Authorization + self-service rules for the admin surface, in one server-side module (every admin LiveView routes its reads and mutations through here — buttons are hidden AND actions re-checked).
The permission model
Core's sub-permission semantics (a sub implies its base) force the calendar module's orientation:
- base
"bookings"— access the bookings admin area, scoped to services YOU OWN. This is the key an owner grants to let a user run their own bookable services. - sub
"bookings.manage_all"— site-wide: every service (owned or site-level), every reservation, and the module settings page. Owner/superadmin roles hold it implicitly.
Self-service settings (owner-controlled, default OFF)
bookings_user_services_enabled(boolean, defaultfalse) — whether base-permission holders may CREATE services at all. Off = they can still manage services an admin assigned to them.bookings_max_services_per_user(integer, default1;0= unlimited) — per-user creation cap.
Summary
Functions
True when the scope may create a new service: site-wide managers always; base-permission holders only when self-service is enabled and they are under the per-user cap.
True when the scope may manage this specific service.
Booking lifecycle actions authorize against the booking's service.
Creates a service on behalf of scope. Site-wide managers create
SITE services (no owner); base-permission holders create services
owned by themselves (when allowed).
Site-wide management (sub-permission, Owner/superadmin implicit).
Service UUIDs the scope may see — feeds the reservations filter.
Services this scope may see in the admin (all opts pass through).
Functions
True when the scope may create a new service: site-wide managers always; base-permission holders only when self-service is enabled and they are under the per-user cap.
True when the scope may manage this specific service.
Booking lifecycle actions authorize against the booking's service.
Creates a service on behalf of scope. Site-wide managers create
SITE services (no owner); base-permission holders create services
owned by themselves (when allowed).
Site-wide management (sub-permission, Owner/superadmin implicit).
Service UUIDs the scope may see — feeds the reservations filter.
Services this scope may see in the admin (all opts pass through).