# Admin Workflows

## Create a Group

1. Open the groups admin page.
2. Enter a group name and slug.
3. Save the record.
4. Confirm the group appears in the list.

## Create an Application

1. Open the applications admin page.
2. Enter the application name and slug.
3. Save the record.
4. Confirm the application appears in the list.

## Assign a User to a Group

1. Open the user detail view.
2. Select one or more groups.
3. Save the assignment.
4. Verify the new access level works.

## Assign a Group to an Application

1. Open the group detail view.
2. Select the applications that group may access.
3. Save the mapping.
4. Verify access checks return the expected result.

## Review Access

1. Check whether the user is active.
2. Check the groups attached to the user.
3. Check the applications attached to those groups.
4. Deny access when no match exists.

## FAQ: Change User to Admin Role

### Group-Based Method (recommended)

```sql
INSERT INTO groups (group_name, group_slug)
VALUES ('Administrators', 'admin')
ON DUPLICATE KEY UPDATE group_name = VALUES(group_name);

INSERT IGNORE INTO user_group (user_id, group_id)
SELECT u.id, g.id
FROM users u
JOIN groups g ON g.group_slug = 'admin'
WHERE u.email = 'you@example.com';
```

### is_admin Method (fallback)

```sql
ALTER TABLE users ADD COLUMN is_admin TINYINT(1) NOT NULL DEFAULT 0;
UPDATE users SET is_admin = 1 WHERE email = 'you@example.com';
```

### role Method (fallback)

```sql
ALTER TABLE users ADD COLUMN role VARCHAR(30) NULL;
UPDATE users SET role = 'admin' WHERE email = 'you@example.com';
```

### Remove Admin

```sql
DELETE ug
FROM user_group ug
JOIN groups g ON g.id = ug.group_id
JOIN users u ON u.id = ug.user_id
WHERE g.group_slug = 'admin'
  AND u.email = 'you@example.com';

UPDATE users SET is_admin = 0 WHERE email = 'you@example.com';
UPDATE users SET role = 'member' WHERE email = 'you@example.com';
```