Module 1
User Authentication
- User registration
- Email verification
- Login / logout
- Forgot password & reset password
- Change password
- User profile
- Account activation / deactivation
Phase 1
Trading Risk Management Platform
A simple web platform where traders sign up, get a subscription, and use risk and trading services — plus a management portal to run users, roles, services and subscriptions.
2Portals: User & Management
4Starting services
9Core modules
6Delivery phases
Overview
Users register, log in, get subscribed to a plan, and only see the services their plan and permissions allow. Everything is kept small and modular so new services can be added later without rebuilding.
Simple
Plain pages, clear menus, no unnecessary features in version 1.
Modular
Each service is a plug-in module switched on per subscription plan.
Secure
Hashed passwords, verified emails, permission checks on every page, audit log.
Easy to maintain
Built on the existing PHP + MySQL code in this repo, same patterns throughout.
💳 No online payments in v1
✋ Subscriptions & payment status managed manually
🧩 More services can be added later
Basic structure
Two entry points: the public side that leads users to their services, and the management side for staff.
User journey
Public Website
→
Registration / Login
→
User Portal
→
Services
→
Trading Risk Management
Management portal
Management Portal
→
Users
Roles & Permissions
Services
Subscriptions
Reports
Modules
The nine building blocks of version 1. Each one can be built, tested and switched on independently.
Module 2
User Permissions
- Create roles
- Assign permissions to roles
- Assign roles to users
- Basic actions: View, Create, Edit, Delete, Manage
- New permissions can be added later without code changes
Phase 2
Module 3
Subscriptions
- Create subscription plans
- Assign services to plans
- Assign a subscription to a user
- Set start and expiry dates
- Activate / deactivate, renew
- View status & subscription history
Manual — no payments
Module 4
User Portal
- Welcome dashboard
- Active services
- Subscription status
- Trading / risk information
- Available reports
- Notifications
- Profile settings
Users only see services they have permission for and an active subscription to.
Module 5 · Main service
Trading Risk Management
- 1. Scalping Analyzer
- 2. Hedging Detector
- 2.1 Single Account Hedging Detector
- 2.2 Cross-Account Hedging Detector
Expandable later
Module 6
Management Portal
- Manage users
- Manage roles & permissions
- Manage services
- Manage subscription plans
- Assign subscriptions; manage dates & status
- View basic reports
- Manage system settings
Each section permission-controlled
Module 7
Notifications
- Account registration
- Password reset
- Subscription activation
- Subscription expiration
- Important risk alerts
Shown in the portal and sent by email.
Module 8
Reports
- Trading performance
- Risk summary
- P&L
- Drawdown
- User subscriptions
View online, export to CSV (PDF later if needed).
Module 9
Audit Log
- User login
- Subscription changes
- Permission changes
- Important risk-setting changes
Who did what, when, from which IP — before & after values.
Who can see what
One simple rule decides access everywhere in the platform.
A user can open a service only when both are true
Role grants the permission
AND
Active, non-expired subscription whose plan includes the service
Permission keys
Permissions are named module.action — for example users.view, subscriptions.manage, risk.edit. Adding a new permission is just a new database row; no code changes to the permission system.
| Permission | Super Admin | Admin | Support | User |
|---|---|---|---|---|
users.view | ✓ | ✓ | ✓ | — |
users.manage | ✓ | ✓ | — | — |
roles.manage | ✓ | — | — | — |
services.manage | ✓ | ✓ | — | — |
subscriptions.manage | ✓ | ✓ | ✓ | — |
reports.view | ✓ | ✓ | ✓ | ✓ |
risk.view | ✓ | ✓ | — | ✓ |
risk.edit | ✓ | ✓ | — | ✓ |
settings.manage | ✓ | — | — | — |
Data model
New MySQL tables, added alongside the existing trade-server tables (accounts, positions, deals, orders). Colors match the modules above.
users
id, name, email, password_hash, status, email_verified_at, last_login_at
email_verifications
user_id, token_hash, expires_at
password_resets
user_id, token_hash, expires_at, used_at
roles
id, name, description
permissions
id, key (module.action), label
role_permissions
role_id, permission_id
user_roles
user_id, role_id
services
id, code, name, description, is_active
plans
id, name, duration_days, price_note, is_active
plan_services
plan_id, service_id
subscriptions
id, user_id, plan_id, starts_at, expires_at, status, payment_status, notes
subscription_history
subscription_id, action, old/new values, changed_by, created_at
trading_accounts
id, user_id, mt5_login, name, currency, is_active
risk_limits
account_id, max_daily_loss, max_drawdown_pct, max_exposure, max_lots
risk_alerts
account_id, type, level, message, value, created_at, acknowledged_at
notifications
user_id, type, title, body, read_at, emailed_at
audit_logs
user_id, action, entity, entity_id, before, after, ip, created_at
settings
key, value
Roadmap
Six phases. Each ends with something working that can be tested.
- 1
Accounts & audit log
- Registration, email verification, login/logout
- Forgot / reset / change password, profile
- Account activation / deactivation
- Audit log for logins
- 2
Roles, permissions & admin shell
- Roles, permissions, assignments
- Management portal layout with permission-controlled menu
- Manage users screen
- 3
Services & subscriptions
- Services and plans, services-per-plan
- Assign, activate, deactivate, renew subscriptions
- Subscription history; daily expiry job
- 4
User portal & risk management
- Dashboard with active services and status
- Scalping Analyzer
- Single Account & Cross-Account Hedging Detectors
- 5
Notifications & reports
- In-app + email notifications
- Performance, risk summary, P&L, drawdown, subscription reports
- CSV export
- 6
Settings & hardening
- System settings screen
- Security review, rate limits, backups
- Final testing on desktop and mobile
Security & what's next
Built-in safeguards for version 1, and ideas that fit in later without a rebuild.
Security checklist
- Passwords hashed with
password_hash - Single-use, expiring email and reset tokens
- CSRF tokens on every form
- Prepared statements for all queries
- Login rate limiting and lockout
- Secure, HTTP-only session cookies
- Permission check on every admin action
Future extensions
- Online payments and automatic renewal
- More services and advanced risk features
- Two-factor authentication
- API access for external tools
- PDF report export and scheduled reports
- SMS / Telegram risk alerts