Admins, roles and permissions
Who can sign in to the dashboard, the two seeded roles, every permission the API checks, and how to give a team member exactly what they need.
For the Full Stack package
How access works
- Only admins sign in, to the dashboard. The website has no accounts: a guest finds a booking by its reference and email.
- An admin holds one or more roles, and a role is a set of permissions named
<area>.<action>, such asbookings.edit. An admin holds every permission of every role they have. - The API checks a permission on every dashboard route, whatever the screen shows. The dashboard hides the sidebar items, tabs and buttons an admin's roles do not include, and a page opened by its address says "You do not have access to this page."
- A change to an admin's roles, or to a role's permissions, reaches that admin while they are signed in.
The seeded roles and accounts
| Role | Permissions | Seeded account |
|---|---|---|
| Super Admin | All 32 | admin@hollina.example |
| Manager | overview.view, stays.*, calendar.*, bookings.*, inquiries.*, reviews.*, destinations.view, ai_chat.*: stays, the calendar, bookings, inquiries, reviews and the assistant, without admins, roles or company settings | manager@hollina.example |
The seed sets the two roles to exactly these lists each time it runs, and never resets an existing password. A Manager's Settings shows only Profile and Security. Change both passwords, or delete the seeded accounts, before the dashboard is reachable from the internet. The installation guide lists the demo sign-in details.
Every permission
| Area | Permissions |
|---|---|
| Overview | overview.view |
| Stays | stays.view, stays.create, stays.edit, stays.publish, stays.delete |
| Calendar | calendar.view, calendar.block |
| Bookings | bookings.view, bookings.edit |
| Inquiries | inquiries.view, inquiries.edit |
| Reviews | reviews.view, reviews.moderate |
| Destinations | destinations.view, destinations.create, destinations.edit, destinations.delete |
| Admins | admins.view, admins.create, admins.edit, admins.delete, admins.assign_roles |
| Roles | roles.view, roles.create, roles.edit, roles.delete, roles.assign_permissions |
| Company settings | settings.view, settings.edit |
| AI assistant | ai_chat.use, ai_chat.view_models |
The list is defined once, in back-end/src/database/seeders/permission.seeder.ts; the seed adds new names and removes the ones the API no longer checks. The home page questions are edited with settings.view and settings.edit.
Admin management
/en/dashboard/admins-managementlists the team, ten a page, searchable by email, name and phone, and adds, edits and deletes accounts (admins.view,admins.create,admins.edit,admins.delete).- A new admin needs a first and last name, an email and a password of at least six characters, typed twice; the phone is optional.
- Each admin's page assigns their roles (
admins.assign_roles). - Every admin, whatever their role, edits their own photo, name, email and phone under Settings, Profile, and changes their own password under Settings, Security, with their current one. Neither needs a permission.
Admin roles
/en/dashboard/admins-roles creates, renames and deletes roles (roles.create, roles.edit, roles.delete), and grants their permissions from a grid grouped by area (roles.assign_permissions). To give a team member less than the Manager role, such as a cleaner who only needs the calendar, create a role with only the permissions they need and assign it instead.
What the assistant can reach
ai_chat.use opens the AI assistant and grants nothing else. The assistant reads and changes only what the admin's other permissions allow, the same ones the dashboard's pages check: without settings.edit it cannot change a setting, and without bookings.edit it cannot cancel a booking. It checks again before every action, so a permission removed during a conversation applies to the next one.