Skip to content
komp.ac Docs

Authentication and accounts

All account operations happen on the Authentication screen, reached from the Intro screen. Login, registration, and password changes are performed through the server’s AuthService; the token returned by login is stored locally so you stay signed in across runs.

The Authentication screen

Section titled “The Authentication screen”

The Authentication screen has two rows of actions:

Row Actions
Account access Login, Register
Account management Change password, Reset password, Return

Press Esc or choose Return to go back to the Intro screen.

Logging in

Section titled “Logging in”

The login form has two fields:

Field Value
Username/Email The account identifier
Password The account password

Submit with the Login button or the save binding (Ctrl+S by default). Submitting with an empty identifier is rejected with an error dialog before anything is sent.

On success the client stores the returned token and loads your authorized profile tree. A success dialog shows your username, user ID, and role, with two choices:

  • Menu returns you to the Intro screen, with the available views adjusted to your role;
  • Exit closes the dialog and leaves the login form open.

If the server rejects the credentials or cannot be reached, the client shows a failure dialog and repeats the error in the form.

Registering

Section titled “Registering”

Registration creates a new account. The fields are:

Field Notes
Username Required
Email Required
Password Optional
Confirm Password Optional
Timezone Suggested as you type
Phone country (ISO code) Suggested as you type, stored uppercase

An empty password is sent as “no password”, which is how a freshly seeded account can start without one. The timezone and phone-country fields offer completions the moment you start typing.

A successful registration shows the new account’s ID, username, email, role, timezone, and phone country. Confirm it to go to the login form.

Changing your password

Section titled “Changing your password”

The change-password form has three fields — current password, new password, and confirm new password — and requires you to be signed in. Password input is masked on screen.

The current password may be left empty on a freshly seeded account that has never had a password set. The new password must not be empty and must match the confirmation; both checks are performed locally before the request is sent.

On success, confirm the dialog to return to the Authentication screen.

Resetting another user’s password

Section titled “Resetting another user’s password”

Reset password is available to structural roles (superadmin, admin) and sets a password for a lower-ranked account. Its fields are the target username, the new password, and the confirmation.

Data roles (for example guest, accountant) do not get this action; their account views are limited to the data-entry workspace.

Stored session

Section titled “Stored session”

When you sign in, the client writes the session to auth.token in its state directory (~/.local/state/komp_ac_client/auth.token on a typical Linux setup). The file stores the access token plus your user ID, role, username, timezone, phone country, and selected profile, and is written with owner-only permissions (0600) on Unix.

On the next start the client reads this file and signs you back in automatically. If the server rejects the stored token as unauthenticated (for example after it expired or the account changed), the client discards the session and deletes the file, so you simply sign in again. A corrupt file is also deleted on load.

The selected profile is remembered only for non-admin users; admin users select their profile when they open the administration panel.

Roles and workspaces

Section titled “Roles and workspaces”

The client distinguishes two kinds of accounts:

Kind Roles Workspace
Structural superadmin, admin Administration panel (profiles, tables, validation, import/export)
Data everything else, e.g. guest, accountant Data-entry panel (profile selection and print)

This only changes what the client shows you. Authorization is still enforced server-side on every request; see Roles and permissions for the full model.

Opening a protected view while signed out sends you to the login form instead.

Troubleshooting

Section titled “Troubleshooting”
Symptom Cause and fix
Login reports a connection error The server is not running or GRPC_ENDPOINT is wrong.
Login succeeded but the profile tree failed to load The token is valid but the catalog request failed; retry or check the server.
The client starts signed out after being signed in The stored token was missing or rejected; sign in again.
A corrupt session file The client deletes auth.token and starts signed out.
Reset password is not shown You are not signed in as a structural role; only superadmin/admin can reset passwords.

Continue

Section titled “Continue”