Cloud Accounts, Server and Team Access

This section covers the Cenex cloud side of TX1 — the optional online features (Cloud Backup, Team Databases, Online Projects, Remote Hub). It is separate from the local app users and roles in section 15.1: a person can have a local TX1 login and a Cenex cloud account, and the two are independent.

How it fits together

Cloud roles (do not confuse with the local roles in 15.1):

1. Create the server (operator, one-time)

Done once per cloud project, by a Cenex operator:

1. Create the cloud project (Supabase, Sydney region, Pro tier for production).
2. Apply the database schema — run migrations 0001, 0002, 0003, 0005, 0006 in order.
3. Deploy the control plane (tx1-control-plane) with JWT verification off.
4. Set the server secrets — the Supabase URL + publishable key, the backup master secret, and the operator token that gates user provisioning.
5. Turn off public sign-ups — Cenex provisions accounts; people do not self-register.

Full step-by-step with commands: see the operator guide in the software package (docs/CLOUD-ONBOARDING-GUIDE.md).

2. Add a user (create a cloud account)

There are two ways. Both create a normal cloud account the person then signs into TX1 with.

A. Operator provisioning (recommended for several users). The operator runs a single secure command (it requires the server's operator token, which is never shared with end users) that creates a confirmed account for an email address. The person is given their email and a temporary password out-of-band.

B. Dashboard (one-off). In the cloud dashboard → Authentication → Users → Add user, enter the email and password and tick Auto-confirm.

After creating the account, ask the user to sign in and set up two-factor (below).

3. Create an organisation and grant access

Once the first owner/admin account exists:

1. Create the org. The owner signs in and creates the organisation (they become its Owner). In the desktop this is the Create organisation action.
2. Invite teammates. An admin creates an invite for each teammate's email at a chosen role (Member / Admin / Owner). TX1 produces an invite code and a shareable join link (valid 14 days). Send it to the person out-of-band.
3. The teammate joins. Signed into TX1, they open Team Databases (or Remote Hub) → Join with code, paste the code, and they become a member at the invited role.

Admins can list pending invites and revoke any of them at any time.

4. Connect the desktop (what each user does)

1. Settings → Cenex Cloud — enable the cloud features you use and enter the control-plane URL supplied by Cenex. (Cloud Backup needs a Pro licence; Team Databases / Online Projects need Enterprise.)
2. Open a project → Team Databases (or Remote Hub) → Sign In with the cloud account email and password. If two-factor is enabled, enter the code.
3. Choose the organisation, then map and open team databases or online projects.

5. Two-factor, sign-out and "sign out everywhere"

• Two-Factor (2FA): in the Team Databases window, click Two-Factor, scan or type the secret into an authenticator app, and confirm a code. From then on, sign-in asks for the 6-digit code.
• Sign Out clears the cloud session on this computer only.
• Sign Out All revokes the account's sessions on every device — use this after a lost laptop or a suspected compromise; everyone signed in with that account must sign in again.

6. Single sign-on (SSO) — coming soon

Enterprise SSO through your own identity provider (Microsoft Entra ID, Okta, …) is built into the server. Enabling it for a customer requires Cenex to register your identity provider; once configured, users sign in through your company login instead of a Cenex password.

Troubleshooting

_See also: 15.1 Users, Roles and Permissions (local app accounts); 00.3 Logging In and User Profile. Operator/technical detail lives in the software package at docs/CLOUD-ONBOARDING-GUIDE.md._