@acms-subir/core 0.3.21 → 0.3.23

package/src/pages/admin/login.astro

@@ -1,5 +1,7 @@
 ---
 import { safeNext } from '../../lib/editor/next';
+import { afterSignIn, isAdminPath, signInReturn } from '../../lib/auth/return';
+import { isStaffRole, roleHome, roleLabel } from '../../lib/roles';
 import { checkPassword, createSessionToken, verifyPassword, SESSION_COOKIE } from '../../lib/auth';
 import { getRequestAuth } from '../../lib/auth/request';
 import { AUTH } from '../../lib/auth/config';
@@ -13,23 +15,25 @@ import '../../styles/admin.css';
 
 // ?next= returns to the editor-app sign-in page only (never another site)
 const next = safeNext(Astro.url.searchParams.get('next'), Astro.url);
-// ?return= brings an owner back to the admin page they left to sign in again
-// (a fresh sign-in is the recent verification sensitive changes need)
-function adminReturn(value: string | null): string | null {
-  if (!value || !value.startsWith('/admin') || value.includes('\\') || /[\u0000-\u001f]/.test(value)) return null;
-  let url: URL;
-  try { url = new URL(value, Astro.url.origin); } catch { return null; }
-  if (url.origin !== Astro.url.origin || !/^\/admin(\/|$)/.test(url.pathname)) return null;
-  if (/^\/admin\/(login|logout|app-auth)\b/.test(url.pathname)) return null;
-  return url.pathname + url.search + url.hash;
-}
-const back = next ? null : adminReturn(Astro.url.searchParams.get('return'));
-const reverify = !!back && Astro.url.searchParams.get('reverify') === '1';
+// ?return= brings people back to the page they signed in from: any page on
+// this site (lib/auth/return.ts), e.g. an owner re-verifying on an admin page
+// (a fresh sign-in is the recent verification sensitive changes need) or a
+// class host coming back to /classes
+const back = next ? null : signInReturn(Astro.url.searchParams.get('return'), Astro.url);
+const reverify = !!back && isAdminPath(back) && Astro.url.searchParams.get('reverify') === '1';
 const clerkMode = AUTH.provider === 'clerk';
 const auth = await getRequestAuth(Astro.request, Astro.cookies, Astro.locals);
 if (auth.userId) {
   return Astro.redirect(next ?? back ?? '/admin');
 }
+// signed in, but in a site role without admin access: back to the site,
+// except from the editor app's sign-in, which can't take them (say so)
+let member: { name: string; role: string } | null = null;
+if (auth.person) {
+  if (!next) return Astro.redirect(afterSignIn(auth.person.role, back));
+  const who = await (await getRepo(Astro.locals)).getUser(auth.person.id);
+  member = { name: who?.name ?? '', role: auth.person.role };
+}
 
 // Clerk mode: the provider's prebuilt components do every credential step on
 // this page. Local passwords, the owner password and recovery links are off.
@@ -69,6 +73,7 @@ if (!clerkMode && Astro.request.method === 'POST') {
   // a user account created in /admin/users.
   let sessionUserId: string | null = null;
   let sessionVersion = 0;
+  let sessionRole = 'owner', sessionName = '';
   let address = 'unknown';
   try { address = Astro.clientAddress || address; } catch { /* shared fallback bucket */ }
   const repo = await getRepo(Astro.locals);
@@ -79,7 +84,7 @@ if (!clerkMode && Astro.request.method === 'POST') {
     sessionUserId = null; // default token = env owner
   } else if (email) {
     const auth = await repo.getUserAuth(email);
-    if (auth && (await verifyPassword(password, auth.passHash))) { sessionUserId = auth.user.id; sessionVersion = auth.sessionVersion; }
+    if (auth && (await verifyPassword(password, auth.passHash))) { sessionUserId = auth.user.id; sessionVersion = auth.sessionVersion; sessionRole = auth.user.role; sessionName = auth.user.name; }
     else {
       error = 'Wrong email or password.';
     }
@@ -95,7 +100,8 @@ if (!clerkMode && Astro.request.method === 'POST') {
       maxAge: 7 * 24 * 60 * 60,
       secure: Astro.url.protocol === 'https:',
     });
-    return Astro.redirect(next ?? back ?? '/admin');
+    if (!isStaffRole(sessionRole) && next) member = { name: sessionName, role: sessionRole };
+    else return Astro.redirect(next && isStaffRole(sessionRole) ? next : afterSignIn(sessionRole, back));
   }
 }
 ---
@@ -120,7 +126,22 @@ if (!clerkMode && Astro.request.method === 'POST') {
           <div class="brand-name">{siteName}</div>
         </div>
 
-        {!clerkMode && (
+        {member && (
+          <section class="login-state" aria-labelledby="login-state-h">
+            <span class="login-state-icon is-warn" aria-hidden="true">
+              <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="9" /><path d="M12 8v5M12 16h.01" /></svg>
+            </span>
+            <h1 id="login-state-h">No access to the editor app</h1>
+            <p>You’re signed in{member.name ? <> as <b>{member.name}</b></> : ''} ({roleLabel(member.role)}).</p>
+            <p class="hint">This account can sign in to the site, but not the admin or the editor app.</p>
+            <div class="login-actions">
+              <a class="btn primary block" href={roleHome(member.role)}>Go to the site</a>
+              <form method="post" action="/admin/logout"><button class="btn block" type="submit">Sign out</button></form>
+            </div>
+          </section>
+        )}
+
+        {!member && !clerkMode && (
           <>
             {next && !error && <p class="hint login-for-app">Sign in to connect the app to your account.</p>}
             {error && <div class="flash error">{error}</div>}
@@ -140,7 +161,7 @@ if (!clerkMode && Astro.request.method === 'POST') {
           </>
         )}
 
-        {clerkMode && (
+        {!member && clerkMode && (
           <div class="login-clerk" data-acms-login data-view={clerkView} data-next={next ?? back ?? '/admin'} data-keep={keep || undefined} data-logout={logoutAction} data-signed-out={signedOut ? '1' : undefined}>
             {(clerkView === 'sign-in' || clerkView === 'sign-up') && (
               <>

package/src/pages/admin/roles.astro

@@ -40,6 +40,9 @@ if (access?.role !== 'owner' && access?.role !== 'administrator') return Astro.r
   .rp-area-head { display: flex; justify-content: space-between; align-items: center; margin-bottom: 4px; font-size: 14px; }
   .rp-row { display: grid; grid-template-columns: minmax(0, 1fr) auto; gap: 14px; align-items: center; padding: 8px 10px; margin: 0 -10px; border-radius: var(--r-md); }
   .rp-row.changed { background: var(--accent-soft); }
+  .rp-row.na .rp-text { opacity: 0.55; }
+  .rp-role-sep { font-size: 11px; font-weight: 600; color: var(--muted); padding: 12px 11px 4px; }
+  .rp-note { font-size: 12.5px; color: var(--text-2); background: var(--panel-2); border-radius: var(--r-md); padding: 8px 11px; margin: 8px 0 0; }
   .rp-text { display: grid; gap: 1px; }
   .rp-label { font-size: 14px; display: inline-flex; align-items: center; gap: 6px; flex-wrap: wrap; }
   .rp-text small { color: var(--muted); font-size: 12.5px; }

package/src/pages/admin/users.astro

@@ -12,10 +12,10 @@ import { issueAccountToken } from '../../lib/email/accounts';
 import { kickEmail } from '../../lib/email/service';
 import { waitUntilFrom } from '../../lib/webhooks';
 import { requireSession } from '../../lib/api';
-import { slugify, authorSlug, Role } from '../../lib/schema';
-import { roleLabels, roleSummaries } from '../../lib/roles';
+import { slugify, authorSlug, type Role } from '../../lib/schema';
+import { isRole, parseRole, roleLabel, roleSummary, rolesByRank } from '../../lib/roles';
 import { accessFor } from '../../lib/permissions/access';
-import { ROLE_RANK, assignableRoles } from '../../lib/permissions/catalog';
+import { assignableRoles, ranksBelow } from '../../lib/permissions/catalog';
 import { EDITOR } from '../../lib/editor/config';
 
 const repo = await getRepo(Astro.locals);
@@ -39,7 +39,7 @@ const canInvite = access?.can('team.invite') ?? false;
 const canManage = access?.can('team.manage') ?? false;
 // roles this person may give out (owners: all; everyone else: below their own)
 const assignable = access ? assignableRoles(access.role) : [];
-const below = (role: Role) => isOwner || (!!access && ROLE_RANK[role] < ROLE_RANK[access.role]);
+const below = (role: Role) => isOwner || (!!access && ranksBelow(role, access.role));
 const manages = (u: { id: string; role: Role }) => canManage && below(u.role) && (isOwner || u.id !== sessionUserId);
 
 let error = '';
@@ -90,16 +90,16 @@ if (Astro.request.method === 'POST' && (canInvite || canManage) && !error) {
     if (inviteOp && !canInvite) throw new Error('Your role doesn’t include “Invite people”. Ask an owner if you need it.');
     if (!inviteOp && !canManage) throw new Error('Your role doesn’t include “Manage members”. Ask an owner if you need it.');
     if (op === 'link' && !isOwner) throw new Error('Only owners can link sign-in accounts.');
-    if (op === 'create' && !assignable.includes(Role.parse(form.get('role')))) throw new Error('You can only invite people to roles below your own.');
+    if (op === 'create' && !assignable.includes(parseRole(form.get('role')))) throw new Error('You can only invite people to roles below your own.');
     if (op === 'resend' || op === 'revoke') {
       const target = clerkMode ? await repo.auth.invitation(issuer, String(form.get('id'))) : await repo.email.token(String(form.get('id')));
-      if (target && !below(Role.parse(target.role))) throw new Error('Only an owner can change invitations for this role.');
+      if (target && !below(String(target.role))) throw new Error('Only an owner can change invitations for this role.');
     }
     if (['update', 'delete', 'email'].includes(op)) {
       const target = await repo.getUser(String(form.get('id')));
       if (!target) throw new Error('The account no longer exists.');
       if (!manages(target)) throw new Error('You can only manage people in roles below your own.');
-      if (op === 'update' && !assignable.includes(Role.parse(form.get('role')))) throw new Error('You can only assign roles below your own.');
+      if (op === 'update' && !assignable.includes(parseRole(form.get('role')))) throw new Error('You can only assign roles below your own.');
     }
     if (clerkMode) {
       if (!clerkReady) throw new Error('Clerk sign-in isn’t fully configured, so accounts can’t be changed right now.');
@@ -132,7 +132,7 @@ if (Astro.request.method === 'POST' && (canInvite || canManage) && !error) {
       if(!await repo.email.rateLimit(`invite:${sessionUserId}`,10,60000))throw new Error('Please wait before sending more invitations.');
       const previous=op==='resend'?await repo.email.token(String(form.get('id'))):null;
       if(op==='resend'&&(!previous||previous.purpose!=='invite'||previous.used_by))throw new Error('This invitation cannot be resent.');
-      const invitedRole = Role.parse(previous ? previous.role : form.get('role'));
+      const invitedRole = parseRole(previous ? previous.role : form.get('role'));
       await issueAccountToken(repo,{purpose:'invite',email:previous?String(previous.email):String(form.get('email')||''),
         name:previous?String(previous.name):String(form.get('name')||''),
         role:invitedRole,invitedBy:sessionUserId},Astro.locals);
@@ -150,7 +150,7 @@ if (Astro.request.method === 'POST' && (canInvite || canManage) && !error) {
       if (password && (password.length < 12 || password.length > 128)) throw new Error('Use a password between 12 and 128 characters.');
       await repo.updateUser(id, {
         name: String(form.get('name') ?? '').trim() || undefined,
-        role: Role.parse(form.get('role')),
+        role: parseRole(form.get('role')),
         bio: String(form.get('bio') ?? ''),
         avatar: String(form.get('avatar') ?? '').trim(),
         slug: String(form.get('slug') ?? '').trim() ? slugify(String(form.get('slug'))) : '',
@@ -266,12 +266,12 @@ const deviceGroups = [...new Set(devices.map((d) => d.userId))].map((uid) => ({
         </label>
         <fieldset class="invite-roles">
           <legend>Role</legend>
-          {Role.options.slice().reverse().map((role) => {
+          {rolesByRank().map((role) => {
             const allowed = assignable.includes(role);
             return (
               <label class:list={['invite-role', { 'is-off': !allowed }]}>
                 <input type="radio" name="role" value={role} checked={role === (assignable.includes('editor') ? 'editor' : assignable[assignable.length - 1])} disabled={!allowed} />
-                <span><b>{roleLabels[role]}</b>{!allowed && <span class="pill archived">Owner only</span>}<small>{roleSummaries[role]}</small></span>
+                <span><b>{roleLabel(role)}</b>{!allowed && <span class="pill archived">Owner only</span>}<small>{roleSummary(role)}</small></span>
               </label>
             );
           })}
@@ -313,7 +313,7 @@ const deviceGroups = [...new Set(devices.map((d) => d.userId))].map((uid) => ({
                 </span>
               </div>
             </td>
-            <td><span class={`pill ${u.role === 'owner' ? 'draft' : 'scheduled'}`}>{roleLabels[u.role]}</span></td>
+            <td><span class={`pill ${u.role === 'owner' ? 'draft' : 'scheduled'}`}>{roleLabel(u.role)}</span>{!isRole(u.role) && <span class="pill edited" title="This site no longer defines this role. People with it can’t use the admin; choose another role for them.">No longer defined</span>}</td>
             {clerkMode && isOwner && clerkReady && (
               <td>{linked.has(u.id)
                 ? <span class="pill published" title={linked.get(u.id)}>Connected</span>
@@ -366,7 +366,8 @@ const deviceGroups = [...new Set(devices.map((d) => d.userId))].map((uid) => ({
               <label class="field">
                 <span>Role</span>
                 <select name="role" form={formId}>
-                  {Role.options.filter((role) => assignable.includes(role)).map(role => <option value={role} selected={u.role === role}>{roleLabels[role]}</option>)}
+                  {!isRole(u.role) && <option value="" selected disabled>{u.role} (no longer defined)</option>}
+                  {rolesByRank().filter((role) => assignable.includes(role)).map(role => <option value={role} selected={u.role === role}>{roleLabel(role)}</option>)}
                 </select>
               </label>
               {!clerkMode && (
@@ -471,7 +472,7 @@ const deviceGroups = [...new Set(devices.map((d) => d.userId))].map((uid) => ({
       {invitations.map(i=>{
         const [label, tone] = clerkMode ? (stateLabel[i.state] ?? [i.state, 'archived']) : [i.state, ''];
         const inviter = i.invitedBy ? (userById.get(i.invitedBy)?.name ?? (i.invitedBy === OWNER_ENV ? 'Owner' : 'Removed user')) : '';
-        return <tr><td>{i.email}{clerkMode && i.name && i.name !== i.email && <div class="t-sub">{i.name}</div>}{(inviter || i.createdAt) && <div class="t-sub">{inviter && <>Invited by {inviter}</>}{inviter && i.createdAt ? ' · ' : ''}{i.createdAt ? day(i.createdAt) : ''}</div>}</td><td>{roleLabels[i.role] ?? i.role}</td>
+        return <tr><td>{i.email}{clerkMode && i.name && i.name !== i.email && <div class="t-sub">{i.name}</div>}{(inviter || i.createdAt) && <div class="t-sub">{inviter && <>Invited by {inviter}</>}{inviter && i.createdAt ? ' · ' : ''}{i.createdAt ? day(i.createdAt) : ''}</div>}</td><td>{roleLabel(i.role)}</td>
           <td>{clerkMode ? <span class={`pill ${tone}`}>{label}</span> : i.state}{clerkMode && i.state === 'pending' && <div class="t-sub">Expires {day(i.expiresAt)}</div>}</td>
           <td class="td-actions">{i.state!=='accepted'&&!below(i.role)&&<span class="hint">Owner only</span>}{i.state!=='accepted'&&below(i.role)&&<form method="post" class="inline-form" data-reverify><input type="hidden" name="id" value={i.id}/><button class="btn sm" name="op" value="resend">Resend</button>{(i.state==='pending'||(clerkMode&&i.state==='sending'))&&<button class="btn sm ghost" name="op" value="revoke">Revoke</button>}</form>}</td></tr>;
       })}

package/src/pages/api/calendar/events/index.ts

@@ -14,14 +14,16 @@ import { readJson } from '../../../../lib/api';
 import { runAgentTool } from '../../../../lib/agent';
 import { waitUntilFrom } from '../../../../lib/webhooks';
 import { fail } from '../../../../lib/calendar/http';
+import { publicTags, tagFilter } from '../../../../lib/schema';
 
 // Public read API for other sites, apps and lobby screens.
 //   GET /api/calendar/events?from=2026-10-01&to=2026-10-31&calendar=youth&q=night
+//   GET /api/calendar/events?tag=class (or excludeTag=class; a tag's name or slug)
 //   → { timezone, from, to, occurrences: [{ id, start, end, allDay, cancelled, event }] }
 //   GET /api/calendar/events?expand=0 → { events: [...] } (rules, not instances)
 // Anonymous callers see public calendars (and an unlisted one when asked by
 // slug). A key with events:read also sees private calendars and private
-// custom fields.
+// custom fields, and its tag filters also match internal "#" tags.
 const CORS = {
   'Access-Control-Allow-Origin': '*',
   'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
@@ -55,6 +57,11 @@ export const GET: APIRoute = async ({ request, locals, url }) => {
       return full ? true : eventIsListed(e, map);
     });
     if (q) events = events.filter((e) => `${e.title} ${e.excerpt} ${e.location.name}`.toLowerCase().includes(q));
+    const tag = url.searchParams.get('tag')?.slice(0, 100), excludeTag = url.searchParams.get('excludeTag')?.slice(0, 100);
+    if (tag || excludeTag) {
+      const tagged = tagFilter(tag, excludeTag);
+      events = events.filter((e) => tagged(full ? e.tags : publicTags(e.tags)));
+    }
 
     if (url.searchParams.get('expand') === '0') {
       return withCors(json({ timezone: tz, events: events.map((e) => eventToJson(e, origin, map, settings.timezone, { includePrivate: full })) }));

package/src/pages/api/search.ts

@@ -1,4 +1,5 @@
 import type { APIRoute } from 'astro';
+import { isStaffRole } from '../../lib/roles';
 import { getRepo } from '../../lib/repo';
 import { authorSlug, publicTags } from '../../lib/schema';
 import { collectionUrl, tagUrl } from '../../lib/content';
@@ -52,7 +53,8 @@ export const GET: APIRoute = async ({ locals, url }) => {
       };
     }),
     tags: results.tags.slice(0, LIMITS.tags).map(({ tag, count }) => ({ name: tag.name, url: tagUrl(tag.slug), count })),
-    authors: results.authors.slice(0, LIMITS.authors).map((u) => ({ name: u.name, url: `/author/${authorSlug(u)}`, avatar: u.avatar })),
+    // staff only: people in the site's own roles don't write posts and have no public profile
+    authors: results.authors.filter((u) => isStaffRole(u.role)).slice(0, LIMITS.authors).map((u) => ({ name: u.name, url: `/author/${authorSlug(u)}`, avatar: u.avatar })),
   };
   return new Response(JSON.stringify(body), { headers });
 };

package/src/pages/author/[slug].astro

@@ -3,6 +3,7 @@ import Site from '../../layouts/Site.astro';
 import PostCard from '../../components/site/PostCard.astro';
 import Pager from '../../components/site/Pager.astro';
 import { getRepo } from '../../lib/repo';
+import { isStaffRole } from '../../lib/roles';
 import { tagUrl } from '../../lib/content';
 import { publicTags, slugify } from '../../lib/schema';
 import { authorSlug } from '../../lib/schema';
@@ -14,7 +15,8 @@ const { slug } = Astro.params;
 const repo = await getRepo(Astro.locals);
 const [users, settings, tags] = await Promise.all([repo.listUsers(), repo.getSettings(), repo.listTags()]);
 // stored slug wins; slugified name is the fallback so profiles work untouched
-const author = users.find((u) => authorSlug(u) === slug);
+// staff only: people in the site's own roles have no public profile
+const author = users.find((u) => isStaffRole(u.role) && authorSlug(u) === slug);
 if (!author) return new Response(null, { status: 404, statusText: 'Not found' });
 
 // includes co-authored posts (authorIds), not just primary authorship

package/src/pages/members/_EventForm.astro

@@ -0,0 +1,89 @@
+---
+import type { EventFieldConfig } from '../../lib/calendar/config';
+import { MEMBER_FORM_LIMITS as L, repeatChoices, type MemberEventForm } from '../../lib/calendar/member-form';
+
+// The event request form (new requests and suggested changes). Plain HTML:
+// it posts to the page it's on, with `op` saying what to do.
+interface Props {
+  values: MemberEventForm;
+  /** the calendars members may choose (native, public); none hides the choice */
+  calendars: { id: string; name: string }[];
+  /** the site's non-private custom event fields */
+  fields: readonly EventFieldConfig[];
+  op: 'submit' | 'update';
+  submitLabel: string;
+  error?: string;
+}
+const { values: v, calendars, fields, op, submitLabel, error = '' } = Astro.props;
+const repeat = repeatChoices(v.repeat, v.date);
+const fieldType = (t: EventFieldConfig['type']) => (t === 'number' ? 'number' : t === 'url' ? 'url' : 'text');
+---
+
+<form method="post" class="pc-mem-form">
+  {error && <p class="pc-bk-error" role="alert">{error}</p>}
+  <input type="hidden" name="op" value={op} />
+  <label class="pc-bk-field">
+    <span>Title</span>
+    <input name="title" required maxlength={L.title} value={v.title} />
+  </label>
+  <fieldset class="pc-mem-when">
+    <legend>When</legend>
+    <div class="pc-mem-row">
+      <label class="pc-bk-field"><span>Date</span><input type="date" name="date" required value={v.date} /></label>
+      <label class="pc-bk-field pc-mem-time"><span>Starts</span><input type="time" name="startTime" value={v.startTime} /></label>
+      <label class="pc-bk-field pc-mem-time"><span>Ends <em>(optional)</em></span><input type="time" name="endTime" value={v.endTime} /></label>
+    </div>
+    <label class="pc-bk-check"><input type="checkbox" name="allDay" value="1" checked={v.allDay} /> <span>All day <small>No start or end time</small></span></label>
+    {v.days > 0 && (
+      <>
+        <input type="hidden" name="days" value={String(v.days)} />
+        <p class="pc-mem-hint">This event runs over {v.days + 1} days. Changing the date moves all of them.</p>
+      </>
+    )}
+    <label class="pc-bk-field">
+      <span>Repeats</span>
+      <select name="repeat">
+        {repeat.options.map((o) => <option value={o.value} selected={o.value === repeat.value}>{o.label}</option>)}
+      </select>
+      {repeat.note && <small>{repeat.note}</small>}
+    </label>
+  </fieldset>
+  <label class="pc-bk-field">
+    <span>Where</span>
+    <input name="where" maxlength={L.where} value={v.where} placeholder="A room, an address, or “Online”" />
+  </label>
+  <label class="pc-bk-field">
+    <span>Description</span>
+    <textarea name="description" rows="6" maxlength={L.description}>{v.description}</textarea>
+    <small>Plain text. Leave a blank line between paragraphs.</small>
+  </label>
+  {calendars.length > 0 && (
+    <label class="pc-bk-field">
+      <span>Calendar</span>
+      <select name="calendarId">
+        <option value="">Not sure (the team will choose)</option>
+        {calendars.map((c) => <option value={c.id} selected={c.id === v.calendarId}>{c.name}</option>)}
+      </select>
+    </label>
+  )}
+  {fields.map((f) => (
+    <label class="pc-bk-field">
+      <span>{f.label}</span>
+      {f.type === 'textarea' ? (
+        <textarea name={`field_${f.key}`} rows="3" maxlength={L.field}>{v.fields[f.key] ?? ''}</textarea>
+      ) : f.type === 'select' ? (
+        <select name={`field_${f.key}`}>
+          <option value="">Choose…</option>
+          {f.options.map((o) => <option value={o} selected={o === v.fields[f.key]}>{o}</option>)}
+        </select>
+      ) : (
+        <input type={fieldType(f.type)} name={`field_${f.key}`} maxlength={f.type === 'number' ? undefined : L.field} step={f.type === 'number' ? 'any' : undefined} value={v.fields[f.key] ?? ''} />
+      )}
+    </label>
+  ))}
+  <label class="pc-bk-field">
+    <span>Note for the team <em>(only staff see this)</em></span>
+    <textarea name="note" rows="3" maxlength={L.note}>{v.note}</textarea>
+  </label>
+  <button class="pc-bk-submit" type="submit">{submitLabel}</button>
+</form>

package/src/pages/members/_Layout.astro

@@ -0,0 +1,76 @@
+---
+import Site from '../../layouts/Site.astro';
+
+// The frame of the built-in member pages: the site's own layout and theme,
+// never indexed, plus who's signed in. `.pc-mem-*` classes are theme hooks;
+// form controls reuse the booking pages' `.pc-bk-*` ones.
+interface Props {
+  title: string;
+  user: { name: string; email: string; staff: boolean };
+}
+const { title, user } = Astro.props;
+---
+
+<Site title={title} noindex staffPreview>
+  <div class="pc-mem">
+    <div class="pc-mem-top">
+      <span>Signed in as {user.name || user.email}</span>
+      <span class="pc-mem-top-links">
+        {user.staff && <a href="/admin">Open the admin</a>}
+        <form method="post" action="/admin/logout"><button type="submit">Sign out</button></form>
+      </span>
+    </div>
+    <slot />
+  </div>
+</Site>
+
+<style is:global>
+  @layer base {
+    .pc-mem { display: grid; gap: 26px; }
+    .pc-mem-top { display: flex; flex-wrap: wrap; justify-content: space-between; gap: 6px 16px; font-size: 13.5px; color: var(--muted); }
+    .pc-mem-top-links { display: inline-flex; gap: 14px; align-items: baseline; }
+    .pc-mem-top a, .pc-mem-top button { color: var(--muted); }
+    .pc-mem-top form { margin: 0; }
+    .pc-mem-top button { background: none; border: 0; padding: 0; font: inherit; text-decoration: underline; text-underline-offset: 3px; cursor: pointer; }
+    .pc-mem-head { display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: 12px; }
+    .pc-mem-head h1 { font-size: 30px; margin: 0; }
+    .pc-mem-back { font-size: 14px; color: var(--muted); }
+    .pc-mem-lede { color: var(--muted); margin: 6px 0 0; }
+    .pc-mem-flash { background: color-mix(in srgb, var(--success) 10%, var(--panel)); color: var(--success); border-radius: var(--r-sm); padding: 9px 12px; font-size: 14px; margin: 0; }
+    .pc-mem .pc-bk-error { margin: 0; }
+    .pc-mem section > h2 { font-size: 19px; margin: 0 0 10px; }
+    .pc-mem-empty { color: var(--muted); font-size: 14.5px; margin: 0; }
+    .pc-mem-list { list-style: none; margin: 0; padding: 0; display: grid; gap: 10px; }
+    .pc-mem-card { background: var(--panel); border: 1px solid var(--line); border-radius: var(--r); padding: 14px 16px; box-shadow: var(--sh-1); }
+    .pc-mem-card h3 { font-size: 16.5px; margin: 0; }
+    .pc-mem-meta { color: var(--muted); font-size: 14px; margin: 3px 0 0; }
+    .pc-mem-state { display: inline-flex; align-items: center; gap: 7px; font-size: 13px; font-weight: 600; margin: 0 0 4px; }
+    .pc-mem-state::before { content: ''; width: 7px; height: 7px; border-radius: 2px; background: currentColor; }
+    .pc-mem-state.is-pending { color: var(--warning); }
+    .pc-mem-state.is-declined { color: var(--danger); }
+    .pc-mem-reply { margin: 10px 0 0; padding: 9px 12px; background: var(--soft); border-radius: var(--r-sm); font-size: 14px; white-space: pre-line; }
+    .pc-mem > .pc-mem-reply { margin: 0; }
+    .pc-mem-actions { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 12px; }
+    .pc-mem-actions form, .pc-mem-dates form { margin: 0; }
+    .pc-mem-btn { display: inline-flex; align-items: center; height: 36px; padding: 0 13px; border: 1px solid var(--line-2); border-radius: 10px; background: var(--panel); font: 550 14px/1.2 var(--font-body); color: var(--ink); text-decoration: none; cursor: pointer; white-space: nowrap; }
+    .pc-mem-btn:hover { background: var(--soft); }
+    .pc-mem-btn.is-primary { background: var(--btn); color: var(--btn-ink); border-color: transparent; box-shadow: var(--sh-1); }
+    .pc-mem-btn.is-primary:hover { background: var(--btn); box-shadow: var(--sh-2); }
+    .pc-mem-btn.is-danger { color: var(--danger); }
+    .pc-mem-btn.is-small { height: 30px; padding: 0 10px; font-size: 13px; }
+    .pc-mem-dates { list-style: none; margin: 10px 0 0; padding: 0; font-size: 14px; }
+    .pc-mem-dates li { display: flex; align-items: center; justify-content: space-between; gap: 10px; min-height: 42px; padding: 5px 0; border-top: 1px solid var(--line); font-variant-numeric: tabular-nums; }
+    .pc-mem-dates li.is-cancelled > span { color: var(--muted); }
+    .pc-mem-dates em { font-style: normal; font-size: 12.5px; font-weight: 600; color: var(--danger); margin-left: 8px; }
+    .pc-mem-past > summary { cursor: pointer; font-weight: 600; font-size: 15px; }
+    .pc-mem-past .pc-mem-list { margin-top: 10px; }
+    /* the request form */
+    .pc-mem-form { display: grid; gap: 14px; }
+    .pc-mem-form .pc-bk-field, .pc-mem-form .pc-bk-check { margin: 0; }
+    .pc-mem-when { border: 0; margin: 0; padding: 0; min-width: 0; display: grid; gap: 10px; }
+    .pc-mem-when > legend { padding: 0; margin-bottom: 6px; font-size: 13px; font-weight: 600; }
+    .pc-mem-row { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); gap: 12px; }
+    .pc-mem-when:has(input[name='allDay']:checked) .pc-mem-time { opacity: 0.45; }
+    .pc-mem-hint { color: var(--muted); font-size: 13px; margin: 0; }
+  }
+</style>

package/src/pages/members/_http.ts

@@ -0,0 +1,25 @@
+import { ApiError } from '../../lib/api';
+
+// Shared by the built-in "My events" pages: they're personal, so nothing
+// they answer (redirects included) may be cached or indexed.
+
+export const NO_STORE: Record<string, string> = { 'Cache-Control': 'private, no-store', 'X-Robots-Tag': 'noindex' };
+
+export function keepPrivate(headers: Headers) {
+  for (const [k, v] of Object.entries(NO_STORE)) headers.set(k, v);
+}
+
+/** 303 after a POST (the browser GETs the list), 302 otherwise */
+export const redirectTo = (location: string, status = 303) => new Response(null, { status, headers: { Location: location, ...NO_STORE } });
+
+/** signed out: sign in, then come back here */
+export const signInRedirect = (url: URL) => redirectTo(`/admin/login?return=${encodeURIComponent(url.pathname + url.search)}`, 302);
+
+export const notFound = () => new Response(null, { status: 404, statusText: 'Not found', headers: NO_STORE });
+
+/** an error from requests.ts → a message safe to show, and the status to answer with */
+export function failure(err: unknown): { message: string; status: number } {
+  if (err instanceof ApiError) return { message: err.message, status: err.status };
+  console.error(err);
+  return { message: 'Something went wrong. Please try again.', status: 500 };
+}

package/src/pages/members/events/[id].astro

@@ -0,0 +1,86 @@
+---
+import Layout from '../_Layout.astro';
+import EventForm from '../_EventForm.astro';
+import { getRepo } from '../../../lib/repo';
+import { currentUser } from '../../../server';
+import { ApiError } from '../../../lib/api';
+import { readForm } from '../../../lib/forms/http';
+import { MEMBERS, memberEventsPath, bodyToText, isHost, updateEventRequest, withdrawEventRequest } from '../../../lib/calendar/requests';
+import { eventFormValues, eventRequestInput, memberEventFields, readEventForm } from '../../../lib/calendar/member-form';
+import { mergeEventDraft } from '../../../lib/drafts';
+import { failure, keepPrivate, notFound, redirectTo, signInRedirect } from '../_http';
+
+// Edit a request, or suggest changes to a live event the member hosts: the
+// form starts from the event with any changes already waiting merged in.
+// A live event stays as it is until the team approves (updateEventRequest).
+if (!MEMBERS.enabled) return notFound();
+const user = await currentUser(Astro);
+if (!user) return signInRedirect(Astro.url);
+keepPrivate(Astro.response.headers);
+const repo = await getRepo(Astro.locals);
+const home = memberEventsPath();
+const hooks = { url: Astro.url, locals: Astro.locals };
+const id = Astro.params.id ?? '';
+const event = await repo.getEvent(id);
+if (!event || event.status === 'archived' || !isHost(event, user.id)) return notFound();
+
+const fields = memberEventFields();
+const calendars = (await repo.listCalendars()).filter((c) => c.kind === 'native' && c.visibility === 'public');
+const live = event.status === 'published' || event.status === 'scheduled';
+// the host's own waiting changes, never staff's unpublished edits
+const merged = event.request?.kind === 'changes' && event.request.state === 'pending' ? mergeEventDraft(event) : event;
+let values = eventFormValues(merged, { description: bodyToText(merged), calendarIds: calendars.map((c) => c.id) }, fields);
+
+let error = '';
+if (Astro.request.method === 'POST') {
+  try {
+    const form = await readForm(Astro.request);
+    const op = String(form.get('op') ?? '');
+    if (op === 'withdraw') {
+      await withdrawEventRequest(repo, user, id, hooks);
+      return redirectTo(`${home}?withdrawn=1`);
+    }
+    if (op !== 'update') throw new ApiError(400, 'That action isn’t available here.');
+    values = readEventForm(form, fields);
+    await updateEventRequest(repo, user, id, eventRequestInput(values), hooks);
+    return redirectTo(`${home}?${live ? 'changes' : 'updated'}=1`);
+  } catch (err) {
+    const f = failure(err);
+    error = f.message;
+    Astro.response.status = f.status;
+  }
+}
+
+const r = event.request;
+const canRequest = user.can('events.request');
+const heading = live ? 'Suggest changes' : 'Edit your request';
+const lede = live
+  ? `“${event.title}” stays as it is on the site until the team approves your changes.`
+  : r?.state === 'declined' ? 'Make your changes and send it again.'
+  : r ? 'It’s waiting for approval. Saving sends the updated request.'
+  : 'It isn’t on the calendar yet. Send it to the team when it’s ready.';
+const waiting = live && r?.kind === 'changes' && r.state === 'pending';
+const reply = r?.state === 'declined' ? r.reply : '';
+const canWithdraw = canRequest && r && !(r.kind === 'changes' && r.state === 'declined');
+---
+
+<Layout title={heading} user={user}>
+  <div>
+    <a class="pc-mem-back" href={home}>← My events</a>
+    <div class="pc-mem-head"><h1>{heading}</h1></div>
+    <p class="pc-mem-lede">{lede}</p>
+  </div>
+  {waiting && <p class="pc-mem-reply">The changes you sent are waiting for approval; they’re filled in below. Sending again replaces them.</p>}
+  {r?.state === 'declined' && (
+    <p class="pc-mem-reply"><strong>{r.kind === 'changes' ? 'The team declined your last changes.' : 'The team declined this request.'}</strong>{reply && <> They said: {reply}</>}</p>
+  )}
+  {canRequest
+    ? <EventForm values={values} calendars={calendars} fields={fields} op="update" submitLabel={live ? 'Send changes for approval' : 'Submit for approval'} error={error} />
+    : <p class="pc-bk-error" role="alert">Your role doesn’t include “Request events”. Ask the site’s team if you need it.</p>}
+  {canWithdraw && (
+    <form method="post" onsubmit={r!.kind === 'new' ? "return confirm('Withdraw this request?')" : "return confirm('Withdraw these changes?')"}>
+      <input type="hidden" name="op" value="withdraw" />
+      <button class="pc-mem-btn is-danger" type="submit">{r!.kind === 'new' ? 'Withdraw request' : 'Withdraw changes'}</button>
+    </form>
+  )}
+</Layout>