# Users and roles

## Roles

| Role | Can do |
|---|---|
| `member` | Ask, answer, comment, vote, follow, report, edit own profile |
| `moderator` | Everything a member can, plus resolve reports, publish/hide/delete content, lock and pin topics |
| `admin` | Everything, plus settings, appearance, languages, plugins, users and system pages |

Authorisation is checked on the server for every action. Hiding a button is presentation, never a control.

## Account status

| Status | Meaning |
|---|---|
| `active` | Normal account |
| `suspended` | Temporarily blocked from signing in and posting |
| `banned` | Permanently blocked |

## Account type

Account type separates real members from house content identities.

| Type | Meaning |
|---|---|
| `member` | A real person who registered |
| `editorial` | A house identity created by an administrator for seed content |
| `system` | An internal identity used by the application itself |

Rules the application enforces:

- **Editorial and system accounts cannot sign in**, even when a valid password hash exists. The check happens during authentication, not in the UI.
- They are **excluded from member-growth counts**, so seeding content never inflates registration statistics.
- Their profiles default to `noindex`.
- No code path fabricates views, votes, likes or followers for them.

`created_by_admin_id` records which administrator created a persona.

## Trust level

`trust_level` is a small integer that grows with an account's history. It feeds the spam risk assessment: a new, unverified, zero-trust account posting content full of external links scores differently from an established contributor posting the same text.

Trust is one signal among several. It is never the only reason a post is rejected. See [Anti-spam](../03-configuration/ANTI-SPAM.md).

## Public profiles

A public profile shows the display name, username, avatar, bio, and public activity.

A profile is indexable only if it has at least one published question, answer or topic, or a meaningful non-empty bio. Empty freshly registered profiles are `noindex` and absent from the sitemap — they are thin pages that dilute the site's index without helping anyone.

## Registration and verification

Registration hashes the password with PHP's password API. Email verification uses one-time hashed tokens with an expiry. A consumed reset token cannot be reused and does not leak whether an address exists.

Rate limiting protects sign-in, registration and recovery. Identifiers are hashed before storage.

## Admin actions on users

Change role, change status, change account type, create an editorial persona. Every change is written to the audit log.

An administrator cannot lock themselves out by removing their own last administrative role.
