# User Roles & Permissions Matrix

The Calian Hotel platform implements a granular Role-Based Access Control (RBAC) structure ensuring least-privilege security across departments.

---

## 1. System Roles

1. **Super Admin (`super_admin`)**: Full unrestricted system access, installer controls, system config, developer tools, raw audit logs.
2. **General Manager (`general_manager`)**: High-level KPIs, revenue management, employee audits, guest CRM, rate overrides, VIP approvals.
3. **Front Desk Manager (`front_desk_manager`)**: Front desk operations, room assignments, folios, cash reconciliation, check-in/out supervisor.
4. **Receptionist (`receptionist`)**: Check-in, check-out, walk-in reservations, billing payments, room status lookups, guest requests.
5. **Reservations Agent (`reservations_agent`)**: Direct booking handling, rate plan quotes, phone/email bookings, deposit recording.
6. **Accounts / Finance (`accounts`)**: Folio settlement, invoices, receipts, refund audits, cashier shifts, Pesapal reconciliations.
7. **Sales & Events (`sales_events`)**: Event RFP pipeline, quotation generator, corporate accounts, group bookings.
8. **Marketing (`marketing`)**: CMS pages, hero sliders, journal/blog posts, SEO meta tags, email newsletter campaigns, promotional promo codes.
9. **Restaurant & Lounge (`restaurant`)**: Table reservations, digital menus, dining billing to guest folios.
10. **Spa Manager / Therapist (`spa`)**: Spa appointment booking, treatment schedules, therapist roster, spa charges to folios.
11. **Housekeeping Supervisor (`housekeeping_supervisor`)**: Room cleaning assignments, status inspections (`Clean` -> `Inspected`), lost & found.
12. **Housekeeper (`housekeeper`)**: Mobile room cleaning task list, marking rooms `Cleaning` and `Clean`, minibar restocking.
13. **Maintenance Engineer (`maintenance`)**: Maintenance tickets, repair logs, out-of-order room flags.

---

## 2. Granular Permissions Matrix

| Permission Key | Description | Roles Assigned |
| :--- | :--- | :--- |
| `manage_settings` | Configure hotel profile, Pesapal credentials, taxes, email | Super Admin |
| `manage_staff` | Create and edit staff accounts and roles | Super Admin, GM |
| `view_reports` | Access executive KPI reports (ADR, RevPAR, Financials) | Super Admin, GM, Accounts |
| `manage_room_types` | Create/edit room types, base pricing, photo galleries | Super Admin, GM, Reservations |
| `manage_rooms` | Add physical rooms, configure floors and amenities | Super Admin, GM, Front Desk Mgr |
| `manage_rates` | Create rate plans, seasonal surcharges, promo codes | Super Admin, GM, Reservations |
| `manage_reservations` | Create, modify, cancel bookings and walk-ins | Super Admin, GM, Front Desk, Reservations |
| `checkin_checkout` | Perform guest check-in, room key assignment, checkout | Front Desk Mgr, Receptionist |
| `manage_folios` | Post charges, add dining/spa items, adjust balances | Front Desk Mgr, Receptionist, Accounts |
| `process_refunds` | Issue refunds or void transactions | Super Admin, GM, Accounts |
| `manage_housekeeping` | Assign rooms, inspect cleaning, update statuses | Housekeeping Supervisor, Housekeeper |
| `manage_maintenance` | Create and resolve repair tickets, mark rooms OOO | Maintenance, Housekeeping Supervisor, GM |
| `manage_dining` | Manage menus, categories, and table reservations | Restaurant, Front Desk, GM |
| `manage_spa` | Manage spa treatments, therapist schedule, appointments | Spa, Front Desk, GM |
| `manage_events` | Manage RFP pipeline and generate event proposals | Sales & Events, GM |
| `manage_cms` | Edit public website pages, journal, gallery, hero banners | Marketing, Super Admin |
| `manage_cashier_shifts`| Open float, record shift transactions, close shift | Receptionist, Front Desk Mgr, Accounts |