> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nova.galaxa.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Zero-Seat Team Management & RBAC

> Why Nova offers unlimited team seats with zero licensing fees, passwordless magic-link invites, and role-based access control.

# Zero-Seat Team Management & RBAC

In the traditional SaaS and BSP landscape, vendors impose artificial "per-seat" licensing taxes—charging between ₹1,500 and ₹3,500 per month for every additional teammate who logs into the dashboard.

This model forces growing merchants into uncomfortable trade-offs: either share insecure master passwords or lock out marketing, support, and warehouse analysts from critical customer and revenue data.

**Galaxa Nova rejects the per-seat tax entirely.**

Nova provides **Zero-Seat Team Management**: unlimited team members on every plan with zero seat fees, zero user caps, and enterprise-grade Role-Based Access Control (RBAC).

***

## The Zero-Seat Philosophy

| Dimension | Legacy Tools (Gallabox, Wati, Intercom) | Galaxa Nova AI |
| :- | :- | :- |
| **Seat Pricing** | ₹1,500 to ₹3,500+ / user / month | **₹0 (Zero)** — Forever free and unlimited |
| **User Limits** | Capped by subscription tier (e.g. 3 or 5 users) | **Unlimited team members** across all tiers |
| **Credential Sharing** | Forced due to seat costs, violating basic security | **Individual accounts** with passwordless magic links |
| **Monetization Focus** | Penalizing merchant team growth | **Aligned with merchant sales and GMV success** |

***

## Role-Based Access Control (RBAC)

To maintain strict operational security without gating collaboration, Nova enforces three distinct permission roles:

| Feature & View | Admin | Analyst | Support |
| :- | :-: | :-: | :-: |
| **Dashboard Metrics & KPIs** | Full Access | Full Access | Full Access |
| **Contacts Directory & GMV** | Full Access | Full Access | Full Access |
| **Live Chat Transcripts** | Full Access | Full Access | Full Access |
| **CSV & JSON Exports** | Full Access | Full Access | No Access |
| **Broadcast Campaigns (Send/Edit)** | Full Access | View Only | No Access |
| **Templates Library** | Full Access | View Only | No Access |
| **Storefront Agent Configuration** | Full Access | No Access | No Access |
| **Developer API Key Generation** | Full Access | No Access (`403`) | No Access (`403`) |
| **Team Member Invitations & Removal** | Full Access | No Access (`403`) | No Access (`403`) |
| **Spend-Cap & Billing Settings** | Full Access | No Access (`403`) | No Access (`403`) |

### Client-Side Gating & Server-Side Enforcement

Security is enforced at both layers:

* **UI Navigation Filtering:** In the dashboard, `App.RBAC.applyRole()` automatically hides administrative navigation tabs (`Settings`, `Deploy`, `Broadcasts`, `Templates`) for non-admin team members. Attempting to navigate directly via URL hash triggers an unauthorized notification and redirects the user back to the main view.
* **HTTP API Middleware:** In `src/dashboard/router.js`, `requireAdminRole` intercepts all write and administrative routes (`POST /api/dashboard/settings`, `POST /api/dashboard/team/invite`, `POST /api/dashboard/developer/keys`, `DELETE /api/dashboard/developer/keys/:id`). Non-admin requests receive an immediate `403 Forbidden`.

### How Roles Are Resolved (fail-closed)

A request's role is never assumed. Nova resolves it in this order and grants
nothing it cannot prove:

1. roles attached to the already-verified identity;
2. the user's **Appwrite Teams** membership for their organization (authoritative);
3. the legacy **`profiles.role`** grant — used only when Teams answered "no
   membership yet", which is the state of merchants provisioned before Teams
   launched;
4. otherwise **nothing** → `403`.

If the identity provider cannot be reached (timeout, 5xx, missing
configuration), the lookup counts as **unresolved** and grants no privileged
access. Before this rule a failed lookup fell through to `admin`, so an
Appwrite blip silently promoted every signed-in session to administrator; that
path is closed and pinned by tests (`tests/dashboard/rbac_fail_closed.test.js`).

***

## Passwordless Magic-Link Invitations

Nova eliminates the vulnerabilities of weak passwords and credential sharing by using passwordless email authentication powered by custom Resend SMTP delivery:

```mermaid theme={null}
flowchart LR
    A["Admin Enters Email & Selects Role"] --> B["Nova Creates Team Membership Invite"]
    B --> C["Resend Dispatches Branded Invitation Email"]
    C --> D["Teammate Clicks Secure 1-Time Magic Link"]
    D --> E["Instant Authentication with Scoped Permissions"]
```

### Inviting a Teammate

1. In the dashboard, navigate to **Settings -> Team Management**.
2. View your current team directory, showing active and pending invitations.
3. Click **Invite Team Member**.
4. Enter the teammate's email address and select their role (`Admin`, `Analyst`, or `Support`).
5. Click **Send Invitation**.
6. The teammate immediately receives a branded invitation email with a secure 1-click login link.

### What the Dashboard Reports

Nova only shows an invitation as **pending** when the identity provider actually
accepted the dispatch:

* **Sent** — the membership invite exists and the email is on its way.
* **`409`** — the address is already a member or already has a pending invite;
  nothing new is created.
* **`502`** — the identity provider rejected the request (misconfiguration,
  SMTP failure, outage). **Nothing is recorded**, so the team list can never
  show a teammate who never received an email. Retry once the cause is fixed.
* **`409` (no organization)** — the signed-in account is not attached to an
  organization, so there is no team to invite into.

### Member Revocation

Today membership removal is performed in the **Appwrite Console** (Teams →
your organization → remove the member). The Nova dashboard does not yet expose a
remove-member button, so do not expect one in the team card.

Because every dashboard request resolves identity → team → organization (with a
30-second memo), removing the membership means the next resolution finds no
organization and the person loses dashboard access. Already-issued API keys are
a **separate** credential: revoke them explicitly in **Settings → Developer
API**, or they keep working after the person has left the team.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.