# Todomator settings and database tables

> The settings that Todomator keeps, the permissions that guard them and what each table of the public schema is for.

Framework: todomator
Product: Todomator (todomator@1.7)
Language: en
Content-SHA256: ebcc4e81d3b881dd5bf445b6b159386aeadd1789cc2a6d4c388975a513a54435
Snapshot: c0700e321579725c5cf4f5ace1ad7d2866d1b4f93c24a63c0b41b6b7998e976c
Sources: 
Review: not-recorded

## The settings

Todomator keeps its configuration in the table `cl_config` and reloads it every 20 minutes. The settings screen (`Settings/read`, `Settings/save` in `schemas/settings.js`) edits these keys, and needs the permission `settings`:

| Key | Meaning |
|---|---|
| `name` | the name of the instance |
| `color` | the main colour |
| `token` | the token of the [API](/en/todomator/create-tickets-with-the-api/) |
| `minlogtime` | the shortest time entry, in minutes (1 by default) ([time tracking](/en/todomator/time-tracking/)) |
| `backup` | when on, each edit of the Markdown of a ticket also stores a copy of the text, with the user, the address and the browser (table `tbl_ticket_backup`) |
| `folderid` | a default folder |

## Permissions

A person is an administrator when the flag `sa` is set or when the permission list contains `admin`. `admin` manages folders and the screens of administration; `settings` allows the settings; `bot` belongs to the built-in user of the API token. The sessions live in the table `tbl_session`, and expired ones are deleted once a day.

## Two-factor authentication

Each user has the flag `is2fa`, which the person turns on when changing the password (`Users|password`). Sign-in then has two steps (`plugins/users/index.js`): email and password first; if the account has `is2fa`, Todomator emails a six-digit code (template `templates/mail-2fa.html`) that is valid for 10 minutes, and the person sends it back to finish. Wrong attempts are blocked after 10 tries in 10 minutes. The `mail` line of the `config` file must be set for the code to be delivered.

## The database

Everything lives in the `public` schema of PostgreSQL:

| Table | What it holds |
|---|---|
| `cl_config` | the configuration |
| `cl_status` | the six statuses of a ticket |
| `cl_notification` | the types of notification |
| `tbl_user` | the users: profile, password hash, permissions and `is2fa` |
| `tbl_folder` | the folders (customers and projects) |
| `tbl_tag` | the tags |
| `tbl_ticket` | the tickets |
| `tbl_ticket_comment` | the comments of the tickets |
| `tbl_ticket_time` | the time entries |
| `tbl_ticket_bookmark` | the bookmarks of each user |
| `tbl_ticket_unread` | the unread state per user and ticket |
| `tbl_ticket_data` | free data of a ticket (`data_read` / `data_save`) |
| `tbl_ticket_backup` | copies of the Markdown of a ticket (the `backup` setting) |
| `tbl_notification` | the notifications of the users |
| `tbl_file` | the files that were uploaded |
| `tbl_session` | the sessions |

Back this schema up like any other PostgreSQL database. For an update, apply the `database_*.sql` scripts of the repository that are newer than your version ([install Todomator](/en/todomator/install-todomator/)).