Skip to main content

​
Zero-Seat Team Management & RBAC

In the traditional SaaS and BSP landscape, vendors impose artificial “per-seat” licensing taxes—charging between ₹1,500 and ₹3,500 per month for every additional teammate who logs into the dashboard. This model forces growing merchants into uncomfortable trade-offs: either share insecure master passwords or lock out marketing, support, and warehouse analysts from critical customer and revenue data. Galaxa Nova rejects the per-seat tax entirely. Nova provides Zero-Seat Team Management: unlimited team members on every plan with zero seat fees, zero user caps, and enterprise-grade Role-Based Access Control (RBAC).

​
The Zero-Seat Philosophy

​
Role-Based Access Control (RBAC)

To maintain strict operational security without gating collaboration, Nova enforces three distinct permission roles:

​
Client-Side Gating & Server-Side Enforcement

Security is enforced at both layers:
  • UI Navigation Filtering: In the dashboard, App.RBAC.applyRole() automatically hides administrative navigation tabs (Settings, Deploy, Broadcasts, Templates) for non-admin team members. Attempting to navigate directly via URL hash triggers an unauthorized notification and redirects the user back to the main view.
  • HTTP API Middleware: In src/dashboard/router.js, requireAdminRole intercepts all write and administrative routes (POST /api/dashboard/settings, POST /api/dashboard/team/invite, POST /api/dashboard/developer/keys, DELETE /api/dashboard/developer/keys/:id). Non-admin requests receive an immediate 403 Forbidden.
Nova eliminates the vulnerabilities of weak passwords and credential sharing by using passwordless email authentication powered by custom Resend SMTP delivery:

​
Inviting a Teammate

  1. In the dashboard, navigate to Settings -> Team Management.
  2. View your current team directory, showing active and pending invitations.
  3. Click Invite Team Member.
  4. Enter the teammate’s email address and select their role (Admin, Analyst, or Support).
  5. Click Send Invitation.
  6. The teammate immediately receives a branded invitation email with a secure 1-click login link.

​
Member Revocation

Administrators can revoke access for departing team members or contractors with a single click. Revoking a membership immediately invalidates all active sessions and secret tokens associated with that user.