Mosaic Art Studio — Management System

What this app is for

The tenant web app helps a business that sells bookable workshops or services (shown in the UI as Services) to:

• Publish sessions (scheduled times) that customers can book.
• Take and manage bookings (status, guests, pricing).
• Maintain customers, locations, and resources (including capacity rules so availability stays realistic).
• Control who on your team can do what, using profiles (roles) and user invitations.

How you open it

Each organization uses its own subdomain (for example https://your-studio.wbc-digital.cloud in production, or https://your-studio.localhost locally). You sign in on the accounts host first, then open a workspace; you are redirected to that tenant’s URL.

In the tenant app header you get: page title, optional Switch Workspace (only if your account has more than one active workspace), your profile menu (account settings, a Notifications item, Workspaces to open the account workspace picker, and Log out), plus banners when impersonation or organization deletion applies. The Notifications entry may not yet link to a full inbox—use your organization’s real notification channels where it matters.

Concepts everyone should understand

• Service = what you sell (workshop or class). Session = a specific date and time. Booking = a customer’s reservation against a service and session.
• Timezone and currency are organization defaults—confirm when speaking to customers in other regions.
• Capacity can be limited by simple caps or by resource rules; “full” in a public booking experience reflects those rules.
• Permissions control every screen; if something is missing, it is usually a profile change, not a bug.

Customers who only book public workshops typically use your public booking or e-commerce flow. This guide focuses on people who use the management application.

Roles: administrator vs staff

The product does not hard-code only two job titles. It uses profiles (roles) and fine-grained permissions (for example booking:view, workshop:edit). What you see in the sidebar depends on your permissions.

Global owner

Some capabilities are tied to the global owner flag on your user record: API Keys and Support Access tabs in Settings appear only for global owners. Delete Organization (in Settings → Organization Profile → Danger Zone) requires both global owner and the settings:delete permission; the UI describes a 30-day grace period before deletion.

Scoping staff when inviting

On Users → Invite user (/users/new), you choose a profile (role), then scope locations and services with “all” or specific checkboxes. Optionally you can create a linked staff resource for capacity. The invitee must accept using the emailed link before they can sign in.

Sign in & registration (accounts portal)

Identity and workspace selection happen on the accounts host (for example locally https://accounts.localhost, or in production https://accounts.wbc-digital.cloud). Your workspace runs on its own subdomain; you usually reach it after you choose an organization on the accounts site.

Sign in

1. Open the accounts site and go to Login.
2. Enter email and password.
3. If you opened login with ?redirect=... (for example after the tenant app sent you back to authenticate), that URL is kept and used after sign-in.
4. On success, you are taken to Select workspace, unless a session was already valid.
5. Use Forgot password? to start email-based reset.

New organization owner: register → verify → onboarding

1. Register — full name, email, password, confirm password. Password rules: at least 8 characters, one uppercase, one lowercase, and one digit.
2. Verify email — enter the 6-digit code sent to your inbox. You can paste the code; you can resend after a cooldown.
3. After verification: if you already have workspace(s), go to Select workspace; if not, go to Create your workspace (onboarding).
4. Onboarding — set workspace name, URL slug (availability checked), timezone, currency, and language. The first-time form may only offer a small fixed set of currencies and languages; you can adjust defaults later under tenant Settings → Defaults, where more options exist.

After onboarding submits successfully, the browser is sent to your new tenant subdomain with an auth callback so you arrive signed in.

Account routes (on the accounts host) include: /login, /register, /verify, /select-tenant, /onboarding, /forgot-password, /reset-password, /confirm-invitation, /accept-invitation.

Select workspace

• Lists organizations you can access (inactive workspaces may be disabled).
• If you have only one workspace, you are often redirected straight into that tenant app.
• If you have several, you choose which to open.
• Platform administrators with no tenants may be sent to the admin portal instead.
• If login included a redirect to a specific tenant subdomain, the app may auto-select that workspace when you have access.

Password reset

• Forgot password — enter your email; a reset link is sent when appropriate.
• Reset password — open the link from email (includes a token) and set a new password.

Joining an existing team (invitation)

Invitation links use a token on the accounts site:

An accept invitation route may also exist on your tenant subdomain when the invitation link points there.

Edge case: ?skip_session_check=1 on login can skip the “already signed in?” check (for example after logout flows).

Administrator guide

Permissions prerequisite

Every area below is gated by permissions (for example location:create, settings:view). If a sidebar item is missing, your profile does not grant it. The Settings page itself requires settings:view; saving changes requires settings:edit.

First-time setup checklist (recommended order)

1. Settings → Defaults (/settings, Defaults tab): set default language, currency, and timezone for the whole organization.
2. Settings → Organization Profile (first tab): confirm name, email, phone; note Organization ID if you need it for support.
3. Locations (/locations): add every site or room where sessions run—services and bookings depend on these.
4. Resources (/resources) and Capacity Management (/resources/capacity): define resources and rules before you rely on resource-based capacity on services.
5. Services (/services): create bookable services (add sessions, variants, pricing, and scheduling rules).
6. Sessions (/sessions): optional central list of scheduled instances; many teams also manage sessions from within each service.
7. Profiles (/profiles): define roles (which permissions each role has).
8. Users (/users/new): invite staff and assign profile, locations, and services.

Sidebar map (labels match the app)

Main Navigation: Dashboard — Bookings (All Bookings, Calendar) — Customers — Services — Sessions.

Management: Resources (All Resources, Capacity Management) — Locations — Profiles — Users — Settings.

Settings

Open Settings from the sidebar. Tab strip depends on whether you are the global owner:

• Everyone with settings:view: Organization Profile (organization name, email, phone, Organization ID; includes Danger Zone for delete) and Defaults (app language, currency, timezone).
• Global owners also see: API Keys and Support Access.
• Delete Organization (Danger Zone): requires global owner plus settings:delete; you must type the organization name to confirm; a 30-day grace applies per the on-screen description; pending deletion can show a banner below the header.

Profiles (roles and permissions)

Create and edit profiles; assign permissions by module (booking, customer, workshop or service, session, resource, capacity rule, location, profile, user, settings, dashboard). Granting create, edit, or delete usually implies view for that module where the UI enforces it.

Users and invitations

Invite by email, choose a profile, assign locations and services (all or selected). Optionally configure a staff resource for capacity.

Locations

Maintain places where services run; used in services, sessions, and bookings.

Services (workshops / classes)

Routes live under /services (list, new, view, edit). In the UI, Service type is offered as Class (the catalog is defined in code as that option). Booking type is shown as Regular Booking or Instant Booking.

• General: internal name, customer-facing title, description, service type, booking type.
• Locations offered, pricing, variants (optional combinations with price, duration, capacity).
• Capacity basis: service level, variant level, or resources via capacity rules.
• Duration at service or variant level depending on configuration.
• Scheduling: cutoff, look-ahead, lead and lag times.
• Sessions: scheduled occurrences; recurrence where supported.
• Public or widget options: time format, timezone helper, location picker, price display, remaining spots, fully booked slots, minimum quantities, checkout redirect, and similar.
• Status: for example active, inactive, or draft. Tags for filtering.

Sessions

View and manage scheduled instances across the business (subject to session permissions).

Resources and capacity management

Define resources and capacity rules. Services can reference rules when capacity is resource-based. Changing capacity may show impact warnings if existing bookings would be over capacity.

Customers

Customer records for bookings; capabilities depend on customer permissions.

Bookings

All bookings (/bookings): search, filters, saved column layouts, bulk actions where enabled, and Export. New booking is at /bookings/new if you have booking:create. Calendar (/bookings/calendar): schedule view. If Shopify is integrated, a Sync Shopify control can appear on the bookings screen. Status values are PENDING, CONFIRMED, CANCELLED, COMPLETED. Bookings can include guests, line items, notes, tags, and private bookings.

Dashboard

With dashboard permission: summary metrics and charts (customers, revenue, bookings, trends, activity—depending on data).

Public booking

A public booking widget loads a service by id and lets customers pick date, optional location, session, and quantities. A demo route exists at /widget-demo/:id in the app shell; production embedding depends on your site and API base URL. Configure services, sessions, and capacity so slots and “remaining spots” match reality.

Shopify

Merchants may use URL parameters such as ?shop=.... Ensure the integration is installed and bookings sync as expected for your workflow.

Staff member guide

What you usually see

Staff often have booking, customer, and calendar access, and may have view-only or limited edit rights on services. The sidebar only lists modules your profile allows.

Visiting the site root (/) does this automatically: if you have dashboard:view, you go to /dashboard; otherwise the app picks the first matching route in this order—Customers (view or create), Bookings (view or create), Services, Sessions, Resources (including capacity views), Locations, Users, Profiles, Settings—using the first path your permissions allow. If none apply, you land on /unauthorized (“Access Denied”).

Switch Workspace in the header appears only when your account has more than one workspace. Otherwise use Workspaces in the profile menu to open the accounts Select workspace page.

Daily workflow: bookings

1. Open Bookings → All bookings (/bookings) to find reservations (filters and search).
2. Use Bookings → Calendar (/bookings/calendar) for a visual schedule.
3. Open a booking row to see customer, location, service, session, guests, totals, and notes (details at /bookings/:id).
4. Update status when you have booking:edit, per your business rules.
5. If you have booking:create, use New booking (/bookings/new) for walk-ins or phone bookings.

Customers

Search before creating duplicates. Create or edit records if your role allows.

Services and sessions

View services to answer customer questions. Escalate configuration errors to an administrator if you cannot edit services.

Locations and resources

You may have view access or none; capacity setup is usually administrative.

Settings, users, and profiles

Often not available to pure staff. Ask an administrator to change your profile or assignments.

Account menu (header)

Open your avatar menu for Account Settings, Notifications (placeholder may not list messages yet), Workspaces (opens the accounts site to pick another organization), and Log out (returns you toward the accounts login flow). Banners below the header can warn about user or organization pending deletion—follow internal procedures.

To sign in again you normally use the accounts URL for your environment. If an on-screen button says “Go to Login” but nothing happens, use Log out or open your saved accounts link manually.

Support or impersonation

During impersonation, an Exit control and banner can appear; workspace switching may be hidden. Support sessions can grant broad access—follow your organization’s policy.

Troubleshooting