How QCFUM Enforces Temporary-Access Expiration

Temporary-access expiration is treated as a security obligation in QCFUM 2.0.4. The Scheduled Automation runner performs expiration enforcement before it checks whether the commercial Scheduled Automation feature is licensed or enabled.

That means existing active temporary-access records continue to be enforceable after automation is turned off or the site downgrades. QCFUM can keep its native Scheduled Automation task published solely because pending temporary-access expirations still exist.

Which Records Are Eligible

The enforcement query selects QCFUM created-user rows whose access_expires_at is not null, is less than or equal to UTC_TIMESTAMP(), and whose QCFUM tracking status is active. Pending or already-finalized rows are not processed by this expiration query.

Normal Joomla Users Are Blocked

For an eligible ordinary Joomla account, QCFUM sets Joomla block=1, changes the tracking status to expired, updates the row timestamp, and writes a temporary_access_expired audit event.

Protected Administrative Accounts Are Not Auto-Blocked

Before blocking, QCFUM checks the target account for core.admin, core.login.admin, or core.manage. If any of those capabilities are present, QCFUM refuses to block the account, changes tracking to expired_protected, and records an audit event for administrator review.

If the Joomla User Is Missing

If the tracked Joomla user no longer exists, QCFUM cannot block anything. It changes the tracking row to expired_missing and audits the missing-user condition instead.

Why the Task Can Stay Published After Downgrade

runScheduledAutomation() calls temporary-access enforcement first. Only afterward does it decide whether Pro commercial work such as nudges, queued-email retry, cleanup, or approval reminders may run. The task synchronizer also keeps the native task enabled while any active created-user row still has an expiration timestamp.

Community Discussion

Want to compare Joomla user-onboarding workflows, share practical QCFUM tips, or discuss how other administrators use this feature? Visit the QC Frontend User Manager Community. For private support, bug reports, account-specific entitlement problems, or feature requests, use the QuantaCade support system.