Admin Access

The dashboard's Google service account is only ever allowed to read sheet data — it can never write, edit, or delete anything in the source spreadsheets. This is enforced at the API level: every request uses the https://www.googleapis.com/auth/spreadsheets.readonly OAuth scope, defined once in netlify/functions/_utils/sheets.js and shared by every function below. A read-only-scoped credential is physically incapable of making write calls — Google's API rejects them before they reach the sheet, regardless of what the function code asks for.

Finance — the source sheet only lists the top 10 hotels per month, so Revenue MTD / Room Nights MTD / ADR are top-10 totals, not full-portfolio totals. A few hotels are priced in MYR instead of IDR; those are excluded from the IDR totals but still shown in the property table.

Revenue — the source sheet has no Traveloka column. "Rate Competitiveness" compares Imagination's IMAGTC rate against Agoda (the real OTA column present in the sheet); MG is also read as a secondary reference. Variance is calculated directly from IMAGTC vs Agoda, not from the sheet's own precomputed variance columns, which are based on a separate "5% Temporary" markup rate.

Sales — each calendar date is its own tab rather than a date column, so "bookings" are row counts within a date's tab and "active agents" are distinct "API Client" values seen this month.

Contracting — Budget/Achievement figures come from the "Target & Achievement" tab's own team-total row. Deal-type monthly counts (Static/Dynamic/Renewal) are re-summed in code from each PIC's rows on the "Summary" tab, not from that sheet's own bottom total rows, which don't reconcile with their own monthly figures. "Recent activity" has no real timestamp to sort by (the sheet's Day/Date column is almost always left blank), so it's ordered by row position on the current month's tab instead — a proxy for recency, not a guarantee.