Admins, roles and permissions
Who can sign in to the dashboard, the two seeded roles, every permission the API checks, and how to give a team member exactly what they need.
For the Full Stack package
How access works
- Only admins sign in, to the dashboard. The website has no accounts.
- An admin holds one or more roles, and a role is a set of permissions named
<area>.<action>, such asproperties.publish. An admin holds every permission of every role they have. - The API checks a permission on every dashboard route, whatever the screen shows. The dashboard hides the sidebar items, tabs and buttons an admin's roles do not include, and a page opened by its address says "This page is not part of your role".
- A change to an admin's roles, or to a role's permissions, reaches that admin while they are signed in.
The seeded roles and accounts
| Role | Permissions | Seeded account |
|---|---|---|
| Super Admin | All 31 | admin@velra.example |
| Agent | overview.view, properties.*, leads.view, leads.edit, viewings.view, viewings.edit, staging.*, neighborhoods.view: properties, inquiries, viewings and the staging studio, without the assistant, settings, admins or roles | agent@velra.example |
The seed sets the two roles to exactly these lists each time it runs, and never resets an existing password. Change both passwords, or delete the seeded accounts, before the agency is reachable from the internet. The installation guide lists the demo sign-in details.
Every permission
| Area | Permissions |
|---|---|
| Overview | overview.view |
| Properties | properties.view, properties.create, properties.edit, properties.publish, properties.delete |
| Inquiries | leads.view, leads.edit |
| Viewings | viewings.view, viewings.edit |
| Staging studio | staging.view, staging.create, staging.approve |
| Neighborhoods | neighborhoods.view, neighborhoods.create, neighborhoods.edit, neighborhoods.delete |
| Admins | admins.view, admins.create, admins.edit, admins.delete, admins.assign_roles |
| Roles | roles.view, roles.create, roles.edit, roles.delete, roles.assign_permissions |
| Agency settings | settings.view, settings.edit |
| AI assistant | ai_chat.use, ai_chat.view_models |
The list is defined once, in back-end/src/database/seeders/permission.seeder.ts; the seed adds new names and removes the ones the API no longer checks.
Admin management
/en/dashboard/admins-managementlists the team, ten a page, searchable by email, name and phone, and adds, edits and deletes accounts (admins.view,admins.create,admins.edit,admins.delete).- A new admin needs a first and last name, an email and a password of at least six characters, typed twice; the phone is optional.
- Each admin's page assigns their roles (
admins.assign_roles). - Every admin, whatever their role, edits their own photo, name, email and phone under Settings, Profile, and changes their own password under Settings, Security, with their current one. Neither needs a permission.
Admin roles
/en/dashboard/admins-roles creates, renames and deletes roles (roles.create, roles.edit, roles.delete), and grants their permissions from a grid grouped by area (roles.assign_permissions). To give a team member less than the Agent role, create a role with only the permissions they need and assign it instead.
What the assistant can reach
ai_chat.use opens the AI assistant and grants nothing else. The assistant reads and changes only what the admin's other permissions allow, the same ones the dashboard's pages check: without settings.edit it cannot change a setting, and without leads.view it cannot read an inquiry. It checks again before every action, so a permission removed during a conversation applies to the next one.