# Non-Filament Company Admin: Hotel Reception Readiness Audit
**Scope:** the authenticated `company-admin` web panel in `routes/web.php`, its
Blade views under `resources/views/company-admin`, and the controllers/models used
by that panel. Filament resources, public booking pages, and API-only capabilities
are excluded unless they are exposed in this panel.
**Assessment date:** 2026-08-26
## Executive conclusion
The non-Filament company-admin panel is a substantial property-management system
with enough implemented surface area for a small hotel's core booking-to-checkout
flow. It is **not ready to be the sole operational system for a staffed hotel
reception** yet. Core daily desk workflows exist, but important controls are
missing and several discovered routes/workflows are incomplete or unsafe.
Suggested readiness level:
| Area | Readiness |
|---|---|
| Reservations, availability and rates | Strong, subject to availability fixes |
| Arrival, stay and departure operations | Partial |
| Guest registration and compliance | Partial |
| Folios, payments and fiscal documents | Partial-to-strong |
| Housekeeping and room status | Strong |
| Night audit and front-desk control | Partial |
| Front-office operating controls | Weak |
| Security, tenant isolation and testing | Blocked / high risk |
## Current functional inventory
### Front-office core
| Capability | Evidence in the non-Filament panel | Assessment |
|---|---|---|
| Reservations | Booking list, dashboard, calendar, create/edit/show, cancellation, email/SMS/payment links, QR code | Implemented |
| Availability | Calendar plus `stays.available-venue-objects`; room availability and room-assignment code | Present, but needs regression testing |
| Rates | Rate-plan CRUD, calendar and price calculation | Implemented |
| Guest profiles | Client and guest directories, guest documents, nationality and ID-number fields | Implemented |
| Pre-arrival | Pre-check-in list, guest details and send-link flow | Implemented |
| Check-in | Booking check-in, QR-assisted check-in, stay creation, room assignments | Implemented, controls incomplete |
| In-house stay | Stay list/detail/edit, add/remove guests, add services, extend/shorten, room change | Implemented |
| Check-out | Folio review/approval/finalization, booking or stay checkout, post-checkout cleaning task | Implemented |
| Room readiness | Room status, housekeeping tasks, inspections, maintenance, room blocks | Implemented |
| Guest communication | Templates, guest messaging, internal messaging and notification preferences | Implemented |
### Financial, compliance and management
| Capability | Evidence | Assessment |
|---|---|---|
| Payments | Payment CRUD, payment stages including deposit/check-in/check-out/refund, in-person Tremol payment | Implemented |
| Folios | `Folio`, `FolioCharge`, `FolioPayment`, stay-modification and checkout-folio review flows | Implemented |
| Invoices and receipts | Invoice CRUD/PDF/email, fiscal receipt download/reprint, settlement reports | Implemented |
| Tax/fiscal | Fiscal device/receipt models and ESTI export | Present; needs country-specific acceptance testing |
| Night audit | Audit list/create/complete/approve routes and views | Present, but not a full close-of-day control set |
| Room blocks | Create/edit/delete room blocks and affected-booking counting | Implemented |
| Housekeeping | Tasks, schedules, checklists, QR, staff tracking, inspections, maintenance, lost & found | Strong |
| Reporting | Occupancy, revenue, forecasting, custom reports, statistics exports | Implemented |
| Staff/RBAC | Users, roles, permission UI, attendance and employee schedules | Present; enforcement needs repair |
### Non-reception/back-office modules also in the panel
Venues, rooms/venue objects, facilities, services, packages, products/inventory,
documents, finance dashboards, subscriptions, B2B invoices, cancellation policy,
company/workspace switching, profile and settings are all exposed by the panel.
## Reception-requirement gap matrix
| Hotel reception requirement | Status | What is missing or insufficient |
|---|---|---|
| Reservation lifecycle and availability | Partial | No visible waitlist/oversell workflow, no walk-in-specific fast flow, and availability must be regression-tested against stays, blocks, housekeeping and concurrent users. |
| Individual/group reservations | Partial | Room blocks are available, but there is no clear group master, rooming list, allotment, group billing or group check-in workflow. |
| Guest registration | Partial | Guest identity fields and document uploads exist, but there is no finished registration-card/signature workflow, verified document/OCR pipeline, or clear mandatory-field compliance gate. |
| Arrival desk | Partial | Check-in and room assignment exist; no operational arrivals queue, no clear early/late check-in policy control, and no key-card issue/reissue log. |
| Key management | Missing | No key/key-card inventory, issuance, encoding, expiry, duplicate/revocation or lost-key charge workflow was found. |
| In-house guest service | Partial | Messaging, service charges and room changes exist. No wake-up-call scheduler, concierge/task log, parcel handling, guest request/SLA queue, or clear internal service recovery workflow. |
| Folio and billing | Partial | Folio charges/payments/refunds exist. No visible split-folio, routing rules (company vs guest), direct-bill account, transfer between folios, authorization/guarantee tracking, or controlled adjustment/void workflow. |
| Payment desk control | Partial | Payment and fiscal flows exist. No cash drawer/float, paid-in/paid-out, cashier shift, variance, handover or end-of-shift reconciliation workflow was found. |
| Departure | Partial | Folio review, checkout and cleaning trigger exist. Missing express checkout, departure queue, guaranteed late-checkout charging, key return control and settled/unsettled departure exceptions. |
| Night audit | Partial | Audit records can be created, completed and approved. A production audit needs locked business-date control, mandatory audit checklist, cashier close, posting rollover, exception queue, rerun/reversal policy and immutable audit package. |
| Housekeeping and maintenance | Strong | Tasking, room status, inspections, maintenance, lost/found and blocks are present. Verify status transitions are the single source of truth for front desk availability. |
| Channel/OTA operations | Missing in panel | No channel manager, OTA reservation mapping, allotment sync, rate/availability sync, delivery queue, failure/retry view, or manual import/reconciliation was found. |
| No-show and cancellation | Partial | Policies and a `Booking::markAsNoShow()` model method exist, but no company-admin route/action was found to mark a no-show, collect its fee, release inventory, or report exceptions. |
| Privacy and security | Blocked | Cross-tenant access checks in `CompanyAdminController` were intentionally commented out while `withoutGlobalScopes()` is used. This makes an ID-guessing user able to access other tenants' records. |
| Auditability and tests | Weak | Activity/audit models exist, but there are no feature tests for the core company-admin reception paths. Existing test coverage is mostly notifications. |
## Material implementation findings
1. **Tenant isolation must be repaired before operational use.**
`CompanyAdminController` loads objects such as stays with
`withoutGlobalScopes()` and comments out the company ownership denial. For
example, see `showStay` around lines 3545-3555. The same pattern appears in
booking, invoice, client, venue, facility and product operations. This is a
cross-tenant data disclosure and mutation risk.
2. **The available-room endpoint is unreachable.**
In `routes/web.php`, `GET /stays/{stayId}` is declared before
`GET /stays/available-venue-objects` (lines 731 and 737). The latter is
swallowed by the wildcard route and returns a stay-not-found response.
3. **Adding a guest to a stay has a model-binding mismatch.**
The route uses `{stayId}` while `addGuestToStay(Request $request, Stay $stay)`
expects the route value named `stay` (routes line 738; controller line 3669).
The route parameter must be renamed or resolved explicitly.
4. **The B2B invoice UI is not routable end to end.**
The controller and views implement create, store, edit, update, send,
mark-paid and cancel. The route group only declares index and show
(`routes/web.php` lines 950-953), so the visible action links refer to named
routes that do not exist.
5. **Camera/QR scanning is not fully implemented.**
The attendance screen explicitly says the camera scanner will be implemented,
and the booking edit screen presents a “Coming Soon” QR scanner. ID document
capture is UI-side and should not be treated as a verified OCR/compliance flow.
6. **Room availability has high-risk edge cases.**
`VenueObject::isBooked()` uses `actual_check_in`/`actual_check_out`; an active
stay with a null checkout can fall outside its overlap predicate. This can
incorrectly offer an occupied room. Back-to-back stays and blocks must also be
tested as one consistent availability engine.
7. **The project cannot currently run Laravel verification locally.**
PHP syntax linting passes, but Artisan aborts because installed PHP is 8.2.12
and Composer requires PHP 8.3 or later. No end-to-end route/feature suite could
be executed in this workspace.
## Minimum go-live plan for a hotel front desk
### Gate 1 — safety and correctness
1. Restore tenant authorization and enforce policies in all company-admin actions.
2. Fix route ordering/model binding and the B2B routes.
3. Make a single transactional availability service cover booking, stay, room
blocks, maintenance and housekeeping states; add concurrency tests.
4. Run feature tests on PHP 8.3+ for booking, check-in, room change, checkout,
payment/refund, room block, night audit and tenant separation.
### Gate 2 — essential receptionist controls
1. Add a dedicated front-desk workboard: arrivals, departures, in-house guests,
room-ready/dirty/out-of-order, balances due and exceptions.
2. Add walk-in, no-show and late/early arrival/departure workflows.
3. Add key-card issue/reissue/return/lost controls.
4. Add cashier shifts, opening float, cash movements, paid-outs and handover
reconciliation.
5. Add an immutable nightly business-date close with explicit exceptions.
### Gate 3 — commercial and service maturity
1. Group reservations, rooming lists, routing/split folios and direct billing.
2. Wake-up calls, guest requests/concierge log and parcel handling.
3. Channel-manager/OTA sync with monitoring and manual recovery.
4. Registration-card signatures, verified document ingestion and retention/access
policies suitable for the jurisdictions served.
## Final verdict
For a small property using manual key control and only direct reservations, the
panel can become usable after Gate 1 and the Gate 2 desk controls are completed.
For a multi-shift, multi-property, OTA-connected hotel, it is not ready yet:
security isolation, reliable availability, cashier close, keys, operational
night-audit controls and channel management are go-live requirements rather than
nice-to-haves.