Skip to content
Sanmopia Modernization

ADR 028 Authenticated Mother Booking Submission

Switch to normal mode

Context

Section titled “Context”

The modern reservation assistant flow must let an authenticated mother submit her own booking request from the browser. The same workflow still creates branch-scoped reservation facts, service occurrence facts, charge snapshots, payment readiness, caregiver payout, branch settlement, and HQ settlement projections.

Legacy screens often mixed those concerns. Browser code or admin forms carried member ids, branch ids, service term strings, address strings, and amount fields as if they were authority. That made customer booking, branch operation, settlement, and audit attribution hard to separate.

Decision

Section titled “Decision”

Authenticated booking has two actor concepts:

  • AuthenticatedReservationBookingSubmitter: backend-resolved submitter from Supabase Auth session and target branch facts.
  • BranchActor: backend-resolved operational branch actor used only when the workflow must persist branch-scoped reservation effects.

Mother submitter rules:

  • A mother can submit only for her own member_id.
  • Mother submitter authority is allowed only for SUBMIT_BOOKING_REQUEST at reservation DRAFT.
  • Browser-supplied branch actor, branch profile id, member role, amount, status, workflow state, and settlement facts are not trusted.
  • Opaque frontend branch-profile keys are accepted only as hints. Backend canonicalizes them to the Supabase branch profile for the selected branch and rejects only real UUID conflicts.

Branch and HQ submitter rules:

  • Branch and HQ submitters still require branch-scope authorization.
  • Branch/HQ operational commands continue through SpiceDB-backed branch MANAGE permission where command semantics require operator authority.

Platform authority split:

  • Supabase Auth/profile rows identify the authenticated user and canonical branch profile.
  • SpiceDB owns branch/HQ command authorization and reservation capability checks beyond the mother-owned draft submission exception.
  • Restate owns workflow execution/retry state.
  • Backend pricing/settlement commands own charge, payout, branch settlement, HQ settlement, and completion facts.
  • Frontend Astro remains Atomic Design presentation with NanoStores for ephemeral step/input state only.

Evidence

Section titled “Evidence”

2026-07-13 focused backend proof:

Terminal window
uv run pytest \
  src/sanmopia_modernization/interfaces/reservation_booking_api_test.py \
  src/sanmopia_modernization/interfaces/reservation_booking_http_test.py \
  src/sanmopia_modernization/adapters/reservation_booking/supabase_identity_test.py \
  src/sanmopia_modernization/application/platform/spicedb_authorization_test.py \
  src/sanmopia_modernization/domain/reservation_operations/features/reservation/reservation_capability_test.py

Result: 133 passed, 1 warning.

2026-07-13 architecture gate:

Terminal window
.venv/bin/tach check --dependencies --interfaces --exact
.venv/bin/tach check-external

Result: all modules and external dependencies validated.

2026-07-13 frontend unit proof:

Terminal window
pnpm vitest run src/lib/booking-client_test.ts

Result: 19 tests passed.

2026-07-13 browser-to-backend reservation and settlement proof:

Terminal window
RESERVATION_FLOW_ARTIFACT_DIR=output/playwright/reservation-card-flow-20260713-mother-submit-runtime-5 \
RESERVATION_FLOW_SUBMIT=1 \
RESERVATION_FLOW_SMOKE_SETTLEMENT=1 \
RESERVATION_FLOW_SETTLEMENT_DRIVER=backend \
RESERVATION_FLOW_SUBMIT_VIEWPORTS=desktop \
pnpm playwright:reservation-card-flow

Artifact: frontend-repo/output/playwright/reservation-card-flow-20260713-mother-submit-runtime-5/desktop-summary.json.

Observed result:

  • badResponses: []
  • submitted: true
  • settlementVisible: true
  • progressStatus: "확정"
  • payment workflow status: completed · 결제 진행 완료
  • mother-visible payable: 1,680,000원
  • booking request id: RBQ-d9518c49-093c-4fc4-8268-dec956b81e80
  • reservation booking id: e80f3139-8f9a-437d-b302-e0f82b245150
  • backend settlement driver success: true
  • final financial stage: settled
  • branch settlement: 100000
  • caregiver payout: 1580000
  • HQ settlement: 0
  • settlement ledger line count: 3

Known Gaps

Section titled “Known Gaps”

Implementation remains partial. Proof covers one authenticated mother desktop flow and backend settlement driver. It does not prove every mobile viewport, every branch/HQ browser operation, family-sponsored booking, payment-provider external callback, refund/partial refund, service suspension, address coverage conflict, or settlement data-room workflow.

The Playwright settlement completion session in this proof used the backend driver, not an HQ-admin browser session. HQ-admin settlement UX still needs its own browser evidence.

Consequences

Section titled “Consequences”

Mother reservation submission can be customer-owned without giving the browser branch operator authority. Branch operational effects remain backend-resolved and auditable. Future booking variants must add capability/projection contracts instead of moving pricing, status, RBAC, settlement, or workflow decisions into Astro/NanoStores.

Revision History

Section titled “Revision History”
  • 2026-07-13: proposed authenticated mother submitter split and recorded first browser-to-backend reservation plus settlement proof.
  • 2026-07-13: accepted by the workspace owner. Implementation remains partial; acceptance does not close the named browser, provider, refund, or settlement evidence gaps.