Officials' console

The officials' console is a web application for an institution's desktop computers. It has two parts: a read-only ledger explorer and verifier, and an admin desk for registrars, court staff, SHOs, supervisors and auditors. It never signs anything on the ledger. Acts that need a signature, such as enrolling a phone or revoking a key, stay on the official's phone.

The console works in English and Hindi, and each institution runs it against its own backend and peer.

Who uses it

Official	Uses
Auditor	The whole ledger explorer, integrity checks, the audit log
Registrar	The explorer for their jurisdiction, integrity checks, the admin desk for their institution
Magistrate, High Court registry	The explorer for the cases they may see
Court staff (CPC)	The help desk and their courts' profiles
SHO	Their station's profile and duty rosters
Supervising officer	The CCTNS reconciliation pages for their stations

Sign in by linking your phone

The console holds no password. You sign in by approving it on your official phone.

1. On the desktop, open the console and choose Show the code to scan. The page shows a QR code, a two-digit number, and what your phone will show about this desktop: its address, the institution network, the browser and the system.
2. On your phone, open your DigiFIR app and scan the code.
3. Check that the phone shows this desktop, then choose the number the desktop shows from the three your phone offers.
4. Approve. The phone signs the approval with its key, and the console opens.

WARNING

Approve only a code you made yourself on the desktop in front of you. If someone else shows you a code to scan, do not approve it: it would give their browser a session in your name.

The code is valid for at most 120 seconds. A wrong number draws a new one; the third wrong choice refuses the link.

Session limits

Limit	Value
Access token	15 minutes, renewed by the console's own key, which the browser cannot export
Idle	The console warns a minute before its idle lock, and the backend ends a session unused for 30 minutes
Total	8 hours after approval; announced ten minutes before

Your phone lists the console's session, and you can end it there. The session also ends when your key is revoked or your roster status changes. A console can only be linked from the institution's own networks.

The ledger explorer

Page	What it shows
Ledger status	What needs attention (open alerts, peers not answering, read views behind), then the last verified block, the projector's state and every peer with its height
Blocks	Blocks newest first, with transaction counts and data hash. The browser recomputes each header hash and its link to the block before.
Block	The header, the backend's ledger and orderer signature checks, the browser's checks, and each transaction with its validation code
Transaction	The block and position, who submitted it, the signed action with its signer and signature check, the exact text that was signed, the endorsing organisations, public writes, private writes as hashes only, and the chaincode event
Record history	Every version of a record, newest first, with transaction, block, time, action, signer, role and value
Integrity checks	Past checks with their outcome and findings; start a new check of one record, a block range or the whole ledger, optionally compared with another institution's peer
Ledger alerts	Alerts by kind, severity, block, transaction and institution
Verify a document	Drop a PDF or paste a fingerprint. The SHA-256 is computed in the browser; the file never leaves the computer.

What you see follows your role and jurisdiction. An auditor reads the whole ledger. Other officials see the cases and exhibits they may see, and every registry record. A transaction outside your jurisdiction appears as "Outside your jurisdiction" with only what proves the chain.

The admin desk

Page	Who	What it does
Officials, official's record, change or add a record, import from HR	Registrars	The roster, changes that wait for a second registrar, HR imports with a dry run first
Institutions, service keys	Registrars	Each member with its registrars, gateway and service keys, and reachable peers; the HSM's service keys
System transactions	Registrars	Status and digests of a system transaction for the MSP administrator's signing tool
Jobs	Registrars (running a job needs an operator)	Schedules, state, backlog, last and next run
Audit log	Auditors	The backend's audit log, newest first
Help desk	Registrars, court staff	Officials' requests, closed with a note the official sees
Law section texts	Registrars	The bilingual text of each legal section; a change waits for a second registrar
Configuration proposals	Registrars	Each proposal, its approvals and who may still approve (approving happens on the phone)
Station profiles, court profiles, duty rosters	Registrars, SHOs, court staff	Supervisors, transfer stations, holidays, hearing slots, eCourts codes, rosters
Dataset imports	Registrars	Court hearings or a station's lookup index
Erasure plans	Registrars	What an erasure order or rule requires: the purges each registrar signs on the phone and the files that become unreadable. Nothing is signed here.
CCTNS reconciliation and anchors	Registrars, supervisors	The night's findings and CCTNS numbers on the ledger

NOTE

A console session can never submit a signed action, read private case data or fetch a file. The backend refuses these for every console session, whatever the page asks.

Accessibility

Every page has a skip link, landmarks, one main heading that takes focus after navigation, labelled controls, real tables with captions, live regions for results and visible focus rings, and reflows at 400% zoom. The browser tests check every page in both languages against WCAG 2.1 A and AA.

Sources: digifir-backend docs/CONSOLE.md, apps/console/README.md, docs/architecture/DECISIONS.md ADR-21, docs/architecture/BACKEND.md section 2.7.