Documentation / Administration
User roles and permissions
What owners, pharmacists, cashiers and custom roles can do.
Built-in roles
| Area | Owner | Pharmacist | Cashier |
|---|---|---|---|
| POS, sales lookup, customers, quick returns | Yes | Yes | Yes |
| Dashboard and reports | Yes | Yes | POS summary only |
| Add or edit products, batches, stocktake | Yes | Yes | View only |
| Purchases, suppliers, insurance claims | Yes | Yes | No |
| Complete online orders at the counter | Yes | Yes | No |
| Staff & roles, audit log, payroll | Yes | No | No |
| Settings, subscription, Store Sync, API keys, Online Store Admin | Yes | No | No |
How it is enforced
Every request is checked on the server against the signed-in person’s role and pharmacy. Hiding a menu item is only a convenience: calling the underlying address directly as a cashier returns 403 Forbidden. A person’s pharmacy comes from the database, so a token can never be used to read another pharmacy’s data.
Database-level protectionPharmacy separation is enforced in the application’s queries. The database’s row-level-security policies protect the Supabase REST interface, but the application connects with a privileged server connection that bypasses them. Making the database itself enforce the boundary is a recommended next step.
Custom roles
Owners can create custom roles in Staff & Roles by choosing permissions such as inventory:write, purchases:read or reports:view. A custom role can only reach the areas its permissions allow; everything else is refused.