Overview

The Hearthstone Bakery website lets customers browse the menu, fill a basket and order bread, pastries and cakes for collection at the counter or for delivery. They choose a day and a two-hour time window, and they pay when they collect or when the order arrives. No card details are ever taken online.

The staff area is where the bakery runs the day: new orders come in, the bakers move them through baking and ready, the counter hands them over, and managers keep the menu, prices, opening days and delivery rules up to date. Every change is written to an activity log.

How the pieces fit together

Customers write orders and messages; staff read them and keep the products and rules that the website shows.

Who does what

What each person can see and do is set by a manager, area by area. See 8.3.

1. Getting Started

1.1 Signing in

Click Staff sign in at the bottom of any page of the website, or go to /AdminLogin. Enter your User name and Password and click Sign in.

The sign-in card. Ask a manager for your user name and first password.

• A wrong user name or password shows The user name or password is not right.
• After 6 wrong tries within 5 minutes the page answers Too many tries. Please wait a few minutes and try again.
• If a manager gave you a temporary password, the page asks you to choose your own straight away (see 1.2).
• A switched-off account cannot sign in.

1.2 Choosing your own password

The first time you sign in with a temporary password, the card changes: the password box becomes Current password, two boxes ask for the new password, and the button reads Save and sign in. Your password must be 8 to 100 characters and different from the temporary one. When it is saved you go straight to the dashboard, and any other place where you were signed in is signed out.

1.3 The staff screen

Every staff page has the same frame.

A: the bakery name. B: the menu with counts of new orders and unread messages. C: your name, View site (opens the website in a new tab) and Sign out. D: search and filters. E: the list; click a row to open it.

• The menu shows only the areas you have rights to. Without the Activity log right you see My activity instead.
• The orange number next to Orders counts new orders; next to Messages, unread messages.
• Lists show 10 rows a page (the activity log 15) with Previous and Next below.
• Windows close with Close, the × button or Esc. If you changed something and did not save, the site asks Leave without saving? first.

1.4 Confirmations

Anything that changes an order or removes something asks first. The right-hand button goes ahead; the left-hand button, Esc or a click outside the box steps back without changing anything.

Moving an order to its next step, and cancelling an order with an optional reason.

1.5 What you can see

A manager decides, area by area, whether you can View, Change and, for orders, use the Extra right (cancel orders). Areas you have no right to are left out of your menu. If you open one through a link, the page says No access.

A counter user with Orders and Messages only: the menu is shorter and the dashboard shows only what they may use.

If you try something you are not allowed to do, the site shows a short message such as You can look at orders but not change them. and the attempt is written to the activity log as Refused.

1.6 On a phone

The staff area works on phones and tablets. The menu folds behind the ☰ button at the top left; lists turn into cards you can scroll.

Dashboard, orders and the open menu on a phone.

1.7 Staying signed in and signing out

• A sign-in lasts 8 hours and renews while you keep working.
• When it runs out, the next click takes you back to the sign-in page.
• Click Sign out at the top right when you leave a shared computer.
• If a manager switches you off or gives you a new temporary password, you are signed out at once.

2. Dashboard

The dashboard opens after you sign in. It shows today's work at a glance.

2.1 The four numbers

You see the order boxes only with the Orders right, and the message box only with the Messages right.

2.2 Today's orders

Below the numbers is a table of up to 10 of today's orders, earliest time window first, with the customer, collect or delivery, the total and the status. Cancelled orders are left out. Below it are shortcuts to every area you can use.

3. Orders

Every order placed on the website lands here with the status New. Staff move it step by step until it is handed over.

3.1 The order steps

An order moves forward one step at a time. It can be cancelled at any step before Done; Done and Cancelled are final.

3.2 Finding an order

The list opens on Active (not done): every order that is not done or cancelled, earliest day and time first.

1. Type in the search box: a customer name, an order number (HB-1008 or just 1008), an email or a phone number.
2. Narrow the list with the status box (Any status, Active (not done), New, Baking, Ready, Done, Cancelled).
3. Pick a day: Today, Tomorrow, Today and later or Before today.
4. Choose Collect only or Delivery only to plan the counter or the van.

Day set to Today and status to Any status: the whole day, including orders already done.

If nothing matches, the list says No orders match.

3.3 Opening an order

Click a row. The window shows the time window, collect or delivery address, the customer's name, phone, email and note, when the order was placed, every item and the total, marked Total, unpaid because customers pay on collection or delivery.

3.4 Moving an order to its next step

You need the Change right for orders.

1. Click the button on the order's row, or open the order and click the same button in the window: Start baking, Mark ready, then Mark collected (collect) or Mark delivered (delivery).
2. Check the question and click Yes, do it. Not yet leaves the order as it was.

The list refreshes and a message at the bottom confirms, for example HB-1008 is now ready. The last step closes the order. Steps cannot be skipped or undone; if someone else moved the order first, you see That order cannot move to that step.

3.5 Cancelling an order

You need the Extra right Cancel orders.

1. Open the order and click Cancel order.
2. Type a reason if you want (up to 200 characters), for example Customer called, wrong day.
3. Click Cancel order. Keep it steps back.

The customer sees the order as cancelled on the Track page, and its place in the time window is free again for other customers. The reason is shown when you open the order later. Done and cancelled orders cannot be cancelled.

4. Products

Products are what customers can order: name, kind, price, how it is sold, a picture and a short description. Here you also mark items sold out for the day.

4.1 The product list

• Search by name or description, or pick a kind (Bread, Pastries, Cakes, Cookies and tarts).
• Status shows On sale or Sold out, and Favourite for products shown on the home page.
• The buttons Edit, Sold out / Back on sale and Delete appear only with the Change right for products.

4.2 Marking an item sold out

1. Click Sold out on the product's row.
2. Click Mark sold out. The message says, for example, Cardamom bun is marked sold out.

On the menu the card shows Sold out today instead of the Add button, and it leaves the home-page favourites. If a customer already has it in their basket, it is taken out when they place the order, with the note Cardamom bun is sold out today and was removed. Click Back on sale, then Put back on sale, when you have it again.

4.3 Changing a product

1. Click Edit.
2. Change what you need and click Save product.

A new price applies to new orders only. Orders already placed keep the price they were placed at.

4.4 Adding a product

1. Click Add a product at the top right.
2. Fill in the fields above and click Save product.

Fields that are missing or wrong are marked in red and nothing is saved until they are fixed.

4.5 Product pictures

The picture list shows every .webp file in the site's images/products folder. To use a new photo, have it saved there as a WebP file (a square-ish photo about 800 pixels wide works well), then pick it in the product window. Pictures cannot be uploaded from the staff area.

4.6 Deleting a product

1. Click Delete on the product's row.
2. Click Delete product. Keep it steps back.

The product disappears from the menu at once. Past orders keep their own copy of the name and price. If you only stop selling it for a while, use Sold out instead.

5. Messages

Messages sent through the website's contact form arrive here. Unread messages are marked and counted next to Messages in the menu.

5.1 Reading a message

1. Search by any word, or choose Unread or Read.
2. Click a row to open it. The window shows who wrote, their email, the topic (An order, Large order, Feedback or Other), when it arrived and the full message.

5.2 Answering and tidying up

• Reply by email opens your email program with the customer's address filled in.
• Mark as read clears the unread mark; Mark as unread puts it back. Opening a message does not mark it read on its own.
• Delete, then Delete message, removes it for everyone; it cannot be undone.

Marking and deleting need the Change right for messages; with View only you can read and reply.

6. Activity Log

Every sign-in, every change and every refused attempt is written to the log, newest first, with who did it and when.

6.1 Reading the log

• Search by a name, an order number or a word such as cancel.
• Choose Done or Refused to see only one kind. Refused rows are attempts the person had no right to, and wrong passwords.
• The log shows 15 rows a page.

6.2 My activity

Staff without the Activity log right see My activity in the menu instead: the same page, showing only what they did themselves.

7. Settings

Settings hold the bakery's contact details and the rules for online orders. Only managers can open and change them. Click Save settings at the bottom when you are done; every field is checked before anything is saved.

7.1 Contact and hours

• Phone, Email and Address appear in the footer of every page and on the Contact page; the address is also shown on collection confirmations.
• Opening hours: 1 to 7 lines, each written as days | times, for example Saturday | 7:00 to 15:00. These lines are only shown to customers; the order rules below decide when people can order.

7.2 Order rules

7.3 Which days and times customers can pick

With the example settings (12 hours notice, 14 days ahead, 6 orders per window).

The times use the clock of the server the site runs on, so the server must be set to the bakery's time zone (see 11.5). If two customers try for the last place at the same moment, the second one is told That time window is no longer available. Please choose another.

7.4 Closing for a holiday

1. Add the date to Closed dates, for example 2026-12-25, one per line.
2. Click Save settings.

The day disappears from the order page at once. Orders already placed for that day stay in the list; open them in Orders and phone those customers.

7.5 Changing the delivery area

Type the 5-digit ZIP codes you deliver to in Delivery ZIP codes, separated by commas, and save. A customer whose ZIP code is not on the list is told Sorry, we do not deliver to this ZIP code yet. Leave the box empty to stop delivery; the order page then says delivery is not available right now.

8. Users and Rights

Only managers can open Users. Here you add a staff account for each person and decide what they may do. Never share one account between people: the activity log shows who did what by account.

8.1 Adding a person

1. Click Add a person.
2. Enter a User name (3 to 30 letters, numbers, dots, dashes or underscores, for example sam or lena.park), the Full name and, if you like, a Job title.
3. Type a Temporary password of 8 characters or more and give it to the person.
4. Tick Manager only for people who may change settings and users. For everyone else, tick their rights in the grid (see 8.3).
5. Click Save person.

At their first sign-in the person is asked to choose their own password.

8.2 Changing a person

Click Edit on their row. You can change the name, job title, rights and manager tick. To reset a forgotten password, type a New temporary password; leave it empty to keep the current one. A new temporary password signs the person out everywhere and asks them to choose their own again.

8.3 The rights grid

• Change includes View; Extra includes Change.
• Everyone can open the dashboard and My account.
• A typical baker: Orders (Change), Products (Change). A typical counter: Orders (Change), Messages (Change).

8.4 Switching someone off

When someone leaves, click Switch off on their row and confirm. They are signed out at once and cannot sign in until you click Switch on. Accounts are not deleted, so the activity log keeps their name.

9. My Account

Every signed-in person can open My account. It shows your name, user name, role and the areas you may use.

9.1 Changing your password

1. Type your Current password.
2. Type the New password (8 characters or more) twice.
3. Click Change password.

You stay signed in here; every other place where you were signed in is signed out. Your name and rights can only be changed by a manager.

10. The Public Website

This chapter shows what customers see, so you can help them on the phone.

10.1 Home

The home page shows the next day customers can order for, how ordering works, the favourites (products ticked as favourites and on sale), the menu sections, and the address with the opening hours. Order online and See the menu lead to the menu.

10.2 The menu

Customers filter by kind with the buttons at the top or search by name. Add puts one item in the basket; the basket count shows at the top right. The basket is kept in the customer's own browser until they order.

10.3 Placing an order

The four parts of the Your order page.

• Customers change amounts with − and + (up to 20 of one item) and remove a line with ×.
• The summary shows the items, the delivery fee or Free, and the total. Prices include tax. For delivery it says how much more is needed for the minimum order or for free delivery.
• When something is missing or wrong, the fields are marked and the summary says Please fix the fields marked above.

Delivery chosen without an address or ZIP code.

When the order is placed the customer sees a thank-you with the order number, day and time, how they get it, the items and the total payable when you collect (or receive it), and a Track this order button. No email is sent, so customers should keep the number.

10.4 Track order

Customers enter the order number (with or without HB-) and the email they ordered with. They see the steps Received, Baking, Ready to collect (or Out for delivery) and Done, with the current one highlighted, plus the time, the items and the total. A wrong number or email shows We could not find that order with the bakery's phone number.

10.5 Contact

The contact form asks for a name, an email, a topic (an order, a large order, feedback or other) and a message of 10 to 1,000 characters. Sent messages appear in Messages.

10.6 On a phone

The website on a phone: the menu folds behind ☰ and the basket stays at the top.

11. Installation & Setup

This chapter is for the person who installs the site and looks after the server.

11.1 The very first sign-in

The first password is made by the site itself the first time the sign-in page opens. Each site gets its own.

1. Start the site on the server and open /AdminLogin in a browser on that same computer (address localhost). A box shows the user name admin and a password made for this site. Visitors from other computers never see the box.
2. The same details are in the file appConfig/initial-admin.txt, if you cannot open a browser on the server.
3. Sign in with them and choose your own password (8 characters or more).
4. Open Users, give yourself your real name, and add an account for each member of staff.

11.2 Locked out of every manager account

If no manager can sign in any more, open data/staff.json on the server, remove the manager accounts (or set their admin to false), save, and open the sign-in page. The site makes a new admin account with a new first password, shown as in 11.1.

11.3 Folders the site writes to

Give the web server's account (on IIS, the application pool) Modify rights on these folders:

11.4 HTTPS and private files

• Run the site on HTTPS only; staff passwords and customer details travel through it.
• After publishing, open /data/staff.json and /appConfig/initial-admin.txt in a browser. Both must answer 404 Not Found. The included web.config blocks them on IIS.

11.5 Time zone

Today, tomorrow, the baking notice and which windows are too soon all use the server's clock. Set the server to the bakery's time zone, or customers will see the wrong days and times.

11.6 Backups and updates

• Back up the data/ folder every day. It is the bakery's whole record.
• When you publish a new version of the site, do not copy the project's data/ folder over the live one: download the live data/ first, or leave it out of the publish.
• Product pictures live in images/products/; copy new ones there as .webp files.

12. Reference

12.1 Limits at a glance

12.2 Status colours

12.3 Order numbers

Orders are numbered from HB-1001 upward, one higher each time. The customer needs the number and their email to track an order.

13. Quick Answers

13.1 Common questions