The staff dashboard

Pages

Every page exists in English under /en and in Arabic under /ar. The dashboard opens at /en/dashboard, after the sign-in at /en/auth/login.

The bell in the top bar holds the notifications, a search palette finds dishes, orders and customers, and the "View storefront" link opens NEXT_PUBLIC_STOREFRONT_URL. The dashboard is never indexed by search engines.

On the demo data, the overview's figures for today start from a stored sample day, with the paid orders placed since the seed added to it, and yesterday is the stored day before. A kitchen account never sees the overview, because it reports money.

Owner, manager and kitchen

• Every demo account uses the password FoodDemo2026!. The sign-in form starts empty: type the email and the password of the account you want. Only a public demo, with demo mode on, fills the form in and shows a button for each account. Change these passwords, or delete the accounts, before going live.
• Permissions are named like orders.view or products.edit, and the API checks one on every staff route, whatever the screen shows.
• The sidebar and the search palette leave out what an account cannot open, and a page opened by its address shows an access notice instead.
• A kitchen account is tied to one kitchen in Team. It sees that kitchen's confirmed, preparing, ready, out for delivery and delivered orders only, and never the overview, because the overview reports money.

Orders and the kitchen's queue

The list searches by order number and customer, and filters by status, delivery or pickup, and date, the day being counted in each kitchen's own timezone. The selected order shows its customer, delivery address, items with their options and notes, totals and timeline.

• The order page moves an order one step forward at a time, with buttons such as Mark ready, Send out for delivery and Mark delivered, or cancels it with a reason. The API enforces the order of the steps, and a pending order cannot be confirmed until it is paid.
• Each order prints as a kitchen ticket and downloads as a CSV file.
• New orders and status changes arrive live, in the list and in the bell, without a reload.

The menu

• Available now is the switch a kitchen flips during service: the dish stays on the menu and cannot be ordered.
• Archiving moves a dish to Archived dishes, where it can be restored. Categories archive and restore the same way.
• The combo, its choices and their surcharges are an offer the API stores; the assistant can switch it on and off.

Customers

The customer list searches and filters customers, with the counts above it. Staff can add a customer, open their details, change their password, mark their email verified, remove them and restore them. Customers edit their own details from their account on the website.

The website's home page

Homepage lists the nine sections in page order. Drag them, or use the arrows, to reorder; switch each one on or off; and open one to edit its text in both languages. Changes save as you type.

Editing a section needs the products.edit permission.

The AI studio and the AI assistant

• AI studio picks a dish, restyles its photo with a background, a lighting and a prompt saying what to keep, and compares the original with the result. Save as draft keeps the result on the dish's draft until you save the dish. A "Remove background" button cuts the dish out when the model file is installed.
• The studio in the dish form has an Assistant mode, which writes the dish's details from its photos and edits photos on request, and an Animate mode, which turns a photo into a short clip. Results land in a Generations list; add the ones you like to the dish.
• AI assistant looks up orders, dishes and sales and draws charts. Anything that would change data is shown as a difference first and runs only when you confirm it.
• Without a Google AI key on the API, the studio says "Image generation is not connected" and the assistant says "No AI model is connected". Everything else in the dashboard works.

• AI features

Team and roles

• Members lists the staff and adds, edits and removes them. Each member holds one or more roles, and a kitchen member is tied to one kitchen.
• Roles creates, renames and deletes roles, and grants their permissions from a grid grouped by area. A member holds every permission of every role they have, and a change reaches a signed-in member straight away.
• Only the owner sees Team: the manager and the kitchen roles hold no team or role permission.

The seed creates eight staff accounts: the owner, three managers and one kitchen account for each of the four kitchens.

Settings

Settings has three tabs. Profile and Security belong to the signed-in account and are open to every member. Restaurant needs the settings.view permission to read and settings.edit to change.

Notifications

• A new order notifies the staff who can see it, and a finished or failed AI studio generation notifies the member who started it. A kitchen account hears only about its own kitchen's orders once they reach its queue.
• They arrive live, with a short message on screen, and stay in the bell's list until read or removed, for 30 days.
• The live connection uses NEXT_PUBLIC_WEBSOCKET_BASE_URL, the API's address without /api, and the API accepts it only from FRONTEND_URL. On your own domains, set both.

Demo mode

How the dashboard's code fits together