One account, two workspaces: renters and hosts in one app

Most marketplaces have two kinds of users: people who buy and people who sell. On BookMeDrive those are Explorers, who rent vehicles, and Hosts, who list them. The obvious way to build that is two separate account types. It's also the wrong way, because the same person is often both.

The problem with two account types

If renters and hosts are separate accounts, a host who wants to rent a car for a weekend has to sign up again with a different email. Their reviews, verification and history are split in two. Support has to ask "which account?" every time.

The idea: one user, two workspaces

Instead, there's one account per person. On top of it sit two workspaces. Everyone gets the Explorer workspace by default. The Host workspace switches on the first time someone lists a vehicle. In the app, a switch at the top moves you between the two, and each one has its own dashboard.

The model, roughly

Here's the shape of it in Django. Host-only data lives in its own table, linked one-to-one to the user, so the user table stays clean.

from django.conf import settings
from django.db import models


class HostProfile(models.Model):
    user = models.OneToOneField(
        settings.AUTH_USER_MODEL, on_delete=models.CASCADE, related_name="host"
    )
    business_name = models.CharField(max_length=120, blank=True)
    phone = models.CharField(max_length=20)
    is_verified = models.BooleanField(default=False)
    created_at = models.DateTimeField(auto_now_add=True)


class Vehicle(models.Model):
    host = models.ForeignKey(HostProfile, on_delete=models.CASCADE, related_name="vehicles")
    title = models.CharField(max_length=120)
    city = models.CharField(max_length=60)
    is_active = models.BooleanField(default=True)

Being a host is then just "does this user have a host profile?" No role field to keep in sync, no flags that drift.

Permissions in Django REST Framework

Host endpoints check for the profile. One small permission class covers every host-only view.

from rest_framework import viewsets
from rest_framework.permissions import BasePermission, IsAuthenticated


class IsHost(BasePermission):
    message = "Switch to your Host workspace to do this."

    def has_permission(self, request, view):
        return hasattr(request.user, "host")


class VehicleViewSet(viewsets.ModelViewSet):
    permission_classes = [IsAuthenticated, IsHost]

    def get_queryset(self):
        # Hosts only ever see their own vehicles
        return Vehicle.objects.filter(host=self.request.user.host)

Scoping the queryset to the logged-in host matters as much as the permission check. It means one host can never see or edit another host's listing, even by guessing an ID.

Remembering which workspace you're in

The active workspace is a UI choice, not a security boundary, so it doesn't need to live in the database. The frontend keeps it in a cookie and shows the matching dashboard. The backend never trusts it for permissions. It always checks the host profile itself.

What this gets you

• One sign-up, one verification, one history per person.
• Becoming a host is one step: create the profile and list a vehicle.
• Host data stays out of the user table, so adding host-only fields later is easy.
• Permissions live in one place.

Model people once. Model what they do separately.