Svelte Rooms Reservations

A full-stack room reservation system built with Svelte + SvelteKit, Prisma 7, and MariaDB. Handles user authentication, role-based access control, space management, recurring reservations, and admin operations.

Table of Contents

• Features
• Architecture
• Tech Stack
• Setup
• API Surface
• Data Models
• Key Patterns

Features

Core Functionality

• Authentication - JWT-based user sessions with bcrypt password hashing
• Role-Based Access Control - Five roles (Owner, Admin, User, Guest, Restricted) with permission checks
• Space Management - CRUD operations for rooms/spaces with locations
• Reservations - Booking system with date/time selection and recurring patterns (via rrule)
• Admin Operations - User role assignment, space management, mass reservation viewing/deletion
• Email Notifications - Nodemailer integration for confirmations and updates

Technical Capabilities

• Type-safe database access via Prisma 7 (ESM client)
• Server-side rendering with SvelteKit
• Responsive UI with Bootstrap 5
• Connection pooling optimized for shared hosting (connectionLimit: 1)
• Sass preprocessing with modern API
• Test coverage for authorization logic (Vitest)

Architecture

Authentication & Authorization

• Session Flow: Login form → JWT token stored in cookie → Checked via src/hooks.server.ts on protected routes
• Permission System: hasPermission(user.role, requiredRole) in src/lib/permissions/auth.ts
• Protected Routes: All routes under src/routes/(authenticated)/ require valid JWT
• Admin-Only Routes: Routes under src/routes/(authenticated)/(admin)/ check for Admin/Owner role

API Route Pattern

src/routes/(authenticated)/(admin)/api/{action}/+server.ts
├── POST handler accepts request
├── Validates user permissions
├── Calls database model (e.g., user.model.js, rooms.model.js)
└── Returns JSON response

Database Query Organization

• src/lib/server/user.model.js - User queries (findUser, createUser, updateRole)
• src/lib/server/rooms.model.js - Room queries (findRooms, createRoom, deleteRoom)
• Prisma Client - Instantiated in src/lib/server/db.ts with MariaDB adapter

Data Flow

SvelteKit Route (+page.server.ts)
  → Server Load Function or Form Action
    → Calls Model (user.model.js, rooms.model.js)
      → Uses PrismaClient
        → Returns data/result to component

Tech Stack

API Surface

Server Routes (API Endpoints)

Admin Routes - All under src/routes/(authenticated)/(admin)/api/

All routes validate user permissions before executing.

See prisma/schema.prisma for full schema.

User Roles & Permissions

Check src/lib/permissions/auth.ts for enforcement.

License

MIT License. See LICENSE file for details.