> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nova.galaxa.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Dashboard Guide

> What each Nova dashboard view shows, which capabilities are gated, and where account and developer settings live.

# Dashboard Guide

The merchant dashboard is served at
[`https://nova.galaxa.in/dashboard`](https://nova.galaxa.in/dashboard). It is a
single-page app backed by `/api/dashboard/*`; every view is scoped to the
signed-in user's organisation.

***

## Capability-Gated Navigation

Some surfaces only appear when the server says the organisation can use them.
The bootstrap response carries a `capabilities` block, and the UI applies it on
load and again after a successful WhatsApp connection:

| Capability | Unlocks |
| :- | :- |
| `whatsapp` | **WhatsApp**, **Broadcasts**, **Templates**, and the mobile WhatsApp tab |
| `dealers` | Dealer partner tools |
| `shopify` | Shopify-specific views |

When `whatsapp` is false, those tabs are hidden rather than shown disabled. The
**Settings → WhatsApp Business** card is the one reachable connect entry point;
after Meta Embedded Signup succeeds, the tabs appear without a reload.

Directly opening a gated view is blocked in `renderView` and falls back to the
overview.

***

## Main Views

### Overview

Account-level KPIs for the selected range: conversations, resolution rate,
escalations, channel mix, top intents, and campaign performance. When the
underlying data is missing, the UI says **Not measured** instead of displaying a
fabricated `0%` or `100%`.

### WhatsApp

Connection health, phone quality, usage, and message activity. Configuration
cards marked `admin-only` are hidden from analysts.

### Broadcasts

Campaign builder, CSV/XLSX or manual recipients, optional RFM filters, template
selection, spend estimate, scheduling up to 30 days ahead, and per-campaign
telemetry. Smart Retry is enabled by default for transient Meta frequency and
throughput errors.

### Templates

Templates synced from the organisation's own WABA, plus submission of new
templates to Meta. A template is only listed with the status Meta returns;
there is no hardcoded fallback catalogue.

### Contacts

Customer directory with channel, acquisition touchpoint, last intent, message
count, and order data. CSV and JSON export are available to admins and
analysts.

### Data Index

The knowledge base that grounds the agent: indexed pages, source counts, and
link coverage. If the database read times out, the UI renders a degraded-state
banner instead of claiming the corpus is empty.

### Archives

Historical exports and the contactability partition. Counts and sizes come from
the export records; an unavailable size is shown as unavailable, not zero.

### Settings

Organisation profile, account identity, password, WhatsApp connection, team
management, developer API keys, and billing/usage. Account changes are proxied
to the identity provider; passwords and provider tokens are never stored in the
browser bundle.

### Developer API

Create, list, and revoke scoped keys. The raw `nova_live_…` token is shown once
at creation. Rate-limit counters are available to admins at
`GET /api/dashboard/developer/rate-limit-stats`.

***

## Roles in the Current Build

Nova resolves the caller's effective roles server-side and fails closed when the
identity provider cannot be reached. The shipped UI distinguishes two effective
modes:

* **Admin / Owner** — full access.
* **Analyst** — can read KPIs, contacts, attribution, and archives, but cannot
  open **Settings**, **Deploy**, **Broadcasts**, or **Templates**, and cannot
  invite teammates.
* **Support** — accepted by the invite API, but the current dashboard does not
  apply a separate support restriction; it is treated like an admin. Do not
  promise support-level restrictions until a dedicated policy ships.

Server-side write routes independently require an admin/owner role. Hiding a
button is not the security boundary.

***

## Account & Security

* **Name** — `POST /api/auth/account/name`
* **Email** — `POST /api/auth/account/email`
* **Password** — `POST /api/auth/account/password`

These routes exchange an opaque session handle for the provider account update;
the handle stays server-side. Dashboard logout clears the local token, org slug,
and metric caches.

***

## Related

> **[Quickstart](https://docs.nova.galaxa.in/getting-started/quickstart.md)**
>
> Connect the store and WhatsApp number.

> **[Team Management](https://docs.nova.galaxa.in/billing-safety/team-management.md)**
>
> Invites, roles, and the current removal path.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.