Add ability-based access control

Date: 2023-07-16

Status: implemented

Context

For controlling access to certain routes or managing permissions for performing actions (deleting users etc) a role based system was in place. Since an ability-based system can be more fine-grained and users can be assigned abilities independent from their role, such a system is superior and grants quicker and better control who can access what.

Decision

The role based system will be replaced by an ability-based access control.

Consequences

Roles have no impact on access control, but instead serve as a template which abilities a user should have.

The prisma schema, the database and the access control checks on each loader and action have to be updated. (Incrementally)

Update the booking mechanism

Date: 2023-07-16

Status: proposed

Context

When booking a driving lesson, several constraints have to be checked and criteria to be met. The current mechanism does not regard all constraints and thus leads to impossible situations

Decision

The mechanism has to be reworked to feature simpler but more validation mechanisms.

Checking if a slot is bookable will be based on the following steps:

1. Check if the user is allowed to book (ability, expiration)
2. Check if the user has not overbooked this week.
3. Check if the day is available (Weekend, Holiday)
4. Check if the day features enough available slots for the desired slot length
5. Check the stage of the user and display the respective lesson types

In the action, the time of the slot should be double-checked to be sure that nobody else has booked in the meantime or the instructor has added a blocked slot / manually added someone.

Consequences

The loader and action of the booking page have to be reworked, aswell as the schema has to be edited

• Add the lesson type
• Add the booking time