Add multi-branch POS with team roles and branch-scoped cashiers.

Pro and Business users can manage branches, invite cashiers with branch assignment, and switch registers; sales and register flows respect acting location. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-08 06:05:30 +00:00
parent cac7c60415
commit 9d7dac6c24
34 changed files with 1434 additions and 30 deletions
@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+
+class AccountSwitchController extends Controller
+{
+    public function switch(Request $request): RedirectResponse
+    {
+        $data = $request->validate([
+            'account' => ['required', 'integer'],
+        ]);
+
+        abort_unless($request->user()->canAccessAccount($data['account']), 403);
+
+        $request->session()->put('ladill_account', $data['account']);
+        $request->session()->forget('ladill_pos_location');
+
+        return back();
+    }
+}
@@ -119,6 +119,7 @@ class SsoLoginController extends Controller
        }

        QrTeamMember::linkPendingInvitesFor($user);
+        app(\App\Services\Pos\TeamMemberProvisioner::class)->sync($user);

        Auth::login($user, remember: true);
        $request->session()->regenerate();
@@ -2,6 +2,11 @@

 namespace App\Http\Controllers\Pos\Concerns;

+use App\Models\PosLocation;
+use App\Models\PosMember;
+use App\Models\User;
+use App\Services\Pos\PosMemberResolver;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Http\Request;

@@ -14,8 +19,63 @@ trait ScopesToAccount
        return (string) $user->public_id;
    }

+    protected function actor(Request $request): User
+    {
+        return $request->user();
+    }
+
+    protected function posMember(Request $request): ?PosMember
+    {
+        return $request->attributes->get('pos.member')
+            ?? app(PosMemberResolver::class)->memberFor($this->actor($request), $this->ownerRef($request));
+    }
+
+    protected function locationScope(Request $request): ?int
+    {
+        return $request->attributes->get('pos.locationScope')
+            ?? app(PosMemberResolver::class)->locationScope(
+                $this->posMember($request),
+                $this->ownerRef($request),
+                $this->actor($request),
+            );
+    }
+
+    protected function location(Request $request): PosLocation
+    {
+        $acting = $request->attributes->get('actingLocation');
+        if ($acting instanceof PosLocation) {
+            return $acting;
+        }
+
+        return app(\App\Services\Pos\PosLocationService::class)->resolve($request);
+    }
+
    protected function authorizeOwner(Request $request, Model $model): void
    {
        abort_unless($model->getAttribute('owner_ref') === $this->ownerRef($request), 404);
+        $this->authorizeLocation($request, $model);
+    }
+
+    protected function authorizeLocation(Request $request, Model $model): void
+    {
+        $scope = $this->locationScope($request);
+        if ($scope === null) {
+            return;
+        }
+
+        $locationId = $model->getAttribute('location_id');
+        if ($locationId !== null) {
+            abort_unless((int) $locationId === $scope, 404);
+        }
+    }
+
+    protected function scopeToLocation(Request $request, Builder $query, string $column = 'location_id'): Builder
+    {
+        $scope = $this->locationScope($request);
+        if ($scope !== null) {
+            $query->where($column, $scope);
+        }
+
+        return $query;
    }
 }
@@ -21,7 +21,7 @@ class DashboardController extends Controller
        $owner = $this->ownerRef($request);
        $todayStart = now()->startOfDay();

-        $todaySales = PosSale::owned($owner)
+        $todaySales = $this->scopeToLocation($request, PosSale::owned($owner))
            ->where('status', PosSale::STATUS_PAID)
            ->where('paid_at', '>=', $todayStart);

@@ -29,10 +29,11 @@ class DashboardController extends Controller
            'today_total_minor' => (int) (clone $todaySales)->sum('total_minor'),
            'today_count' => (clone $todaySales)->count(),
            'product_count' => PosProduct::owned($owner)->active()->count(),
-            'open_pending' => PosSale::owned($owner)->where('status', PosSale::STATUS_PENDING)->count(),
+            'open_pending' => $this->scopeToLocation($request, PosSale::owned($owner))
+                ->where('status', PosSale::STATUS_PENDING)->count(),
        ];

-        $recentSales = PosSale::owned($owner)
+        $recentSales = $this->scopeToLocation($request, PosSale::owned($owner))
            ->with('lines')
            ->latest()
            ->limit(8)
@@ -0,0 +1,207 @@
+<?php
+
+namespace App\Http\Controllers\Pos;
+
+use App\Http\Controllers\Controller;
+use App\Http\Controllers\Pos\Concerns\ScopesToAccount;
+use App\Models\PosLocation;
+use App\Models\PosSale;
+use App\Models\PosTable;
+use App\Services\Pos\PosLocationService;
+use App\Services\Pos\SubscriptionService;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Validation\Rule;
+use Illuminate\View\View;
+
+class LocationController extends Controller
+{
+    use ScopesToAccount;
+
+    public function __construct(
+        private PosLocationService $locations,
+        private SubscriptionService $subscriptions,
+    ) {}
+
+    public function index(Request $request): View
+    {
+        $owner = $this->ownerRef($request);
+        $account = ladill_account() ?? $request->user();
+
+        abort_unless(
+            app(\App\Services\Pos\PosMemberResolver::class)->canManageBranches(
+                $this->posMember($request),
+                $owner,
+                $this->actor($request),
+            ),
+            403,
+        );
+
+        $branches = PosLocation::owned($owner)->orderBy('name')->get();
+
+        return view('pos.branches.index', [
+            'branches' => $branches,
+            'canAddBranch' => $this->subscriptions->canAddLocation($account, $owner),
+            'hasMultiLocation' => $this->subscriptions->canUseMultiLocation($account),
+        ]);
+    }
+
+    public function create(Request $request): View|RedirectResponse
+    {
+        return $this->guardManage($request) ?? view('pos.branches.create');
+    }
+
+    public function store(Request $request): RedirectResponse
+    {
+        if ($redirect = $this->guardManage($request)) {
+            return $redirect;
+        }
+
+        $owner = $this->ownerRef($request);
+        $account = ladill_account() ?? $request->user();
+
+        if (! $this->subscriptions->canAddLocation($account, $owner)) {
+            return redirect()->route('pos.pro.index')
+                ->with('upsell', 'Multi-branch POS requires Ladill POS Pro or Business.');
+        }
+
+        $data = $request->validate([
+            'name' => ['required', 'string', 'max:120'],
+            'currency' => ['required', 'string', 'size:3'],
+            'service_style' => ['required', 'in:retail,restaurant'],
+        ]);
+
+        if ($data['service_style'] === 'restaurant' && ! $this->subscriptions->canUseRestaurantMode($account)) {
+            return back()->withInput()->with('upsell', 'Restaurant mode is part of Ladill POS Pro.');
+        }
+
+        $isFirst = $this->subscriptions->locationCount($owner) === 0;
+
+        PosLocation::create([
+            'owner_ref' => $owner,
+            'name' => $data['name'],
+            'currency' => strtoupper($data['currency']),
+            'service_style' => $data['service_style'],
+            'is_default' => $isFirst,
+        ]);
+
+        return redirect()->route('pos.branches.index')->with('success', 'Branch created.');
+    }
+
+    public function edit(Request $request, PosLocation $location): View|RedirectResponse
+    {
+        $this->authorizeOwner($request, $location);
+        if ($redirect = $this->guardManage($request)) {
+            return $redirect;
+        }
+
+        return view('pos.branches.edit', compact('location'));
+    }
+
+    public function update(Request $request, PosLocation $location): RedirectResponse
+    {
+        $this->authorizeOwner($request, $location);
+        if ($redirect = $this->guardManage($request)) {
+            return $redirect;
+        }
+
+        $account = ladill_account() ?? $request->user();
+        $data = $request->validate([
+            'name' => ['required', 'string', 'max:120'],
+            'currency' => ['required', 'string', 'size:3'],
+            'service_style' => ['required', 'in:retail,restaurant'],
+            'is_default' => ['sometimes', 'boolean'],
+        ]);
+
+        if ($data['service_style'] === 'restaurant' && ! $this->subscriptions->canUseRestaurantMode($account)) {
+            return back()->withInput()->with('upsell', 'Restaurant mode is part of Ladill POS Pro.');
+        }
+
+        if ($request->boolean('is_default')) {
+            PosLocation::owned($this->ownerRef($request))
+                ->where('id', '!=', $location->id)
+                ->update(['is_default' => false]);
+            $location->is_default = true;
+        }
+
+        $location->update([
+            'name' => $data['name'],
+            'currency' => strtoupper($data['currency']),
+            'service_style' => $data['service_style'],
+        ]);
+
+        return redirect()->route('pos.branches.index')->with('success', 'Branch updated.');
+    }
+
+    public function destroy(Request $request, PosLocation $location): RedirectResponse
+    {
+        $this->authorizeOwner($request, $location);
+        if ($redirect = $this->guardManage($request)) {
+            return $redirect;
+        }
+
+        $owner = $this->ownerRef($request);
+
+        if (PosLocation::owned($owner)->count() <= 1) {
+            return back()->with('error', 'You must keep at least one branch.');
+        }
+
+        if (PosSale::owned($owner)->where('location_id', $location->id)->exists()) {
+            return back()->with('error', 'This branch has sales history and cannot be removed.');
+        }
+
+        if (PosTable::owned($owner)->where('location_id', $location->id)->where('status', '!=', PosTable::STATUS_FREE)->exists()) {
+            return back()->with('error', 'Settle open tickets on this branch before removing it.');
+        }
+
+        $wasDefault = $location->is_default;
+        $location->delete();
+
+        if ($wasDefault) {
+            PosLocation::owned($owner)->orderBy('id')->first()?->update(['is_default' => true]);
+        }
+
+        if ((int) $request->session()->get('ladill_pos_location') === (int) $location->id) {
+            $request->session()->forget('ladill_pos_location');
+        }
+
+        return redirect()->route('pos.branches.index')->with('success', 'Branch removed.');
+    }
+
+    public function switch(Request $request): RedirectResponse
+    {
+        $owner = $this->ownerRef($request);
+        $data = $request->validate([
+            'location' => [
+                'required',
+                'integer',
+                Rule::exists('pos_locations', 'id')->where('owner_ref', $owner),
+            ],
+        ]);
+
+        $this->locations->switch($request, (int) $data['location']);
+
+        return back()->with('success', 'Switched branch.');
+    }
+
+    private function guardManage(Request $request): ?RedirectResponse
+    {
+        $owner = $this->ownerRef($request);
+
+        if (! app(\App\Services\Pos\PosMemberResolver::class)->canManageBranches(
+            $this->posMember($request),
+            $owner,
+            $this->actor($request),
+        )) {
+            abort(403);
+        }
+
+        $account = ladill_account() ?? $request->user();
+        if (! $this->subscriptions->canUseMultiLocation($account)) {
+            return redirect()->route('pos.pro.index')
+                ->with('upsell', 'Multi-branch POS requires Ladill POS Pro or Business.');
+        }
+
+        return null;
+    }
+}
@@ -0,0 +1,130 @@
+<?php
+
+namespace App\Http\Controllers\Pos;
+
+use App\Http\Controllers\Controller;
+use App\Http\Controllers\Pos\Concerns\ScopesToAccount;
+use App\Models\PosLocation;
+use App\Models\PosMember;
+use App\Models\User;
+use App\Services\Identity\IdentityTeamClient;
+use App\Services\Pos\SubscriptionService;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Validation\Rule;
+use Illuminate\View\View;
+
+class MemberController extends Controller
+{
+    use ScopesToAccount;
+
+    public function __construct(private SubscriptionService $subscriptions) {}
+
+    public function index(Request $request): View|RedirectResponse
+    {
+        if ($redirect = $this->guardManage($request)) {
+            return $redirect;
+        }
+
+        $owner = $this->ownerRef($request);
+        $members = PosMember::owned($owner)->with('location')->orderBy('created_at')->get();
+
+        return view('pos.team.index', [
+            'members' => $members,
+            'roles' => config('pos.roles', []),
+            'branches' => PosLocation::owned($owner)->orderBy('name')->get(),
+        ]);
+    }
+
+    public function store(Request $request, IdentityTeamClient $identity): RedirectResponse
+    {
+        if ($redirect = $this->guardManage($request)) {
+            return $redirect;
+        }
+
+        $owner = $this->ownerRef($request);
+
+        $validated = $request->validate([
+            'email' => ['required', 'email', 'max:255'],
+            'role' => ['required', 'string', Rule::in(array_keys(config('pos.roles', [])))],
+            'location_id' => [
+                Rule::requiredIf(fn () => $request->input('role') === PosMember::ROLE_CASHIER),
+                'nullable',
+                'integer',
+                Rule::exists('pos_locations', 'id')->where('owner_ref', $owner),
+            ],
+        ]);
+
+        $email = strtolower(trim($validated['email']));
+        $actor = $request->user();
+
+        if ($email === strtolower((string) $actor->email)) {
+            return back()->withErrors(['email' => 'You cannot invite yourself.']);
+        }
+
+        try {
+            $identity->inviteAppMember(
+                $owner,
+                $email,
+                ['pos'],
+                [
+                    'pos' => [
+                        'role' => $validated['role'],
+                        'location_id' => $validated['location_id'] ?? null,
+                    ],
+                ],
+            );
+        } catch (\Throwable $e) {
+            return back()->withInput()->with('error', $e->getMessage());
+        }
+
+        PosMember::updateOrCreate(
+            [
+                'owner_ref' => $owner,
+                'user_ref' => $email,
+            ],
+            [
+                'role' => $validated['role'],
+                'location_id' => $validated['location_id'] ?? null,
+            ],
+        );
+
+        return back()->with('success', 'Invitation sent to '.$email.'.');
+    }
+
+    public function destroy(Request $request, PosMember $member): RedirectResponse
+    {
+        if ($redirect = $this->guardManage($request)) {
+            return $redirect;
+        }
+
+        $this->authorizeOwner($request, $member);
+
+        $actor = $request->user();
+        if ($member->user_ref === $actor->public_id || $member->user_ref === strtolower((string) $actor->email)) {
+            return back()->with('error', 'You cannot remove yourself.');
+        }
+
+        $member->delete();
+
+        return back()->with('success', 'Team member removed.');
+    }
+
+    private function guardManage(Request $request): ?RedirectResponse
+    {
+        $owner = $this->ownerRef($request);
+        $resolver = app(\App\Services\Pos\PosMemberResolver::class);
+
+        if (! $resolver->canManageTeam($this->posMember($request), $owner, $this->actor($request))) {
+            abort(403);
+        }
+
+        $account = ladill_account() ?? $request->user();
+        if (! $this->subscriptions->canManageTeam($account)) {
+            return redirect()->route('pos.pro.index')
+                ->with('upsell', 'Team members and branch assignment require Ladill POS Pro or Business.');
+        }
+
+        return null;
+    }
+}
@@ -30,7 +30,7 @@ class RegisterController extends Controller
    public function index(Request $request): View
    {
        $owner = $this->ownerRef($request);
-        $location = $this->locations->ensureDefault($owner);
+        $location = $this->location($request);

        return view('pos.register', [
            'products' => $this->registerProducts($owner, $location),
@@ -47,7 +47,7 @@ class RegisterController extends Controller
        ]);

        $owner = $this->ownerRef($request);
-        $location = $this->locations->ensureDefault($owner);
+        $location = $this->location($request);
        $product = $this->barcodes->lookup($owner, $location, $data['code']);

        if (! $product || $product['price_minor'] <= 0 || $product['name'] === '') {
@@ -66,7 +66,14 @@ class RegisterController extends Controller
    private function registerProducts(string $owner, PosLocation $location): array
    {
        if ($location->isRestaurant()) {
-            return PosProduct::owned($owner)->active()->orderBy('name')->get()
+            return PosProduct::owned($owner)
+                ->active()
+                ->where(function ($query) use ($location) {
+                    $query->where('location_id', $location->id)
+                        ->orWhereNull('location_id');
+                })
+                ->orderBy('name')
+                ->get()
                ->map(fn (PosProduct $p) => [
                    'id' => $p->id,
                    'name' => $p->name,
@@ -99,7 +106,7 @@ class RegisterController extends Controller
    {
        $data = $request->validate(['style' => ['required', 'in:retail,restaurant']]);

-        $location = $this->locations->ensureDefault($this->ownerRef($request));
+        $location = $this->location($request);
        $location->update(['service_style' => $data['style']]);

        if ($data['style'] === PosLocation::STYLE_RESTAURANT) {
@@ -135,7 +142,7 @@ class RegisterController extends Controller
        ]);

        $merchant = ladill_account() ?? $request->user();
-        $location = $this->locations->ensureDefault($this->ownerRef($request));
+        $location = $this->location($request);

        $lines = $data['lines'];
        if (! $location->isRestaurant()) {
@@ -23,7 +23,7 @@ class SaleController extends Controller

    public function index(Request $request): View
    {
-        $sales = PosSale::owned($this->ownerRef($request))
+        $sales = $this->scopeToLocation($request, PosSale::owned($this->ownerRef($request)))
            ->with('lines')
            ->latest()
            ->paginate(25)
@@ -27,12 +27,13 @@ class SettingsController extends Controller
    public function index(Request $request): View
    {
        $owner = $this->ownerRef($request);
-        $location = $this->locations->ensureDefault($owner);
+        $location = $this->location($request);

        return view('pos.settings', [
            'location' => $location,
            'merchantImportEnabled' => (bool) config('pos.merchant_import_enabled', true),
-            'tables' => PosTable::owned($owner)->orderBy('area')->orderBy('position')->orderBy('label')->get(),
+            'tables' => $this->scopeToLocation($request, PosTable::owned($owner))
+                ->orderBy('area')->orderBy('position')->orderBy('label')->get(),
        ]);
    }

@@ -56,7 +57,7 @@ class SettingsController extends Controller
                ->with('upsell', 'Restaurant mode is part of Ladill POS Pro.');
        }

-        $location = $this->locations->ensureDefault($this->ownerRef($request));
+        $location = $this->location($request);

        if ($request->boolean('remove_receipt_logo') && $location->receipt_logo_path) {
            Storage::disk('public')->delete($location->receipt_logo_path);
@@ -96,7 +97,7 @@ class SettingsController extends Controller
        ]);

        $owner = $this->ownerRef($request);
-        $location = $this->locations->ensureDefault($owner);
+        $location = $this->location($request);

        PosTable::create([
            'owner_ref' => $owner,
@@ -19,16 +19,16 @@ class TableController extends Controller
    public function index(Request $request): View
    {
        $owner = $this->ownerRef($request);
-        $location = $this->locations->ensureDefault($owner);
+        $location = $this->location($request);

-        $tables = PosTable::owned($owner)
+        $tables = $this->scopeToLocation($request, PosTable::owned($owner))
            ->with('currentSale')
            ->orderBy('area')
            ->orderBy('position')
            ->orderBy('label')
            ->get();

-        $openTickets = PosSale::owned($owner)
+        $openTickets = $this->scopeToLocation($request, PosSale::owned($owner))
            ->openTickets()
            ->with('table')
            ->withCount('lines')
@@ -2,6 +2,7 @@

 namespace App\Http\Middleware;

+use App\Models\PosLocation;
 use App\Models\User;
 use Closure;
 use Illuminate\Http\Request;
@@ -26,6 +27,8 @@ class SetActingAccount
                }
            }

+            $accountId = $this->preferEmployerAccount($request, $user, $accountId);
+
            $account = $accountId === $user->id ? $user : (User::find($accountId) ?? $user);

            $request->attributes->set('actingAccount', $account);
@@ -38,4 +41,31 @@ class SetActingAccount

        return $next($request);
    }
+
+    private function preferEmployerAccount(Request $request, User $user, int $accountId): int
+    {
+        if ($accountId !== $user->id) {
+            return $accountId;
+        }
+
+        if (PosLocation::owned($user->public_id)->exists()) {
+            return $accountId;
+        }
+
+        $membership = $user->posMemberships()->first();
+        if (! $membership) {
+            return $accountId;
+        }
+
+        $employer = User::where('public_id', $membership->owner_ref)->first();
+        if ($employer && $user->canAccessAccount($employer->id)) {
+            if (! $request->is('api/*')) {
+                $request->session()->put('ladill_account', $employer->id);
+            }
+
+            return $employer->id;
+        }
+
+        return $accountId;
+    }
 }
@@ -0,0 +1,67 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Models\PosLocation;
+use App\Models\User;
+use App\Services\Pos\PosLocationService;
+use App\Services\Pos\PosMemberResolver;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\View;
+use Symfony\Component\HttpFoundation\Response;
+
+class SetActingLocation
+{
+    public function __construct(
+        private PosLocationService $locations,
+        private PosMemberResolver $members,
+    ) {}
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (! $user = $request->user()) {
+            return $next($request);
+        }
+
+        $account = ladill_account() ?? $user;
+        $ownerRef = (string) $account->public_id;
+        $member = $this->members->memberFor($user, $ownerRef);
+        $scope = $this->members->locationScope($member, $ownerRef, $user);
+
+        $request->attributes->set('pos.member', $member);
+        $request->attributes->set('pos.locationScope', $scope);
+
+        $location = $this->resolveLocation($request, $ownerRef, $scope);
+        $request->attributes->set('actingLocation', $location);
+
+        if (! $request->is('api/*')) {
+            View::share('actingLocation', $location);
+            View::share('accessibleLocations', $this->locations->accessible($ownerRef, $scope));
+            View::share('posMember', $member);
+            View::share('canManageBranches', $this->members->canManageBranches($member, $ownerRef, $user));
+            View::share('canManageTeam', $this->members->canManageTeam($member, $ownerRef, $user));
+        }
+
+        return $next($request);
+    }
+
+    private function resolveLocation(Request $request, string $ownerRef, ?int $scope): PosLocation
+    {
+        if ($scope !== null) {
+            return PosLocation::owned($ownerRef)->whereKey($scope)->firstOrFail();
+        }
+
+        if (! $request->is('api/*')) {
+            $sessionId = (int) $request->session()->get('ladill_pos_location', 0);
+            if ($sessionId > 0) {
+                $fromSession = PosLocation::owned($ownerRef)->whereKey($sessionId)->first();
+                if ($fromSession) {
+                    return $fromSession;
+                }
+            }
+        }
+
+        return $this->locations->ensureDefault($ownerRef);
+    }
+}
@@ -17,6 +17,7 @@ class PosLocation extends Model
        'owner_ref',
        'name',
        'currency',
+        'is_default',
        'service_style',
        'receipt_footer',
        'receipt_header',
@@ -28,6 +29,7 @@ class PosLocation extends Model
    protected function casts(): array
    {
        return [
+            'is_default' => 'boolean',
            'printer_paper_mm' => 'integer',
            'printer_auto_print' => 'boolean',
        ];
@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class PosMember extends Model
+{
+    public const ROLE_ADMIN = 'admin';
+
+    public const ROLE_MANAGER = 'manager';
+
+    public const ROLE_CASHIER = 'cashier';
+
+    protected $fillable = [
+        'owner_ref',
+        'user_ref',
+        'role',
+        'location_id',
+    ];
+
+    public function location(): BelongsTo
+    {
+        return $this->belongsTo(PosLocation::class, 'location_id');
+    }
+
+    public function hasRole(string ...$roles): bool
+    {
+        return in_array($this->role, $roles, true);
+    }
+
+    public function scopeOwned(Builder $query, string $ownerRef): Builder
+    {
+        return $query->where('owner_ref', $ownerRef);
+    }
+}
@@ -37,18 +37,38 @@ class User extends Authenticatable
            ->where('status', QrTeamMember::STATUS_ACTIVE);
    }

+    public function posMemberships(): HasMany
+    {
+        return $this->hasMany(PosMember::class, 'user_ref', 'public_id');
+    }
+
    public function canAccessAccount(int $accountId): bool
    {
-        return $accountId === $this->id
-            || $this->memberships()->where('account_id', $accountId)->exists();
+        if ($accountId === $this->id) {
+            return true;
+        }
+
+        if ($this->memberships()->where('account_id', $accountId)->exists()) {
+            return true;
+        }
+
+        $account = self::find($accountId);
+
+        return $account !== null
+            && $this->posMemberships()->where('owner_ref', $account->public_id)->exists();
    }

    /** @return Collection<int, User> */
    public function accessibleAccounts(): Collection
    {
-        $ids = $this->memberships()->pluck('account_id')->all();
+        $qrIds = $this->memberships()->pluck('account_id')->all();
+        $posOwnerRefs = $this->posMemberships()->pluck('owner_ref')->all();

-        return collect([$this])->merge(self::whereIn('id', $ids)->get())->unique('id')->values();
+        return collect([$this])
+            ->merge(self::whereIn('id', $qrIds)->get())
+            ->merge(self::whereIn('public_id', $posOwnerRefs)->get())
+            ->unique('id')
+            ->values();
    }

    public function avatarUrl(): ?string
@@ -27,9 +27,14 @@ class AppServiceProvider extends ServiceProvider
            $account = ladill_account();
            $restaurant = false;
            if ($account) {
+                $actingLocation = request()->attributes->get('actingLocation');
+                if ($actingLocation instanceof PosLocation) {
+                    $restaurant = $actingLocation->isRestaurant();
+                } else {
                    $restaurant = PosLocation::owned((string) $account->public_id)
                        ->where('service_style', PosLocation::STYLE_RESTAURANT)
                        ->exists();
+                }
                $svc = app(SubscriptionService::class);
                $view->with('isPro', $svc->isPro($account));
                $view->with('hasPaidPlan', $svc->hasPaidPlan($account));
@@ -0,0 +1,74 @@
+<?php
+
+namespace App\Services\Identity;
+
+use Illuminate\Http\Client\Response;
+use Illuminate\Support\Facades\Http;
+use RuntimeException;
+
+class IdentityTeamClient
+{
+    /**
+     * @param  list<string>  $apps
+     * @param  array<string, mixed>  $metadata
+     *
+     * @return array<string, mixed>
+     */
+    public function inviteAppMember(
+        string $ownerPublicId,
+        string $email,
+        array $apps,
+        array $metadata = [],
+        string $role = 'member',
+    ): array {
+        $response = $this->request('post', '/identity/team/invite', [
+            'owner' => $ownerPublicId,
+            'email' => strtolower(trim($email)),
+            'apps' => $apps,
+            'role' => $role,
+            'metadata' => $metadata,
+        ]);
+
+        return (array) $response->json('data', []);
+    }
+
+    public function postAuthRedirect(string $userPublicId, string $intendedUrl): string
+    {
+        $response = $this->request('get', '/identity/team/post-auth-redirect', [
+            'user' => $userPublicId,
+            'redirect' => $intendedUrl,
+        ]);
+
+        return (string) $response->json('data.url', $intendedUrl);
+    }
+
+    /** @return list<array<string, mixed>> */
+    public function teamAccess(string $userPublicId): array
+    {
+        $response = $this->request('get', '/identity/team/access', [
+            'user' => $userPublicId,
+        ]);
+
+        return (array) $response->json('data', []);
+    }
+
+    private function request(string $method, string $path, array $query = []): Response
+    {
+        $url = rtrim((string) config('identity.api_url'), '/').$path;
+        $key = config('identity.api_key');
+
+        if ($url === '' || ! is_string($key) || $key === '') {
+            throw new RuntimeException('Identity API is not configured.');
+        }
+
+        $response = Http::withToken($key)
+            ->timeout(10)
+            ->{$method}($url, $query);
+
+        if (! $response->successful()) {
+            throw new RuntimeException($response->json('message') ?: 'Identity API request failed.');
+        }
+
+        return $response;
+    }
+}
@@ -3,14 +3,76 @@
 namespace App\Services\Pos;

 use App\Models\PosLocation;
+use Illuminate\Http\Request;
+use Illuminate\Support\Collection;

 class PosLocationService
 {
    public function ensureDefault(string $ownerRef): PosLocation
    {
-        return PosLocation::owned($ownerRef)->firstOrCreate(
-            ['owner_ref' => $ownerRef, 'name' => 'Main register'],
-            ['currency' => config('pos.default_currency', 'GHS')],
-        );
+        $existing = PosLocation::owned($ownerRef)
+            ->where('is_default', true)
+            ->first()
+            ?? PosLocation::owned($ownerRef)->orderBy('id')->first();
+
+        if ($existing) {
+            return $existing;
+        }
+
+        return PosLocation::create([
+            'owner_ref' => $ownerRef,
+            'name' => 'Main register',
+            'currency' => config('pos.default_currency', 'GHS'),
+            'is_default' => true,
+        ]);
+    }
+
+    public function resolve(Request $request): PosLocation
+    {
+        $acting = $request->attributes->get('actingLocation');
+        if ($acting instanceof PosLocation) {
+            return $acting;
+        }
+
+        return $this->ensureDefault($this->ownerRefFromRequest($request));
+    }
+
+    /** @return Collection<int, PosLocation> */
+    public function accessible(string $ownerRef, ?int $locationScope): Collection
+    {
+        $query = PosLocation::owned($ownerRef)->orderBy('name');
+
+        if ($locationScope !== null) {
+            $query->where('id', $locationScope);
+        }
+
+        return $query->get();
+    }
+
+    public function switch(Request $request, int $locationId): PosLocation
+    {
+        $ownerRef = $this->ownerRefFromRequest($request);
+        $scope = $request->attributes->get('pos.locationScope');
+
+        $location = PosLocation::owned($ownerRef)->whereKey($locationId)->firstOrFail();
+
+        if ($scope !== null && (int) $scope !== $location->id) {
+            abort(403, 'You do not have access to that branch.');
+        }
+
+        if (! $request->is('api/*')) {
+            $request->session()->put('ladill_pos_location', $location->id);
+        }
+
+        $request->attributes->set('actingLocation', $location);
+
+        return $location;
+    }
+
+    private function ownerRefFromRequest(Request $request): string
+    {
+        $user = ladill_account() ?? $request->user();
+
+        return (string) $user->public_id;
    }
 }
@@ -0,0 +1,64 @@
+<?php
+
+namespace App\Services\Pos;
+
+use App\Models\PosMember;
+use App\Models\User;
+
+class PosMemberResolver
+{
+    public function isAccountOwner(User $actor, string $ownerRef): bool
+    {
+        return $actor->public_id === $ownerRef;
+    }
+
+    public function memberFor(User $actor, string $ownerRef): ?PosMember
+    {
+        if ($this->isAccountOwner($actor, $ownerRef)) {
+            return null;
+        }
+
+        return PosMember::query()
+            ->where('owner_ref', $ownerRef)
+            ->where('user_ref', $actor->public_id)
+            ->first();
+    }
+
+    /** Location ID the member may access; null = all branches. */
+    public function locationScope(?PosMember $member, string $ownerRef, User $actor): ?int
+    {
+        if ($this->isAccountOwner($actor, $ownerRef)) {
+            return null;
+        }
+
+        if ($member === null) {
+            abort(403, 'You do not have access to this POS account.');
+        }
+
+        if ($member->role === PosMember::ROLE_CASHIER) {
+            abort_unless($member->location_id, 403, 'Your cashier account is not assigned to a branch.');
+
+            return (int) $member->location_id;
+        }
+
+        return $member->location_id ? (int) $member->location_id : null;
+    }
+
+    public function canManageBranches(?PosMember $member, string $ownerRef, User $actor): bool
+    {
+        if ($this->isAccountOwner($actor, $ownerRef)) {
+            return true;
+        }
+
+        return $member?->hasRole(PosMember::ROLE_ADMIN, PosMember::ROLE_MANAGER) ?? false;
+    }
+
+    public function canManageTeam(?PosMember $member, string $ownerRef, User $actor): bool
+    {
+        if ($this->isAccountOwner($actor, $ownerRef)) {
+            return true;
+        }
+
+        return $member?->hasRole(PosMember::ROLE_ADMIN) ?? false;
+    }
+}
@@ -110,6 +110,25 @@ class SubscriptionService
        return PosLocation::owned($ownerRef)->count();
    }

+    public function canUseMultiLocation(User $user): bool
+    {
+        return $this->isPro($user);
+    }
+
+    public function canAddLocation(User $user, string $ownerRef): bool
+    {
+        if (! $this->canUseMultiLocation($user)) {
+            return $this->locationCount($ownerRef) < (int) config('pos.free.max_locations', 1);
+        }
+
+        return true;
+    }
+
+    public function canManageTeam(User $user): bool
+    {
+        return $this->isPro($user);
+    }
+
    /** @return array{0:bool,1:string} */
    public function subscribe(User $user): array
    {
@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Services\Pos;
+
+use App\Models\PosMember;
+use App\Models\User;
+use App\Services\Identity\IdentityTeamClient;
+
+class TeamMemberProvisioner
+{
+    public function __construct(
+        protected IdentityTeamClient $identity,
+    ) {}
+
+    public function sync(User $user): void
+    {
+        PosMember::query()
+            ->where('user_ref', strtolower((string) $user->email))
+            ->update(['user_ref' => $user->public_id]);
+
+        try {
+            $access = $this->identity->teamAccess($user->public_id);
+        } catch (\Throwable) {
+            return;
+        }
+
+        foreach ($access as $grant) {
+            if (($grant['self'] ?? false) || ($grant['full_access'] ?? false)) {
+                continue;
+            }
+
+            $apps = (array) ($grant['apps'] ?? []);
+            if (! in_array('pos', $apps, true)) {
+                continue;
+            }
+
+            $meta = (array) data_get($grant, 'metadata.pos', []);
+
+            PosMember::updateOrCreate(
+                [
+                    'owner_ref' => (string) ($grant['account'] ?? $user->public_id),
+                    'user_ref' => $user->public_id,
+                ],
+                [
+                    'role' => (string) ($meta['role'] ?? PosMember::ROLE_CASHIER),
+                    'location_id' => $meta['location_id'] ?? null,
+                ],
+            );
+        }
+    }
+}
@@ -18,6 +18,7 @@ return Application::configure(basePath: dirname(__DIR__))
        ]));
        $middleware->web(append: [
            \App\Http\Middleware\SetActingAccount::class,
+            \App\Http\Middleware\SetActingLocation::class,
            \App\Http\Middleware\InjectBootSplash::class,
        ]);
        $middleware->alias([
@@ -30,6 +30,12 @@ return [
        'max_products' => (int) env('POS_FREE_MAX_PRODUCTS', 50),
    ],

+    'roles' => [
+        'admin' => 'Admin — full access to all branches',
+        'manager' => 'Manager — all branches (or one if assigned)',
+        'cashier' => 'Cashier — assigned branch only',
+    ],
+
    'upgrade_banner' => [
        'title' => 'Unlock POS Pro or Business',
        'description' => 'Unlimited registers & catalog, stock tracking & ecosystem sync — from GHS 79/mo.',
@@ -0,0 +1,27 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('pos_members', function (Blueprint $table) {
+            $table->id();
+            $table->string('owner_ref')->index();
+            $table->string('user_ref')->index();
+            $table->string('role', 30)->default('cashier');
+            $table->foreignId('location_id')->nullable()->constrained('pos_locations')->nullOnDelete();
+            $table->timestamps();
+
+            $table->unique(['owner_ref', 'user_ref']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('pos_members');
+    }
+};
@@ -0,0 +1,34 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('pos_locations', function (Blueprint $table) {
+            $table->boolean('is_default')->default(false)->after('currency');
+        });
+
+        $defaults = DB::table('pos_locations')
+            ->select('owner_ref', DB::raw('MIN(id) as id'))
+            ->groupBy('owner_ref')
+            ->get();
+
+        foreach ($defaults as $row) {
+            DB::table('pos_locations')
+                ->where('id', $row->id)
+                ->update(['is_default' => true]);
+        }
+    }
+
+    public function down(): void
+    {
+        Schema::table('pos_locations', function (Blueprint $table) {
+            $table->dropColumn('is_default');
+        });
+    }
+};
@@ -21,6 +21,10 @@

@includeIf('partials.topbar-widgets-mid')

+@include('partials.topbar-location-switcher')
+
+@includeIf('partials.topbar-account-switcher')
+
 <div class="hidden h-8 w-px bg-slate-200 lg:block"></div>

 <div class="relative hidden lg:block" x-data="{ profileOpen: false }" @click.outside="profileOpen = false" @keydown.escape.window="profileOpen = false">
@@ -0,0 +1,30 @@
+@if (isset($accessibleLocations) && $accessibleLocations->count() > 1)
+    <div x-data="{ branchOpen: false }" @click.outside="branchOpen = false" class="relative hidden lg:block">
+        <button type="button" @click="branchOpen = !branchOpen"
+                class="inline-flex items-center gap-1.5 rounded-full border border-slate-200 px-3 py-2 text-sm text-slate-700 transition hover:bg-slate-50">
+            <span class="max-w-[140px] truncate">{{ $actingLocation->name ?? 'Branch' }}</span>
+            <svg class="h-4 w-4 text-slate-400" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" d="m19 9-7 7-7-7"/></svg>
+        </button>
+        <div x-show="branchOpen" x-cloak x-transition
+             class="absolute right-0 z-30 mt-2 w-60 rounded-xl border border-slate-200 bg-white p-1 shadow-lg">
+            <p class="px-3 py-1.5 text-[10px] font-bold uppercase tracking-widest text-slate-400">Switch branch</p>
+            @foreach ($accessibleLocations as $branch)
+                <form method="POST" action="{{ route('pos.location.switch') }}">
+                    @csrf
+                    <input type="hidden" name="location" value="{{ $branch->id }}">
+                    <button type="submit" class="flex w-full items-center justify-between rounded-lg px-3 py-2 text-left text-sm hover:bg-slate-50 {{ $branch->id === ($actingLocation->id ?? null) ? 'font-semibold text-indigo-700' : 'text-slate-700' }}">
+                        <span class="truncate">{{ $branch->name }}</span>
+                        @if ($branch->id === ($actingLocation->id ?? null))<span class="text-indigo-600">✓</span>@endif
+                    </button>
+                </form>
+            @endforeach
+            @if (! empty($canManageBranches))
+                <div class="mt-1 border-t border-slate-100 pt-1">
+                    <a href="{{ route('pos.branches.index') }}" class="block rounded-lg px-3 py-2 text-sm text-indigo-600 hover:bg-slate-50">Manage branches</a>
+                </div>
+            @endif
+        </div>
+    </div>
+@elseif (isset($actingLocation))
+    <span class="hidden rounded-full border border-slate-200 px-3 py-2 text-sm text-slate-600 lg:inline-flex">{{ $actingLocation->name }}</span>
+@endif
@@ -0,0 +1,32 @@
+<x-app-layout title="Add branch">
+    <x-settings.page description="Create a new register location.">
+        <x-settings.card title="New branch">
+            <form method="POST" action="{{ route('pos.branches.store') }}" class="space-y-4">
+                @csrf
+                <div>
+                    <label for="name" class="text-sm font-medium text-slate-700">Branch name</label>
+                    <input type="text" id="name" name="name" value="{{ old('name') }}" required
+                           placeholder="e.g. Airport kiosk"
+                           class="mt-1.5 block w-full rounded-xl border-slate-300 text-sm shadow-sm focus:border-indigo-500 focus:ring-indigo-500">
+                </div>
+                <div>
+                    <label for="currency" class="text-sm font-medium text-slate-700">Currency</label>
+                    <input type="text" id="currency" name="currency" value="{{ old('currency', config('pos.default_currency', 'GHS')) }}" maxlength="3" required
+                           class="mt-1.5 block w-full rounded-xl border-slate-300 text-sm uppercase shadow-sm focus:border-indigo-500 focus:ring-indigo-500">
+                </div>
+                <div>
+                    <label for="service_style" class="text-sm font-medium text-slate-700">Service style</label>
+                    <select id="service_style" name="service_style"
+                            class="mt-1.5 block w-full rounded-xl border-slate-300 text-sm shadow-sm focus:border-indigo-500 focus:ring-indigo-500">
+                        <option value="retail" @selected(old('service_style') === 'retail')>Retail</option>
+                        <option value="restaurant" @selected(old('service_style') === 'restaurant')>Restaurant / café</option>
+                    </select>
+                </div>
+                <div class="flex justify-end gap-3">
+                    <a href="{{ route('pos.branches.index') }}" class="rounded-xl border border-slate-200 px-4 py-2 text-sm font-medium text-slate-700 hover:bg-slate-50">Cancel</a>
+                    <button type="submit" class="btn-primary">Create branch</button>
+                </div>
+            </form>
+        </x-settings.card>
+    </x-settings.page>
+</x-app-layout>
@@ -0,0 +1,42 @@
+<x-app-layout title="Edit branch">
+    <x-settings.page description="Update branch details.">
+        <x-settings.card title="Edit {{ $location->name }}">
+            <form method="POST" action="{{ route('pos.branches.update', $location) }}" class="space-y-4">
+                @csrf
+                @method('PUT')
+                <div>
+                    <label for="name" class="text-sm font-medium text-slate-700">Branch name</label>
+                    <input type="text" id="name" name="name" value="{{ old('name', $location->name) }}" required
+                           class="mt-1.5 block w-full rounded-xl border-slate-300 text-sm shadow-sm focus:border-indigo-500 focus:ring-indigo-500">
+                </div>
+                <div>
+                    <label for="currency" class="text-sm font-medium text-slate-700">Currency</label>
+                    <input type="text" id="currency" name="currency" value="{{ old('currency', $location->currency) }}" maxlength="3" required
+                           class="mt-1.5 block w-full rounded-xl border-slate-300 text-sm uppercase shadow-sm focus:border-indigo-500 focus:ring-indigo-500">
+                </div>
+                <div>
+                    <label for="service_style" class="text-sm font-medium text-slate-700">Service style</label>
+                    <select id="service_style" name="service_style"
+                            class="mt-1.5 block w-full rounded-xl border-slate-300 text-sm shadow-sm focus:border-indigo-500 focus:ring-indigo-500">
+                        <option value="retail" @selected(old('service_style', $location->service_style) === 'retail')>Retail</option>
+                        <option value="restaurant" @selected(old('service_style', $location->service_style) === 'restaurant')>Restaurant / café</option>
+                    </select>
+                </div>
+                <label class="flex items-center gap-2 text-sm text-slate-700">
+                    <input type="checkbox" name="is_default" value="1" @checked(old('is_default', $location->is_default))
+                           class="rounded border-slate-300 text-indigo-600 focus:ring-indigo-500">
+                    Default branch for admins
+                </label>
+                <div class="flex justify-end gap-3">
+                    <a href="{{ route('pos.branches.index') }}" class="rounded-xl border border-slate-200 px-4 py-2 text-sm font-medium text-slate-700 hover:bg-slate-50">Cancel</a>
+                    <button type="submit" class="btn-primary">Save branch</button>
+                </div>
+            </form>
+            <form method="POST" action="{{ route('pos.branches.destroy', $location) }}" class="mt-4 border-t border-slate-100 pt-4" onsubmit="return confirm('Remove this branch?');">
+                @csrf
+                @method('DELETE')
+                <button type="submit" class="text-sm font-medium text-red-600 hover:text-red-800">Delete branch</button>
+            </form>
+        </x-settings.card>
+    </x-settings.page>
+</x-app-layout>
@@ -0,0 +1,58 @@
+<x-app-layout title="Branches">
+    <x-settings.page description="Manage registers and locations across your business.">
+        <div class="mb-4 flex flex-wrap items-center justify-between gap-3">
+            <div class="flex flex-wrap gap-2 text-sm">
+                <a href="{{ route('pos.settings') }}" class="text-slate-500 hover:text-slate-800">Branch settings</a>
+                <span class="text-slate-300">/</span>
+                <span class="font-medium text-slate-900">All branches</span>
+                @if (! empty($canManageTeam))
+                    <a href="{{ route('pos.team.index') }}" class="ml-3 text-indigo-600 hover:text-indigo-800">Team</a>
+                @endif
+            </div>
+            @if ($canAddBranch)
+                <a href="{{ route('pos.branches.create') }}" class="btn-primary">Add branch</a>
+            @endif
+        </div>
+
+        <x-settings.card title="Branches" description="Each branch has its own register, receipts, and sales history.">
+            @if ($branches->isEmpty())
+                <p class="text-sm text-slate-500">No branches yet.</p>
+            @else
+                <ul class="divide-y divide-slate-100">
+                    @foreach ($branches as $branch)
+                        <li class="flex items-center justify-between gap-4 py-3">
+                            <div>
+                                <p class="font-medium text-slate-900">
+                                    {{ $branch->name }}
+                                    @if ($branch->is_default)
+                                        <span class="ml-2 rounded-full bg-slate-100 px-2 py-0.5 text-[10px] font-semibold uppercase text-slate-500">Default</span>
+                                    @endif
+                                </p>
+                                <p class="text-xs text-slate-500">
+                                    {{ strtoupper($branch->currency) }}
+                                    · {{ $branch->isRestaurant() ? 'Restaurant' : 'Retail' }}
+                                </p>
+                            </div>
+                            <div class="flex items-center gap-3">
+                                @if (($actingLocation->id ?? null) !== $branch->id)
+                                    <form method="POST" action="{{ route('pos.location.switch') }}">
+                                        @csrf
+                                        <input type="hidden" name="location" value="{{ $branch->id }}">
+                                        <button type="submit" class="text-sm font-medium text-indigo-600 hover:text-indigo-800">Switch</button>
+                                    </form>
+                                @endif
+                                <a href="{{ route('pos.branches.edit', $branch) }}" class="text-sm font-medium text-slate-600 hover:text-slate-900">Edit</a>
+                            </div>
+                        </li>
+                    @endforeach
+                </ul>
+            @endif
+
+            @unless ($hasMultiLocation)
+                <p class="mt-4 rounded-xl bg-amber-50 px-4 py-3 text-sm text-amber-900">
+                    Multi-branch POS is available on <a href="{{ route('pos.pro.index') }}" class="font-semibold underline">Pro or Business</a>.
+                </p>
+            @endunless
+        </x-settings.card>
+    </x-settings.page>
+</x-app-layout>
@@ -1,6 +1,19 @@
 <x-app-layout title="Settings">
-    <x-settings.page description="Register location, receipt footer, and catalog imports.">
-        <x-settings.card title="Location" description="Register name, currency, service style, and receipt footer.">
+    <x-settings.page description="Branch settings, receipt footer, and catalog imports.">
+        <div class="mb-4 flex flex-wrap items-center justify-between gap-3">
+            <p class="text-sm text-slate-600">
+                Editing <span class="font-semibold text-slate-900">{{ $location->name }}</span>
+            </p>
+            <div class="flex flex-wrap gap-3 text-sm">
+                @if (! empty($canManageBranches))
+                    <a href="{{ route('pos.branches.index') }}" class="font-medium text-indigo-600 hover:text-indigo-800">Branches</a>
+                @endif
+                @if (! empty($canManageTeam))
+                    <a href="{{ route('pos.team.index') }}" class="font-medium text-indigo-600 hover:text-indigo-800">Team</a>
+                @endif
+            </div>
+        </div>
+        <x-settings.card title="Branch settings" description="Register name, currency, service style, and receipt footer for this branch.">
            <form method="POST" action="{{ route('pos.settings.update') }}" enctype="multipart/form-data" class="space-y-4">
                @csrf
                @method('PUT')
@@ -0,0 +1,88 @@
+<x-app-layout title="Team">
+    <x-settings.page description="Invite cashiers and managers, and assign them to branches.">
+        <div class="mb-4 flex flex-wrap gap-2 text-sm">
+            <a href="{{ route('pos.settings') }}" class="text-slate-500 hover:text-slate-800">Settings</a>
+            <span class="text-slate-300">/</span>
+            <span class="font-medium text-slate-900">Team</span>
+            @if (! empty($canManageBranches))
+                <a href="{{ route('pos.branches.index') }}" class="ml-3 text-indigo-600 hover:text-indigo-800">Branches</a>
+            @endif
+        </div>
+
+        <x-settings.card title="Invite team member" description="Invited users sign in with Ladill and get access to this POS account.">
+            <form method="POST" action="{{ route('pos.team.store') }}" class="grid gap-4 md:grid-cols-2">
+                @csrf
+                <div class="md:col-span-2">
+                    <label for="email" class="text-sm font-medium text-slate-700">Email</label>
+                    <input type="email" id="email" name="email" value="{{ old('email') }}" required
+                           class="mt-1.5 block w-full rounded-xl border-slate-300 text-sm shadow-sm focus:border-indigo-500 focus:ring-indigo-500">
+                </div>
+                <div>
+                    <label for="role" class="text-sm font-medium text-slate-700">Role</label>
+                    <select id="role" name="role" x-data x-on:change="$dispatch('role-changed', $event.target.value)"
+                            class="mt-1.5 block w-full rounded-xl border-slate-300 text-sm shadow-sm focus:border-indigo-500 focus:ring-indigo-500">
+                        @foreach ($roles as $key => $label)
+                            <option value="{{ $key }}" @selected(old('role') === $key)>{{ $label }}</option>
+                        @endforeach
+                    </select>
+                </div>
+                <div x-data="{ role: @js(old('role', 'cashier')) }" @role-changed.window="role = $event.detail">
+                    <label for="location_id" class="text-sm font-medium text-slate-700">Branch</label>
+                    <select id="location_id" name="location_id"
+                            class="mt-1.5 block w-full rounded-xl border-slate-300 text-sm shadow-sm focus:border-indigo-500 focus:ring-indigo-500">
+                        <option value="">All branches</option>
+                        @foreach ($branches as $branch)
+                            <option value="{{ $branch->id }}" @selected((int) old('location_id') === $branch->id)>{{ $branch->name }}</option>
+                        @endforeach
+                    </select>
+                    <p class="mt-1 text-xs text-slate-400" x-show="role === 'cashier'" x-cloak>Required for cashiers — limits the register and sales to one branch.</p>
+                </div>
+                <div class="md:col-span-2 flex justify-end">
+                    <button type="submit" class="btn-primary">Send invite</button>
+                </div>
+            </form>
+        </x-settings.card>
+
+        <x-settings.card title="Team members" class="mt-6">
+            @if ($members->isEmpty())
+                <p class="text-sm text-slate-500">No team members yet.</p>
+            @else
+                <div class="overflow-x-auto">
+                    <table class="min-w-full text-sm">
+                        <thead class="text-left text-xs uppercase text-slate-500">
+                            <tr>
+                                <th class="pb-2 pr-4">Member</th>
+                                <th class="pb-2 pr-4">Role</th>
+                                <th class="pb-2 pr-4">Branch</th>
+                                <th class="pb-2"></th>
+                            </tr>
+                        </thead>
+                        <tbody class="divide-y divide-slate-100">
+                            @foreach ($members as $member)
+                                @php
+                                    $display = str_contains($member->user_ref, '@')
+                                        ? $member->user_ref
+                                        : (\App\Models\User::where('public_id', $member->user_ref)->value('email') ?? $member->user_ref);
+                                @endphp
+                                <tr>
+                                    <td class="py-3 pr-4">{{ $display }}</td>
+                                    <td class="py-3 pr-4">{{ $roles[$member->role] ?? $member->role }}</td>
+                                    <td class="py-3 pr-4">{{ $member->location?->name ?? 'All branches' }}</td>
+                                    <td class="py-3 text-right">
+                                        @if ($member->user_ref !== auth()->user()->public_id && $member->user_ref !== strtolower((string) auth()->user()->email))
+                                            <form method="POST" action="{{ route('pos.team.destroy', $member) }}" class="inline" onsubmit="return confirm('Remove this member?');">
+                                                @csrf
+                                                @method('DELETE')
+                                                <button type="submit" class="text-red-600 hover:text-red-800">Remove</button>
+                                            </form>
+                                        @endif
+                                    </td>
+                                </tr>
+                            @endforeach
+                        </tbody>
+                    </table>
+                </div>
+            @endif
+        </x-settings.card>
+    </x-settings.page>
+</x-app-layout>
@@ -1,7 +1,9 @@
 <?php

 use App\Http\Controllers\Auth\SsoLoginController;
-use App\Http\Controllers\Pos\AiController;
+use App\Http\Controllers\AccountSwitchController;
+use App\Http\Controllers\Pos\LocationController;
+use App\Http\Controllers\Pos\MemberController;
 use App\Http\Controllers\Pos\DashboardController;
 use App\Http\Controllers\Pos\KitchenController;
 use App\Http\Controllers\Pos\MenuController;
@@ -50,6 +52,9 @@ Route::middleware(['auth', 'platform.session'])->group(function () {

    Route::get('/dashboard', [DashboardController::class, 'index'])->name('pos.dashboard');

+    Route::post('/account/switch', [AccountSwitchController::class, 'switch'])->name('account.switch');
+    Route::post('/settings/location/switch', [LocationController::class, 'switch'])->name('pos.location.switch');
+
    Route::get('/register', [RegisterController::class, 'index'])->name('pos.register');
    Route::get('/register/lookup', [RegisterController::class, 'lookup'])->name('pos.register.lookup');
    Route::post('/register/charge', [RegisterController::class, 'charge'])->name('pos.register.charge');
@@ -101,6 +106,15 @@ Route::middleware(['auth', 'platform.session'])->group(function () {

    Route::get('/settings', [SettingsController::class, 'index'])->name('pos.settings');
    Route::put('/settings', [SettingsController::class, 'update'])->name('pos.settings.update');
+    Route::get('/settings/branches', [LocationController::class, 'index'])->name('pos.branches.index');
+    Route::get('/settings/branches/create', [LocationController::class, 'create'])->name('pos.branches.create');
+    Route::post('/settings/branches', [LocationController::class, 'store'])->name('pos.branches.store');
+    Route::get('/settings/branches/{location}/edit', [LocationController::class, 'edit'])->name('pos.branches.edit');
+    Route::put('/settings/branches/{location}', [LocationController::class, 'update'])->name('pos.branches.update');
+    Route::delete('/settings/branches/{location}', [LocationController::class, 'destroy'])->name('pos.branches.destroy');
+    Route::get('/settings/team', [MemberController::class, 'index'])->name('pos.team.index');
+    Route::post('/settings/team', [MemberController::class, 'store'])->name('pos.team.store');
+    Route::delete('/settings/team/{member}', [MemberController::class, 'destroy'])->name('pos.team.destroy');
    Route::post('/settings/import-crm', [SettingsController::class, 'importCrm'])->middleware('pro')->name('pos.settings.import-crm');
    Route::post('/settings/import-merchant', [SettingsController::class, 'importMerchant'])->middleware('pro')->name('pos.settings.import-merchant');
    Route::post('/settings/tables', [SettingsController::class, 'storeTable'])->name('pos.settings.tables.store');
@@ -0,0 +1,193 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Http\Middleware\EnsurePlatformSession;
+use App\Models\Pos\ProSubscription;
+use App\Models\PosLocation;
+use App\Models\PosMember;
+use App\Models\PosSale;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class PosMultiBranchTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private function owner(): User
+    {
+        return User::create([
+            'public_id' => 'owner-'.uniqid(),
+            'name' => 'Owner',
+            'email' => uniqid().'@owner.example.com',
+        ]);
+    }
+
+    private function cashier(): User
+    {
+        return User::create([
+            'public_id' => 'cashier-'.uniqid(),
+            'name' => 'Cashier',
+            'email' => uniqid().'@cashier.example.com',
+        ]);
+    }
+
+    private function activatePro(User $user): void
+    {
+        ProSubscription::create([
+            'user_id' => $user->id,
+            'plan' => ProSubscription::PLAN_PRO,
+            'status' => ProSubscription::STATUS_ACTIVE,
+            'price_minor' => 7900,
+            'currency' => 'GHS',
+            'auto_renew' => true,
+            'started_at' => now(),
+            'current_period_end' => now()->addMonth(),
+        ]);
+    }
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->withoutMiddleware(EnsurePlatformSession::class);
+        $this->withoutVite();
+
+        config([
+            'pos.pro.enabled' => true,
+            'billing.api_url' => 'https://billing.test',
+            'billing.api_key' => 'test-key',
+        ]);
+    }
+
+    public function test_free_account_cannot_add_second_branch(): void
+    {
+        $owner = $this->owner();
+        PosLocation::create([
+            'owner_ref' => $owner->public_id,
+            'name' => 'Main register',
+            'currency' => 'GHS',
+            'is_default' => true,
+        ]);
+
+        $this->actingAs($owner)
+            ->post(route('pos.branches.store'), [
+                'name' => 'Second branch',
+                'currency' => 'GHS',
+                'service_style' => 'retail',
+            ])
+            ->assertRedirect(route('pos.pro.index'));
+
+        $this->assertSame(1, PosLocation::owned($owner->public_id)->count());
+    }
+
+    public function test_pro_account_can_add_branch(): void
+    {
+        $owner = $this->owner();
+        $this->activatePro($owner);
+
+        PosLocation::create([
+            'owner_ref' => $owner->public_id,
+            'name' => 'Main register',
+            'currency' => 'GHS',
+            'is_default' => true,
+        ]);
+
+        $this->actingAs($owner)
+            ->post(route('pos.branches.store'), [
+                'name' => 'Mall kiosk',
+                'currency' => 'GHS',
+                'service_style' => 'retail',
+            ])
+            ->assertRedirect(route('pos.branches.index'));
+
+        $this->assertSame(2, PosLocation::owned($owner->public_id)->count());
+    }
+
+    public function test_cashier_is_limited_to_assigned_branch_sales(): void
+    {
+        $owner = $this->owner();
+        $this->activatePro($owner);
+
+        $branchA = PosLocation::create([
+            'owner_ref' => $owner->public_id,
+            'name' => 'Downtown',
+            'currency' => 'GHS',
+            'is_default' => true,
+        ]);
+        $branchB = PosLocation::create([
+            'owner_ref' => $owner->public_id,
+            'name' => 'Airport',
+            'currency' => 'GHS',
+        ]);
+
+        $cashier = $this->cashier();
+        PosMember::create([
+            'owner_ref' => $owner->public_id,
+            'user_ref' => $cashier->public_id,
+            'role' => PosMember::ROLE_CASHIER,
+            'location_id' => $branchB->id,
+        ]);
+
+        $saleA = PosSale::create([
+            'owner_ref' => $owner->public_id,
+            'location_id' => $branchA->id,
+            'reference' => 'POS-A',
+            'currency' => 'GHS',
+            'status' => 'paid',
+            'payment_method' => 'cash',
+            'total_minor' => 1000,
+        ]);
+        $saleB = PosSale::create([
+            'owner_ref' => $owner->public_id,
+            'location_id' => $branchB->id,
+            'reference' => 'POS-B',
+            'currency' => 'GHS',
+            'status' => 'paid',
+            'payment_method' => 'cash',
+            'total_minor' => 2000,
+        ]);
+
+        $this->actingAs($cashier)
+            ->withSession(['ladill_account' => $owner->id])
+            ->get(route('pos.sales.show', $saleB))
+            ->assertOk()
+            ->assertSee('POS-B');
+
+        $this->actingAs($cashier)
+            ->withSession(['ladill_account' => $owner->id])
+            ->get(route('pos.sales.show', $saleA))
+            ->assertNotFound();
+    }
+
+    public function test_cashier_cannot_switch_to_other_branch(): void
+    {
+        $owner = $this->owner();
+        $this->activatePro($owner);
+
+        $branchA = PosLocation::create([
+            'owner_ref' => $owner->public_id,
+            'name' => 'Downtown',
+            'currency' => 'GHS',
+            'is_default' => true,
+        ]);
+        $branchB = PosLocation::create([
+            'owner_ref' => $owner->public_id,
+            'name' => 'Airport',
+            'currency' => 'GHS',
+        ]);
+
+        $cashier = $this->cashier();
+        PosMember::create([
+            'owner_ref' => $owner->public_id,
+            'user_ref' => $cashier->public_id,
+            'role' => PosMember::ROLE_CASHIER,
+            'location_id' => $branchB->id,
+        ]);
+
+        $this->actingAs($cashier)
+            ->withSession(['ladill_account' => $owner->id])
+            ->post(route('pos.location.switch'), ['location' => $branchA->id])
+            ->assertForbidden();
+    }
+}