Source-audited application manualበምንጭ የተመረመረ የapplication መመሪያ

Account, Verification & SecurityAccount፣ የኢሜይል ማረጋገጫ እና ደህንነት

The complete account lifecycle: registration, Pending/Active states, profile, password recovery, server sessions, and privileged TOTP MFA.

የaccount ምዝገባ፣ Pending/Active ሁኔታ፣ profile፣ የpassword መልሶ ማግኛ፣ የserver session አስተዳደር እና privileged TOTP MFA የሚያብራራ ሙሉ መመሪያ።

1verified identityየተረጋገጠ ማንነት

24hemail linkየemail link

8–128password charsየpassword ርዝመት

10MFA recovery codesየMFA recovery codes

Account & SecurityAccount & Security

What this part of the platform doesAccount መፍጠር እና ኮርስ መመዝገብ አንድ ነገር አይደሉም

A verified GTM student account is the identity layer for structured course participation and private learner records. GOLD Grammar, NT Greek 310, Interlinear, Vocabulary and Concordance reference/study access are public; sign-in is used only where personal progress, saved state, course work, transcripts or certificates must be associated with a learner.

Registration is not enrollment. Creating and verifying an account makes the account usable; enrollment is a separate action inside Courses.

MFA is role-sensitive. Ordinary student accounts are not forced through TOTP in the audited login flow. Administrator and scholarly-editor roles are treated as privileged and, when privileged MFA enforcement is enabled, must complete TOTP setup/challenge before a full privileged session is created.

የGTM account ከGrammar፣ NT Greek 310፣ assignments፣ transcripts፣ certificates፣ Lexical ፍለጋዎች እና Interlinear የጥናት ሁኔታ ጋር ይገናኛል። User identity በaccount መረጃ ውስጥ ይቀመጣል፣ የCourses እና ሌሎች መዝገቦች ደግሞ ከዚህ መለያ ጋር ይገናኛሉ።

MFA በrole ይለያያል። መደበኛ student account በaudited login flow ውስጥ TOTP አይጠየቅም። Administrator እና scholarly-editor ግን privileged roles ስለሆኑ MFA enforcement ሲነቃ TOTP ያስፈልጋቸዋል።መደበኛ student account በaudited login flow ውስጥ TOTP አያስፈልገውም። Administrator እና scholarly-editor ያሉ privileged roles ግን MFA enforcement እና TOTP ይፈልጋሉ።

Creating an account: every visible field and ruleAccount መፍጠር፦ ዋና መረጃዎች እና ህጎች

Control	What it means
Given name / Family name	Stored in the account profile and used to form the initial display name.
Email	Normalized and used as the sign-in address. The permanent internal student ID is not the email.
Preferred language	English or አማርኛ.
Password	8–128 characters in the audited policy. There is deliberately no forced symbol/number pattern. Common/expected passwords are rejected through a blocklist.
Terms / Privacy checkboxes	Both must be accepted/acknowledged before account creation.

If public registration is disabled by deployment configuration, the registration page is replaced by a “registration closed” response.

For a new address, the server creates a Pending account, profile, student role, consent records, and an email-verification token. If the address already belongs to a Pending account, registration can issue another verification token rather than creating a second user row. The response remains deliberately neutral to reduce account-enumeration leakage.

Given name እና Family name በprofile ውስጥ ይመዘገባሉ፤ display name ደግሞ ለተጠቃሚው ማሳያ ይጠቅማል። Email የaccount ዋና መለያ ነው፣ student ID ግን emailን አይተካም። የEnglish ወይም Amharic ስም መጠቀም ይቻላል። Password 8–128 characters መሆን አለበት፣ በblocklist ያሉ ወይም በተደጋጋሚ የሚጠቀሙ passwords አይፈቀዱም። Terms / Privacy መቀበል እና Pending account verification ማጠናቀቅ የaccount መክፈቻ ሂደቱ አካል ናቸው።

Pending → verified → ActivePending → Verified → Active የaccount ሁኔታ

Open the verification message sent to the registration email.
Click its verification link once. GTM automatically completes email verification.
The link opens GTM, completes verification automatically, and shows the verification result.
No second “Verify email” button or scrolling is required.
The account status changes to Active and the result page offers Sign in.

Audited current verification lifetime: 24 hours. If the link is invalid, expired, or already consumed, use Request a new verification email.

The resend endpoint uses a neutral privacy-preserving response and suppresses another verification send when a verification token was created within the preceding five minutes.

Email verification ለaccount ማረጋገጫ ይጠቅማል። Pending ከሆነ verification email ይላካል፣ linkውን ከተጫኑ በኋላ accountው Verified እና Active ይሆናል። Verification link ጊዜው ካለፈ ወይም ከተጠቀመ አዲስ link መጠየቅ ይቻላል።

Resend ጥያቄ ለprivacy ገለልተኛ መልስ ይሰጣል፣ ባለፉት 5 ደቂቃዎች token ከተፈጠረ ደግሞ አዲስ email ማላክን ይገድባል።Resend የሚለው privacy ገደብ ሳይጥስ ሌላ verification email ለመላክ ያገለግላል።

የEmail verification ሂደት፦ በverification email ውስጥ ያለውን link አንድ ጊዜ ይጫኑ። GTM verificationን በራሱ ያጠናቅቃል፣ accountውም Verified እና Active ይሆናል። ተጨማሪ “Verify email” ቁልፍ መጫን ወይም ወደ ታች መሸብለል አያስፈልግም። Verification link ጊዜው ካለፈ ወይም ቀድሞ ከተጠቀመ አዲስ link ይጠይቁ።

Signing in, Pending accounts, failed attempts and sessionsወደ account መግባት እና የserver session አስተዳደር

A correct password is not enough for a Pending account: normal authentication requires status=Active and a verified email timestamp. When a Pending user enters the correct password, the audited UI now explains that the account exists but the email has not been verified and exposes Resend verification email.

Incorrect sign-ins increment a server-side failure counter and can produce a temporary lock. The deployment defaults begin lockouts after repeated failures and use increasing back-off; runtime values can be environment-configured.

A successful ordinary login creates a random server-side session record. The browser carries a session token; the server tracks expiry, last-seen time, user agent, revocation, and—where applicable—MFA verification. The audited default session lifetime is 12 hours, but deployment configuration can override it.

የaccount ሁኔታና የsession መረጃ በserver ላይ ይቀመጣሉ። Temporary lock ከተፈጠረ በተወሰነ ጊዜ በኋላ ይነሳል። Session በserver-side መዝገብ ይቆጣጠራል፣ user agent እና revocation መረጃም ሊመዘገብ ይችላል። MFA state እና session ዕድሜ በdeployment configuration መሠረት ይተዳደራሉ።

Profile and permanent student identifierProfile እና ቋሚ የተማሪ መለያ

Email: Displayed as the account email; it is not the academic database key.
Given name / Family name / Display name: Editable profile identity fields.
Language: English or Amharic preference.
Timezone: Must be a valid IANA timezone.
Country code: Stored as profile metadata.
Student identifier: A permanent UUID linking enrollments, progress, assessed work, transcripts and certificates without using the email as the database key.

Email ለaccount እና ለመግቢያ የሚጠቅም መለያ ነው። የacademic database ቁልፍ ግን permanent UUID ነው። Given name፣ Family name እና Display name በprofile ውስጥ የሚስተካከሉ የidentity መረጃዎች ናቸው። የቋንቋ ምርጫ English/Amharic ሊሆን ይችላል። Timezone ትክክለኛ IANA timezone መሆን አለበት። ቋሚው student identifier ከemail የተለየ UUID ሲሆን የኮርስ ምዝገባ፣ እድገት፣ የተገመገመ ስራ፣ transcript እና certificate ከዚህ ጋር ይገናኛሉ።

Forgot password, reset password, and change passwordPassword መርሳት / ዳግም ማዘጋጀት / መቀየር

Forgot password

The request page always uses a neutral response. A reset email is sent only for an Active, verified account, and another reset token is suppressed for five minutes after a recent one. The audited default reset-link lifetime is 30 minutes, subject to deployment configuration.

Reset password

The reset page requires a valid one-time token and a new password that passes the same 8–128-character/blocklist policy. A successful reset clears login-failure lock state and revokes all server sessions, requiring a fresh sign-in.

Change password while signed in

Security → Change password requires the current password plus the new password twice. On success, the current session remains but all other active sessions are revoked.

Password ከተረሳ የreset ጥያቄ ይላካል። ካልተገኘ account እንኳን ስርዓቱ neutral response ይሰጣል፣ ይህም account enumerationን ለመከላከል ነው። Active/verified account ካለ reset email ይላካል። Reset token ጊዜው የተገደበ ሲሆን reset-link lifetime 30 ደቂቃ ነው። ተደጋጋሚ login failure ካለ temporary lock ሊፈጠር ይችላል። Password ከተቀየረ በኋላ የቀድሞ active sessions ሊዘጉ ይችላሉ።

Account creation is not course enrollment Account መፍጠር ከኮርስ መመዝገብ የተለየ ነው

A GTM user account may exist even when the learner has not enrolled in a course. These are separate records and should be diagnosed separately.

Account created: the person has an identity record in the platform.
Email verified: the account has completed the required verification step.
Course enrolled: a separate enrollment record connects that account to a course.

If a learner reports that account creation failed, first check whether an account record already exists before asking the learner to register again. Repeated registration attempts can produce confusion when the original account was created but verification or enrollment was not completed.

If the same person appears more than once in an administrative user list, verify email address, account status, verification state and enrollment records before deleting or merging anything. Similar display names alone do not prove that two records are duplicates.

Diagnostic rule:የDiagnostic ደንብ፦ “User exists” does not mean “user is enrolled,” and “not enrolled” does not mean “account creation failed.”“User exists” ማለት “user is enrolled” ማለት አይደለም፣ “not enrolled”ም “account creation failed” ማለት አይደለም።

Security page and recent sessionsየSecurity ገጽ እና የቅርብ ጊዜ sessions

The Security page combines password management, a link to MFA security, and up to 20 recent server-session rows. Each session row can expose client/user-agent, last-seen time, expiry, and revoked state.

Current UI boundary: the audited Security page displays session history but does not expose a per-session “revoke this session” button. Password change revokes other sessions programmatically.

Security ገጹ password መቀየር፣ MFA security እና active server sessions ለመቆጣጠር ይጠቅማል። እያንዳንዱ session user agent፣ last-seen፣ expiry እና revoked state መረጃ ሊኖረው ይችላል። ከUI ውስጥ session revoke ማድረግ ይቻላል። Password በserver ላይ raw text አይቀመጥም፤ password hash ብቻ ይቀመጣል።

Privileged MFA: enrollment, sign-in, recovery and reauthenticationPrivileged MFA፦ ምዝገባ፣ መግቢያ፣ recovery እና ዳግም ማረጋገጫ

This section is mainly for administrators and scholarly editors. The application treats those roles as privileged.

First privileged sign-inየመጀመሪያ privileged sign-in

After the correct password, if no active TOTP exists, GTM starts MFA enrollment instead of creating a full privileged session.
Scan the QR code with a standard TOTP authenticator or manually enter the displayed secret.
Enter the current 6-digit authenticator code and click Verify and finish setup.
GTM activates TOTP and generates 10 recovery codes.
Save the recovery codes immediately; plaintext is shown only on that response.

The underlying TOTP implementation uses 6 digits, a 30-second period, SHA-1, an adjacent time-window tolerance, and replay protection so an already accepted counter is not accepted again.

Later privileged sign-ins

After password verification, enter a current 6-digit TOTP. If the authenticator is unavailable, a saved recovery code can be used once. A recovery-code session restores sign-in/read access, but cannot authorize sensitive administrator writes.

Fresh privileged reauthentication

Sensitive administrator writes require the current password plus a fresh TOTP. The audited default privileged reauthentication window is 15 minutes; recovery codes cannot create that write-authorizing window.

Regenerating recovery codes

MFA Status shows TOTP state, remaining recovery-code count, current-session MFA state and fresh-reauth state. Regeneration requires current password + fresh TOTP and invalidates every unused older recovery code.

Privileged MFA ለadministrator ወይም scholarly editor ያሉ ከፍተኛ መብት ያላቸው users ይጠቅማል። TOTP authenticator በመጀመሪያ ምዝገባ እና በኋለኞቹ መግቢያዎች ይጠቀማል። Recovery codes የauthenticator መዳረሻ ሲጠፋ አንድ ጊዜ ብቻ የሚጠቀሙ ናቸው። Sensitive writes የአሁኑ password እና fresh TOTP በመጠቀም privileged reauthentication ማለፍ አለባቸው።

First privileged sign-inየመጀመሪያ privileged sign-in

Correct password ከገባ በኋላ active TOTP ካልነበረ MFA enrollment ይጀምራል።ትክክለኛ password ካስገቡ በኋላ active TOTP ከሌለ MFA enrollment ይጀምራል።
QR code በTOTP authenticator ይscan ወይም secret በmanual ያስገቡ።QR codeን በTOTP authenticator ይscan ወይም secretን በmanual ያስገቡ።
Current 6-digit code ያስገቡ እናየአሁኑን 6-digit code ያስገቡ እና Verify and finish setupsetupን ያረጋግጡ እና ያጠናቅቁ ይጫኑ።
GTM TOTP ያነቃል እና 10 recovery codes10 recovery codes ይፈጥራል።
Codes ወዲያው ያስቀምጡ፤ plaintext በዚያ response ብቻ ይታያል።Codes በresponse ውስጥ plaintext አይመለሱም።

TOTP 6 digits፣ 30-second period፣ SHA-1 እና replay protection ይጠቀማል።TOTP 6 digits ነው፣ 30-second period፣ SHA-1 እና replay protection ይጠቀማል።

Later sign-insበኋለኞቹ sign-ins

Password ከተረጋገጠ በኋላ current TOTP ያስገቡ። Authenticator ካልተገኘ one-time recovery code መጠቀም ይቻላል፤ ግን recovery-code sessionPassword ካስገቡ በኋላ current TOTP ያስገቡ። Authenticator ከጠፋ አንድ ጊዜ የሚጠቅም recovery code ይጠቀሙ፤ recovery-code session የ sensitive administrator writesensitive administrator write አይፈቅድም።

Fresh reauthenticationFresh reauthentication

Sensitive admin write current password +Sensitive admin write ለማድረግ current password + fresh TOTPfresh TOTP ይጠይቃል። Audited default reauth window 15 ደቂቃ ነው።ይፈልጋል። Audited default reauth window 15 ደቂቃ ነው።

Regenerate recovery codesRecovery codesን እንደገና ፍጠር

MFA Status TOTP state፣ remaining codes፣ session MFA እና reauth state ያሳያል። Regenerate ሲደረግ older unused codes ሁሉ invalid ይሆናሉ።MFA Status የTOTP state፣ remaining codes፣ session MFA እና reauth state ያሳያል። Regenerate ሲደረግ older unused codes ወዲያውኑ invalid ይሆናሉ።

What is stored, privacy boundaries, Terms and Privacy pagesየግላዊነት ወሰኖች፣ Terms እና Privacy ገጾች

Data	Where / purpose
Identity/profile	Server account tables.
Consent versions	Server records of Terms and Privacy acknowledgement.
Session/security metadata	Server sessions and audit data; the working privacy text says identity-foundation IP handling uses privacy-preserving hashes rather than raw-IP storage.
Academic record	Enrollment, progress, assessment, assignment, transcript and certificate records.
Passwords	Raw passwords are not stored; password hashes are stored.

Audit issue to resolve before a final public manual: the current Terms and Privacy templates explicitly call themselves “Phase 1C working” documents and state that legal/privacy review is still required before public production registration. If public registration is already live, these documents need product/legal finalization; the final manual should link only to finalized policy text.

የidentity/profile መረጃ በserver የaccount ሰንጠረዦች ውስጥ ይቀመጣል። የTerms/Privacy መቀበል የተለያዩ version records በመጠቀም ይመዘገባል። የsession/security metadata እና audit data በserver ላይ ይቀመጣሉ። ለግላዊነት ጥበቃ raw IP ከማከማቸት ይልቅ privacy-preserving IP hashes መጠቀም ይመረጣል። የacademic records የኮርስ ምዝገባ፣ እድገት፣ ፈተና፣ assignment፣ transcript እና certificate መረጃዎችን ያካትታሉ። Raw passwords አይቀመጡም፤ የpassword hashes ብቻ ይቀመጣሉ። የTerms/Privacy ጽሑፎች የመጨረሻ legal/privacy review ሳይጠናቀቅ እንደ final policy መቆጠር የለባቸውም።

Troubleshooting and expected failure statesችግር መፍቻ እና የሚጠበቁ failure states

What you see	What it means / what to do
Pending account	Email verification is incomplete. Resend verification; do not create another account.
Verification link unavailable	Invalid, expired, or already consumed. Request a new link.
Correct password but cannot sign in	If Pending, verify email. If repeated failures occurred, a temporary lock may be active.
Reset email not arriving	Only Active verified accounts are eligible; the response remains neutral. Check Spam/Junk and wait before resending.
Authenticator code rejected	Use the current 6-digit code; repeated invalid codes can temporarily lock MFA. A previously accepted TOTP counter is not reusable.
Recovery code rejected	Each recovery code is single-use; regenerate only after normal privileged authentication is restored.
Forbidden on administrator write	A privileged session may still need fresh password + TOTP reauthentication.

የemail ማረጋገጫ ሁኔታ Pending ከሆነ Resend ይጠቀሙ፤ አዲስ account አይፍጠሩ። Verification link ጊዜው ካለፈ፣ ትክክል ካልሆነ ወይም ቀድሞ ከተጠቀመ አዲስ link ይጠይቁ። Password ትክክል ሆኖ መግባት ካልቻሉ account Pending መሆኑን ወይም temporary lock መኖሩን ይፈትሹ። Reset email ለActive/verified account ብቻ ይላካል፤ Spam/Junk ይፈትሹ። TOTP ካልተቀበለ የአሁኑን 6-digit code ይጠቀሙ። ተደጋጋሚ ስህተት temporary lock ሊያመጣ ይችላል። Recovery code አንድ ጊዜ ብቻ ይጠቀማል። Admin write Forbidden ከሆነ fresh password + TOTP reauthentication መሟላቱን ያረጋግጡ።

Final-manual acceptance checklistየመጨረሻ የManual ማረጋገጫ ዝርዝር

□ Capture current desktop and iPhone screenshots for Register, Pending, verification-success, Login, Profile, Security and privileged MFA screens.
□ Reconfirm deployed TTL overrides before publishing exact expiration durations beyond the already verified 24-hour email link.
□ Finalize Terms/Privacy legal text.
□ Verify session-history presentation on production devices.
□ Test the complete privileged recovery-code and fresh-reauth sequence after the repaired recovery-code implementation.

□ Register፣ Pending፣ verification-success፣ Login፣ Profile፣ Security እና MFA flow በscreenshots ያረጋግጡ። □ Session ጊዜና server መዝገቦች ከdeployed settings ጋር እንደሚጣጣሙ ይፈትሹ። □ Terms / Privacy ጽሑፎች የproduction version መሆናቸውን ያረጋግጡ። □ Session history በproduction device ላይ ይፈትሹ። □ Recovery code እና fresh reauthentication flow በትክክል መስራታቸውን ያረጋግጡ።