​

Dashboard Guide

The merchant dashboard is served at https://nova.galaxa.in/dashboard. It is a single-page app backed by /api/dashboard/*; every view is scoped to the signed-in user’s organisation.

---

​

Capability-Gated Navigation

Some surfaces only appear when the server says the organisation can use them. The bootstrap response carries a capabilities block, and the UI applies it on load and again after a successful WhatsApp connection: When whatsapp is false, those tabs are hidden rather than shown disabled. The Settings → WhatsApp Business card is the one reachable connect entry point; after Meta Embedded Signup succeeds, the tabs appear without a reload. Directly opening a gated view is blocked in renderView and falls back to the overview.

---

​

Main Views

​

Overview

Account-level KPIs for the selected range: conversations, resolution rate, escalations, channel mix, top intents, and campaign performance. When the underlying data is missing, the UI says Not measured instead of displaying a fabricated 0% or 100%.

​

WhatsApp

Connection health, phone quality, usage, and message activity. Configuration cards marked admin-only are hidden from analysts.

​

Broadcasts

Campaign builder, CSV/XLSX or manual recipients, optional RFM filters, template selection, spend estimate, scheduling up to 30 days ahead, and per-campaign telemetry. Smart Retry is enabled by default for transient Meta frequency and throughput errors.

​

Templates

Templates synced from the organisation’s own WABA, plus submission of new templates to Meta. A template is only listed with the status Meta returns; there is no hardcoded fallback catalogue.

​

Contacts

Customer directory with channel, acquisition touchpoint, last intent, message count, and order data. CSV and JSON export are available to admins and analysts.

​

Data Index

The knowledge base that grounds the agent: indexed pages, source counts, and link coverage. If the database read times out, the UI renders a degraded-state banner instead of claiming the corpus is empty.

​

Archives

Historical exports and the contactability partition. Counts and sizes come from the export records; an unavailable size is shown as unavailable, not zero.

​

Settings

Organisation profile, account identity, password, WhatsApp connection, team management, developer API keys, and billing/usage. Account changes are proxied to the identity provider; passwords and provider tokens are never stored in the browser bundle.

​

Developer API

Create, list, and revoke scoped keys. The raw nova_live_… token is shown once at creation. Rate-limit counters are available to admins at GET /api/dashboard/developer/rate-limit-stats.

---

​

Roles in the Current Build

Nova resolves the caller’s effective roles server-side and fails closed when the identity provider cannot be reached. The shipped UI distinguishes two effective modes:

• Admin / Owner — full access.
• Analyst — can read KPIs, contacts, attribution, and archives, but cannot open Settings, Deploy, Broadcasts, or Templates, and cannot invite teammates.
• Support — accepted by the invite API, but the current dashboard does not apply a separate support restriction; it is treated like an admin. Do not promise support-level restrictions until a dedicated policy ships.

Server-side write routes independently require an admin/owner role. Hiding a button is not the security boundary.

---

​

Account & Security

• Name — POST /api/auth/account/name
• Email — POST /api/auth/account/email
• Password — POST /api/auth/account/password

These routes exchange an opaque session handle for the provider account update; the handle stays server-side. Dashboard logout clears the local token, org slug, and metric caches.

---

​

Related