Roles & permissions
This matrix shows which dashboard areas each role can access. Permissions are enforced in the sidebar and on the backend.
How to use
| Area | Owner | Manager | Staff | Trainer | Member |
|---|---|---|---|---|---|
| Overview | ✓ | ✓ | ✓ | ✓ | ✓ |
| Members | ✓ | ✓ | ✓ | — | — |
| Check-in | ✓ | ✓ | ✓ | ✓ | QR link |
| Staff attendance | ✓ | ✓ | ✓ | ✓ | — |
| Classes | ✓ | ✓ | ✓ | ✓ | My Classes |
| Workouts | ✓ | ✓ | — | ✓ | My Workouts |
| Equipment | ✓ | ✓ | — | ✓ | My Equipment |
| Memberships | ✓ | ✓ | ✓ | — | — |
| POS / Products | ✓ | ✓ | ✓ | — | — |
| Packages | ✓ | ✓ | ✓ | — | — |
| Package categories | ✓ | ✓ | — | — | — |
| Reports | ✓ | ✓ | — | — | — |
| Website | ✓ | ✓ | — | — | public site |
| Tiers | ✓ | — | — | — | — |
| Settings (nav) | ✓ | ✓ | — | — | user menu |
| Goals / Achievements | — | — | — | — | ✓ |
Named permissions are resolved on the server and returned on GET /users/me as permissions[]. The sidebar and view router use that list — not role alone.
Staff sub-roles (templates)
When a user has role Staff, a staff category selects one of four templates. Managers and owners can optionally add per-user grants and denies (max 10 each). Owner-only capabilities (MANAGE_TIERS, MANAGE_WEBSITE, MANAGE_USERS, business settings, financial reports, export) cannot be granted to staff.
| Category | Typical desk | Highlights |
|---|---|---|
| Reception | Front desk | Member lookup, check-in, class enrollments, read memberships/packages |
| POS Seller | Register | Products catalog + POS sales only |
| Front Desk Lead | Lead desk | Reception + POS + subscriptions + product management (legacy flat Staff) |
| Maintenance | Facilities | Equipment maintenance logs + self staff attendance; no member PII |
Demo accounts (password password123): staff@demo.gym (Front Desk Lead), reception@demo.gym (Reception + POS grant), pos@demo.gym, maintenance@demo.gym.
| Area | Reception | POS Seller | Front Desk Lead | Maintenance |
|---|---|---|---|---|
| Members (read) | ✓ | link for sales | ✓ | — |
| Check-in | ✓ | — | ✓ | — |
| Classes (view / enroll) | view + enroll | — | view + enroll | — |
| Memberships | read | — | read + manage | — |
| POS / Products | — | ✓ | ✓ | — |
| Equipment | — | — | — | maintenance |
| Reports / Settings (business) | — | — | — | — |
Key permission keys: MANAGE_USERS, MANAGE_SUBSCRIPTIONS, MANAGE_CLASS_SCHEDULE, MANAGE_CLASS_ENROLLMENTS, MANAGE_POS, VIEW_FINANCIAL_REPORTS, VIEW_OPERATIONAL_CHARTS, VIEW_EQUIPMENT, MANAGE_EQUIPMENT_MAINTENANCE.