# Roles and permissions

**Source:** `includes/Roles/AgencyRoles.php`, `includes/Admin/AdminCapabilities.php`, REST `permission_callback`s, traveler FAQ copy.

## Roles that exist

| Role slug | Display name | Purpose |
|-----------|--------------|---------|
| `administrator` | Administrator (WordPress) | Full WP + all Alya caps including vault, settings, purge |
| `alya_agency_admin` | Agency Admin | Agency operations without `manage_options` / vault / log purge |
| `alya_agency_staff` | Agency Staff | Read-oriented cockpit (dashboard, CRM view, reports, documents, logs) |
| *(none)* | Public traveler | Books via shortcodes + REST nonce; not a WP role |

**NOT FOUND as WP roles:** Hotel Manager, Reception Staff, Accountant, Corporate User.

## Typical workflows

### Administrator

- Configure `sand_` / `prod_` keys (vault), environment switch, webhooks, HMAC (default **OFF**).
- Access Console ops, tools, flush cache, health.
- All Agency Admin capabilities plus settings and purge.

### Agency Admin

- Agent book (`AgentBookingPage`), CRM, customers, team, pricing rules, documents, emails, audit, webhooks view.
- Hotel cancel is **staff** (`edit_alya_bookings`); traveler cannot cancel hotels (FAQ + `verify_cancel_permission`).

### Agency Staff

- View dashboard, bookings, customers, reports, documents, logs, CRM.
- **No** `edit_alya_bookings` (revoked via `staff_revoke()`), no settings, no vault, no purge.

### Public traveler

- Search → rates/verify → prebook → Stripe Elements → book.
- Flights: traveler **can** request cancel quote + confirm cancel with `sessionId`.
- Hotels: cancel **staff-only**.
- Account pages: `[alya_account]`, `[alya_my_bookings]` — local WP/session; wishlist is **localStorage**, not a LiteAPI guest account.

## Restricted modules

| Area | Administrator | Agency Admin | Agency Staff | Traveler |
|------|---------------|--------------|--------------|----------|
| API key vault | Yes | No | No | No |
| HMAC / webhook secret | Yes | View webhooks only | No | No |
| Purge logs | Yes | No | No | No |
| Agent book | Yes | Yes | No (no edit bookings) | No |
| Hotel cancel | Yes | Yes if `edit_alya_bookings` | No | No |
| Flight cancel | Yes | Yes | View only | Yes (own session) |
| Cockpit `/function-user-settings/` | Staff users | Yes | Yes | No |

## Helpdesk extra caps

`alya_hs_view_helpdesk`, `alya_hs_reply_helpdesk`, `alya_hs_assign_helpdesk`, `alya_hs_close_helpdesk`, `alya_hs_manage_helpdesk`, `alya_hs_manage_helpdesk_settings` — granted via `Helpdesk\Caps`. Staff vs admin split follows helpdesk settings, not a “Reception” role.