AquaDealers
← All Docs
Overview of what each role can access across the platform. Staff capabilities depend on per-member permission flags set by the dealer.
| Feature | Dealer | Staff | Admin |
|---|---|---|---|
| Dashboard | ✓ | ✓ (if permitted) | ✓ (platform-wide) |
| Create/Edit Bills | ✓ | ✓ (if permitted) | — |
| View Bills | ✓ | ✓ | ✓ (read-only) |
| Cancel Bills | ✓ | ✓ (if permitted) | — |
| Collect Payments | ✓ | ✓ (if permitted) | — |
| Manage Farmers | ✓ | ✓ (if permitted) | — (view only) |
| Manage Products | ✓ | ✓ (if permitted) | — |
| Manage Inventory | ✓ | ✓ (if permitted) | — |
| Stock Purchases | ✓ | ✓ (if permitted) | — |
| Supplier Payments | ✓ | ✓ (if permitted) | — |
| Expenses | ✓ | ✓ (if permitted) | — |
| Cash Book / Daily Book | ✓ | ✓ (if permitted) | — |
| Cash Closing | ✓ | — | — |
| Reports (Profit, Ageing) | ✓ | — | ✓ |
| Branch Management | ✓ | — | — |
| Staff Management | ✓ | — | — |
| Stock Transfers | ✓ | — | — |
| Undo Transactions | ✓ | — | — |
| Settings / Profile | ✓ | — | Own profile |
| WhatsApp Sending | ✓ | ✓ (if permitted) | — |
| Support Tickets | ✓ | — | Manage |
| Subscription/Plans | View | — | Manage |
| Farmer Statements | ✓ | ✓ | — |
| Bill Returns | ✓ | ✓ (if permitted) | — |
| Farmer Discounts | ✓ | — | — |
Staff permissions are stored as a JSONB column on staff_members.permissions. Each key maps to one of three access modes:
"visible" — full access to the module"disabled" — the module appears in the sidebar but is greyed out / non-interactive (staff can see it exists but cannot use it)"hidden" — the module is completely removed from the UIWhen a dealer creates a new staff member, all keys default to the values shown below. The dealer can then toggle individual permissions from the Staff Management screen.
| Key | Controls | Default |
|---|---|---|
dashboard | Dashboard access | hidden |
billHistory | View past bills | hidden |
newBill | Create/edit bills | visible |
farmerList | View farmer list | hidden |
addFarmer | Add new farmers | visible |
inventory | Stock levels | hidden |
suppliers | Supplier management | hidden |
cashbook | Daily book | hidden |
expenses | Expense tracking | hidden |
reports | Reports section | hidden |
settings | Shop settings | hidden |
branches | Branch management | hidden |
staffManagement | Manage other staff | hidden |
transactions | Payment collection | visible |
Most staff permissions are enforced client-side only. However, cashbook and expenses are also enforced server-side: the staff_has_permission() SQL function is called within RLS policies to block access at the database level for those modules. Other modules remain client-side only — a technically savvy staff member could bypass those restrictions by directly querying the Supabase REST API.
The admin portal supports three role levels. Admin accounts are managed separately from dealer/staff accounts and authenticate through their own portal.
| Role | Capabilities |
|---|---|
| super_admin | Full platform access. Create/delete admins, manage all dealers, subscriptions, system configuration, view all data. |
| support | View-only access to dealer data, ticket resolution, no write operations on dealer data. |
| sales | Onboarding new dealers, subscription management, limited dealer data access for demos. |
Row Level Security (RLS) is the primary data isolation mechanism in AquaDealers. It ensures that every database query is scoped to the authenticated user's tenant.
dealer_id = auth.uid() to scope all queries to the authenticated dealerstaff_dealer_id() function that resolves a staff session token to the parent dealer's ID, giving staff the same data scope as their dealerservice_role key bypasses RLS entirely and is used only within Edge Functions running on the server sideTenant Isolation. RLS policies ensure complete tenant isolation. A dealer can never access another dealer's data, even through direct API calls.
verify_dealer_pin RPC)staff_portal_login RPC verifies the PIN against a bcrypt hashsessionStorage, expires in 4 hours