Confirmation emails and clients amending bookings themselves

• The idea is that it would be nice if clients could edit/correct some details in their booking directly.
• In my old company clients had to call or email in to make ANY changes to their booking,  but it would be much more efficient if they could amend bookings themselves 
• However, we can't let them make changes (without us ok'ing them) if they critically change the program for the driver after it is too late.
• The key concept is that clients shouldn't be able to amend things that mess up the day (if they make last minute changes).  So they can't change the destination or number of passengers (beyond the capacity of the car), or times at the last minute
• Issue is security - how do we give non-login access to edit a booking without exposing the database? Do we add a specific link to a page that is not login protected that allows changes, and only works for some fields with 24hours notice?  
  • At ANY time (even last minute) they should be able to:
    • Add/correct phone numbers or emails
    • Additional passengers names/details
    • Add address within the resort/cities
    • Reduce baby/child seats (not increase)
    • Change passenger numbers so long as it doesn't change the price (ie the vehicle)
    • Add flights number so long as it doesn't change the time  (probably not allow that change)
  • With more than [36] hours they should be able to change things that make a difference to the driver's program (eg destinations, dates, add trips)
• Think about the best approach for this. 
  • Give them a unique page  (and include a password on their email?)
  • Do it by buttons?
  • What do you think?

Ideas

• Clients can have a secure webpage (similar to the autologin) to shows each booking/transfer with the ability to edit some fields
  • Security code that times out. 
• Client acceptance - Give a code to clients to accept the transfer. 
• Whatsapp message to clients the night before.   Link to summary of transfer (not user protected)