Generalitats¶
Drechs¶
We can see several rights level in Galette, allowing access to different parts and features of the application. Levels are:
super administrator is a special user (the only one that is not a member) created at installation,
administrators are members for who the "administrator" checkbox has been checked,
staff members have a specific status (President, Treasurer, Secretary, ...),
groups managers have only rights on the groups they manage,
up to date members are members whose account are active, and whose subscription are up to date,
members are members whose account is inactive or whose subscriptions are not up to date,
simple visitors.
Staff members, administrators as well as the super administrator can create, edit and remove members, contributions, transactions, send emailings, ...
Administrators have also access to the application configuration, excepted super admin information.
The super administrator has a full access to the application, but not to all features. Indeed, this is not a member account, and it cannot have some of required information. It can change its own login and password from My account, then My information.
Members can change their own information, and can see their contributions and transactions (as read only).
Visitors can - if this is parameted in preferences - access to public pages (trombinoscope, public members list) but can also register :)
Group managers¶
With the stricter configuration, groups managers can show and search on members of their groups, and see accessible data for members. On members and cards, you can configure which fields are accessible.
From the preferences, you can also give groups managers extra rights, like editing or creating members.
Management rules¶
Due dates are calculated by day. If a member pay into before the end of his membership, duration of this membership will be added to remaining days. Example:
Roger subscribed on 2004-01-01 for one year,if he pays into for a year on 2004-12-13,his due date will become 2006-01-01.No day will be forget.
At the contrary, if a member renew his membership late, we evaluate again his membership duration:
Roger subscribed on 2004-01-01 for one year,if he pays into for a year on 2006-01-13,his due date will become 2006-01-13.
He is not an up to date member from 2006-01-01 to 2006-01-13... On paper at least :)
Those rules are flexible because you can freely change membership dates on contributions, if you have rights to add or update them. We can imagine an association who stores all contributions on the first day of the next month (offering its members a longer membership time).
Two-factor authentication¶
New in version 1.3.0: Marked experimental: it is complete and tested, but it is new, and the interface may still change.
Once a policy has been set in the preferences, every account can protect itself with a second factor: after the password, Galette asks for a six digits code that changes every thirty seconds.
If you are an administrator or a staff member and have not set one up, Galette invites you to when you log in. Nothing forces you to; Later keeps quiet for six months, Do not ask again for a year.
You need an application to compute those codes. Any of them will do, they all follow the same standard; among the free ones:
KeePassXC on a computer, in the TOTP field of an entry,
Google Authenticator, Microsoft Authenticator, ... on Android and iOS.
Enabling it¶
Go to My account, then Two-factor authentication, and click on Enable two-factor authentication. Galette shows a QR code to scan with your application; if you cannot scan it, the key displayed right under it can be typed in by hand instead.
Your application then starts displaying codes. Type the current one in to confirm, and it is on. That first code is asked for on purpose: it makes sure your application really is set up before Galette starts requiring it.
Galette then displays ten recovery codes, and displays them only once.
Warning
Print those recovery codes, or save them somewhere that is not the device computing your codes. They are the way back in if you lose your phone. Each one works once, and Galette never shows them again -- it does not keep them in a readable form.
You can get ten new ones at any time from the same page; the previous ones are then void.
Logging in¶
Nothing changes for the password. Once it has been accepted, Galette asks for a code. Nothing else is reachable until it is given: an account waiting for its code is not logged in.
If you no longer have your device, use one of your recovery codes instead of a code: the same field takes both.
Disabling it¶
From My account, then Two-factor authentication, a current code is required to turn it off. That is deliberate: somebody who found your session open should not be able to remove your second factor with a click.
If a policy makes it mandatory, you will be asked to enable it again at your next login.
Note
Codes are computed from the current time, so both your device and the server have to agree on it. This is by far the most common reason for codes being refused; see the FAQ.
Dashboard¶
The dashboard is the page displayed after logging in. Its tiles give a quick access to the main features; each user only sees the tiles of the features they are allowed to use. Members see their own information, contributions and transactions; group managers also get shortcuts to the contributions and transactions of the members they manage, when the association allows it.
Next to the tiles:
administrators and staff members see the latest news of the Galette project,
everyone sees the news of your association, when an RSS feed URL is set in the preferences,
administrators are invited to send telemetry data, until it is sent or the panel is hidden.
Administrators and staff members can uncheck Show dashboard on login to go straight to the members list after logging in; this choice is kept by the browser. The dashboard remains available from the Dashboard menu entry.
At the top of every page, the language list changes the language of the interface.
A few banners may also be displayed at the top of the pages:
Maintenance: the instance is in maintenance mode; only the super administrator can log in, and is reminded of it,
Demonstration: the instance runs in demonstration mode, some features are disabled,
Superadmin: you are logged in as super administrator, who is not a member.
When a new Galette release is available, an icon is displayed next to the version number at the bottom of the pages, for administrators and staff members.
Interface¶
We do our best for the Galette interface to be:
logical and consistent (you will always find icons at familiar places),
web standards compliant (HTML and CSS valid),
HTML semantic respectful,
accessible (without any WCAG, WAI or equivalent tests run).
If you find places where one of those points is incorrect, do not hesitate to tell us on the tracker or on the mailing list!
History¶
Galette keeps a history of what happens: logins, failed logins, members added or changed, contributions, mailings sent... Administrators and staff members can read it from Management, then Logs.
Each line gives the date, the address the action came from, the user who did it, the action and a short description. The list can be filtered on a period, a member and an action.
Flush the logs empties the history, after a confirmation. This cannot be undone.
Note
Actions are stored in the language of the user who did them: a history can therefore mix several languages.
Telemetria¶
New in version 0.9.
Galette propose to send some telemetry information:
entirely anonymous: no information about your association or your members is sent,
deliberately blurred: we retrieve an estimation of members count, never a real count,
sent by a secured way (HTTPS) on https://telemetry.galette.eu.
Sending telemetry data is a manual process, nothing will be sent until you explicitly ask it. With those information, we can have a better knowledge of different usages of Galette, their number of member or contributions, plugins used, ...
Those information are useful for the project development and promotion. When you send those information, you can review data that would be sent.
After data has been sent once, Galette will propose to send an update from time to time. You can also send them from Galette preferences.
It is also possible to register your association on the website, of course, not anonymously, but it is not possible to link telemetry and registration. New references are moderated.
You can update your registration information from Galette preferences. The form will be blank (because it is not possible to retrieve data you've sent) but all data will be updated because your instance has a unique registration identifier designed for that.
A new panel has been added on Galette dashboard to send telemetry information and/or register your instance. Once those steps has been completed, the panel will disappear. You also can choose to just disable it.
