The workspace dashboard

Pages

Every page exists in English under /en and in Arabic under /ar. The dashboard opens at /en/dashboard after the sign-in at /en/auth/signin. The sidebar has two columns: the workspace, for members of a workspace, and platform administration, for platform staff. Each row shows only when the signed-in account holds its permission in the workspace it is working in.

• Activity (/en/dashboard/activity, audit.read) opens from the overview's View all activity links and from the bell. Archived projects (/en/dashboard/projects/deleted, projects.read) opens from the projects list.
• The account menu at the foot of the sidebar holds My profile and Preferences (Settings, on its Profile and Notifications tabs) and Sign out. Under it, Documentation opens the website's /docs (NEXT_PUBLIC_WEBSITE_URL), and Platform admin shows for accounts that hold a platform permission.
• The top bar holds the page's trail, search (Ctrl K, or Cmd K on a Mac), the language switch, the theme switch and the bell.
• A page opened by its address without the permission shows Access required: "Your role in this workspace does not include this page." The API refuses the same requests whatever the screen shows.
• An account with no workspace is sent to onboarding, or to platform administration when it is platform staff.

• Team and roles
• Platform administration

Signing in and signing up

• Everyone signs in on the same page, /en/auth/signin, with an email and a password: workspace members and platform staff alike. The seeded accounts are listed in the installation guide.
• Remember me is ticked by default and keeps the session for 30 days; untick it and the session ends after 12 hours. When the API refuses a session, the dashboard signs out and opens the sign-in page.
• A wrong email and a wrong password show the same message, "That email and password do not match an account." After RATE_LIMIT_LOGIN failed sign-ins (10 in .env.example) from one address in 15 minutes, the API refuses every try from it, the right password included, until the oldest failure is 15 minutes old, and the form says "Too many failed sign-in attempts. Wait 15 minutes, then try again."
• Create an account (/en/auth/signup) asks for a full name, a work email, a password of at least 8 characters and the Terms. The new account is signed in and goes to onboarding. One address may start 10 sign-ups an hour; past that, and while the platform has New sign-ups off, the form shows the API's own sentence.
• Forgot password? (/en/auth/forgot-password) answers the same whether or not the email has an account, and mails a link to /en/auth/reset-password that works once and expires in one hour. Without SMTP_HOST the message, link included, is written to the API's log.
• The sign-in page links to the website's Privacy and Terms pages (NEXT_PUBLIC_WEBSITE_URL).
• On the built-in sample data, with no API, any password signs in: see Sample data.

• Sign-in fails
• Mail settings

Creating a workspace

/en/onboarding creates a workspace in three steps. A new account lands here after sign-up, and any account opens it again from Create workspace in the workspace switcher.

The creator becomes the workspace's owner. A new workspace starts on Starter, marked as a trial for the platform's Trial length setting (14 days as seeded, read from the API's public GET /api/public-settings, so onboarding states the length before the workspace exists), with the default roles matrix, and each invitation is mailed (or written to the API's log). Billing shows the trial's end date. When it passes without a paid plan, the workspace becomes past due and the grace period starts, as after a failed payment.

While platform staff have New sign-ups switched off, the API refuses both the sign-up and a new workspace, and the form, or onboarding's review step, says "New sign-ups are closed on this platform right now."

• Billing and plans

Switching workspace

• The block at the top of the sidebar shows the workspace's name and plan. Its menu lists every workspace the account belongs to, with Create workspace under them. The seeded owner, owner@northstack.example, owns Forma Studio and is an admin of Monogram.
• Choosing one drops everything shown for the previous workspace and reloads the pages for the new one, so no row of one workspace is ever shown under another. The choice is kept on the account, and the next sign-in opens the same workspace.
• The role is per workspace: the same person can be the owner of one and a member of another, and the sidebar follows the role in the workspace chosen.

The overview

The Reporting period (Last 7 days, Last 30 days or Last 90 days, 30 by default) narrows the projects needing attention and the recent activity; the weekly chart keeps its own seven days. The period is kept in the address (?period=7d). New project shows for members who hold projects.write.

Search and the bell

• Search (Ctrl K or Cmd K) finds pages, and from two typed characters the workspace's projects, tasks and members, five of each. Projects and tasks appear only for members who hold projects.read. In platform administration it searches organizations.
• The bell lists the workspace's eight latest events with the number unread since the reader last pressed Mark all read, and refreshes every minute. It shows the same events as the overview's recent activity: all of them with projects.read or audit.read, the billing events to a role that reads only billing, and none otherwise. View all activity opens the activity log for members who hold audit.read.

The activity log

Every change in a workspace writes an event: projects, tasks, files, invitations, members, roles, settings, API keys, billing and the assistant's applied suggestions. /en/dashboard/activity lists them newest first, ten a page, for members who hold audit.read (the owner and admins as seeded).

• Filters: a search, Action (one of the groups above), Person, and From and To dates. Reset clears them. Every filter is kept in the address.
• Export CSV downloads every event the filters match as <workspace-address>-activity.csv, with the columns date, actor, action, subject and details. A value that starts with =, +, - or @ is written with a leading quote so a spreadsheet does not run it.

Settings

Settings (/en/dashboard/settings) has five tabs, and the open one is kept in the address (?tab=profile). Every member opens it; what they may change follows their role.

• Email notifications turns the billing emails on or off: a failed payment, an ended trial, a paid plan change and a scheduled change applied at the renewal, sent to the owner, the billing members and the workspace's billing email. Invitations, password resets and licence receipts are always sent.
• Weekly digest sends every active member a summary of the past week, on Mondays from 08:00 UTC, once per workspace per week. Project and task figures go only to roles with projects.read, and the activity count follows what the role may see. A workspace's first digest covers its first full week, and on a new install the first run only marks the current week and sends nothing, so the first digests go out the Monday after.
• Every email is written in the recipient's own language, or in the workspace's language when they have chosen none. The screens' language is always the one in the address. Without SMTP settings the API writes each email to its log instead.
• Delete workspace, in the Danger zone, is the owner's alone: type the workspace's name and your password. The API then cancels its Stripe subscription, if it has one, with no credit for the days left, and marks the workspace deleted (a soft delete): every member loses access, its API keys stop working, it leaves every list and switcher, its rows stay in the database and its address stays taken. If Stripe cannot be reached, nothing is deleted, and a notice says to try again in a few minutes.
• The brand name, logo and colours are not set here: they come from the dashboard's brand files.

• API keys and the public API
• Branding

Language and theme

The top bar switches between English and Arabic (the Arabic pages run right to left) and between the light and the dark theme. The theme follows the computer's setting until it is switched, and the choice is kept in that browser.

• Languages

How the dashboard's code fits together