Configurable RFID Token Management Permissions for Drivers

[Tobias9876]

What

Add an operator-configurable setting to control whether drivers are allowed to manage their own RFID tokens.

The setting should provide two modes:

Enabled (Self-Service): Drivers can add and manage their own RFID tokens through the driver portal.

Disabled (Read-Only): Drivers can only view their assigned RFID tokens. Adding, editing, or deleting RFID tokens is restricted to administrators/operators.

This setting should be configurable by the operator and enforced by the backend API, not just by hiding controls in the user interface.

Why

In environments such as companies or organizations, RFID tokens are often centrally issued and managed by administrators.

Allowing drivers to register their own RFID tokens can lead to unauthorized tokens being added, making it harder to maintain control over charging permissions and access management.

Operators should be able to decide whether RFID token self-management is appropriate for their environment.

Who

Operators / Administrators: Maintain centralized control over RFID token assignments and charging authorization.
Drivers: Can still view their assigned RFID tokens without being able to modify them when self-management is disabled.
Organizations / Companies: Benefit from consistent RFID access policies and reduced administrative risks.

Suggested Acceptance Criteria

Operators can enable or disable RFID token self-management.
When disabled, drivers can view their assigned RFID tokens but cannot add, edit, or delete them.
Administrators can continue to manage RFID tokens regardless of this setting.

[evtivity-admin]

Thanks @Tobias9876, this makes sense for operators who issue RFID cards centrally. We are building it for v0.1.51:

• A new operator setting in Settings > Integrations & Features > RFID Cards decides whether drivers manage their own RFID cards.
• On (the default, today's behavior): drivers add, rename, deactivate and remove their cards in the driver portal and the mobile app.
• Off (read-only): drivers only see the cards assigned to them. The API refuses every driver change to a card, not just the buttons in the apps, and the portal and app tell the driver to contact the operator, including to block a lost card.
• Operators keep managing all cards either way: on the Tokens page, through the API and by CSV import.

[evtivity-admin]

This shipped in v0.1.51, with the driver app v0.1.51. Settings > Integrations & Features > RFID Cards turns driver RFID card management on or off; off, drivers see their cards read-only. See RFID Cards settings and driver self-service. Thanks @Tobias9876. Closing as resolved; open a new discussion if anything needs a follow-up.