This register documents who can access which systems, at what level, and why. Generated from live Django data via python manage.py audit_user_access.
| System | Role / User | Access Level | Auth Method | Review Frequency |
|---|---|---|---|---|
| GP Booking App | Superuser (admin, mstickels, matthew) | Full Read/Write: All data | Django + (planned MFA) | Quarterly |
| GP Booking App | ADMIN (peter, quicktest) | Full Read/Write: Non-clinical & Administration | Django + (planned MFA) | Quarterly |
| GP Booking App | ADMIN (yunHT...) | Full Read/Write: System configuration | OIDC (Keycloak) | Quarterly |
| GP Booking App | RECEPTIONIST (debug_receptionist) | Create/Update: Bookings. No clinical access. | Django | Quarterly |
| GP Booking App | SYSTEM_ADMIN (testuser_new) | System configuration & user management | Django | Quarterly |
| VPS Console | mstickels (Superuser) | SSH Root Access | SSH Key | Monthly |
| Wiki.js KB | OpenCode (AI Assistant) | Full Read/Write: All pages | Bearer API Token | As needed |
| PostgreSQL DB | postgres user | Full Database Access | Password Auth | Quarterly |
Generated 2026-05-04 via python manage.py audit_user_access --format table
| Username | Role | Superuser | Active | Formal Roles | Last Login |
|---|---|---|---|---|---|
| admin | ADMIN | Yes | Yes | - | 2026-04-20 |
| matthew | ADMIN → Superuser | Yes | Yes | - | 2026-05-04 |
| mstickels | ADMIN | Yes | Yes | SYSTEM_ADMIN | 2026-04-28 |
| peter | ADMIN | No | Yes | - | 2026-04-30 |
| quicktest | ADMIN | No | Yes | SYSTEM_ADMIN | 2026-04-14 |
| yunHT2hY7Mn99vTf_qS15NNsXiQ | ADMIN | No | Yes | - | 2026-04-30 |
| debug_receptionist | RECEPTIONIST | No | Yes | - | never |
| testuser_new | SYSTEM_ADMIN | No | Yes | - | 2026-04-15 |
Access is enforced at three layers in the Django app:
core/middleware.RBACMiddleware) — URL-prefix to role mappingcore.permissions.*, dashboards.mixins.*) — per-view role checksThe principle of least privilege is enforced: no user can access functionality outside their assigned role.