Improving Web Vulnerability Management through Automation at Lyft

Ideas you will meet

Distributed Systems

Consensus, time, failure and the fundamentals of scale-out.

Web Security

OWASP risks, XSS, CSRF, CORS and secure design.

What we already know about this

Our own lessons on these ideas. Read them here before you start, so it makes sense.

• Low-Level Design Practice · 11 minHotel managementRooms, bookings and availability: modelling date ranges, preventing double booking and pricing by room type and season.Read hereClose

  The problem

  Guests search for a room type and dates, book, check in, check out and pay. Staff manage rooms. The system must never double-book a room for overlapping dates.

  Entities

  100%

  Figure SDA-LLD-04-1 · Hotel classes · © forcsguy.com

  Booking.status moves through reserved, checked in, checked out, cancelled.

  Availability is a range problem

  A room is free for [in, out) if no active booking overlaps it. Two ranges overlap when startA < endB && startB < endA.

  const overlaps = (a: Range, b: Range) => a.start < b.end && b.start < a.end;
  
  function freeRooms(rooms: Room[], bookings: Booking[], want: Range, type: string) {
    return rooms.filter((r) => r.type === type &&
      !bookings.some((b) => b.room === r && b.status !== "CANCELLED" && overlaps(b, want)));
  }
  

  Booking safely

  100%

  Figure SDA-LLD-04-2 · Booking flow · © forcsguy.com

  The check and the insert must be one atomic step. In a database that means a transaction with a lock on the room row (or an exclusion constraint on the date range). In memory it means a lock per room.

  Pricing

  Keep price calculation behind RatePlan: base price per room type, multiplied by season, weekday and demand, with member discounts. A Booking stores the price it was sold at, so later rate changes do not alter old bookings.

  Cancellation, check-in and check-out

  • Cancel: apply a cancellation policy (strategy) to compute the refund from how close the stay is.
  • Check-in: assign a specific room if the booking was for a type, mark checked in, create a folio for extra charges.
  • Check-out: add extras, settle the payment, mark the room "needs cleaning" and release it for new bookings after housekeeping.

  Extensions

  Group bookings, room upgrades, overbooking with a controlled allowance, and housekeeping as a small state machine (dirty, cleaning, ready).

  Real-world reading

  Related reading

  • Scaling Gradient Boosted Trees for Click-Through-Rate Prediction at YelpYelp engineers · YelpCase Studies
  • Improving Search Engine Efficiency by over 25% at eBayeBay engineers · eBayCase Studies
  • Docker Containers that Power Over 100.000 Online Shops at ShopifyShopify engineers · ShopifyCase Studies
  • Ratequeue: Core Queueing-And-Rate-Limiting System at TwilioTwilio engineers · TwilioCase Studies

  Show 6 moreShow fewer

  • Cloud Bouncer: Distributed Rate Limiting at YahooYahoo engineers · YahooCase Studies
  • Reasons for Choosing S3 over HDFS at DatabricksDatabricks engineers · DatabricksCase Studies
  • Improving Web Vulnerability Management through Automation at LyftLyft engineers · LyftCase Studies
  • Distributed Rate Limiting at AllegroAllegro engineers · AllegroCase Studies
  • Galois Engineering BlogGalois engineers · GaloisBlogs
  • Hashrocket Engineering BlogHashrocket engineers · HashrocketBlogs

  Open this lesson with its quiz and exercise