the SysAdmins screen are enforced server-side (SysadminService.java L66–L89): an OWNER may create, edit or delete anyone but themselves; an ADMIN may create or edit ADMIN and MEMBER rows only, may not touch an OWNER row or promote to OWNER, and may not edit their own row. The client shows a DELETE button only to OWNERs, but the server applies the same rule to ADMINs who call the endpoint directly. The failure text is “This user does not have the minimum rank to do this action or create own sysadmin”.
• The permission tables (bl_applet_client_side_perm_dfn, permission sets, roles) play no part in any of the above. bl_applet_client_side_perm_dfn has 0 rows for PlatformSysAdmin (queried 2026-09-16), and the applet reads no SHOW_* / HIDE_* key.

Applet settings

No exposed control found (routes and settings components checked at commit f015e510):

• Settings → Field Settings renders eight mat-slide-toggles (Unit Discount, SST/VAT/GST, WHT, Blanket Order, Segment, G/L Dimension, Profit Center, Project) bound to no form control, with a SAVE button that has no handler; the component class is empty. It is the same unbound stub found in several other applets.
• Settings → Default Selection and Personalization → Default Selection are routed directly, yet declare @Input() appletSettings$ and @Output() save. Angular binds nothing on a directly-routed component, so appletContainer is never set and the first change to the branch or location drop-down throws on this.appletContainer.bl_applet_exts; SAVE emits to nobody. Nothing is persisted.
• No component reads selectMasterSettings for a decision; the only subscription (the audit-trail listing) stores the observable and does not use it.

Settings in other applets that control this applet

None found. The applet’s behaviour is fixed by the backend authorisation described above.

Feature visibility / permissions

The applet declares no client-side permission codes and the registry seeds none. Visibility of menus and buttons does not vary by role; what varies is whether the backend accepts the call, per the two checks above.

Fields

SysAdmins → Add / Edit

Tenant → Create / Edit → Details

Tenant → Users → Add

The Users → Edit form exposes the same Rank and Status for an existing link, plus audit columns.

Catalogue → Create / Edit → Details

Catalogue Code (required), Catalogue Name (required), Catalogue Type (PRIVATE default, required), Applet Store (required, from the store list), Tenant (required, searchable drop-down of tenant codes), Description, Status (ACTIVE default), Subscription Name / Type (read-only), and three true/false flags — Auto Install Login, Auto Install Entity Login, Auto Install Consolidated Login — stored on bl_applet_catalog_hdr. Their effect is in the tenant-side login flow, not in this applet.

Subscription → Create / Edit → Details

Subscription Code (required, ^[a-zA-Z0-9-_]+$), Subscription Name (required), Subscription Type (default STANDARD, required), Currency (required), Credit Limit (number, default 0.00, required), Country (required), Description, Status (ACTIVE default, required).

Applet Stores → Create / Edit → Details

Applet Store Code (required; read-only once created), Applet Store Name, Description, Status (required).

User → Edit

User GUID and Email are read-only; Given Name and Family Name are required and are the only two values SAVE writes.

Lifecycle and effects

This is a master-data applet on the platform database. Nothing here posts a journal or moves stock; the effects are rows in akaun_master and, in two cases, a queued processor.

Related applets

• Developer SysAdmin Applet — registers the applets, vendors and stores that this applet then catalogues, installs and trends.
• Tenants V2 — the earlier tenant-maintenance applet. It creates tenants through POST …/tenants (permission-table authorised, audit-trailed) rather than …/tenants/sysadmin-ep; both hit the same provisioning code and the same current failure.
• Developer — the earlier applet-registration screen.
• Tenant Admin Applet — what a tenant’s own OWNER or ADMIN uses once the tenant and its first user exist.
• Applet Store — consumes the stores, catalogues and trending links.

Troubleshooting

Related documentation

• Platform applets — the section hub.
• Applet Catalog — the registry-generated list this applet’s Catalogue menu feeds.