Session Management

Introduction

After login, Damsy ERP stores nearly all request context in ASP.NET session state. Session keys carry company scope, user identity, role, module access flags, payroll defaults, mail settings, and e-invoice API configuration. Most controller actions begin by reading Session["CompID"]; many also read Session["dtVerifyUser"] for module booleans.

Purpose

This page is the authoritative reference for which session keys exist, what they mean, when they are set, and how they relate to authorization — without relying on a non-existent ModuleAccess key.

When to Use

Consult this page when you:

• Add a new controller action that needs company or user context
• Debug "redirect to login" loops
• Wire e-invoice or SMTP features that read session
• Determine whether a user should see a module tile or menu

How It Works

Session lifecycle overview

Keys set at login

Key	Type	Description
CompID	int (as string)	Primary gate. Selected company ID. Required on almost every action.
CompName	string	Display name of selected company
UserID	int	UserAccountsID from database
UserName	string	Display name
Role	string	Role name (e.g. Administrator)
RoleId	int	Role ID — session key is RoleId, not RoleID
BranchCode	int	User's assigned branch
dtVerifyUser	BO.User	Full user object including module boolean flags
StartMonth	int	Default payroll month for company
StartYear	int	Default payroll year for company
Version	double/string	Application software version

Module flags on dtVerifyUser

Module access is stored as boolean properties on the BO.User object in Session["dtVerifyUser"]. There is no Session["ModuleAccess"] key.

User property	Dashboard ViewData key	Module
Payroll	Payroll	Payroll
Webenroll	Webenroll	Registration
Billing	Billing	Bills
ZSTOCK	StockModuleAccess	Stock
ZSales	ZSales	Sales
Ess	Ess	ESS
ControlPanel	ControlPanel	Adminisration
AttPunch	AttPunch	AttendancePunching
Operation	Operation	Operation
ManagementDashboard	ManagementDashboard	ManagmentDashBoard
ContractedRates	ContractedRates	ContractedRates
VerificationAndApproval	VerificationAndApproval	VerificationAndApproval

The dashboard copies these booleans to ViewData for tile visibility. Area controllers typically re-read dtVerifyUser or rely on menu permission SPs for fine-grained access.

E-invoice and ZAPI keys

Set from GetLoginUser result columns:

Session key	User property	Purpose
CDKEY	CDKEY	E-invoice license / CD key
EFUSERNAME	EFUSERNAME	E-invoice username
EFPASSWORD	EFPASSWORD	E-invoice password
ZAPIPATH	ZAPIPATH	ZAPI server base path (ServerLocation in DB)
GenerateIRNUri	GenerateIRNUri	IRN generation endpoint
CancelIrnUri	CancelIrnUri	IRN cancellation endpoint
PrintIRNUri	PrintIRNUri	IRN print endpoint
PrintEWayBillDetailed	PrintEWayBillDetailed	Detailed E-Way bill print URL
PrintEWayBillSummary	PrintEWayBillSummary	Summary E-Way bill print URL
EWayBillDeliveryChallan	EWayBillDeliveryChallan	Delivery challan E-Way URL

Bills module IRN integration reads these session values when calling external GST APIs.

SMTP keys

Loaded via Login_DAL.MailConfigure → [dbo].[GetEmailConfigration]:

Key	Description
SMTP_HOST	Mail server hostname
SMTP_PORT	Port (typically 587 or 25)
SMTP_USER	SMTP username
SMTP_PSWD	SMTP password

Used when the application sends mail on behalf of the logged-in company context.

Keys set later (situational)

Key	When set	Purpose
Module	Opening shared screens (e.g. EmployeeM)	Identifies which module owns the shared form
Entryflag	Admin re-authentication	Sensitive admin action confirmation via AdminLoginCheckMenu

Logout behavior

LoginController.LogOut:

1. FormsAuthentication.SignOut()
2. Session.Clear()
3. Session.Abandon()
4. Expire ASP.NET_SessionId cookie
5. Redirect to Login/Index

Developer Notes

Standard gate pattern

if (string.IsNullOrEmpty(Convert.ToString(Session["CompID"])))
    return RedirectToAction("UserLogin", "Login", new { Area = "" });

Reading module access

var user = Session["dtVerifyUser"] as User;
if (user == null || !user.Billing)
    return Redirect("~/Dashboard/Index");

Passing context to DAL

var bo = new Some_BO();
bo.CompID = Convert.ToInt32(Session["CompID"]);
bo.UserID = Convert.ToInt32(Session["UserID"]);
bo.BranchCode = Convert.ToInt32(Session["BranchCode"]);

Fine-grained permissions

Menu-level CRUD permissions use GetDataUserPermissions with UserAccountsID, ModuleID, and MenuID — separate from module bool flags. On a minimal blank database seed, menus may be empty even when module flags are true.

Why no ModuleAccess key

Historical designs sometimes used a single comma-separated module list. Damsy ERP uses dtVerifyUser booleans plus per-menu SP permissions instead. Do not introduce Session["ModuleAccess"] without a coordinated migration.

Examples

Dashboard ViewData mapping (DashboardController)

ViewData["Payroll"] = dtVerifyUser.Payroll;
ViewData["Webenroll"] = dtVerifyUser.Webenroll;
ViewData["Billing"] = dtVerifyUser.Billing;
ViewData["StockModuleAccess"] = dtVerifyUser.ZSTOCK;
// ... remaining flags

Bills IRN call using session

var generateUri = Convert.ToString(Session["GenerateIRNUri"]);
var cdKey = Convert.ToString(Session["CDKEY"]);
// HTTP client call to GST provider

Related Pages

• Authentication Flow
• Session Lifecycle
• Dashboard
• Module Routing

Important Notes

RoleId casing

Use Session["RoleId"] exactly. RoleID will return null and break permission or audit logic.

Session size

dtVerifyUser stores the full user object. Avoid adding large binary data to session (employee images are not stored in session by default).

CompID is a string in session

Always use Convert.ToString(Session["CompID"]) for empty checks; use Convert.ToInt32 when passing to DAL/SP.

Common Mistakes

Mistake	Result
Checking ModuleAccess session key	Always null — key does not exist
Using RoleID instead of RoleId	Wrong or zero role in updates
Omitting Session.Clear() on login	Stale keys from previous user on shared PC
Assuming module flag = menu permission	User sees tile but gets empty sidebar
Hardcoding company ID	Multi-company deployment breaks

Next Steps

1. Read Session Lifecycle for login-to-logout flow diagram.
2. Read Module Routing for how flags connect to Area URLs.