Skip to content

Staff and Roles

Hyvä POS is in closed beta

Hyvä POS is currently in a closed beta (pilot phase) with a small group of merchants. It is not yet generally available: the App Store release follows the pilot, and features and configuration may still change - possibly in backwards-incompatible ways - before the general release. Want to take part? Sign up at hyva.io/pos.

On the free tier, the register has one user. PRO gives every employee their own PIN, with permissions that come from roles you manage in Magento, so the register knows who did what, and who may do what.

PIN Login

Staff members are created in the Magento admin (POS → Staff → Manage Staff) and assigned to locations and a role. On the register, each shift starts with a PIN: the sale, the drawer opening, the stock change all carry the person who did them, and reports show it. Every staff record also carries a staff ID (an employee code, generated when the record is created): choose it as the receipt's staff-name format and receipts stay anonymous for customers while the store can still trace every sale to a cashier - see receipt layout.

Whether the register demands a login at all is a Magento switch: Stores → Configuration → Hyvä POS → General → Require Staff Login.

What Magento Stores

A staff record is a name, an email, a staff ID, location assignments, a role, and a PIN. The PIN never exists in readable form on the server: Magento stores only a bcrypt hash, and that hash is never sent to devices - the API that ships staff lists to registers strips it by construction. Each successful online login is recorded as a session in Magento, and every consequential action a staff member takes at the register lands in the audit log (POS → Audit Log) with their name on it.

Roles and the 42 Permissions

Roles are managed under POS → Staff → Roles. Every permission is an individual switch on the role - 42 of them, grouped by what they protect:

  • Selling (9): place orders, apply discounts, apply coupons, custom line items, issue refunds, void orders, price override, tax-exempt sales, reverse charge.
  • Payments (5): accept cash, card, split payment, store credit, pay by invoice.
  • Register (4): open register, close register, cash in/out, view register history.
  • Customers (4): view, create, edit, assign customer group.
  • Products and stock (5): view products, view stock levels, manage stock, assign source to product, toggle ship-together.
  • Reporting (4): edit dashboard, view reports, view daily summary, export reports.
  • Staff administration (3): view users, manage users, assign roles.
  • Settings and audit (2): access device settings, view audit log.
  • Hardware (4): open cash drawer, print receipts, print barcode labels, configure hardware.
  • Carts (2): hold cart, recall any cart.

Three roles ship as sensible defaults:

Role In one sentence
Cashier Sells and runs their own register shift; no discounts, refunds, voids, stock changes or settings
Manager Runs the floor: discounts, refunds, cash in/out, stock, customer management, reports
Admin Everything, including staff management, role assignment, settings and report export

Duplicate and adjust them, or build your own. Refunds for managers only, price overrides for nobody, the audit log visible to team leads: it is all in the role, and the register enforces it per action.

The Security Details

  • First login must be online; from then on the PIN verifies offline against a securely cached, salted slow hash (never the PIN itself), compared in constant time.
  • PIN changes invalidate the cache everywhere. Each staff record carries a change watermark that is stamped in the same operation that stores the new PIN - the two cannot drift apart. Registers receive the watermark with every staff sync; a mismatch drops the cached credential on the spot and forces one online login with the new PIN. Changing a PIN in Magento is therefore an effective lockout within minutes, on every device at once, including devices that are offline when the change happens - they re-check at their next sync.
  • Lockouts are graduated and per person: repeated wrong PINs lock that staff member out on a rising schedule - 15 seconds after 3 failures, 1 minute after 5, 5 minutes after 8, 30 minutes after 12 - without affecting colleagues. The failure counter resets after 24 hours. The lockout is enforced server-side and the app deliberately refuses to fall back to offline verification while locked, so offline mode cannot bypass it. An admin can unlock early from Magento.
  • Inactivity locks the register after a configurable timeout (5 minutes by default); unlocking takes the PIN again.

Changes Reach Devices Fast

PIN changes, role changes and deactivations sync to the registers through the heartbeat, within minutes. Deactivating a staff member in Magento is how you off-board: their PIN stops working everywhere at once. There is nothing to clean up on the devices themselves - the register is a window onto the staff list in Magento, not a second copy to maintain.

Offline

After the first online login, PIN verification works fully offline - a network dip never locks staff out mid-shift. What offline mode cannot do is bypass a server-side lockout or resurrect a rotated PIN: both are checked against Magento the moment the connection returns, and a changed PIN already stops working at the next staff sync.