How long does Ezvento setup take?

Most stores are up and running in under 10 minutes. Create your account, add your store name and address, and start billing. You can add products later or import from Excel.

Is GST compliance automatic in Ezvento?

Yes. Ezvento automatically calculates GST based on your product HSN codes. You can export GSTR-1 and GSTR-3B reports in one click. E-invoices are generated for B2B sales automatically.

Can I use Ezvento on my tablet or phone?

Absolutely. The POS works beautifully on iPad, Android tablets, and any touchscreen device. No expensive POS hardware needed — just a device and a printer.

What happens if internet goes down while using Ezvento?

Ezvento works offline. You can keep billing, scanning barcodes, and printing receipts. When your internet comes back, everything syncs automatically. No sale is ever lost.

What is the price of Ezvento?

Ezvento starts at ₹999/month for the Launch plan (1 store, 3 users) and ₹2,499/month for the Grow plan (3 stores, 10 users). All plans include a 14-day free trial with no credit card required.

Can I track credit (udhar) sales in Ezvento?

Yes. Link a sale to a customer as credit. See all outstanding balances in one place. Send payment reminders. Record partial payments. Full credit ledger for every customer.

Do I need special hardware to use Ezvento?

No. Ezvento works on any device with a browser. For printing, any thermal receipt printer connected via USB or network will work. Barcode scanners plug in directly.

Can I manage multiple stores with Ezvento?

Yes. The Grow plan supports 3 stores, and Scale supports unlimited. See all stores from one dashboard, transfer stock between locations, and get consolidated reports.

Personas & User Journeys

The persona system maps the 8 system roles into 6 login selectors. After authentication, users choose their persona, which determines their landing page, visible screens, and proxy-level route guards.

Persona System

Roles are mapped to personas for the login selector. A persona is a coarse-grained routing category that simplifies the post-login experience.

Persona	Mapped Roles	Route Prefix	Default Landing	Description
OWNER	`ORGANIZATION_OWNER`	/dashboard	/dashboard	Full access to all stores, settings, and subscription management.
MANAGER	`STORE_MANAGERREGIONAL_MANAGER`	/dashboard	/dashboard	Store operations, billing oversight, team management, and reports.
CASHIER	`CASHIER`	/cashier	/cashier/counter-select	Fast checkout, shift management, and customer-facing POS operations.
HELPER	`INVENTORY_STAFFWAREHOUSE_MANAGER`	/helper	/helper/lookup	Stock lookup, inventory assistance, and warehouse operations.
ACCOUNTANT	`ACCOUNTANT`	/dashboard	/dashboard/reports	Financial reports, GST reconciliation, and audit-ready exports.
AUDITOR	`AUDITOR`	/dashboard	/dashboard/reports	Read-only compliance access across the entire organization.

Why personas exist

A single user can have multiple roles (e.g., a Store Manager who also works as a Cashier on weekends). The persona selector lets them choose their "hat" for the day. The choice is stored in the ezvento-persona cookie and drives:

Route prefix guards (cashiers can't visit /dashboard)
Default landing page after login
Menu access (which sidebar items are visible)
Store-switcher visibility (hidden for single-store cashiers)

Persona Selection Flow

The complete flow from login to landing page, with every API call and cookie interaction.

User logs in

Email + password (or Google OAuth) via Supabase Auth PKCE flow. If 2FA is enabled, redirect to /2fa-verify.

POST /auth/v1/token?grant_type=password

Auth callback resolves persona

The callback route calls /api/auth/callback-server which resolves roles → personaType and sets the ezvento-persona cookie.

GET /auth/callback?code=xxx → cookie: ezvento-persona=OWNER

Multi-role users hit /persona-select

If the user has multiple personas (e.g., MANAGER + CASHIER), they land on the persona selector instead of dashboard.

redirect: /persona-select

Fetch permissions

The persona-select page fetches /api/auth/permissions to display available roles with icons and descriptions.

GET /api/auth/permissions

User clicks a persona card

The selected persona is POSTed to the server, which validates it against the user's actual role assignments.

POST /api/auth/session-persona { personaType: 'CASHIER' }

Cookie set + redirect

The server sets the ezvento-persona cookie (httpOnly, 8h expiry) and returns the redirectPath.

cookie: ezvento-persona=CASHIER; redirectPath: /cashier/counter-select

Proxy-Level Guards

The proxy (src/proxy.ts) enforces persona isolation at the edge, before any page or API handler runs. These guards run on every request.

Cashier blocked from /dashboard

Condition: pathname.startsWith('/dashboard') && personaType === 'CASHIER'

Action: Redirect to /cashier/counter-select

Helper blocked from /dashboard

Condition: pathname.startsWith('/dashboard') && personaType === 'HELPER'

Action: Redirect to /helper/lookup

2FA enforcement for 2FA-required roles

Condition: requiresTwoFactor === true && !twoFactorEnabled

Action: Redirect to /2fa-setup

Auth pages redirect authenticated users

Condition: isAuthPage && user

Action: Redirect to persona's defaultLandingPath

Unauthenticated users blocked from protected routes

Condition: (isDashboard || isCashier || isHelper) && !user

Action: Redirect to /login

Implementation in src/proxy.ts

// Cross-persona guard
const personaType = request.cookies.get('ezvento-persona')?.value
if (isDashboard && user && personaType === 'CASHIER') {
  return NextResponse.redirect(new URL('/cashier/counter-select', request.url))
}
if (isDashboard && user && personaType === 'HELPER') {
  return NextResponse.redirect(new URL('/helper/lookup', request.url))
}

// 2FA enforcement
if (requiresTwoFactor && !twoFactorEnabled) {
  return NextResponse.redirect(new URL('/2fa-setup', request.url))
}

Per-Persona User Journeys

Detailed breakdown of what each persona sees, does, and accesses on a typical day.

OWNER

Landing: /dashboard

OWNER

Key Screens

Dashboard overview with store-level KPIs
Store management (create, edit, freeze stores)
Team management (invite, assign roles, reset PINs)
Subscription & billing (Dodo Payments plans)
Organization settings (logo, GST, integrations)
Reports (sales, inventory, financial, audit)
Audit log viewer (tamper-evident activity)
Inventory and product catalog
Purchase orders and vendor management

Typical Daily Workflow

1Log in with email + password + TOTP
2Land on /dashboard with multi-store overview
3Check daily sales and inventory alerts
4Invite new staff and assign roles with store scope
5Review subscription status and upgrade if needed
6Run GST reports for monthly filing
7Force-logout suspicious sessions from Audit Logs

Permissions Summary

All 80 permissions
Full org-wide access (ORG scope)
Can approve any high-risk action without PIN
Can revoke any session, disable any user

Special Features

Auto-created on signup via ensureTenant()
isOwner flag on User model
Bypasses all scope checks (null allowedStoreIds)
Can access admin panel if isPlatformAdmin is also set

Role Assignment UI

How admins assign roles to users with scope selection in the Team management page.

Navigate to Team

Owner or Manager opens Dashboard → Team → Roles tab.

Select User

Click a user card or use the 'Invite User' button for new members.

Choose Role

Select from the 8 system roles. The UI shows a description and permission count for each.

Set Scope

If the role requires a scope, pick store(s), region(s), counter(s), or location(s). Multi-select is supported for multi-scope roles.

Set Expiry (Optional)

Temporary assignments can have an expiry date (e.g., intern access for 3 months).

Save

The backend increments the user's permissionVersion, forcing a JWT refresh on next request.

UserRoleAssignment Model

id          String      @id @default(cuid())
userId      String
tenantId    String
role        SystemRole  // ORGANIZATION_OWNER | STORE_MANAGER | CASHIER | ...
scopeType   ScopeType   // ORG | REGION | STORE | COUNTER | WAREHOUSE | LOCATION
scopeIds    String[]    // e.g. ["store_abc", "store_def"]
isActive    Boolean     @default(true)
isPrimary   Boolean     @default(false)  // shown first in persona select
expiresAt   DateTime?   // temporary assignment expiry
createdAt   DateTime    @default(now())
updatedAt   DateTime    @updatedAt

Important: Changing a role assignment increments User.permissionVersion. The next API call will fail with PERMISSION_VERSION_STALE, forcing the user to re-authenticate and receive a fresh JWT with updated claims. This ensures permission changes take effect immediately without waiting for JWT expiry.

Personas & User Journeys

Persona System

Roles are mapped to personas for the login selector. A persona is a coarse-grained routing category that simplifies the post-login experience.

Persona	Mapped Roles	Route Prefix	Default Landing	Description
OWNER	`ORGANIZATION_OWNER`	/dashboard	/dashboard	Full access to all stores, settings, and subscription management.
MANAGER	`STORE_MANAGERREGIONAL_MANAGER`	/dashboard	/dashboard	Store operations, billing oversight, team management, and reports.
CASHIER	`CASHIER`	/cashier	/cashier/counter-select	Fast checkout, shift management, and customer-facing POS operations.
HELPER	`INVENTORY_STAFFWAREHOUSE_MANAGER`	/helper	/helper/lookup	Stock lookup, inventory assistance, and warehouse operations.
ACCOUNTANT	`ACCOUNTANT`	/dashboard	/dashboard/reports	Financial reports, GST reconciliation, and audit-ready exports.
AUDITOR	`AUDITOR`	/dashboard	/dashboard/reports	Read-only compliance access across the entire organization.

Why personas exist

Route prefix guards (cashiers can't visit /dashboard)
Default landing page after login
Menu access (which sidebar items are visible)
Store-switcher visibility (hidden for single-store cashiers)

Persona Selection Flow

The complete flow from login to landing page, with every API call and cookie interaction.

User logs in

Email + password (or Google OAuth) via Supabase Auth PKCE flow. If 2FA is enabled, redirect to /2fa-verify.

POST /auth/v1/token?grant_type=password

Auth callback resolves persona

The callback route calls /api/auth/callback-server which resolves roles → personaType and sets the ezvento-persona cookie.

GET /auth/callback?code=xxx → cookie: ezvento-persona=OWNER

Multi-role users hit /persona-select

If the user has multiple personas (e.g., MANAGER + CASHIER), they land on the persona selector instead of dashboard.

redirect: /persona-select

Fetch permissions

The persona-select page fetches /api/auth/permissions to display available roles with icons and descriptions.

GET /api/auth/permissions

User clicks a persona card

The selected persona is POSTed to the server, which validates it against the user's actual role assignments.

POST /api/auth/session-persona { personaType: 'CASHIER' }

Cookie set + redirect

The server sets the ezvento-persona cookie (httpOnly, 8h expiry) and returns the redirectPath.

cookie: ezvento-persona=CASHIER; redirectPath: /cashier/counter-select

Proxy-Level Guards

The proxy (src/proxy.ts) enforces persona isolation at the edge, before any page or API handler runs. These guards run on every request.

Cashier blocked from /dashboard

Condition: pathname.startsWith('/dashboard') && personaType === 'CASHIER'

Action: Redirect to /cashier/counter-select

Helper blocked from /dashboard

Condition: pathname.startsWith('/dashboard') && personaType === 'HELPER'

Action: Redirect to /helper/lookup

2FA enforcement for 2FA-required roles

Condition: requiresTwoFactor === true && !twoFactorEnabled

Action: Redirect to /2fa-setup

Auth pages redirect authenticated users

Condition: isAuthPage && user

Action: Redirect to persona's defaultLandingPath

Unauthenticated users blocked from protected routes

Condition: (isDashboard || isCashier || isHelper) && !user

Action: Redirect to /login

Implementation in src/proxy.ts

// Cross-persona guard
const personaType = request.cookies.get('ezvento-persona')?.value
if (isDashboard && user && personaType === 'CASHIER') {
  return NextResponse.redirect(new URL('/cashier/counter-select', request.url))
}
if (isDashboard && user && personaType === 'HELPER') {
  return NextResponse.redirect(new URL('/helper/lookup', request.url))
}

// 2FA enforcement
if (requiresTwoFactor && !twoFactorEnabled) {
  return NextResponse.redirect(new URL('/2fa-setup', request.url))
}

Per-Persona User Journeys

Detailed breakdown of what each persona sees, does, and accesses on a typical day.

OWNER

Landing: /dashboard

OWNER

Key Screens

Dashboard overview with store-level KPIs
Store management (create, edit, freeze stores)
Team management (invite, assign roles, reset PINs)
Subscription & billing (Dodo Payments plans)
Organization settings (logo, GST, integrations)
Reports (sales, inventory, financial, audit)
Audit log viewer (tamper-evident activity)
Inventory and product catalog
Purchase orders and vendor management

Typical Daily Workflow

1Log in with email + password + TOTP
2Land on /dashboard with multi-store overview
3Check daily sales and inventory alerts
4Invite new staff and assign roles with store scope
5Review subscription status and upgrade if needed
6Run GST reports for monthly filing
7Force-logout suspicious sessions from Audit Logs

Permissions Summary

All 80 permissions
Full org-wide access (ORG scope)
Can approve any high-risk action without PIN
Can revoke any session, disable any user

Special Features

Auto-created on signup via ensureTenant()
isOwner flag on User model
Bypasses all scope checks (null allowedStoreIds)
Can access admin panel if isPlatformAdmin is also set

Role Assignment UI

How admins assign roles to users with scope selection in the Team management page.

Navigate to Team

Owner or Manager opens Dashboard → Team → Roles tab.

Select User

Click a user card or use the 'Invite User' button for new members.

Choose Role

Select from the 8 system roles. The UI shows a description and permission count for each.

Set Scope

If the role requires a scope, pick store(s), region(s), counter(s), or location(s). Multi-select is supported for multi-scope roles.

Set Expiry (Optional)

Temporary assignments can have an expiry date (e.g., intern access for 3 months).

Save

The backend increments the user's permissionVersion, forcing a JWT refresh on next request.

UserRoleAssignment Model

id          String      @id @default(cuid())
userId      String
tenantId    String
role        SystemRole  // ORGANIZATION_OWNER | STORE_MANAGER | CASHIER | ...
scopeType   ScopeType   // ORG | REGION | STORE | COUNTER | WAREHOUSE | LOCATION
scopeIds    String[]    // e.g. ["store_abc", "store_def"]
isActive    Boolean     @default(true)
isPrimary   Boolean     @default(false)  // shown first in persona select
expiresAt   DateTime?   // temporary assignment expiry
createdAt   DateTime    @default(now())
updatedAt   DateTime    @updatedAt