Organisasi & RBAC

​

Pendahuluan

​

Konsep Organisasi

​

Organisasi

• Data terisolasi sepenuhnya
• Member/staff sendiri
• Billing sendiri
• Domain sendiri (custom + subdomain cekolah.com)

​

Struktur Organisasi

Organisasi (Sekolah)
├── Owner (1 atau lebih)
├── Admin
├── Teachers
├── Staff
├── Parents (segera)
└── Students (segera)

​

Role & Permissions

​

Built-in Roles

• Akses penuh ke semua fitur
• Kelola billing dan subscription
• Kelola anggota organisasi
• Tidak bisa remove diri sendiri
• Punya 1 owner minimal per org

• Akses penuh ke fitur operasional
• Kelola member (invite, remove, role)
• Kelola data (HRIS, siswa, jadwal, dll)
• Tidak bisa ubah billing
• Tidak bisa hapus owner

• Akses sesuai permission yang diberikan
• Default: limited access
• Bisa lihat data diri sendiri
• Bisa update profil sendiri

​

Custom Roles

1. Buka Settings → Roles & Permissions
2. Klik Create Custom Role
3. Isi:
   • Nama role: “Guru Senior”, “Koordinator HRIS”, dll
   • Deskripsi
   • Pilih permissions (checkboxes)
4. Simpan

• Guru Senior: lihat & edit HRIS, jadwal
• Koordinator Akademik: manage siswa, jadwal, nilai
• HR Staff: manage HRIS, rekrutmen (read-only kehadiran)

​

Manajemen Anggota

​

Invite Member

1. Buka Settings → Members
2. Klik Invite Member
3. Isi:
   • Email address
   • Nama (opsional, bisa edit nanti)
   • Role: Owner, Admin, atau custom role
4. Klik Send Invite

• Click link untuk create akun
• Atau join jika sudah punya akun Cekolah

​

Manage Member

1. Buka Settings → Members
2. Lihat daftar semua member:
   • Email
   • Nama
   • Role
   • Status (active, pending invite, etc)
   • Join date
3. Untuk setiap member:
   • Change Role - Ubah role member
   • Change Permissions - Ubah permission granular
   • Remove - Hapus dari organisasi
   • Resend Invite - Jika pending

​

Remove Member

1. Klik member yang ingin dihapus
2. Klik Remove from Organization
3. Confirm removal
4. Member kehilangan akses semua data org

​

Permission System

​

Permission Levels

• hris.employees.view - Lihat data karyawan
• hris.employees.create - Tambah karyawan
• hris.employees.edit - Edit karyawan
• hris.employees.delete - Hapus karyawan
• hris.recruitment.* - Semua permission recruitment
• etc

• students.view - Lihat siswa
• students.manage - Kelola siswa
• students.enroll - Enroll siswa
• etc

• attendance.view_all - Lihat semua kehadiran
• attendance.approve - Approve izin/cuti
• attendance.manage_calendar - Kelola kalender
• etc

​

Set Custom Permission

1. Buka Settings → Members
2. Klik member
3. Klik Custom Permissions
4. Check/uncheck permission sesuai kebutuhan
5. Simpan

• ✅ HRIS: view, create, edit (not delete)
• ✅ Schedule: manage
• ✅ Attendance: view_all
• ❌ Billing: none
• ❌ Settings: none

​

Permission Templates

​

Access Control Examples

​

Skenario 1: Guru

• Lihat dan kelola jadwal mengajar
• Submit attendance (check-in)
• View data siswa di kelas mereka
• Upload nilai (segera)

• Role: Teacher (predefined)
• Atau custom dengan permission terbatas

​

Skenario 2: HR Manager

• Manage semua data HRIS (create, edit, delete)
• Kelola rekrutmen
• Tidak bisa kelola siswa/jadwal
• Tidak bisa akses billing

• Role: Custom “HR Manager”
• Permissions: HRIS full, Recruitment full, siswa read-only

​

Skenario 3: Koordinator Akademik

• Manage siswa & enrollment
• Manage jadwal & kurikulum
• View HRIS (guru/staff)
• Approve attendance izin
• Tidak bisa akses karyawan edit

• Role: Custom “Koordinator Akademik”
• Permissions: Students full, Schedule full, HRIS limited, Attendance approve

​

Activity & Audit

​

Activity Log

1. Buka Settings → Activity Log
2. Lihat:
   • Who: Member mana yang action
   • What: Aksi apa (create, edit, delete)
   • When: Kapan
   • Target: Data apa yang di-action
   • Details: Perubahan detail
3. Filter by:
   • Member
   • Modul (HRIS, Students, dll)
   • Aksi (create, update, delete)
   • Date range

​

Export Audit Log

1. Klik Export
2. Format: CSV, PDF
3. Date range
4. Download laporan

​

Multi-Organization

1. Switch between org di dropdown
2. Access berbeda per organization
3. Billing separate per org
4. Activity log separate

​

Security

​

Session Management

• Each device = separate session
• Logout dari satu device tidak affect device lain
• Admin dapat force logout user dari settings
• Session timeout otomatis (idle 30 min)

​

Password & 2FA

• Member manage password di settings profil
• Optional 2FA untuk security extra
• Password reset via email

​

Data Privacy

• Member hanya see data sesuai permission
• Database query di-filter by org & permission
• Audit log mencatat semua access

​

Tips & Best Practices

• ✅ Use roles yang sudah ada (Owner, Admin, Member)
• ✅ Buat custom role hanya jika perlu
• ✅ Assign least privilege (minimal permission needed)
• ✅ Review member permission secara berkala
• ✅ Remove member yang tidak lagi aktif
• ✅ Monitor activity log untuk suspicious activity
• ✅ Keep owner/admin count minimal (security)

​

Troubleshooting

• Autentikasi
• HRIS
• Subscription