staff7 is a multi-tenant SaaS platform built for ESNs, consulting agencies, and independent firms. It centralises the full operational stack — from consultant availability to project profitability — in a single, role-aware interface.

The dashboard is the entry point for all roles. It aggregates key metrics in real time and surfaces pending actions without navigating away.

The consultant directory is the operational core of the platform. Each profile tracks availability, assignments, financial cost, and leave entitlements.

Contract types drive behaviour across the platform:

// Actual daily cost formula (employee)
actual_daily_cost = gross_annual_salary × (1 + employer_charges_pct / 100) / working_days

// Default values (FR market)
charges_pct      = 42%  // employer charges
working_days     = 218  // working days / year

Projects are the financial and operational unit of the platform. Each project links a client, a team, and a financial envelope.

The timesheet module provides weekly time tracking with a structured validation workflow. Each day entry can be 0, 0.5, or 1 day — and moves through draft → submitted → approved.

// Entry states
empty     → no entry (0d)
half      → 0.5d (half day)
full      → 1d
draft     → saved but not submitted
submitted → awaiting manager approval
approved  → locked

The leave module handles request submission, manager approval, and balance tracking. Freelancers have a restricted set of leave types — CP and RTT are not available.

Two complementary views give a spatial sense of team availability and workload.

Financial data is admin-only. Two views expose different angles: project-level margins in Finances, and consultant-level profitability in Profitability.

// Gross margin per consultant
revenue      = SUM(sold_rate × days) on active assignments
cost         = actual_daily_cost × billed_days
gross_margin = revenue - cost
margin_pct   = gross_margin / revenue × 100

// Margin health thresholds
≥ 25%  →  Excellent  (green)
15–25% →  Correct    (gold)
< 15%  →  Watch      (pink)

The invoice module lets admins, managers, and freelancers generate client invoices directly from approved timesheets or project budgets. Each invoice carries a legal snapshot of emitter and client data at generation time.

-- Invoice number generation (atomic, thread-safe)
SELECT next_invoice_number(company_id);
-- → 'NEX-2026-0004'

-- billing_settings (companies table, jsonb)
{
  "siret":          "12345678901234",
  "tva_number":     "FR12345678901",
  "tva_rate":       20,
  "payment_terms":  30,
  "bank_iban":      "FR76 ...",
  "bank_bic":       "BNPAFRPPXXX",
  "legal_mention":  "Auto-entrepreneur...",
  "invoice_prefix": "NEX-2026-",
  "invoice_counter": 4
}

Roles are stored in auth.users.app_metadata.user_role — not in a user-editable table. They are set at invite time and can only be changed by an admin.

// RLS JWT path (Supabase)
auth.jwt() -> 'app_metadata' ->> 'user_role'

// Guard helpers (lib/auth.ts)
isAdmin(role)             // admin + super_admin
canEdit(role)             // admin + manager + super_admin
canViewFinancials(role)   // admin + super_admin
canViewOwnInvoices(role)  // freelance + admin + manager + super_admin

// Freelance invoice RLS — own records only
consultant_id IN (
  SELECT id FROM consultants WHERE user_id = auth.uid()
)

Every table has a company_id column. Supabase RLS policies enforce that queries only return rows matching the user's tenant. No application-level filtering is required.

-- RLS policy example (consultants table)
CREATE POLICY "tenant_isolation" ON consultants
  USING (company_id = my_company_id());

-- my_company_id() helper function
CREATE FUNCTION my_company_id() RETURNS uuid AS $$
  SELECT (auth.jwt() -> 'app_metadata' ->> 'company_id')::uuid
$$ LANGUAGE sql STABLE;

-- super_admin bypass
CREATE POLICY "super_admin_all" ON consultants
  USING (is_super_admin());