Rock Frost Business Suite

Shared Paystack operational-payment infrastructure lets tenant organizations connect a masked Settlement Account. Fleet drivers can pay server-calculated remittance and Work & Pay obligations through hosted checkout, with confirmed revenue posted to the tenant Accounting ledger. Shared trend charts across dashboards and reporting allow Curved, Zigzag, and Bars views without changing the underlying figures. See Shared Payments and Settlements.

Security and compliance claims are tracked in docs/COMPLIANCE_AND_ASSURANCE.md. The register separates implemented product controls from provider-dependent controls and external certifications or regulatory determinations.

A modular multi-tenant business platform. Organizations activate fifteen customer-facing products: Fleet, Installment Sales, CRM, Inventory & Procurement, Accounting, Human Resources & Payroll, Analytics, Point of Sale, Project Management, Hotel Management, School Management, Hostel Management, Pharmacy Management, Hospital Management, and Contract Management (available to subscribed organizations; not yet listed on the public site). Each product runs in one unified workspace without mixing unrelated business data.

This is a clean rebuild started 2026-07-19. The previous implementation is archived on branch archive/pre-redesign-rfbs and under docs/archive/previous-implementation/. See docs/DECISIONS.md for why.

Current status: fourteen customer-facing products are implemented across sixteen internal permission and route domains. Payroll remains an internal domain within Human Resources & Payroll, and Procurement remains an internal domain within Inventory & Procurement, preserving existing data and URLs while presenting one subscription for each combined product. The authenticated workspace uses a responsive, user-collapsible navigation shell with vertical-suite workflows and operational overview pages. Release and deployment evidence is recorded in OPERATOR_HANDOFF.md. The production platform is live at rockfrostgroup.com.

School fee payments link to an organization-scoped printable receipt view; access is limited to School fee managers or users with student-finance view permission. Fee managers can also record audited partial or full refunds, which preserve the original receipt, reopen invoice balances, and post separately to Accounting with retry support. The browser print dialog provides paper or PDF output.

Security controls include server-enforced tenant and role boundaries, bcrypt password hashing, encrypted TOTP secrets, login lockout, signed host-only sessions, upload signature validation, global browser security headers, centralized rate limiting on every API route and Server Action, and CI dependency and Git-history secret scanning. Optional Cloudflare Turnstile protection for login, password reset, and contact submissions is enabled by configuring both documented Turnstile environment variables. When Turnstile is not configured, the public contact form uses a signed, expiring form proof, a honeypot, and a database-backed resubmission cooldown; authentication forms continue to fail closed.

The public marketing site has a generated sitemap and robots policy, unique canonical metadata, Open Graph/Twitter sharing data, structured data, and dedicated search landing pages for all fourteen customer-facing products. Fleet, Inventory, Human Resources and Payroll, Hotel, and School also carry expanded Ghana-focused audience, workflow, outcome, and FAQ content. A consent-controlled carousel can feature approved platform tenants and independent Rock Frost customers. Platform owners manage homepage copy, visibility, ordering, logos, and publication without code from the bottom-anchored Platform Settings workspace. Onboarded tenants and independent customers are never published automatically. See docs/SEO.md for the authoritative indexable surface, docs/PLATFORM_SETTINGS.md for owner controls, and the Search Console launch checklist.

Vertical suites

• Hotel Management: rooms, guests, reservations, stay lifecycle, folios and payments, housekeeping, reporting, restaurant, channels, and enforced property settings for currency/timezone, stay policy, charges, numbering, settlement, and room-readiness workflow.
• School Management: tenant-scoped School staff invitation and access management, tabbed student and guardian administration with one unified admission form that requires atomic guardian selection or creation, post-admission family-link management for primary contacts, pickup authorization, relationship edits, and removals, duplicate prevention, editable guardian details, an explicit learner-profile action, a permission-aware 360-degree learner profile, validated and optimized passport photos, signed and revocable digital IDs with public QR verification and wallet-size PDF output, academic periods, tabbed classes and subjects, individual enrollment, academic-year rollover with active learner review, same-campus class mapping, capacity checks, atomic processing, and audit history, phone-first one-tap attendance rosters with bulk Present and live summaries, conduct, fees and Accounting integration, examinations, grading with a Ghana (WASSCE/BECE) grading-scale preset and a ranking-gated exam broadsheet, timetables, transport, library, conditional Hostel integration, campus services, payroll integration, optional SMS notifications for attendance/fees/results and a self-service Parent/Student portal, both paid per-organization add-ons a platform operator grants individually, in-app school announcements for staff and guardians, an optional, separately granted Assignments & Assessments add-on (class assignments with versioned questions, server-side automatic marking of single choice, true or false, multiple select, and numeric answers, teacher-marked written answers, idempotent student submission from My Portal, and an explicit off-by-default opt-in that records results through an existing exam so the broadsheet weighting is unchanged; see docs/SCHOOL_ASSIGNMENTS.md), WhatsApp-style School chat (direct chats, staff-created groups with admins and announcement mode, broadcast lists, photos and PDFs, replies, reactions, read ticks, pin, mute, archive, and in-app plus opt-in web push notifications; staff chat with staff on School alone, chats with guardians need the paid Guardian messaging and portal add-ons and stay scoped to each teacher's classes; no SMS or email; see docs/SCHOOL_COMMUNICATIONS.md), and filterable attendance and collection dashboards with trends and prior-period comparisons. Every tenant user's profile also shows an assigned-role quick guide and a reliable tour replay action.
• Hostel Management: a separately subscribed companion to School Management for schools with boarding facilities. Buildings, rooms and beds (bed labels generated automatically from room capacity), student allocations, warden assignments per building, and hostel fee structures, invoices, and payments — see .

School customer-readiness is delivered in guarded tranches. School payroll adjustments now link to HR employees and feed earnings and deductions into full-calendar-month Payroll runs atomically, with recoverable handling for unlinked legacy inputs. Authorized School staff can update core student profile fields with stale-edit protection while preserving admission number, campus, status, and class history. The Students table now searches within the tenant's database records and returns stable pages instead of loading every student for that view. Fee invoices, attendance history, and the library catalogue now also search and paginate in tenant-scoped database queries, with fee summary totals aggregated across all invoices. Library loan history now has separate search and pagination, with open/all-loan views and a full-organization overdue count. Student choice pickers in enrollment, fees, transport, exam results, and library circulation now search within a bounded tenant-scoped result set; book issuance choices search only available copies. The lifecycle and fee-control tranche adds explicit status history, reusable fee structures, idempotent bulk billing, attendance correction windows, and campus receipt numbering. Fee payments retain their source receipt if Accounting posting fails and expose delivery status with an authorized retry. The student-profile tranche adds sensitive-field query boundaries, digital identity lifecycle controls, an explicit Hostel-owned read service, and permission-adaptive operational KPIs. See docs/SCHOOL_CUSTOMER_READINESS.md, docs/SCHOOL_STUDENT_PROFILE_AND_DIGITAL_ID.md, and docs/DASHBOARD_KPI_STANDARD.md for scope and release gates.

See docs/HOTEL_AND_SCHOOL_MODULES.md for boundaries, invariants, roles, integrations, and completion gates. Both modules now have tenant routes and unique RBAC prefixes.

Production uses host-separated authentication: platform owners use admin.rockfrostgroup.com, tenant users use app.rockfrostgroup.com, and public pages remain on www.rockfrostgroup.com. Host-only cookies allow both accounts to stay signed in concurrently in one browser profile.

The public site publishes canonical metadata, structured data, robots.txt, and a complete XML sitemap for Google discovery. Optional Vercel Analytics and Speed Insights remain disabled until a visitor accepts them through the cookie preferences interface; essential authentication and security cookies remain available independently.

A new user sees a short interactive walkthrough of the workspace chrome the first time they sign in, and a module gets its own short intro (derived automatically from its own description and navigation, not hand-written per module) the first time that user opens it; either can be replayed from the account menu. Public module pages use screenshots captured from the real authenticated test workspace and offer a module-specific walkthrough plus assisted pilot. See docs/ONBOARDING_TOURS.md.

Platform administrators manage each organization's modules from a status list (enabled, waiting for payment, disabled, available as an add-on, unavailable) and a per-module configuration page with access and subscription facts, dependencies, and confirmed, audited switches for paid add-ons and optional included capabilities (School Transport and Library); see docs/MODULE_FEATURE_CONFIGURATION.md. Platform administrators and organization users can enable two-factor authentication from Account Security, using either an authenticator app or SMS codes (via mNotify - see docs/SMS_INTEGRATION.md). Module subscriptions support enforced per-module user seats (including pending invitations and multi-module roles), with used and remaining capacity visible to tenant administrators. Operational modules expose a local Team page for inviting staff, assigning only that module's supported roles, and managing access without creating a second employee identity; HR remains the authoritative employee directory, while Fleet, Installment, Hostel, and School retain their specialist assignment-aware staff workflows. Organization administrators can purchase catalogue modules directly from Billing without platform-owner approval; verified Paystack payment activates access automatically and returns the customer to a detailed thank-you and payment-summary page. Paystack card subscriptions can renew automatically with signed-webhook verification, idempotent payment history, failure suspension, hosted card management, and cancellation that preserves already-paid access. Organization administrators can safely change roles and deactivate/reactivate members, with immediate seat release and capacity checks on restored access. Assigning a Driver-permission role also puts that member straight onto the Fleet roster. When HR is enabled, active internal members are automatically linked to one HR employee record without overwriting HR-managed details; Vehicle Owner and Investor memberships remain external stakeholders. Tenants also have active-module Excel exports, lossless JSON system backups, and password/2FA-protected merge restores; see docs/BILLING_AND_SUBSCRIPTIONS.md and docs/BACKUP_AND_RECOVERY.md. Every module's Reports page also offers PDF and Excel downloads of its live figures.

Public pricing is available at /pricing. The public acquisition pages position Rock Frost as a modular, role-based ERP built for Ghana: organizations can start with a focused module or connect operational suites to Accounting, while managers, staff and external stakeholders receive appropriately scoped workspaces. A database-backed, platform-operator-editable GHS catalogue (/app/platform/subscriptions's "Pricing catalogue" section) covers all fourteen customer-facing products, annual savings, included and additional seats, first-class combined-suite entitlements, and enterprise pricing. Individual module cards show a concise audience and workflow description, the monthly catalogue price, included seats, annual price, and additional-seat pricing. Connected suite prices remain the exact catalogue amount. The separately granted School Assignments & Assessments add-on is advertised on /modules/school; its price is managed by the platform but is not shown on /pricing. Marketing updates do not overwrite operator-approved amounts. Accounting is GHS 849 monthly or GHS 8,490 annually by default, and Accounting-inclusive suites use the reviewed August 2026 catalogue prices unless a platform operator has since edited them. A visitor can start a subscription without requesting a demo or waiting for operator approval: /subscribe verifies the owner email, prepares the workspace and pending product or suite, then sends the owner to tenant Billing for Paystack payment and automatic activation. Trial workspaces are limited to three customer-facing products.

Modules with a published plan ladder are sold by plan. School is the only one today: /pricing shows its Basic, Pro, Platinum and Enterprise columns generated from the enforced entitlement catalogue, /subscribe and tenant Billing both carry a plan picker priced from ModuleTierPrice, and Enterprise is quote-only. School's Pro rung is priced at the module's long-standing headline, so existing agreements and older links buy exactly what they did before. The other sixteen modules keep their single price until their own ladder is defined, because a tier that is not enforced is not a plan. See docs/PLAN_TIERS.md.

The public /company page positions Rock Frost Technologies as a broader technology partner covering bespoke software, digital commerce, websites, integrations, cloud modernization, and advisory work alongside the Business Suite. It presents selected work and carefully scoped Ghana Data Protection Act language without representing product controls as legal certification.

All public marketing pages share an editorial hero system, fluid display typography, translucent premium panels, and a restrained blue-white atmospheric background. This visual system is scoped to the public site and does not alter authenticated tenant or platform workspaces.

Every tenant can reach in-app Support via a responsive floating chat bubble available everywhere in the workspace, with an online indicator, read receipts, optimistic sending feedback, AI assistance, and human handoff; platform operators reply from a two-pane inbox (/app/platform/support) across every organization. Public pages also expose a floating Contact entry point, while Platform Settings controls the public sales email, support email, phone, and WhatsApp details. No email is sent by the authenticated chat feature. See docs/SUPPORT_MESSAGING.md.

Authenticated users can submit private product feedback or explicitly consented testimonials from /app/feedback. Platform operators moderate publication from /app/platform/feedback; nothing is published automatically, attribution and logo display remain independently consent-bound, and consent withdrawal immediately removes a testimonial from the public feed. Approved testimonials reuse the accessible homepage customer carousel. Organization dashboards also show timezone-aware greetings, while infrequent, dismissible business motivation messages remain local to each user and avoid high-attention routes. See docs/CUSTOMER_FEEDBACK.md.

Stack

• Next.js 16.2.12 (App Router, Turbopack) — see AGENTS.md before writing Next.js-specific code; this project pins a version with breaking changes from what most training data assumes.
• TypeScript, strict mode
• Tailwind CSS v4
• shadcn/ui (Base UI primitives) — see docs/DECISIONS.md for the license/rationale
• Prisma + Neon Postgres
• NextAuth v4 (credentials-based auth, JWT sessions, session revocation via a sessionVersion check, canonical invited-email handoff to login, and accessible password visibility — see docs/HARDENING_PLAN.md)
• Zod for input validation on the highest-risk untrusted-input surfaces (see src/lib/validation.ts)
• Vitest for automated tests (npm run test)

Getting started

cp .env.example .env   # fill in real values — see comments in the file
npm install
npm run db:seed        # idempotent: permissions, system roles, module registry rows
npm run dev

Node version is pinned in .nvmrc/package.json's engines field. Required environment variables are documented in .env.example. See docs/DATABASE_STRATEGY.md for the database connection story and docs/AUTHENTICATION_AND_AUTHORIZATION.md for auth-related variables.

Database migrations: always use npx prisma migrate deploy (after hand-verifying a prisma migrate diff-generated migration file) — never npx prisma migrate dev against the shared Neon database. See OPERATOR_HANDOFF.md's "Mandatory instructions" for why.

Platform-owner isolation check/repair: npm run db:repair-platform-owner-isolation removes any historical tenant memberships from platform identities, revokes their pending tenant invitations, and invalidates affected sessions. Deployment migration 20260726050000_enforce_platform_owner_isolation performs the same idempotent repair automatically.

Looking at a UI change in a browser: npx tsx scripts/local-preview-fixture.ts (after npm run db:seed) additively creates a platform anchor with one Super Admin login and one fully-populated tenant organization, then prints the credentials and the tenant's id. It deletes nothing and refuses to run unless DATABASE_URL points at localhost. Set LOCAL_PREVIEW_PASSWORD to choose the password. NEXTAUTH_SECRET must be set locally or sign-in fails with a JWE decryption error.

Project structure

See docs/ARCHITECTURE.md for the full breakdown. Short version:

src/
  app/            App Router routes: (public) marketing site, (auth) sign-in/reset/invite, app/ (everything behind sign-in, at /app/*, one route tree per module plus app/platform for Rock Frost operators)
  modules/        Per-module service layer, navigation, dashboards and Accounting Insights (fleet/, installment/, crm/, inventory/, accounting/, hr/, procurement/, payroll/, analytics/, pos/, projects/)
  platform/       Shared platform concerns: module registry, platform-scope navigation, dashboard widget registry
  components/     Genuinely reusable UI: ui/ (shadcn primitives), layout/, navigation/, feedback/, forms/
  lib/            Shared utilities: db client, auth (NextAuth config, session revocation, invitations, permissions), tenant resolution, email, validation
  types/          Shared TypeScript types
prisma/           Database schema, migrations, and the committed seed.ts (permissions/roles/modules bootstrap)
test/             Vitest suite — mocked-db unit/integration tests for the hardening-pass fixes
docs/             Authoritative documentation (this rebuild) + docs/archive/ (retired, non-authoritative)

Accounting Insights includes the branded Rock Frost Business Assistant. Assistant replies use a dedicated visual identity, while each signed-in user's questions use their uploaded profile photo with an initials fallback.

Documentation

• docs/OFFLINE_PWA.md - browser PWA architecture, signed synchronization, local-data security, work packs, attachment staging, retention, and release-acceptance rules. The expanded multi-module implementation remains feature-flagged until its production acceptance gate passes.
• docs/OFFLINE_CAPABILITY_MATRIX.md - current per-module offline support and protected conflict rules.
• docs/OFFLINE_OPERATIONS_RUNBOOK.md - installation, feature-flag rollout, kill switch, rollback, and disaster recovery.

Start with OPERATOR_HANDOFF.md at the repo root for the current state and next steps, and docs/HARDENING_PLAN.md for the production-hardening track specifically. Then:

• docs/PRODUCT_VISION.md — what this platform is and isn't
• docs/ARCHITECTURE.md — folder structure, route groups, module isolation mechanics
• docs/MODULE_BOUNDARIES.md — the non-negotiable isolation rules between modules
• docs/DESIGN_SYSTEM.md — UI foundation, tokens, component conventions
• docs/DEVELOPMENT_ROADMAP.md — phased build history (all nineteen phases complete)
• docs/PLAN_TIERS.md — the Basic/Pro/Platinum/Enterprise ladder, what each tier includes per module, which tier each checkout path stores and why, how the public price list is generated from the enforced catalogue, how existing customers were grandfathered, and how to add a ladder to another module
• docs/DATABASE_STRATEGY.md — Prisma/Neon setup and migration workflow
• docs/AUTHENTICATION_AND_AUTHORIZATION.md - real, enforced auth/RBAC (162 permission keys across sixteen modules)
• docs/BACKUP_AND_RECOVERY.md — tenant-isolated module exports, protected merge restore, and infrastructure recovery boundaries
• docs/EMAIL_DELIVERY.md — transactional templates, sender-domain authentication, and deliverability operations
• docs/TESTING_STRATEGY.md — how work is validated, current automated test coverage
• docs/MODULE_REQUESTS_AND_CUSTOMIZATION.md — customer requests, operator assignment, approval/enablement, and per-organization module configuration
• docs/BILLING_AND_SUBSCRIPTIONS.md — public acquisition, prefilled onboarding, offline/platform billing modes, activation, and expiry enforcement
• docs/ORGANIZATION_LIFECYCLE.md — Super Admin onboarding, profile/status management, protected platform organizations, and recoverable deletion
• docs/HARDENING_PLAN.md — the production-hardening track: what's fixed, what's deferred, why
• docs/OPERATIONS_AND_MONITORING.md — trial-expiry cron, health checks, logs, performance monitoring, and accessibility operations
• docs/OPERATIONAL_WORKFLOW_UPGRADES.md - Fleet driver, Accounting liquidity, and HR termination workflow controls
• docs/TAX_AND_STATUTORY_REPORTING.md - effective-dated tax codes, Ghana VAT working returns, Procurement input tax, and filing boundaries
• docs/ACCOUNTING_PLANNING.md - budgets, forecasts, maker-checker approvals, revisions, and actual-versus-plan reporting
• docs/SUPPORT_MESSAGING.md — in-app tenant/platform support chat, presence, and why it's deliberately not email or a business module

docs/archive/previous-implementation/ contains the retired implementation's docs, marked obsolete. Do not follow them.

Organization owners can configure a separate display name, logo, and primary/accent/surface palette for each active subscribed module from Workspace settings. The legal/account organization name stays intact, and modules without overrides inherit existing organization branding. See docs/ACCOUNT_AND_TENANT_SETTINGS.md.