@acms-subir/core 0.3.21 → 0.3.23

package/src/components/RolesManager.tsx

@@ -74,6 +74,8 @@ export default function RolesManager() {
   const customized = (r: RoleKey) => diff(state.defaults, draft).some((d) => d.role === r);
   const unsaved = (r: RoleKey) => pending.some((d) => d.role === r);
   const grant = (r: string, key: string) => r === 'owner' || (editable(r) && (draft[r] as Record<string, boolean>)[key] === true);
+  // a role without admin access can only hold site permissions (and core ones marked for members)
+  const usable = (r: string, p: { members: boolean; locked: boolean }) => r === 'owner' || (!p.locked && (state.roles.find((x) => x.role === r)?.admin === true || p.members));
 
   const toggle = (r: RoleKey, key: string) => {
     if (readOnly) return;
@@ -114,8 +116,10 @@ export default function RolesManager() {
   };
 
   const areaSummary = (r: string, a: Area) => {
-    const n = a.permissions.filter((p) => grant(r, p.key)).length;
-    return n === a.permissions.length ? ['Full access', 'published'] : n === 0 ? ['No access', 'archived'] : ['Partial access', 'edited'];
+    const open = a.permissions.filter((p) => usable(r, p));
+    if (!open.length) return ['Needs admin access', 'archived'];
+    const n = open.filter((p) => grant(r, p.key)).length;
+    return n === open.length ? ['Full access', 'published'] : n === 0 ? ['No access', 'archived'] : ['Partial access', 'edited'];
   };
   const selected = state.roles.find((r) => r.role === role)!;
   const rolesChanged = new Set(pending.map((p) => p.role)).size;
@@ -143,7 +147,8 @@ export default function RolesManager() {
       {tab === 'edit' ? (
         <div className="rp-grid">
           <nav className="rp-roles" aria-label="Roles">
-            {state.roles.map((r) => (
+            {state.roles.map((r, i) => [
+              r.site && !state.roles[i - 1]?.site && <span key={`${r.role}-sep`} className="rp-role-sep">This site</span>,
               <button key={r.role} type="button" className={`rp-role${role === r.role ? ' on' : ''}`} aria-current={role === r.role} onClick={() => setRole(r.role)}>
                 <span className="rp-role-name">
                   {editable(r.role) && unsaved(r.role) && <span className="rp-dot" title="Unsaved changes" />}
@@ -151,8 +156,8 @@ export default function RolesManager() {
                   {editable(r.role) && customized(r.role) && <span className="pill draft">Customized</span>}
                 </span>
                 <small>{r.members} {r.members === 1 ? 'person' : 'people'}</small>
-              </button>
-            ))}
+              </button>,
+            ])}
           </nav>
 
           <section className="card rp-panel" aria-labelledby="rp-role-h">
@@ -160,6 +165,7 @@ export default function RolesManager() {
               <div>
                 <h2 id="rp-role-h">{selected.label} {editable(role) && <span className={`pill ${customized(role) ? 'draft' : 'archived'}`}>{customized(role) ? 'Customized' : 'Default'}</span>}</h2>
                 <p className="hint">{role === 'owner' ? 'Owners always have full access, so the site can never be locked out.' : selected.summary}</p>
+                {!selected.admin && <p className="rp-note">This role can’t use the admin, so only the permissions under “This site” (and “Request events”) can be turned on.</p>}
               </div>
               {!readOnly && editable(role) && <button className="btn sm" type="button" disabled={!customized(role)} onClick={() => setConfirm({ kind: 'restore', role: role as RoleKey })}>Restore defaults</button>}
             </header>
@@ -171,13 +177,14 @@ export default function RolesManager() {
                   {a.permissions.map((p) => {
                     const changed = editable(role) && pending.some((d) => d.role === role && d.key === p.key);
                     const on = grant(role, p.key);
+                    const open = usable(role, p);
                     return (
-                      <div className={`rp-row${changed ? ' changed' : ''}`} key={p.key}>
+                      <div className={`rp-row${changed ? ' changed' : ''}${open ? '' : ' na'}`} key={p.key}>
                         <div className="rp-text">
                           <span className="rp-label">{p.label}{p.sensitive && <span className="pill edited" title="Grants code, credentials or people. Grant with care.">Sensitive</span>}{changed && <span className="pill draft">Changed</span>}</span>
                           <small>{p.description}</small>
                         </div>
-                        <Switch on={on} label={`${p.label} for ${selected.label}`} disabled={readOnly || role === 'owner' || p.locked} onChange={() => editable(role) && toggle(role, p.key)} />
+                        <Switch on={on} label={`${p.label} for ${selected.label}`} disabled={readOnly || role === 'owner' || p.locked || !open} onChange={() => editable(role) && open && toggle(role, p.key)} />
                       </div>
                     );
                   })}
@@ -197,6 +204,7 @@ export default function RolesManager() {
                   <tr key={p.key}>
                     <td>{p.label}</td>
                     {state.roles.map((r) => {
+                      if (!usable(r.role, p)) return <td key={r.role} className="rp-cell" title="Needs admin access" aria-label="Needs admin access">·</td>;
                       const on = grant(r.role, p.key);
                       const changed = editable(r.role) && pending.some((d) => d.role === r.role && d.key === p.key);
                       return <td key={r.role} className={`rp-cell${on ? ' on' : ''}${changed ? ' changed' : ''}`} aria-label={on ? 'Allowed' : 'Not allowed'}>{on ? '✓' : '—'}</td>;

package/src/components/calendar/CalendarBoard.tsx

@@ -43,6 +43,8 @@ const rangeOf = (view: View, anchor: Iso, weekStart: 0 | 1): [Iso, Iso] => {
 const keyOf = (r: [Iso, Iso]) => `${r[0]}|${r[1]}`;
 const filterKey = (it: BoardItem) => (it.kind === 'booking' || it.kind === 'block' ? BOOKINGS : it.calendarId || NONE);
 const editable = (it: BoardItem) => it.kind === 'event';
+// a member's event request waiting for approval is a draft too (dashed, hollow marker)
+const isDraftLike = (it: BoardItem) => it.status === 'draft' || (it.kind === 'event' && it.status === 'pending');
 
 export default function CalendarBoard(props: Props) {
   const { today, weekStart, locale } = props;
@@ -299,7 +301,7 @@ export default function CalendarBoard(props: Props) {
     try { return f.formatRange(utc(w[0]), utc(w[6])); } catch { return `${f.format(utc(w[0]))} – ${f.format(utc(w[6]))}`; }
   };
   const chipClass = (it: BoardItem) => ['sch-chip',
-    it.status === 'draft' || it.status === 'scheduled' ? 'is-draft' : '',
+    isDraftLike(it) || it.status === 'scheduled' ? 'is-draft' : '',
     it.kind === 'booking' || it.kind === 'block' ? 'is-booking' : '',
     it.status === 'pending' ? 'is-pending' : '',
     it.kind === 'feed' ? 'is-feed' : '',
@@ -465,7 +467,7 @@ export default function CalendarBoard(props: Props) {
       <div className="sch-peek-layer" onMouseDown={(e) => { if (e.target === e.currentTarget) setPeek(null); }}>
         <div className="sch-peek" style={style} role="dialog" aria-label={it.title}>
           <div className="sch-peek-head">
-            <i style={{ background: it.color }} className={it.kind === 'booking' || it.kind === 'block' || it.status === 'draft' ? 'hollow' : ''} />
+            <i style={{ background: it.color }} className={it.kind === 'booking' || it.kind === 'block' || isDraftLike(it) ? 'hollow' : ''} />
             <b>{it.title}</b>
             <button type="button" className="sch-x" aria-label="Close" onClick={() => setPeek(null)}>✕</button>
           </div>
@@ -612,7 +614,7 @@ function shortTime(min: number) {
 }
 
 function DayRow({ it, status, onOpen }: { it: BoardItem; status: string; onOpen: (e: ReactMouseEvent) => void }) {
-  const hollow = it.kind === 'booking' || it.kind === 'block' || it.status === 'draft' || it.status === 'scheduled';
+  const hollow = it.kind === 'booking' || it.kind === 'block' || isDraftLike(it) || it.status === 'scheduled';
   return (
     <button type="button" className={`sch-row ${hollow ? 'hollow' : ''} ${it.cancelled ? 'is-cancelled' : ''}`} style={{ ['--c' as string]: it.color }} onClick={onOpen}>
       <i />

package/src/components/sections/SectionFields.tsx

@@ -25,6 +25,8 @@ export interface SectionTargets {
   calendars: { slug: string; name: string }[];
   collections: { key: string; label: string }[];
   tags: string[];
+  /** tags on published events (the events source picks from these) */
+  eventTags?: string[];
   resources: { slug: string; name: string }[];
   features: { events: boolean; bookings: boolean };
   ai?: { enabled: boolean; languages: string[] };
@@ -321,27 +323,46 @@ function SourceInput({ id, field, value, onChange, targets }: InputProps<SourceF
   const off = (field.source === 'events' && !targets.features.events) || (field.source === 'bookings' && !targets.features.bookings);
   let from = '';
   let picker: ReactNode = null;
+  // only items with one tag, and/or leaving out another ("events not tagged Class")
+  const tag = String(v.tag ?? ''), excludeTag = String(v.excludeTag ?? '');
+  const tagged = `${tag ? ` tagged “${tag}”` : ''}${tag && excludeTag ? ',' : ''}${excludeTag ? ` not tagged “${excludeTag}”` : ''}`;
+  const tagPickers = (names: string[]) => {
+    // a saved tag no item uses any more stays listed, so the picker shows what's stored
+    const list = [...new Set([...names, tag, excludeTag].filter(Boolean))];
+    return (
+      <>
+        <select aria-label="Only items with this tag" value={tag} onChange={(e) => set({ tag: e.target.value })}>
+          <option value="">Any tag</option>
+          {list.map((t) => <option key={t} value={t}>{t}</option>)}
+        </select>
+        <select aria-label="Leave out items with this tag" value={excludeTag} onChange={(e) => set({ excludeTag: e.target.value })}>
+          <option value="">Leave nothing out</option>
+          {list.map((t) => <option key={t} value={t}>Leave out “{t}”</option>)}
+        </select>
+      </>
+    );
+  };
   if (field.source === 'events') {
     const cal = targets.calendars.find((c) => c.slug === v.calendar);
-    from = `Calendar${cal ? ` → ${cal.name}` : ' · all public calendars'}`;
+    from = `${cal ? `Calendar → ${cal.name}` : 'All public calendars'}${tagged ? ` · events${tagged}` : ''}`;
     picker = (
-      <select id={id} aria-label="Calendar" value={String(v.calendar ?? '')} onChange={(e) => set({ calendar: e.target.value })}>
-        <option value="">All public calendars</option>
-        {targets.calendars.map((c) => <option key={c.slug} value={c.slug}>{c.name}</option>)}
-      </select>
+      <>
+        <select id={id} aria-label="Calendar" value={String(v.calendar ?? '')} onChange={(e) => set({ calendar: e.target.value })}>
+          <option value="">All public calendars</option>
+          {targets.calendars.map((c) => <option key={c.slug} value={c.slug}>{c.name}</option>)}
+        </select>
+        {tagPickers(targets.eventTags ?? targets.tags)}
+      </>
     );
   } else if (field.source === 'posts') {
     const col = targets.collections.find((c) => c.key === (v.collection ?? 'posts'));
-    from = `${col?.label ?? 'Posts'}${v.tag ? ` tagged “${v.tag}”` : ''}`;
+    from = `${col?.label ?? 'Posts'}${tagged}`;
     picker = (
       <>
         <select id={id} aria-label="Collection" value={String(v.collection ?? 'posts')} onChange={(e) => set({ collection: e.target.value === 'posts' ? '' : e.target.value })}>
           {targets.collections.map((c) => <option key={c.key} value={c.key}>{c.label}</option>)}
         </select>
-        <select aria-label="Tag" value={String(v.tag ?? '')} onChange={(e) => set({ tag: e.target.value })}>
-          <option value="">Any tag</option>
-          {targets.tags.map((t) => <option key={t} value={t}>{t}</option>)}
-        </select>
+        {tagPickers(targets.tags)}
       </>
     );
   } else {

package/src/layouts/Admin.astro

@@ -1,5 +1,5 @@
 ---
-import { roleLabels } from '../lib/roles';
+import { roleLabel } from '../lib/roles';
 import { getRepo } from '../lib/repo';
 import { BRAND } from '../lib/brand';
 import { CONTENT } from '../lib/content';
@@ -37,7 +37,7 @@ const [pages, posts, links, home, settings, sessionUser] = await Promise.all([
 const pendingBookings = CALENDAR.enabled ? (await repo.listBookings({ from: Date.now(), statuses: ['pending'], ...(!bookingsEnabled() ? { kinds: ['rsvp'] as const as ['rsvp'] } : {}) })).length : 0;
 const me = {
   name: sessionUser?.name || 'Admin',
-  role: roleLabels[sessionUserId === OWNER_ENV ? 'owner' : sessionUser?.role ?? 'editor'],
+  role: roleLabel(sessionUserId === OWNER_ENV ? 'owner' : sessionUser?.role ?? 'editor'),
   avatar: sessionUser?.avatar || '',
 };
 const initials = me.name.split(/\s+/).map((w) => w[0] ?? '').join('').slice(0, 2).toUpperCase();

package/src/lib/auth/accounts.ts

@@ -1,12 +1,12 @@
 import type { ContentRepository } from '../repo/types';
-import { Role } from '../schema';
+import { parseRole } from '../roles';
 import { AUTH, clerkConfig } from './config';
 import { clerkClient, clerkOperation } from './request';
 import { validAddress } from '../email/config';
 
 export async function inviteClerkUser(repo: ContentRepository, data: { email: string; name: string; role: unknown; invitedBy?: string }, locals?: unknown) {
   if (AUTH.provider !== 'clerk') throw new Error('Clerk authentication is not enabled.');
-  const config = clerkConfig(locals), email = data.email.trim().toLowerCase(), role = Role.parse(data.role);
+  const config = clerkConfig(locals), email = data.email.trim().toLowerCase(), role = parseRole(data.role);
   if (!validAddress(email)) throw new Error('Enter a valid email address.');
   if (await repo.getUserAuth(email)) throw new Error('This account already exists. Link its Clerk user ID instead.');
   const client = await clerkClient(locals);

package/src/lib/auth/request.ts

@@ -1,12 +1,16 @@
 import type { ClerkClient } from '@clerk/backend';
 import type { ContentRepository } from '../repo/types';
-import { validateSession, SESSION_COOKIE } from '../auth';
+import { validatePerson, SESSION_COOKIE } from '../auth';
+import { isStaffRole } from '../roles';
 import { AUTH, clerkConfig } from './config';
 import type { ClerkBinding } from './store';
 
 type Cookies = { get(name: string): { value: string } | undefined };
 export interface RequestAuth {
+  /** the signed-in staff member (null for signed-out visitors and for site roles without admin access) */
   userId: string | null;
+  /** whoever is signed in, staff or not, with their role (what currentUser() and the login page read) */
+  person: { id: string; role: string } | null;
   provider: 'builtin' | 'clerk';
   clerk: ClerkBinding | null;
   headers: Headers;
@@ -77,7 +81,7 @@ export async function activeClerkSession(client: ClerkClient, binding: ClerkBind
   return active;
 }
 export function getRequestAuth(request: Request, cookies: Cookies, localsOrRepo?: unknown): Promise<RequestAuth> {
-  if (AUTH.provider === 'builtin') return validateSession(cookies.get(SESSION_COOKIE)?.value, localsOrRepo).then(userId => ({ userId, provider: 'builtin', clerk: null, headers: new Headers(), error: null, reverified: false }));
+  if (AUTH.provider === 'builtin') return validatePerson(cookies.get(SESSION_COOKIE)?.value, localsOrRepo).then(person => ({ userId: person && isStaffRole(person.role) ? person.id : null, person, provider: 'builtin', clerk: null, headers: new Headers(), error: null, reverified: false }));
   let cached = requests.get(request);
   if (!cached) {
     if (!(localsOrRepo && typeof localsOrRepo === 'object' && 'email' in localsOrRepo)) environments.set(request, localsOrRepo);
@@ -88,11 +92,11 @@ export function getRequestAuth(request: Request, cookies: Cookies, localsOrRepo?
   return cached;
 }
 export async function validatePreviewSession(cookies: Cookies, locals?: unknown) {
-  if (AUTH.provider === 'builtin') return validateSession(cookies.get(SESSION_COOKIE)?.value, locals);
+  if (AUTH.provider === 'builtin') return validatePerson(cookies.get(SESSION_COOKIE)?.value, locals).then((p) => (p && isStaffRole(p.role) ? p.id : null));
   return locals && typeof locals === 'object' ? (await contexts.get(locals))?.userId ?? null : null;
 }
 async function resolveClerk(request: Request, localsOrRepo?: unknown): Promise<RequestAuth> {
-  const result: RequestAuth = { userId: null, provider: 'clerk', clerk: null, headers: new Headers(), error: null, reverified: false };
+  const result: RequestAuth = { userId: null, person: null, provider: 'clerk', clerk: null, headers: new Headers(), error: null, reverified: false };
   if (!shouldResolveClerk(request)) return result;
   let config: ReturnType<typeof clerkConfig>;
   try { config = clerkConfig(authEnvironment(request, localsOrRepo)); } catch { return { ...result, error: 'configuration' }; }
@@ -133,14 +137,22 @@ async function resolveClerk(request: Request, localsOrRepo?: unknown): Promise<R
         id = await repo.auth.identity(config.issuer, auth.userId);
       }
     }
-    result.userId = id && await repo.getUser(id) ? id : null;
-    if (!result.userId) result.error = 'access_denied';
+    const user = id ? await repo.getUser(id) : null;
+    // a site role without admin access is signed in (person) but not staff (userId)
+    result.person = user ? { id: user.id, role: user.role } : null;
+    result.userId = user && isStaffRole(user.role) ? user.id : null;
+    if (!user) result.error = 'access_denied';
     return result;
-  } catch { return { ...result, userId: null, error: 'unavailable' }; }
+  } catch { return { ...result, userId: null, person: null, error: 'unavailable' }; }
 }
+/** the signed-in staff member's id (null for everyone else, site roles without admin access included) */
 export async function validateRequestSession(request: Request, cookies: Cookies, localsOrRepo?: unknown) {
   return (await getRequestAuth(request, cookies, localsOrRepo)).userId;
 }
+/** whoever is signed in on this request, staff or not, with their current role */
+export async function requestPerson(request: Request, cookies: Cookies, localsOrRepo?: unknown) {
+  return (await getRequestAuth(request, cookies, localsOrRepo)).person;
+}
 /** Stable browser-session binding for consent and third-party OAuth state. */
 export async function requestSessionBinding(request: Request, cookies: Cookies, localsOrRepo?: unknown) {
   const auth = await getRequestAuth(request, cookies, localsOrRepo);

package/src/lib/auth/return.ts

@@ -0,0 +1,32 @@
+import { isStaffRole, roleHome } from '../roles';
+
+// Where /admin/login sends someone after they sign in. `?return=` may name any
+// page on this site (a site's "Sign in" link on /classes brings people back
+// there), never another site, and never a page that would loop or act:
+// login/logout/app sign-in, APIs, actions and the account (invite/reset) pages.
+
+const BLOCKED = /^\/(?:admin\/(?:login|logout|app-auth)(?:\/|$)|api(?:\/|$)|_actions(?:\/|$)|account(?:\/|$))/;
+
+/** a safe same-site path + query + hash from ?return=, or null */
+export function signInReturn(value: string | null | undefined, here: URL): string | null {
+  if (!value || !value.startsWith('/') || value.startsWith('//') || value.includes('\\') || /[\u0000-\u001f\u007f]/.test(value)) return null;
+  // dot segments (also %2e-encoded) would normalise "/.//evil.example" into "//evil.example"
+  const path = value.split(/[?#]/)[0];
+  if (/(^|\/)(\.|%2e){1,2}(\/|$)/i.test(path)) return null;
+  let url: URL;
+  try { url = new URL(value, here.origin); } catch { return null; }
+  if (url.origin !== here.origin || url.pathname.startsWith('//') || BLOCKED.test(url.pathname)) return null;
+  return url.pathname + url.search + url.hash;
+}
+
+export const isAdminPath = (path: string) => /^\/admin(?:[/?#]|$)/.test(path);
+
+/**
+ * Staff go back where they asked, else to the admin. Everyone else (site
+ * roles without admin access) goes back where they asked unless that's the
+ * admin, else to their role's home page.
+ */
+export function afterSignIn(role: string, back: string | null): string {
+  if (isStaffRole(role)) return back ?? '/admin';
+  return back && !isAdminPath(back) ? back : roleHome(role);
+}

package/src/lib/auth.ts

@@ -1,6 +1,7 @@
 import { AUTH } from './auth/config';
 import { createHmac, timingSafeEqual } from 'node:crypto';
 import { env } from './env';
+import { isStaffRole } from './roles';
 
 const COOKIE = 'acms_session';
 const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
@@ -104,14 +105,26 @@ export async function verifyPassword(password: string, stored: string): Promise<
 export const SESSION_COOKIE = COOKIE;
 
 // All authorization paths must consult the database, not just the signature.
-export async function validateSession(token: string | undefined, localsOrRepo?: unknown): Promise<string | null> {
+/** whoever this session cookie signs in, staff or not, with their current role */
+export async function validatePerson(token: string | undefined, localsOrRepo?: unknown): Promise<{ id: string; role: string } | null> {
   if (AUTH.provider !== 'builtin') return null;
   const id = verifySessionToken(token);
-  if (!id || id === OWNER_ENV) return id;
+  if (!id) return null;
+  if (id === OWNER_ENV) return { id, role: 'owner' };
   const { getRepo } = await import('./repo');
   const repo = localsOrRepo && typeof localsOrRepo === 'object' && 'email' in localsOrRepo
     ? localsOrRepo as import('./repo/types').ContentRepository : await getRepo(localsOrRepo);
-  const version = await repo.email.sessionVersion(id);
+  const state = await repo.email.sessionState(id);
   const expected = token!.startsWith('v.') ? Number(token!.split('.')[2]) : 0;
-  return version !== null && version === expected ? id : null;
+  return state && state.version === expected ? { id, role: state.role } : null;
+}
+/**
+ * The signed-in staff member's id (null for everyone else). Every admin, API,
+ * action and preview check goes through here, so a site role without admin
+ * access (lib/roles.ts) counts as signed out for all of them; site pages use
+ * validatePerson / currentUser() instead.
+ */
+export async function validateSession(token: string | undefined, localsOrRepo?: unknown): Promise<string | null> {
+  const person = await validatePerson(token, localsOrRepo);
+  return person && isStaffRole(person.role) ? person.id : null;
 }

package/src/lib/calendar/board.ts

@@ -65,6 +65,17 @@ export function todayIn(tz: string, now = Date.now()): Iso {
   return isoOf(tzParts(now, tz || 'UTC'));
 }
 
+/**
+ * An event's status on the board. A member's new event that is still waiting
+ * for approval (lib/calendar/requests.ts) shows as 'pending' ("Needs
+ * approval"). Suggested changes to a live event don't: the event stays as
+ * it is until they're approved.
+ */
+export function eventBoardStatus(e: Pick<CalEvent, 'status' | 'request'>): BoardStatus {
+  if (e.status === 'draft' && e.request?.state === 'pending' && e.request.kind === 'new') return 'pending';
+  return e.status as BoardStatus;
+}
+
 // local day + minutes for an instant; `endExclusive` maps midnight to the
 // previous day's 24:00 so an event ending at midnight stays on its day
 function local(ms: number, tz: string, endExclusive = false) {
@@ -118,7 +129,7 @@ export async function loadBoard(repo: ContentRepository, settings: Settings, fro
       color: v.color ?? (cal ? safeColor(cal.color) : '#8a8378'),
       calendarId: cal?.id ?? NO_CALENDAR,
       calendarName: cal?.name ?? '',
-      status: e ? (e.status as BoardStatus) : 'feed',
+      status: e ? eventBoardStatus(e) : 'feed',
       recurring: Boolean(e?.rrule),
       repeat: e?.rrule ? describeRepeat(e.rrule, e.start) : '',
       rooms: e ? e.roomHold.resourceIds.map((id) => roomName.get(id)).filter((n): n is string => Boolean(n)) : [],

package/src/lib/calendar/cards.ts

@@ -2,7 +2,7 @@
 // block (data-dyn="events"), the /calendar page and embeds. Stable
 // .pc-ev-card* classes are the styling API, like .pc-cal-* for the grid.
 import type { ContentRepository } from '../repo/types';
-import type { CalEvent, Settings } from '../schema';
+import { tagFilter, type CalEvent, type Settings } from '../schema';
 import { siteLocale } from '../dates';
 import { eventImage } from './images';
 import { eventUrl } from './config';
@@ -62,21 +62,23 @@ export function eventCardHtml(
   );
 }
 
-// next occurrence of each distinct event, soonest first
+// next occurrence of each distinct event, soonest first; tag/excludeTag
+// narrow by event tag (name or slug, any case)
 export async function upcomingEvents(
   repo: ContentRepository,
   settings: Settings,
   now: number,
-  opts: { calendarIds?: string[]; limit: number; horizonDays?: number }
+  opts: { calendarIds?: string[]; limit: number; horizonDays?: number; tag?: string; excludeTag?: string }
 ) {
   const tz = settings.timezone || 'UTC';
+  const tagged = tagFilter(opts.tag, opts.excludeTag);
   const { events } = await collectViewEvents(repo, settings, {
     displayTz: tz, now, windowStartMs: now, windowEndMs: now + (opts.horizonDays ?? 400) * 86_400_000,
   }, { audience: 'public', calendarIds: opts.calendarIds, includeFeeds: false });
   const seen = new Set<string>();
   const out: Pick<Occurrence, 'event' | 'start' | 'end' | 'allDay' | 'days' | 'cancelled'>[] = [];
   for (const v of events) {
-    if (!v.event || v.end <= now || seen.has(v.event.id)) continue;
+    if (!v.event || v.end <= now || seen.has(v.event.id) || !tagged(v.event.tags)) continue;
     seen.add(v.event.id);
     out.push({ event: v.event, start: v.start, end: v.end, allDay: v.allDay, days: v.days, cancelled: Boolean(v.cancelled) });
     if (out.length >= opts.limit) break;

package/src/lib/calendar/member-form.ts

@@ -0,0 +1,152 @@
+import type { CalEvent, EventRequest } from '../schema';
+import type { EventRequestInput } from './requests';
+import { CALENDAR, type EventFieldConfig } from './config';
+import { describeRepeat } from './rrule';
+
+// The event request form on the built-in "My events" pages, as pure
+// functions: the HTML form's fields → EventRequestInput (requests.ts checks
+// and saves it), and an event → the form's values for editing. A site that
+// builds its own request page can reuse them or post its own input.
+
+/** what the form holds; times are wall-clock in the site's time zone */
+export interface MemberEventForm {
+  title: string;
+  /** YYYY-MM-DD */
+  date: string;
+  /** HH:mm ('' for all-day events) */
+  startTime: string;
+  endTime: string;
+  /** days from `date` to the last day: kept (hidden) so a multi-day event stays multi-day when its date moves */
+  days: number;
+  allDay: boolean;
+  /** an RRULE body: one of REPEAT_CHOICES, or what the event had */
+  repeat: string;
+  where: string;
+  /** plain text */
+  description: string;
+  calendarId: string;
+  /** the site's non-private custom event fields */
+  fields: Record<string, string>;
+  note: string;
+}
+
+/** the request form's "Repeats" choices */
+export const REPEAT_CHOICES: readonly { value: string; label: string }[] = [
+  { value: '', label: 'Does not repeat' },
+  { value: 'FREQ=DAILY', label: 'Every day' },
+  { value: 'FREQ=WEEKLY', label: 'Every week' },
+  { value: 'FREQ=WEEKLY;INTERVAL=2', label: 'Every 2 weeks' },
+  { value: 'FREQ=MONTHLY', label: 'Every month' },
+];
+
+/** the patterns requests.ts accepts from members (kept in step with its REPEAT) */
+const MEMBER_REPEAT = /^FREQ=(DAILY|WEEKLY|MONTHLY)(;INTERVAL=[1-9]\d?)?(;COUNT=[1-9]\d{0,2})?$/;
+/** maxlength for the inputs (requests.ts trims to the same) */
+export const MEMBER_FORM_LIMITS = { title: 200, description: 5000, where: 300, note: 1000, field: 500 } as const;
+const MAX_DAYS = 366;
+const DAY = 86_400_000;
+const YMD = /^\d{4}-\d{2}-\d{2}$/;
+
+/** the custom event fields members fill in (private ones are staff-only) */
+export const memberEventFields = (fields: readonly EventFieldConfig[] = CALENDAR.eventFields) => fields.filter((f) => !f.private);
+
+export function blankEventForm(fields: readonly EventFieldConfig[] = memberEventFields()): MemberEventForm {
+  return {
+    title: '', date: '', startTime: '', endTime: '', days: 0, allDay: false, repeat: '', where: '', description: '', calendarId: '',
+    fields: Object.fromEntries(fields.map((f) => [f.key, ''])), note: '',
+  };
+}
+
+const ymdMs = (ymd: string) => {
+  if (!YMD.test(ymd)) return NaN;
+  const [y, m, d] = ymd.split('-').map(Number);
+  const ms = Date.UTC(y, m - 1, d);
+  const back = new Date(ms);
+  return back.getUTCFullYear() === y && back.getUTCMonth() === m - 1 && back.getUTCDate() === d ? ms : NaN;
+};
+const addDays = (ymd: string, n: number) => {
+  const ms = ymdMs(ymd);
+  return Number.isFinite(ms) ? new Date(ms + n * DAY).toISOString().slice(0, 10) : ymd;
+};
+const dayDiff = (from: string, to: string) => {
+  const a = ymdMs(from), b = ymdMs(to);
+  return Number.isFinite(a) && Number.isFinite(b) ? Math.round((b - a) / DAY) : 0;
+};
+const clampDays = (n: number) => (Number.isFinite(n) ? Math.min(MAX_DAYS, Math.max(0, Math.trunc(n))) : 0);
+const time = (v: string) => (/^\d{2}:\d{2}/.test(v.trim()) ? v.trim().slice(0, 5) : '');
+
+/** anything with get(name): FormData, URLSearchParams */
+export interface FormLike { get(name: string): FormDataEntryValue | null }
+
+/** the posted form → its values (unchecked; requests.ts validates) */
+export function readEventForm(form: FormLike, fields: readonly EventFieldConfig[] = memberEventFields()): MemberEventForm {
+  const s = (name: string) => { const v = form.get(name); return typeof v === 'string' ? v : ''; };
+  const all = s('allDay').toLowerCase();
+  const values: MemberEventForm = {
+    title: s('title'), date: s('date').trim(), startTime: time(s('startTime')), endTime: time(s('endTime')),
+    days: clampDays(Number(s('days') || 0)), allDay: all !== '' && all !== '0' && all !== 'false',
+    repeat: s('repeat').trim(), where: s('where'), description: s('description'), calendarId: s('calendarId').trim(),
+    fields: {}, note: s('note'),
+  };
+  // a field the form didn't include is left as it is (undefined), not cleared
+  for (const f of fields) {
+    const v = form.get(`field_${f.key}`);
+    if (typeof v === 'string') values.fields[f.key] = v;
+  }
+  return values;
+}
+
+/** the form's values → what submitEventRequest / updateEventRequest take */
+export function eventRequestInput(v: MemberEventForm): EventRequestInput {
+  const lastDay = v.days > 0 ? addDays(v.date, v.days) : v.date;
+  // a timed event without a start time stays a bare date, which requests.ts answers with "Pick a date and start time."
+  const start = v.allDay || !v.startTime ? v.date : `${v.date}T${v.startTime}`;
+  const end = v.allDay ? (v.days > 0 ? lastDay : '') : v.endTime ? `${lastDay}T${v.endTime}` : '';
+  return {
+    title: v.title, description: v.description, start, end, allDay: v.allDay, repeat: v.repeat, where: v.where,
+    calendarId: v.calendarId, fields: v.fields, note: v.note,
+  };
+}
+
+type FormEvent = Pick<CalEvent, 'title' | 'start' | 'end' | 'allDay' | 'rrule' | 'location' | 'calendarIds' | 'fields' | 'request'>;
+
+/**
+ * An event (with its staged changes merged: mergeEventDraft) → the form's
+ * values. `description` is bodyToText(event); `calendarIds` are the
+ * calendars the form offers (the event's first one among them is picked).
+ */
+export function eventFormValues(e: FormEvent, opts: { description: string; calendarIds?: readonly string[] }, fields: readonly EventFieldConfig[] = memberEventFields()): MemberEventForm {
+  const date = e.start.slice(0, 10);
+  const lastDay = e.end ? e.end.slice(0, 10) : date;
+  return {
+    title: e.title, date, allDay: e.allDay,
+    startTime: e.allDay ? '' : time(e.start.slice(11)),
+    endTime: e.allDay || !e.end ? '' : time(e.end.slice(11)),
+    days: clampDays(dayDiff(date, lastDay)),
+    repeat: e.rrule, where: e.location.name, description: opts.description,
+    calendarId: e.calendarIds.find((id) => !opts.calendarIds || opts.calendarIds.includes(id)) ?? '',
+    fields: Object.fromEntries(fields.map((f) => [f.key, e.fields[f.key] ?? ''])),
+    // a waiting request's note is theirs to edit; after an answer they write a new one
+    note: e.request?.state === 'pending' ? e.request.note : '',
+  };
+}
+
+/**
+ * The "Repeats" select for a value: the standard choices, plus the event's
+ * own pattern (e.g. every 3 weeks, or one only the admin can set, like weekly
+ * on two days), selected, so sending the form unchanged keeps it.
+ */
+export function repeatChoices(current: string, start: string): { options: { value: string; label: string }[]; value: string; note: string } {
+  const rule = current.trim().replace(/^RRULE:/i, '').toUpperCase();
+  const options = [...REPEAT_CHOICES];
+  if (!rule || options.some((o) => o.value === rule)) return { options, value: rule, note: '' };
+  if (MEMBER_REPEAT.test(rule)) return { options: [...options, { value: rule, label: describeRepeat(rule, start) }], value: rule, note: '' };
+  // set up by the team: members can keep it (requests.ts accepts an unchanged rule) or pick another
+  return { options: [...options, { value: rule, label: `${describeRepeat(rule, start)} (as set by the team)` }], value: rule, note: '' };
+}
+
+/** how a request reads on "My events" */
+export function requestLabel(r: Pick<EventRequest, 'kind' | 'state'>): string {
+  if (r.kind === 'changes') return r.state === 'pending' ? 'Changes waiting for approval' : 'Changes declined';
+  return r.state === 'pending' ? 'Waiting for approval' : 'Declined';
+}