Team & Business Management
Relevant source files
The following files were used as context for generating this wiki page:
Team & Business Management is a core module within the DRX platform designed to handle multi-tenant business configurations and granular role-based access control (RBAC). It ensures that data remains isolated between different business entities while providing owners and managers with the tools to manage staff roles, permissions, and business-level identity settings.
The system emphasizes security through server-side role enforcement and immutable audit trails for sensitive administrative actions. It allows for the creation of staff accounts, assignment of specific operational roles, and the configuration of business identities including naming, logos, and privacy presets.
Sources: scripts/help-center-data.ts:40-60, testsprite_tests/standard_prd.json:9-15
Business Management and Multi-Tenancy
The architecture of DRX is built on a "Tenant Basics" principle where every business is completely isolated from others. Staff and data within one tenant are strictly separated from another, ensuring that operational data like inventory and customer lists do not leak across business boundaries.
Sources: scripts/help-center-data.ts:133-145, CHANGELOG.md:43-50
Business Setup and Configuration
Business owners manage their core identity through the Settings interface. This includes configuring the business name, uploading a logo, and selecting a Privacy Preset (Standard, Private, or Max Secure) which dictates data retention and masking policies.
Sources: scripts/help-center-data.ts:40-52
The following diagram illustrates the business entity relationship and its core attributes:
Team Management and Staffing
Team Management involves the administration of staff logins, PIN assignments, and role transitions. Access is governed by a strict role hierarchy where higher-level roles (e.g., Owners) can manage all members, while mid-level roles (e.g., Managers) are restricted from assigning or modifying Owner-level permissions.
Sources: scripts/help-center-data.ts:555-570, testsprite_tests/standard_prd.json:20-25
Role-Based Access Control (RBAC)
DRX utilizes defined roles to gate system functionality. Each role has a specific set of permissions that determine what UI elements are visible and what API actions can be performed.
| Role | Primary Responsibilities | Key Permissions |
|---|---|---|
| Owner | Full system control, billing, and privacy. | All permissions, including managing other owners. |
| Manager | Inventory management, staff oversight, reports. | staff.manage, inventory intake, system settings. |
| Supervisor | Transactional oversight and customer management. | Void transactions, price overrides, daily reports. |
| Cashier / Staff | Sales operations and basic profile entry. | Create sales, process payments, view catalog. |
| Sources: app/(app)/settings/team/page.tsx:165-195, scripts/help-center-data.ts:120-130 |
Staff Lifecycle Flow
The process of adding or offboarding staff involves real-time synchronization. When a staff member is deactivated in the Settings, their access to all devices is revoked instantly upon the next sync.
Sources: scripts/help-center-data.ts:575-585
Team Management API
The Team Management API facilitates the retrieval and modification of staff data. It leverages an administrative client to bridge the gap between the application database (which stores roles) and the authentication provider (which stores user identity like emails).
Sources: app/api/team/route.ts:5-15
User Retrieval Logic
To display the team list, the API performs a multi-step fetch:
- Authorize: Verifies the requesting user has the appropriate role within the specified
business_id. - Fetch Roles: Retrieves all records from the
user_rolestable for that business. - Enrich Data: Uses a service-role admin client to fetch email and phone details from the Auth provider for each
user_idfound in the roles table.
Sources: app/api/team/route.ts:15-110
API Endpoints
| Method | Endpoint | Description |
|---|---|---|
GET | /api/team | Retrieves all team members for a specific business, enriched with email/phone data. |
POST | /api/team/members | Creates a new team member with hierarchy validation. |
PUT | /api/team/members/{id}/role | Updates an existing member's role. |
| Sources: app/api/team/route.ts:7-10, testsprite_tests/standard_prd.json:100-145 |
Audit and Compliance
Every sensitive action related to team and business management—such as role changes, price overrides, or inventory adjustments—is recorded in an immutable audit log. These logs are tenant-isolated and cannot be deleted by standard users, ensuring compliance and accountability.
Sources: scripts/help-center-data.ts:600-610, testsprite_tests/standard_prd.json:80-95
Right to be Forgotten (RTBF)
The system supports privacy compliance through a dedicated RTBF API. This allows for the permanent masking of Personally Identifiable Information (PII) and the removal of tenant roles when a user or customer requests data deletion.
Sources: testsprite_tests/standard_prd.json:150-170, CHANGELOG.md:86-90
Conclusion
Team & Business Management in DRX provides a robust framework for multi-tenant operations. By combining strict server-side role hierarchies with comprehensive audit logging and privacy-focused presets, the system allows businesses to scale their operations securely while maintaining complete control over staff access and data visibility.