Feed-point sales with costs the staff cannot see

Problem

A feed seller with several points needed stock, cost and debt tracking — but hired sellers must not see purchase costs or profit, and the points have unreliable internet.

What we did

1. Split the app by role at the token level: sellers get masked costs, read-only stock and no reports — enforced by the API, not the UI.
2. Computed true weighted-average cost per product across arrivals, so profit is real, not estimated.
3. Synced offline work with last-write-wins per record, so a day without internet reconciles cleanly in the evening.

Result

The owner sees profit per point and per product; sellers sell without seeing margins. Cash and credit sales, debts and stock stay correct through offline days.