How we built Cozira, a multi-tenant platform for running restaurant cash, stock, and staff

Tenancy is enforced through a shared PostgreSQL database with global scopes keyed on the restaurant. This keeps migrations and reporting simple while ensuring one restaurant can never read another’s data, and it let owners with multiple sites move between them without separate logins.

Controllers stay thin. Validation lives in Form Requests, business rules in service classes, and complex multi-step operations such as publishing a cash sheet or allocating a tronc pool in dedicated actions. This made the cash, inventory and HR rules testable and kept the codebase manageable as modules were added.

Using Spatie Permission with teams enabled, each restaurant defines its own roles from a fixed set of permissions such as publishing cash sheets or logging waste. Owners bypass checks, staff are limited to their site, and the UI only shows what a user can actually do.

The tronc module follows a strict collected, allocated, paid-out state machine. The split is stored the moment it is allocated, so what the manager reviewed is exactly what gets paid, and it can be audited later without re-running any formula.

The mobile clock-in app uses its own API contract rather than sharing the browser cookie flow. That kept the web portal’s httpOnly-cookie security intact while giving the Expo app a clean token-based integration, with both personal-phone and shared-tablet kiosk modes.