Security Features
#################

sERP v1.11 introduces enhanced security features including multi-factor authentication for administrator accounts and automated database backups.


.. _security_mfa:

Multi-Factor Authentication (MFA)
**********************************

Administrator accounts (access level 1) are required to complete two-factor authentication (2FA) at every login. After entering the correct username and password, a 6-digit One-Time Password (OTP) is sent to the administrator's registered mobile number via SMS.

MFA Login Process
=================

1. Enter your username and password on the login page and click **Login**
2. sERP verifies your credentials. If your account has administrator access (level 100), you are redirected to the OTP verification page
3. Check your registered mobile number for the SMS containing your 6-digit OTP
4. Enter the OTP on the verification screen
5. Click **Verify OTP** to complete login

.. note::

	OTPs expire after **5 minutes**. If the OTP expires before you enter it, return to the login page and log in again to receive a fresh OTP.

Configuring a Mobile Number for MFA
=====================================

Administrator accounts must have a mobile number registered in order to receive OTP codes. This is managed from the **Change Password** page.

1. Log in as the administrator
2. From the welcome menu, click **Change Password**
3. In the **MFA Phone Number** pane, enter or update the mobile number
4. Click **Save Phone**

.. warning::

	If no mobile number is configured for an administrator account, the OTP is displayed on-screen as a temporary fallback. This is intended for development and initial setup only. Always ensure a valid mobile number is configured before going live.

.. note::

	MFA is applied to administrator accounts only. Standard staff, teacher, student, and parent accounts log in with username and password only.


.. _security_backups:

Automated Database Backups
**************************

sERP can perform scheduled automated database backups to protect against data loss.

How Backups Work
================

Backups are generated by the script at ``cron/backup.php``. When executed, it:

1. Runs a MySQL dump of the full sERP database
2. Compresses the output as a ``.sql.gz`` file
3. Saves the file to ``temp/backups/`` with a date-stamped filename (e.g. ``serp_backup_2026-02-27.sql.gz``)
4. Automatically deletes backup files older than 30 days

Scheduling Automated Backups
==============================

To run backups automatically, add the following line to your server's cron configuration (``crontab -e``)::

	0 2 * * * php /path/to/serp/cron/backup.php

This runs the backup daily at 2:00 AM. Adjust the schedule as appropriate for your environment.

.. note::

	Replace ``/path/to/serp/`` with the actual filesystem path to your sERP installation (e.g. ``/var/www/html/serp/``).

Manual Backups
==============

A manual backup can be triggered at any time from the admin panel:

1. Navigate to **Tools > Backup Database**
2. Click **Download Backup** — a database dump is generated and downloaded to your browser

.. tip::

	For production deployments, consider storing automated backups in an off-site location (e.g. cloud storage bucket or a remote server) in addition to the local ``temp/backups/`` directory.