The booking dashboard
What the host team's dashboard does: the overview, the pages in the sidebar, the company's settings, notifications and signing in.
For the Full Stack package
Pages
Every page exists in English under /en and in Arabic under /ar. The dashboard opens at /en/dashboard, after the sign-in at /en/auth/login. Each sidebar item shows only when the signed-in admin holds its permission.
| Sidebar item | Path | Permission | What it does |
|---|---|---|---|
| Overview | /en/dashboard | overview.view | This month's occupancy and revenue, today's arrivals and departures, and what is waiting. |
| Calendar | /en/dashboard/calendar | calendar.view | A month of nights, one row per stay, with the blocked-dates dialog and the register of blocks. |
| Bookings | /en/dashboard/bookings | bookings.view | Bookings with status tabs, search and filters, and one page per booking. |
| Stays | /en/dashboard/stays | stays.view | The stays with status tabs, search and filters, and the stay editor. |
| Inquiries | /en/dashboard/inquiries | inquiries.view | Guest questions from the website, with a detail panel. |
| Reviews | /en/dashboard/reviews | reviews.view | What guests wrote after a stay; publish or hide each one. |
| AI assistant | /en/dashboard/ai-assistant | ai_chat.use | A chat that answers from the company's data and acts on it. |
| Settings | /en/dashboard/settings | None (each tab has its own) | Company, Homepage, Destinations, Payments, Profile and Security. |
| Admin management | /en/dashboard/admins-management | admins.view | Team accounts and their roles. |
| Admin roles | /en/dashboard/admins-roles | roles.view | Roles and permissions. |
A search palette in the top bar finds pages, stays, bookings and inquiries, and the bell holds the notifications. A page opened by its address without the permission shows "You do not have access to this page." instead, the same refusal the API gives.
The overview
- This month's occupancy, revenue and bookings, today's arrivals and departures, and the guests in house, in the company's time zone.
- Revenue, bookings and occupancy month by month over the last twelve months, the top stays, bookings by status and the guests' countries.
- Today's arrivals and departures, the pending bookings, the latest seven bookings, the latest reviews and the open inquiries, each linking to its page.
- Every figure is computed from the bookings when the page asks, so it is never out of step with the calendar.
Bookings
- A filter for every status with its count, a search by reference or guest name, and a check-in date range, newest first, ten a page.
- One page per booking, at
/en/dashboard/bookings/<reference>: the stay, the guest, the price breakdown, the payment, the timeline, an internal note the guest never sees, and the steps it can take: Confirm, Check in, Complete and Cancel. - A step the booking cannot take now is shown disabled with its reason, such as a card booking whose payment has not arrived, rather than hidden.
Settings
Settings has six tabs. Profile and Security belong to the signed-in admin; the others need a permission to see and another to save.
| Tab | Permission | What it sets |
|---|---|---|
| Company | settings.view, settings.edit to save | The company's name, tagline and description in both languages, contact email, phone and address line, the currency (USD), the time zone (America/New_York), the default check-in and check-out times on a half-hour grid, and the signature for messages to guests. |
| Homepage | settings.view, settings.edit to save | The stay in the website's hero, the four featured stays, in order (published stays only), and the questions the home page answers, in both languages. |
| Destinations | destinations.view, and create, edit or delete | Each area's name, tagline and description in both languages, slug, cover photograph, sort order, and whether it is shown. A destination that still has stays cannot be deleted. |
| Payments | settings.view, settings.edit to save | Whether Stripe and PayPal are configured on the API and whether their keys are test or live, whether the simulator is in use, the pay on arrival switch, and the cancellation policy guests read. |
| Profile | None: every admin saves their own | The signed-in admin's photo, first and last name, email and phone. The password is changed under Security, not here. |
| Security | None | The signed-in admin's password. |
The payment keys themselves are never shown or edited here: they live in the API's .env. The brand logo is not uploaded here either: it comes from the project's brand files.
Notifications
- Every admin who can view bookings is told when a booking is paid, whether Stripe's or PayPal's webhook, the PayPal capture or the simulator settled it; when a pay-on-arrival booking is waiting for the host to confirm it; and when a booking is cancelled, in a sentence that says whether the guest, the team or a lapsed unpaid hold ended it. A new question notifies every admin who can view inquiries, and a new review every admin who can view reviews.
- They arrive live, with a short message on screen, and the bell lists the newest 30. Each is kept for 30 days, until read or removed.
- Nothing is sent by email: there is no mail service in the template.
- The live connection uses
NEXT_PUBLIC_WEBSOCKET_BASE_URL, the API's address without/api, and the API accepts it fromFRONTEND_URL. A reload always shows the latest rows; only the live updates depend on the connection.
Signing in
- The sign-in form starts empty. Remember this device keeps the session after the browser closes, until the API's token expires (seven days by default); untick it and the session ends with the browser or the tab.
- A wrong email and a wrong password read the same, "Invalid email or password", so the form never tells anyone which addresses have an account. After ten failed attempts in fifteen minutes from one address, the form says to try again later.
- When the API refuses a session (an expired or revoked token), the dashboard signs out and opens the sign-in page. A change to an admin's roles reaches them while they are signed in.
- The sign-in page shows how many stays the company publishes and how many destinations it shows, read from the API's public
GET /api/staysandGET /api/destinations, beside the languages the dashboard ships; while the API cannot be reached it shows the languages only. - The page's header carries the wordmark, "Back to website", the language switch and the System, Light and Dark theme switch; its footer carries the copyright line and a link to the website's privacy page. The wordmark, "Back to website" and the privacy link open
NEXT_PUBLIC_SITE_URL, and while it is empty the two links are left out and the wordmark links nowhere.
How the dashboard's code fits together
Included with your purchase. Sign in to read, or open it in your download.
The code's structure, and the recipes for adding a page, a translation and an API service.