Architecting WavePMS: Multi-Tenancy and Real-Time RBAC

Description:
WavePMS - Technical Specifications & Database Architecture
1. Project Overview
WavePMS is a comprehensive, multi-tenant SaaS platform engineered specifically to digitize and automate the operations of Surf Camps and adventure resorts. Unlike traditional Property Management Systems (PMS), WavePMS combines standard accommodation management (bookings, check-ins, channel manager synchronization) with highly specialized operational modules. These custom modules include dynamic surf lesson scheduling based on weather/skill levels, automated airport/spot shuttle logistics with live flight tracking, and advanced kitchen management capable of calculating daily covers categorized by specific dietary restrictions and allergens. The architecture relies on a multi-tenant PostgreSQL database where data is strictly isolated per tenant (surf camp).

2. User Roles & System Permissions
The application enforces strict Role-Based Access Control (RBAC). The primary actors and their system capabilities are:

Super Admin: Has absolute control over the SaaS infrastructure. Manages tenant creation, global billing, subscription plans, and platform-wide configurations. Does not participate in the daily operations of individual surf camps.

Gérant (Manager): The primary administrator for a specific Surf Camp (Tenant). Has full access to all operational data, financial analytics, revenue dashboards, employee management, rate plan configuration, and Channel Manager synchronization logs.

Reception: The front-desk operator. Manages the daily interactive drag-and-drop Gantt calendar, processes reservations, handles guest check-ins/check-outs, uploads passport documents, and verifies payment statuses.

Moniteur Surf (Instructor): Has specialized, limited access focused on activity operations. Views daily surf session schedules, accesses the list of assigned learners categorized by skill level, tracks student progression, and logs weather/wave conditions for specific surf spots.

Chauffeur (Driver): Has mobile-friendly access to the logistics module. Views daily shuttle routes (airport, bus station, beach), accesses passenger manifests (with photos), updates route statuses (e.g., In Transit, Completed), and receives automated flight delay alerts.

Chef Cuisine (Kitchen Chef): Accesses the kitchen dashboard to view automated daily catering requirements. Tracks total covers needed, precise breakdowns of dietary restrictions (Vegan, Gluten-Free, Halal, etc.), allergen alerts, and generates automated grocery lists.

Ménage (Cleaning Staff): Has heavily restricted access to a single interface to view room statuses and mark rooms as "Cleaned" or "Maintenance Required."

Client Final (Guest): Accesses a separate, secure self-service portal via a unique booking link. Can sign digital liability waivers, upload identification documents, update their dietary preferences/surf levels, and download invoices prior to arrival.