Officer access} />

{[ { id: 'accounts', label: 'Accounts & roles' }, { id: 'codes', label: 'Access codes' }, { id: 'company', label: 'Company config' }, { id: 'server', label: 'Server & identity' }, { id: 'data', label: 'Data & integrations' }, ].map(t => { const on = tab === t.id; return ( ); })}

{tab === 'accounts' && } {tab === 'codes' && } {tab === 'company' && } {tab === 'server' && } {tab === 'data' && } ); } // ── Accounts ───────────────────────────────────────────────── function AccountsTab() { const { toast } = useAdmin(); const [accounts, setAccounts] = useState(() => { const saved = dbLoad().accounts; return saved || ACCOUNTS; }); const persist = (next) => { setAccounts(next); dbSave({ accounts: next }); }; const toggleStatus = (id) => { persist(accounts.map(a => a.id === id ? { ...a, status: a.status === 'active' ? 'suspended' : 'active' } : a)); toast('Account status updated · saved', 'success'); }; const roleTone = { officer: 'dark', ops: 'accent', safety: 'info', dispatch: 'indigo', accounting: 'good', employee: 'neutral' }; const appPill = { console: 'Console', tablet: 'Tablet', portal: 'Portal' }; const cols = [ { key: 'name', label: 'User', render: (r) => (

{A_initials(r.name)}

{r.name}

{r.email}

) }, { key: 'role', label: 'Role', render: (r) => {r.role} }, { key: 'apps', label: 'Apps', render: (r) =>

{r.apps.map(a => {appPill[a]})}

}, { key: 'mfa', label: 'MFA', render: (r) => r.mfa ? On : Off }, { key: 'lastLogin', label: 'Last login', mono: true, render: (r) => r.lastLogin.replace('T', ' ') }, { key: 'status', label: 'Status', render: (r) => ( ) }, ]; return ( <>

} /> a.status === 'active').length} tone="good" icon={} /> a.mfa).length / accounts.length * 100)}%`} tone="info" icon={} /> a.status === 'suspended').length} tone={accounts.some(a => a.status === 'suspended') ? 'bad' : 'neutral'} icon={} />

Shared across Console · Tablet · Portal}> ); } // ── Access codes ───────────────────────────────────────────── function AccessCodesTab() { const { toast } = useAdmin(); return ( <>

Access codes are issued to a client on sale. Each role gets a code; share it with the staff who need that view. Codes can be rotated at any time.

{ROLES.map(r => (

{r.short}

{r.label}

{ACCESS_CODES[r.id]}

))}

SYS

System / Officer master

SYS-2026-0001

Restricted

); } // ── Company config (persisted) ─────────────────────────────── function CompanyConfigTab() { const { toast } = useAdmin(); const [cfg, setCfg] = useState(() => ({ ...COMPANY_CONFIG, ...(dbLoad().company || {}) })); const set = (k, v) => setCfg(c => ({ ...c, [k]: v })); const setAddon = (id, v) => setCfg(c => ({ ...c, addons: { ...(c.addons || {}), [id]: v } })); const save = () => { dbSave({ company: cfg }); toast('Company configuration saved', 'success'); }; const row = (label, k, opts) => (

{label} {opts ? ( ) : ( set(k, e.target.value)} style={{ padding: '6px 10px', border: '1px solid var(--line-strong)', borderRadius: 8, fontSize: 13, background: 'var(--panel)', textAlign: 'right', width: 280, fontFamily: 'var(--font-mono)' }} /> )}

); return (

LEGAL ENTITY

{row('Legal name', 'legalName')} {row('EIN', 'ein')} {row('RRB BA number', 'rrbBaNumber')} {row('Address', 'address')} {row('Fiscal year', 'fiscalYear', ['Calendar (Jan–Dec)', 'Jul–Jun', 'Oct–Sep'])}

PAYROLL DEFAULTS

{row('Pay frequency', 'payFrequency', ['Weekly', 'Bi-weekly', 'Semi-monthly', 'Monthly'])} {row('OT threshold (hrs/day)', 'otThreshold')} {row('OT multiplier', 'otMultiplier')} {row('Mileage rate ($/mi)', 'mileageRate')} {row('Per-diem rate ($/day)', 'perDiemRate')} {row('Tax policy', 'taxPolicy', ['home', 'work', 'hybrid'])}

Railroad Retirement (RRTA)

Most flagging companies are under FICA, not RRB. Only enable if you actually pay into Railroad Retirement.

Persists across refresh · would write to the API in production.

{/* Add-on modules — purchasable, off by default */}

ADD-ON MODULES · SOLD SEPARATELY

Optional modules enabled per-contract at purchase. Off by default — these are upsells beyond the base platform.

{ADDON_MODULES.map(m => { const on = !!(cfg.addons && cfg.addons[m.id]); return (

{m.name} {m.priceNote}

{m.desc}

{m.sells}

); })}

Open Client Portal →

); } // ── Data model + integration health ────────────────────────── function DataModelTab() { const { integrations } = useAdmin(); return ( <>

Every entity the platform stores and where it originates — the spine that connects the field tablet, console, and employee portal.

{DATA_MODEL.map((e, i) => (

{e.entity}

{e.count}

{e.fields}

{e.source}

))}

{integrations.filter(i => i.status === 'connected').map(i => (

{i.name}

{i.format} · synced {typeof i.lastSync === 'string' && i.lastSync.includes('T') ? i.lastSync.slice(5, 16).replace('T', ' ') : i.lastSync}

healthy

))}

); } // ── Server & identity status panel ─────────────────────────── function ServerIdentityTab() { const { toast } = useAdmin(); const [, force] = useState(0); const health = RFP.server.health(); const cfg = RFP.idp.config(); const log = RFP.server.requestLog(); const db = RFP.db.get(); const sessions = db.sessions || []; const ping = () => { RFP.server.api('GET', '/v1/health', null, {}); toast('Health check 200 OK', 'success'); force(x => x + 1); }; const reseed = () => { RFP.db.reseed(); toast('Identity directory reseeded', 'info'); force(x => x + 1); }; return ( <>

} footer={`v${health.data.version}`} /> } footer="auth.railflagspro.com" /> } /> } />

Reseed directory}>

{[['Issuer', cfg.issuer], ['Token endpoint', cfg.token_endpoint], ['Userinfo', cfg.userinfo_endpoint], ['JWKS', cfg.jwks_uri], ['Signing alg', cfg.id_token_signing_alg_values_supported.join(', ')]].map(([k, v]) => (

{k}

{v}

))}

{cfg.grant_types_supported.map(g => {g})}

Tokens are signed JWTs (header.payload.signature). Passwords are salted-hashed; the directory, sessions, and request log persist server-side.

} onClick={ping}>Ping /health}>

{log.length === 0 &&

No requests logged yet.

} {log.map((r, i) => (

{r.method} {r.path} {r.status} {r.ms}ms

))}

); } Object.assign(window, { RoleSystem, ServerIdentityTab });