studio-engine 0.83.0 → 0.85.0

data/app/views/studio/site_footer/_assets.html.erb

@@ -11,20 +11,43 @@
     border-top: 1px solid var(--ftr-line); }
   .ftr a { transition: color .15s ease, opacity .15s ease; }
   .ftr-wrap { max-width: 72rem; margin-inline: auto; padding-inline: 1rem; }
-  .ftr-link { color: inherit; opacity: .78; text-decoration: none; overflow-wrap: anywhere; }
+  .ftr-link { color: inherit; opacity: .78; text-decoration: none; }
+  /* A label that is an address (an email address, a URL) stays on one line: a browser
+     would otherwise wrap it after a hyphen or a slash. Its track is at least as
+     wide as it is (the grid below), and the tracks beside it give way. It is
+     broken only on a screen narrower than any phone, where no layout holds it. */
+  .ftr-link-solid { white-space: nowrap; }
+  @media (max-width: 299px) { .ftr-link-solid { white-space: normal; overflow-wrap: anywhere; } }
   .ftr-link-disabled { opacity: .38; cursor: not-allowed; }
   .ftr-link-plain { opacity: .78; }
   .ftr-link:hover, .ftr-link:focus-visible { opacity: 1; color: var(--ftr-primary); }
 
-  /* Brand, then the link columns. Two tracks on a phone with the brand across
-     both; from 768px the links sit in one row (at most four across); from
-     1024px the brand joins that row. --ftr-n is the number of link columns. */
-  .ftr-cols { display: grid; gap: 3rem 2rem; padding-block: 4rem; grid-template-columns: repeat(2, minmax(0, 1fr)); }
+  /* Brand, then the link columns (.ftr-col), on a grid with explicit tracks.
+       below 768px: the brand across the top, the link columns two to a row
+       from 768px:  the brand across the top, every link column in one row
+       from 1024px: the brand in that row too, at 1.7 shares
+     A track is `Nfr`, never `minmax(0, Nfr)`: an fr track is at least as wide as
+     its longest unbreakable word, so the column holding an email address grows
+     to hold it and its neighbours give way. Nothing moves to another row.
+     --ftr-tracks is one track per link column (Studio::SiteFooter.tracks): the
+     first is wider by default, and a column's `width:` hint sets its own.
+     A footer with more than four link columns (.ftr-cols-many) keeps the brand
+     across the top and wraps the columns four to a row. */
+  .ftr-cols { display: grid; gap: 3rem 2rem; padding-block: 4rem; grid-template-columns: 1.2fr 1fr; }
   .ftr-brand { grid-column: 1 / -1; }
-  @media (min-width: 768px) { .ftr-cols { grid-template-columns: repeat(var(--ftr-n-md, 4), minmax(0, 1fr)); } }
+  /* The smallest phones (320px): two columns still share a row beside an email
+     address, by a narrower gutter and a slightly smaller address. */
+  @media (max-width: 359px) {
+    .ftr-cols { column-gap: 1rem; }
+    .ftr-col .ftr-link-solid { font-size: .875rem; }
+  }
+  @media (min-width: 768px) {
+    .ftr-cols { grid-template-columns: var(--ftr-tracks, 1fr); }
+    .ftr-cols-many { grid-template-columns: repeat(4, 1fr); }
+  }
   @media (min-width: 1024px) {
-    .ftr-cols { grid-template-columns: minmax(0, 1.7fr) repeat(var(--ftr-n, 4), minmax(0, 1fr)); }
-    .ftr-brand { grid-column: auto; }
+    .ftr-cols:not(.ftr-cols-many) { grid-template-columns: 1.7fr var(--ftr-tracks,); }
+    .ftr-cols:not(.ftr-cols-many) .ftr-brand { grid-column: auto; }
   }
   .ftr-home { display: inline-flex; align-items: center; gap: .75rem; color: inherit; text-decoration: none; }
   .ftr-logo { width: 3rem; height: 3rem; object-fit: contain; }
@@ -47,9 +70,9 @@
   .ftr-list { display: grid; gap: 1rem; margin: 0; padding: 0; list-style: none; }
 
   .ftr-location { border-top: 1px solid var(--ftr-line); padding-block: 3.5rem 2rem; text-align: center; }
-  .ftr-location-title { margin: 0; font-size: 1.875rem; font-weight: 800; letter-spacing: -.025em; color: var(--ftr-ink); }
+  .ftr-location-title { margin: 0; font-size: 1.875rem; line-height: 2.25rem; font-weight: 800; letter-spacing: -.025em; color: var(--ftr-ink); }
   .ftr-address { margin-top: 1rem; font-style: normal; line-height: 1.625; }
-  .ftr-legal { padding-block: 2rem; text-align: center; font-size: .875rem; }
+  .ftr-legal { padding-block: 2rem; text-align: center; font-size: .875rem; line-height: 1.25rem; }
   .ftr-legal p { margin: 0; }
   .ftr-legal .ftr-copyright { margin-top: .5rem; color: var(--color-text-muted, inherit); }
   /* With no map between them, a rule separates the legal line from what is above. */

data/app/views/studio/site_footer/_footer.html.erb

@@ -13,7 +13,8 @@
 <%= studio_site_footer_assets %>
 <footer class="ftr" data-site-footer>
   <div class="ftr-wrap">
-    <div class="ftr-cols" style="--ftr-n: <%= columns.size %>; --ftr-n-md: <%= [ columns.size, 4 ].min.clamp(1, 4) %>;">
+    <% tracks = Studio::SiteFooter.tracks(columns) %>
+    <div class="ftr-cols<%= " ftr-cols-many" if columns.size > Studio::SiteFooter::MAX_ROW_COLUMNS %>"<% if tracks %> style="--ftr-tracks: <%= tracks %>"<% end %>>
       <div class="ftr-brand">
         <% if facts[:logo] || facts[:wordmark] %>
           <a href="<%= facts[:home_path] %>" class="ftr-home" aria-label="<%= facts[:name] %>">
@@ -29,7 +30,7 @@
           <p class="ftr-tagline"><%= facts[:tagline] %></p>
         <% end %>
         <% if facts[:email] %>
-          <p class="ftr-email"><a href="mailto:<%= facts[:email] %>" class="ftr-link"><%= facts[:email] %></a></p>
+          <p class="ftr-email"><a href="mailto:<%= facts[:email] %>" class="ftr-link ftr-link-solid"><%= facts[:email] %></a></p>
         <% end %>
         <% if facts[:social].any? %>
           <ul class="ftr-socials" aria-label="Social profiles">
@@ -48,7 +49,7 @@
       </div>
 
       <% columns.each do |column| %>
-        <nav aria-label="<%= column[:heading] || "Footer" %>">
+        <nav class="ftr-col" aria-label="<%= column[:heading] || "Footer" %>">
           <% if column[:heading] %>
             <h2 class="ftr-heading"><%= column[:heading] %></h2>
           <% end %>

data/app/views/studio/site_footer/_link.html.erb

@@ -8,7 +8,9 @@
 <% elsif link[:disabled] %>
   <span class="ftr-link-disabled" aria-disabled="true" title="Coming soon"><%= link[:label] %></span>
 <% else %>
-  <%= link_to link[:label], link[:href], { class: "ftr-link" }
+  <%# An email address or a URL as a label is one word however many hyphens and
+      slashes it holds: .ftr-link-solid keeps it on one line. %>
+  <%= link_to link[:label], link[:href], { class: Studio::SiteFooter.solid_label?(link[:label]) ? "ftr-link ftr-link-solid" : "ftr-link" }
         .merge(link[:external] ? { target: "_blank", rel: "noopener" } : {})
         .merge(link[:booking] && booking ? { data: { booking_popup: true, studio_booking: true } } : {}) %>
 <% end %>

data/app/views/style/_site_footer.html.erb

@@ -1,12 +1,16 @@
 <%#  The Site footer and booking group of the Tricks board (admin/style).
      The primitives a public site ends with: the footer, its map, and the Google
-     Calendar booking frame, popup and link (docs/SITE_FOOTER.md). Each card
+     Calendar booking frame, popup and link (docs/SITE_FOOTER.md,
+     docs/BOOKING.md). Each card
      gives the helper to call; the preview below them is the real footer partial,
      rendered with THIS app's facts when it has declared any and with a sample
      when it has not, so the group is never empty.
 
-     The booking frame is described, not embedded: a style guide should not ask
-     Google for a calendar every time an admin scrolls past. %>
+     The booking frame is DRAWN, not embedded: a style guide should not ask
+     Google for a calendar every time an admin scrolls past. Its two states, whole
+     and cropped, are quarter-scale drawings of a made-up schedule (a 720px page
+     whose box runs from 200 to 600), cropped by the same arithmetic the real
+     wrapper uses (Studio::Booking.crop). No real schedule's numbers are here. %>
 <%
   own_facts    = studio_site_footer_facts
   sample       = {
@@ -20,6 +24,12 @@
   }
   preview      = own_facts || Studio::SiteFooter.resolve(sample, self, logo: Studio.logo_for("Footer Logo"))
   booking      = studio_booking?
+  own_crop     = studio_booking_crop
+  sample_crop  = Studio::Booking.crop(top: 200, bottom: 600, frame_height: 720)
+  scale        = 0.25
+  # The made-up page, top to bottom: [label, from, to, is it the box?].
+  sample_page  = [ [ "Google's header", 0, 200, false ], [ "Select an appointment time", 200, 600, true ],
+                   [ "Google's credit lines", 600, 720, false ] ]
 %>
 <section id="site-footer" class="space-y-5" style="scroll-margin-top: calc(var(--nav-h, 0px) + 5rem)">
   <div class="space-y-1">
@@ -34,7 +44,8 @@
       This app:
       footer <strong class="text-body"><%= own_facts ? "declared" : "not declared" %></strong> &middot;
       booking <strong class="text-body"><%= booking ? "on" : "off" %></strong> &middot;
-      booking page <strong class="text-body"><%= Studio.draw_booking_routes ? "drawn" : "not drawn" %></strong>
+      booking page <strong class="text-body"><%= Studio.draw_booking_routes ? "drawn" : "not drawn" %></strong> &middot;
+      frame <strong class="text-body"><%= own_crop ? "cropped at rest" : "whole at rest" %></strong>
     </p>
   </div>
 
@@ -59,14 +70,26 @@
       <% end %>
     <% end %>
 
-    <%= render layout: "style/specimen",
-          locals: { klass: "studio_booking_frame",
-                    disabled: !booking, disabled_label: "no booking_url",
-                    usage: %(studio_booking_frame   # crop: false shows Google's whole page at rest) } do %>
-      <p class="text-sm text-secondary text-center">
-        Google's booking page inline. Asked for only after the page has loaded and the frame is near
-        the viewport; cropped to the slot picker until it is used.
-      </p>
+    <% [ [ "studio_booking_frame", nil, "whole",
+           %(studio_booking_frame   # whole at rest: the default, and crop: false),
+           "Whole at rest, the default. Google's page as Google draws it: its header, the slot picker, its credit lines." ],
+         [ "config.booking_crop", sample_crop, "cropped",
+           %(config.booking_crop = { top: 200, bottom: 600, frame_height: 720 }   # bin/booking-crop-measure prints yours),
+           "Cropped at rest to the slot picker, from numbers measured on the app's own schedule. Opens to the whole page when it is used." ]
+       ].each do |klass, crop, state, usage, caption| %>
+      <%= render layout: "style/specimen",
+            locals: { klass: klass, disabled: !booking, disabled_label: "no booking_url", usage: usage } do %>
+        <div class="w-full space-y-3" data-booking-specimen="<%= state %>">
+          <div style="margin-inline: auto; width: 11rem; overflow: hidden; background: #fff; border-radius: .5rem; border: 1px solid rgb(127 127 127 / .35); height: <%= ((crop ? crop[:window] : 720) * scale).round %>px;">
+            <div style="margin-top: -<%= ((crop ? crop[:offset] : 0) * scale).round %>px;">
+              <% sample_page.each do |label, from, to, box| %>
+                <div style="box-sizing: border-box; height: <%= ((to - from) * scale).round %>px; display: flex; align-items: center; justify-content: center; padding: 0 .5rem; text-align: center; font-size: .625rem; line-height: 1.2; color: #374151;<%= box ? " margin: 0 .35rem; border: 1px solid rgb(17 24 39 / .45); border-radius: .35rem; font-weight: 700;" : " background: rgb(17 24 39 / .06);" %>"><%= label %></div>
+              <% end %>
+            </div>
+          </div>
+          <p class="text-sm text-secondary text-center"><%= caption %></p>
+        </div>
+      <% end %>
     <% end %>
   </div>
 

data/lib/active_storage/service/studio_trash_s3_service.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+require "active_storage/service/s3_service"
+require_relative "../../studio/s3"
+
+module ActiveStorage
+  # Active Storage's S3 service with a three-day grace period on delete. An app
+  # opts in from config/storage.yml by naming it instead of S3:
+  #
+  #   r2_production:
+  #     service: StudioTrashS3
+  #     bucket: turf-monster-production
+  #     endpoint: <%= ENV["R2_ENDPOINT"] %>
+  #     ...
+  #
+  # Active Storage resolves `service: StudioTrashS3` by requiring
+  # "active_storage/service/studio_trash_s3_service", which is why this file
+  # lives at lib/active_storage/service/ on the gem's load path. Nothing
+  # autoloads it; Zeitwerk never sees lib/.
+  #
+  # delete(key) — what Blob#purge and a replaced attachment end in — MOVES the
+  # object under trash/ (Studio::S3::Trash) instead of deleting it. By the time
+  # it runs the blob row is already destroyed, so what the trash copy records
+  # about the blob (content type, byte size, checksum, filename when the upload
+  # carried one) is read back off the object itself.
+  #
+  # delete_prefixed(prefix) stays a HARD delete. Active Storage calls it for
+  # "variants/<key>/": derived images, regenerated on demand from the original,
+  # which is the object that matters and the one trashed.
+  #
+  # Both refuse a "*-production" bucket from a non-production process.
+  class Service::StudioTrashS3Service < Service::S3Service
+    def delete(key)
+      instrument :delete, key: key do
+        Studio::S3.guard_production_bucket!(bucket.name)
+        Studio::S3::Trash.trash!(client: client.client, bucket: bucket.name, key: key,
+                                 env: Studio::S3.deletion_environment)
+      rescue StandardError => error
+        # Logged, then RE-RAISED. Blob#purge has already destroyed the row, so a
+        # raise here leaks the object rather than losing it: the failure that
+        # costs storage, never the one that costs a user's file.
+        log_trash_failure(key, error)
+        raise
+      end
+    end
+
+    def delete_prefixed(prefix)
+      Studio::S3.guard_production_bucket!(bucket.name)
+      super
+    end
+
+    private
+
+    def log_trash_failure(key, error)
+      message = "[StudioTrashS3] trash of #{bucket.name}/#{key} failed, object left in place: " \
+                "#{error.class}: #{error.message}"
+      if defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
+        Rails.logger.error(message)
+      else
+        warn message
+      end
+    end
+  end
+end

data/lib/studio/auth_labels.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+# The words the engine's own auth pages say for "sign in", derived from the one
+# setting the navbar already reads, Studio.sign_in_label (default "Log in";
+# lib/studio/navbar_identity.rb). An app that says "Sign in" in its navbar gets
+# "Sign in" on /login, /signup and the magic-link pages too, never a mix.
+#
+# Every form is derived from the label as written:
+#
+#   label "Sign in"   link "Sign in"   button "Sign In"
+#                     prompt "Sign in to continue"
+#                     to_app "Sign in to Cyvasse"
+#                     or_below "or sign in below"
+#                     link_noun "sign-in link"
+#
+# THE DEFAULT IS PINNED, NOT DERIVED. With the default label the pages print
+# exactly what they printed before this setting reached them, and that text was
+# itself mixed: "Log in to continue" and "Log In" beside "Sign in to <App>",
+# "or sign in below" and "sign-in link". So the three forms that said "sign in"
+# under the default keep saying it while the label is the default, and follow the
+# label only once an app configures another one. An app that never configures
+# the label renders byte-identical pages (test/integration/auth_page_labels_render_test.rb).
+#
+# Pure Ruby, so the unit suite covers it without the dummy app.
+require_relative "navbar_identity"
+
+module Studio
+  module AuthLabels
+    DEFAULT = NavbarIdentity::DEFAULT_SIGN_IN_LABEL
+
+    module_function
+
+    def configured?(label)
+      label.to_s != DEFAULT
+    end
+
+    # The sign-up page's "Already have an account?" link.
+    def link(label)
+      label.to_s
+    end
+
+    # The login form's submit button, in title case: "Log In", "Sign In".
+    def button(label)
+      label.to_s.split(" ").map { |word| capitalize_first(word) }.join(" ")
+    end
+
+    # The login page's line under the app name.
+    def prompt(label)
+      "#{label} to continue"
+    end
+
+    # The magic-link confirm page's fallback button.
+    def to_app(label, app_name)
+      "#{configured?(label) ? label : 'Sign in'} to #{app_name}"
+    end
+
+    # The divider under the SSO "Continue as" button.
+    def or_below(label)
+      configured?(label) ? "or #{label.to_s.downcase} below" : "or sign in below"
+    end
+
+    # The emailed link's noun: the magic-link button and the "sent" notice.
+    def link_noun(label)
+      configured?(label) ? "#{label.to_s.downcase.tr(' ', '-')} link" : "sign-in link"
+    end
+
+    # Only the first letter changes, so an already-capital word is untouched.
+    def capitalize_first(word)
+      word.sub(/\A\p{Ll}/) { |c| c.upcase }
+    end
+  end
+end

data/lib/studio/booking.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
-# Studio.booking_url — the app's Google Calendar appointment schedule — and the
-# two URLs the booking primitives derive from it. Pure Ruby. See
-# docs/SITE_FOOTER.md.
+# Studio.booking_url — the app's Google Calendar appointment schedule — the two
+# URLs the booking primitives derive from it, and the frame's crop
+# (Studio.booking_crop). Pure Ruby. See docs/BOOKING.md.
 #
 # The configured value is the schedule's PUBLIC page, the URL Google gives you
 # to share, without `?gv=true`:
@@ -15,15 +15,175 @@ module Studio
   module Booking
     EMBED_PARAM = "gv=true"
 
+    # THE CROP. At rest the inline frame can show only Google's "Select an
+    # appointment time" box, with Google's header above it and its credit lines
+    # below clipped away. Where that box sits is a fact about ONE schedule (its
+    # header is as tall as its title, description and meeting line; its box is as
+    # tall as its fullest day), so the app measures its own and declares it:
+    #
+    #   config.booking_crop = { top: 200, bottom: 600, frame_height: 720 }
+    #
+    # All three are pixels in Google's own page, at 640px wide or more:
+    #
+    #   top:          the box's top edge. Stable for a schedule.
+    #   bottom:       the box's bottom edge ON ITS FULLEST DAY. Not stable: the box
+    #                 grows a row per appointment slot, so it is shorter on a day
+    #                 with fewer slots left. Declare the tallest it gets.
+    #   frame_height: the whole page's height on that fullest day. The frame is
+    #                 this tall once it opens.
+    #
+    # `bin/booking-crop-measure <booking url>` prints the Hash.
+    #
+    # The window is [top - CROP_MARGIN, bottom + CROP_MARGIN], held inside the
+    # frame. Because `bottom` is the tallest the box gets, a day with fewer slots
+    # shows a strip of Google's credit lines under a shorter box; it never cuts
+    # the box. A value that cannot be a crop (not a number, negative, bottom not
+    # below top, a box that ends outside the frame, a window that hides nothing)
+    # is reported once and the frame shows whole.
+    CROP_MARGIN = 6
+    CROP_KEYS = %i[top bottom frame_height].freeze
+    REPORTED_LIMIT = 100
+
+    class << self
+      # Where a refused crop is reported: a callable taking the message. The
+      # default writes one warning to the Rails log (or to stderr without Rails).
+      attr_writer :reporter
+
+      def reporter
+        @reporter ||= lambda do |message|
+          if defined?(::Rails) && ::Rails.respond_to?(:logger) && ::Rails.logger
+            ::Rails.logger.warn(message)
+          else
+            warn(message)
+          end
+        end
+      end
+
+      def reported
+        @reported ||= {}
+      end
+    end
+
     module_function
 
+    def validate_crop!(declared)
+      return if declared.nil? || declared == false || declared.is_a?(Hash)
+
+      raise ArgumentError,
+            "Studio.booking_crop must be nil, false, or a Hash of top:, bottom: and frame_height: " \
+            "(got #{declared.inspect}). See docs/BOOKING.md."
+    end
+
+    # The crop to render: { offset:, window:, frame_height: } in whole pixels, or
+    # nil for the whole frame at rest. `offset` is how far the frame is pulled up
+    # behind its wrapper and `window` is the wrapper's height.
+    def crop(declared)
+      return nil if declared.nil? || declared == false
+      return refuse_crop(declared, "it is not a Hash") unless declared.is_a?(Hash)
+
+      values = CROP_KEYS.to_h { |key| [key, declared[key] || declared[key.to_s]] }
+      missing = values.reject { |_key, value| value.is_a?(Numeric) && value.respond_to?(:round) && value.finite? }.keys
+      return refuse_crop(declared, "#{missing.join(', ')} must be a number") unless missing.empty?
+
+      top, bottom, frame_height = values.values_at(*CROP_KEYS).map(&:round)
+      return refuse_crop(declared, "top is negative") if top.negative?
+      return refuse_crop(declared, "bottom is not below top") unless bottom > top
+      return refuse_crop(declared, "bottom is outside the frame") if bottom > frame_height
+
+      offset = [top - CROP_MARGIN, 0].max
+      window = [bottom + CROP_MARGIN, frame_height].min - offset
+      return refuse_crop(declared, "the window is the whole frame") unless window < frame_height
+
+      { offset: offset, window: window, frame_height: frame_height }
+    end
+
+    # The crop as the custom properties the wrapper carries, so two frames with
+    # different crops can share a page (studio/booking/_assets reads them).
+    def crop_style(crop)
+      return nil if crop.nil?
+
+      "--booking-crop-offset: #{crop[:offset]}px; --booking-crop-window: #{crop[:window]}px; " \
+        "--booking-frame-height: #{crop[:frame_height]}px"
+    end
+
+    def refuse_crop(declared, why)
+      report_once("[studio.booking] booking crop #{declared.inspect} is ignored (#{why}); the frame shows whole. " \
+                  "See docs/BOOKING.md.")
+      nil
+    end
+
+    # A LOCAL PATH, and nothing else, may be the booking page: it is written into
+    # hrefs (the footer's booking links, `studio_booking_link`). It begins with
+    # one "/" and carries no control character. That refuses a scheme
+    # ("javascript:", "https:") and a protocol-relative "//host", which a browser
+    # reads as another site.
+    def local_path?(path)
+      string = path.to_s
+      string.start_with?("/") && !string.start_with?("//") && !string.match?(/[\x00-\x1f\x7f\\]/)
+    end
+
+    # Studio.booking_path: nil, a local path, or a callable receiving the view.
+    def validate_path!(declared)
+      return if declared.nil? || declared.respond_to?(:call)
+      return if declared.is_a?(String) && (declared.strip.empty? || local_path?(declared.strip))
+
+      raise ArgumentError,
+            "Studio.booking_path must be nil, a path beginning with one \"/\", or a callable receiving the view " \
+            "(got #{declared.inspect}). See docs/BOOKING.md."
+    end
+
+    # The declared value as it is stored: a stripped path, a callable, or nil.
+    def normalize_path(declared)
+      validate_path!(declared)
+      return declared unless declared.is_a?(String)
+
+      declared.strip.empty? ? nil : declared.strip
+    end
+
+    # The booking page's path for a view: the app's own (`declared`, a path or
+    # a callable receiving the view), else the engine's /schedule when it is
+    # `drawn`, else nil. A callable may decline with nil. What a callable returns
+    # is held to the same rule as a declared String: anything but a local path is
+    # reported once and treated as no answer.
+    def path_for(declared, view, drawn: false)
+      unless declared.nil?
+        path = (declared.respond_to?(:call) ? declared.call(view) : declared).to_s.strip
+        return path if local_path?(path)
+
+        refuse_path(path) unless path.empty?
+      end
+
+      drawn && view.respond_to?(:studio_booking_path) ? view.studio_booking_path : nil
+    end
+
+    def refuse_path(path)
+      report_once("[studio.booking] booking_path #{path.inspect} is ignored: it is not a local path " \
+                  "(one leading \"/\"). See docs/BOOKING.md.")
+      nil
+    end
+
+    def report_once(message)
+      seen = Studio::Booking.reported
+      return if seen.key?(message)
+
+      seen[message] = true if seen.size < REPORTED_LIMIT
+      Studio::Booking.reporter.call(message)
+    end
+
+    # True when `current` (a request path) is the page `declared` names. A query
+    # string, a fragment and a trailing slash on either side do not count.
+    def same_path?(current, declared)
+      a, b = [current, declared].map { |path| path.to_s.strip.sub(/[?#].*\z/m, "").sub(%r{(?<=.)/+\z}, "") }
+      !a.empty? && a == b
+    end
+
     def validate!(url)
       return if url.nil? || url.to_s.strip.empty?
       return if url.to_s.strip.match?(%r{\Ahttps://\S+\z})
 
       raise ArgumentError,
             "Studio.booking_url must be an https URL (got #{url.inspect}). Use the appointment " \
-            "schedule's public link. See docs/SITE_FOOTER.md."
+            "schedule's public link. See docs/BOOKING.md."
     end
 
     # The public page, with any embed parameter removed. nil when unset.