Owner can create staff, control page access, hide/show cost, profit, supplier bills, payments and sensitive details, view stored passwords, reset passwords, and force logout.
Use order number or move up/down in the user list. Lower number appears first.
Owner password view is enabled. Old passwords will show only when your backend/RPC returns an owner-visible password field; new or reset passwords show immediately on this page.
Change role, then click Apply Role Upgrade to auto-fill matching permissions.
Page Access + Detail Visibility
Users, Logins & Allowed Details
Owner view includes staff user ID/login ID and stored password visibility when returned by your backend. Password reset values are also shown after reset.
Important: Do not show cost, profit, supplier bills, payments, owner alerts, delete/merge, or staff credentials to normal staff. Keep those permissions only for owner/manager/accountant when needed.
If Create Staff shows a Supabase 404/400 error, the page is okay but your backend RPC/columns are missing. Run the SQL patch file: user-management-supabase-rpc-fix.sql.