@acms-subir/core 0.3.3-next.20260929113209 → 0.3.4

package/src/pages/admin/calendar/settings.astro

@@ -0,0 +1,458 @@
+---
+import Admin from '../../../layouts/Admin.astro';
+import Modal from '../../../components/Modal.astro';
+import { getRepo } from '../../../lib/repo';
+import { ApprovalRules, slugify, type ApprovalMode, type CalendarVisibility } from '../../../lib/schema';
+import { CALENDAR, bookingsEnabled, calendarFeedUrl, calendarPageUrl } from '../../../lib/calendar/config';
+import { safeColor } from '../../../lib/calendar/events';
+import { normalizeCalendarSrc } from '../../../lib/calendar/src';
+import { loadFeed } from '../../../lib/calendar/ics';
+import { siteApproval, APPROVAL_LABEL } from '../../../lib/booking/approval';
+import { siteOrigin } from '../../../lib/seo';
+
+// Calendar settings — one page behind the ⚙ on Schedule and Bookings:
+// calendars (groups + colors), subscribed calendars (read-only, synced in),
+// share links (out to Google/Apple/Outlook), booking approval, defaults.
+// Replaces the old Calendars page and the duplicate subscribe dialogs.
+if (!CALENDAR.enabled) return new Response(null, { status: 404, statusText: 'Not found' });
+
+const repo = await getRepo(Astro.locals);
+const settings = await repo.getSettings();
+const origin = siteOrigin(settings, Astro.url);
+const back = (notice?: string, hash = '') => Astro.redirect(`/admin/calendar/settings${notice ? `?notice=${encodeURIComponent(notice)}` : ''}${hash}`);
+const VIS: CalendarVisibility[] = ['public', 'unlisted', 'private'];
+const token = () => {
+  const bytes = crypto.getRandomValues(new Uint8Array(18));
+  return btoa(String.fromCharCode(...bytes)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+async function freeSlug(raw: string, selfId?: string) {
+  const base = slugify(raw) || 'calendar';
+  let slug = base;
+  for (let n = 2; ; n++) {
+    const hit = await repo.getCalendarBySlug(slug);
+    if (!hit || hit.id === selfId) return slug;
+    slug = `${base}-${n}`;
+  }
+}
+const int = (v: FormDataEntryValue | null, max: number) => Math.max(0, Math.min(max, Math.floor(Number(v) || 0)));
+
+if (Astro.request.method === 'POST') {
+  const form = await Astro.request.formData();
+  // an edit dialog's Delete button overrides the hidden op (last value wins)
+  const ops = form.getAll('op');
+  const op = String(ops[ops.length - 1]);
+  const id = String(form.get('id') || '');
+  const name = String(form.get('name') || '').trim().slice(0, 120);
+  const visibility = VIS.find((v) => v === form.get('visibility')) ?? 'public';
+  const color = safeColor(String(form.get('color') || '#4f46e5'));
+  const description = String(form.get('description') || '').slice(0, 1000);
+
+  if (op === 'defaults') {
+    const defaultCalendarId = String(form.get('defaultCalendarId') || '');
+    const ok = !defaultCalendarId || (await repo.getCalendar(defaultCalendarId))?.kind === 'native';
+    await repo.updateSettings({ calendar: {
+      ...settings.calendar,
+      weekStart: form.get('weekStart') === '1' ? 1 : 0,
+      defaultCalendarId: ok ? defaultCalendarId : '',
+      // the checkbox only exists when bookings are on; otherwise keep the old value
+      showBookings: bookingsEnabled() ? form.has('showBookings') : settings.calendar.showBookings,
+    } });
+    return back('Defaults saved.', '#defaults');
+  }
+  if (op === 'approval') {
+    const mode = (['auto', 'rules', 'manual'] as const).find((m) => m === form.get('approval')) ?? 'auto';
+    const approvalRules = ApprovalRules.parse({
+      longerThan: form.has('ruleLonger') ? int(form.get('longerThanHours'), 24 * 60) * 60 : 0,
+      firstTime: form.has('ruleFirst'),
+      moreSeats: form.has('ruleSeats') ? int(form.get('moreSeats'), 100000) : 0,
+      deadlineHours: form.has('deadline') ? int(form.get('deadlineHours'), 24 * 60) : 0,
+      deadlineAction: form.get('deadlineAction') === 'decline' ? 'decline' : 'approve',
+    });
+    await repo.updateSettings({ calendar: { ...settings.calendar, approval: mode, approvalRules } });
+    let reset = 0;
+    if (form.get('apply') === 'all') {
+      for (const l of await repo.listBookingLinks()) {
+        if (l.approval !== 'default') { await repo.updateBookingLink(l.id, { approval: 'default' }); reset++; }
+      }
+    }
+    return back(reset ? `Approval saved — ${reset} booking link${reset === 1 ? '' : 's'} now follow it.` : 'Approval saved.', '#bookings');
+  }
+  if (op === 'create' || op === 'subscribe') {
+    if (!name) return back('Give the calendar a name.');
+    let feedUrl = '';
+    if (op === 'subscribe') {
+      feedUrl = normalizeCalendarSrc(String(form.get('feedUrl') || '')) ?? '';
+      if (!feedUrl) return back('Paste a Google Calendar link, a calendar ID, or an .ics link.', '#subscribed');
+      try { await loadFeed(feedUrl, Date.now()); } catch (err) { return back(err instanceof Error ? err.message : 'Couldn’t load that calendar.', '#subscribed'); }
+    }
+    await repo.createCalendar({ name, slug: await freeSlug(String(form.get('slug') || name)), color, description, visibility, kind: op === 'subscribe' ? 'feed' : 'native', feedUrl });
+    return back(op === 'subscribe' ? `Subscribed to “${name}” — its events now show on your Schedule.` : `Created “${name}”.`, op === 'subscribe' ? '#subscribed' : '#calendars');
+  }
+  const cal = id ? await repo.getCalendar(id) : null;
+  if (!cal) return back('That calendar no longer exists.');
+  const hash = cal.kind === 'feed' ? '#subscribed' : '#calendars';
+  if (op === 'update') {
+    let feedUrl = cal.feedUrl;
+    if (cal.kind === 'feed' && form.has('feedUrl') && String(form.get('feedUrl')) !== cal.feedUrl) {
+      feedUrl = normalizeCalendarSrc(String(form.get('feedUrl'))) ?? '';
+      if (!feedUrl) return back('Paste a Google Calendar link, a calendar ID, or an .ics link.', hash);
+    }
+    await repo.updateCalendar(cal.id, {
+      name: name || cal.name, slug: await freeSlug(String(form.get('slug') || name || cal.slug), cal.id),
+      color, description, visibility, feedUrl,
+    });
+    return back(`Saved “${name || cal.name}”.`, hash);
+  }
+  if (op === 'rotate') {
+    await repo.updateCalendar(cal.id, { feedToken: token() });
+    return back('Link reset — the old one stopped working.', '#share');
+  }
+  if (op === 'move') {
+    const ids = (await repo.listCalendars()).map((c) => c.id);
+    const i = ids.indexOf(cal.id);
+    const j = form.get('dir') === 'up' ? i - 1 : i + 1;
+    if (j >= 0 && j < ids.length) [ids[i], ids[j]] = [ids[j], ids[i]];
+    await repo.reorderCalendars(ids);
+    return back(undefined, hash);
+  }
+  if (op === 'delete') {
+    await repo.deleteCalendar(cal.id);
+    if (settings.calendar.defaultCalendarId === cal.id) await repo.updateSettings({ calendar: { ...settings.calendar, defaultCalendarId: '' } });
+    return back(cal.kind === 'feed' ? `Removed “${cal.name}”.` : `Deleted “${cal.name}”. Its events are still there, just without a calendar.`, hash);
+  }
+}
+
+const [calendars, events, links] = await Promise.all([repo.listCalendars(), repo.listEvents(), bookingsEnabled() ? repo.listBookingLinks() : Promise.resolve([])]);
+const natives = calendars.filter((c) => c.kind === 'native');
+const feeds = calendars.filter((c) => c.kind === 'feed');
+const counts = new Map<string, number>();
+for (const e of events) for (const cid of e.calendarIds) counts.set(cid, (counts.get(cid) ?? 0) + 1);
+const notice = Astro.url.searchParams.get('notice') ?? '';
+const shareFor = (c: (typeof calendars)[number]) =>
+  origin + calendarFeedUrl(c.slug) + (c.visibility === 'private' ? `?t=${encodeURIComponent(c.feedToken)}` : '');
+const hostOf = (u: string) => { try { return new URL(u).hostname.replace(/^www\./, ''); } catch { return u; } };
+const VIS_LABEL: Record<CalendarVisibility, string> = {
+  public: 'Public — listed on the calendar page',
+  unlisted: 'Unlisted — event pages and the share link work, not listed',
+  private: 'Private — admins and the private share link only',
+};
+const visWord = (v: CalendarVisibility) => v[0].toUpperCase() + v.slice(1);
+const site = siteApproval(settings);
+const rules = site.rules;
+const own = links.filter((l) => l.approval !== 'default').length;
+const APPROVAL_NOTE: Record<ApprovalMode, string> = {
+  auto: 'Booked means confirmed. The person gets a confirmation email and it shows on your Schedule right away.',
+  rules: 'Confirm most bookings at once, but hold unusual ones for you to approve.',
+  manual: 'Every booking waits under Needs approval until you accept or decline it.',
+};
+const I = {
+  up: 'M6 15l6-6 6 6', down: 'M6 9l6 6 6-6',
+  ext: 'M14 4h6v6M20 4l-9 9M18 14v5a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1V7a1 1 0 0 1 1-1h5',
+};
+const sections = [
+  ['calendars', 'Calendars'], ['subscribed', 'Subscribed calendars'], ['share', 'Share links'],
+  ...(bookingsEnabled() ? [['bookings', 'Bookings']] : []), ['defaults', 'Defaults'],
+] as const;
+---
+
+<Admin title="Calendar settings" section="calendar:schedule">
+  <div class="page-head">
+    <div>
+      <p class="sub cs-crumb"><a href="/admin/calendar">Schedule</a> ›</p>
+      <h1>Calendar settings</h1>
+      <p class="sub">Used by Schedule{bookingsEnabled() ? ' and Bookings' : ''}. Changes here apply everywhere.</p>
+    </div>
+  </div>
+
+  {notice && <p class="notice" role="status">{notice}</p>}
+
+  <div class="cs">
+    <nav class="cs-nav" aria-label="Sections">
+      {sections.map(([k, l]) => <a href={`#${k}`}>{l}</a>)}
+    </nav>
+
+    <div class="cs-body">
+      <!-- Calendars -->
+      <section class="cs-sect" id="calendars">
+        <header>
+          <div><h2>Calendars</h2><p>Group your events, like Services or Youth. Each one has a color and its own share link.</p></div>
+          <button class="btn" type="button" data-modal="cal-new">+ New calendar</button>
+        </header>
+        {natives.length === 0 ? (
+          <p class="cs-empty">No calendars yet. Events work without them; add some to color-code the Schedule and filter the public calendar.</p>
+        ) : natives.map((c, i) => (
+          <div class="cs-row" id={`cal-${c.id}`}>
+            <i class="cal-dot lg" style={`background:${safeColor(c.color)}`} aria-hidden="true" />
+            <div class="cs-main">
+              <b>{c.name}</b>
+              <small>{visWord(c.visibility)} · {counts.get(c.id) ?? 0} event{counts.get(c.id) === 1 ? '' : 's'}{settings.calendar.defaultCalendarId === c.id ? ' · default for new events' : ''}{c.description ? ` · ${c.description}` : ''}</small>
+            </div>
+            <div class="cs-actions">
+              {c.visibility !== 'private' && (
+                <a class="icon-btn" href={calendarPageUrl(c.slug)} target="_blank" rel="noopener" title="View on site" aria-label="View on site">
+                  <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d={I.ext} /></svg>
+                </a>
+              )}
+              <form method="post" class="cal-move">
+                <input type="hidden" name="op" value="move" /><input type="hidden" name="id" value={c.id} />
+                <button class="icon-btn" name="dir" value="up" disabled={i === 0} title="Move up" aria-label="Move up"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><path d={I.up} /></svg></button>
+                <button class="icon-btn" name="dir" value="down" disabled={i === natives.length - 1} title="Move down" aria-label="Move down"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><path d={I.down} /></svg></button>
+              </form>
+              <button class="btn sm" type="button" data-modal={`cal-edit-${c.id}`}>Edit</button>
+            </div>
+          </div>
+        ))}
+      </section>
+
+      <!-- Subscribed -->
+      <section class="cs-sect" id="subscribed">
+        <header>
+          <div><h2>Subscribed calendars</h2><p>Calendars from Google, Apple or Outlook, kept in sync. They show on your Schedule and can’t be edited here.</p></div>
+          <button class="btn" type="button" data-modal="cal-subscribe">+ Subscribe</button>
+        </header>
+        {feeds.length === 0 ? (
+          <p class="cs-empty">None yet. Subscribe to holidays, a staff calendar, or anything with a calendar link.</p>
+        ) : feeds.map((c) => (
+          <div class="cs-row" id={`cal-${c.id}`}>
+            <i class="cal-dot lg" style={`background:${safeColor(c.color)}`} aria-hidden="true" />
+            <div class="cs-main">
+              <b>{c.name}</b>
+              <small>{hostOf(c.feedUrl)} · refreshed every few minutes · {visWord(c.visibility)}</small>
+            </div>
+            <div class="cs-actions">
+              <a class="btn sm ghost" href={`/admin/calendar/events?cal=${c.id}`}>Make an editable copy…</a>
+              <button class="btn sm" type="button" data-modal={`cal-edit-${c.id}`}>Edit</button>
+            </div>
+          </div>
+        ))}
+      </section>
+
+      <!-- Share links -->
+      <section class="cs-sect" id="share">
+        <header>
+          <div><h2>Share links</h2><p>Paste one into Google Calendar, Apple Calendar or Outlook to follow your calendar. It updates on its own.</p></div>
+        </header>
+        <div class="cs-row">
+          <i class="cal-dot lg" style="background:var(--accent)" aria-hidden="true" />
+          <div class="cs-main"><b>Everything public</b><small>Every public calendar in one link</small></div>
+          <div class="cs-share">
+            <input type="text" class="mono" readonly value={origin + calendarFeedUrl()} aria-label="Share link for every public calendar" />
+            <button class="btn sm" type="button" data-copy={origin + calendarFeedUrl()}>Copy</button>
+          </div>
+        </div>
+        {natives.filter((c) => c.visibility !== 'private' || c.feedToken).map((c) => (
+          <div class="cs-row">
+            <i class="cal-dot lg" style={`background:${safeColor(c.color)}`} aria-hidden="true" />
+            <div class="cs-main"><b>{c.name}</b><small>{c.visibility === 'private' ? 'Private link — keep it secret' : 'Just this calendar'}</small></div>
+            <div class="cs-share">
+              <input type="text" class="mono" readonly value={shareFor(c)} aria-label={`Share link for ${c.name}`} />
+              <button class="btn sm" type="button" data-copy={shareFor(c)}>Copy</button>
+              {c.visibility === 'private' && (
+                <form method="post">
+                  <input type="hidden" name="op" value="rotate" /><input type="hidden" name="id" value={c.id} />
+                  <button class="btn sm ghost" type="submit" data-confirm="Reset this link? Anyone following the old one stops getting updates.">Reset link</button>
+                </form>
+              )}
+            </div>
+          </div>
+        ))}
+      </section>
+
+      <!-- Bookings: approval -->
+      {bookingsEnabled() && (
+        <section class="cs-sect" id="bookings">
+          <header>
+            <div><h2>Booking approval</h2><p>What happens when someone books a room or person. Each booking link can follow this or pick its own.</p></div>
+          </header>
+          <form method="post" class="cs-form" data-approval>
+            <input type="hidden" name="op" value="approval" />
+            <div class="cs-choices" role="radiogroup" aria-label="Approval">
+              {(['auto', 'rules', 'manual'] as const).map((m) => (
+                <label class="cs-choice">
+                  <input type="radio" name="approval" value={m} checked={site.mode === m} />
+                  <span><b>{APPROVAL_LABEL[m]}</b><small>{APPROVAL_NOTE[m]}</small></span>
+                </label>
+              ))}
+            </div>
+            <fieldset class="cs-rules" data-rules hidden={site.mode !== 'rules'}>
+              <legend>Ask me first when a booking is…</legend>
+              <label class="cs-check"><input type="checkbox" name="ruleLonger" checked={rules.longerThan > 0} /> longer than <input type="number" name="longerThanHours" min="1" max="1440" value={rules.longerThan ? Math.round(rules.longerThan / 60) : 4} /> hours</label>
+              <label class="cs-check"><input type="checkbox" name="ruleFirst" checked={rules.firstTime} /> the first booking from that email address</label>
+              <label class="cs-check"><input type="checkbox" name="ruleSeats" checked={rules.moreSeats > 0} /> for more than <input type="number" name="moreSeats" min="1" max="100000" value={rules.moreSeats || 20} /> people</label>
+            </fieldset>
+            <div class="cs-deadline" data-deadline hidden={site.mode === 'auto'}>
+              <label class="cs-check"><input type="checkbox" name="deadline" checked={rules.deadlineHours > 0} /> If I haven’t answered in <input type="number" name="deadlineHours" min="1" max="1440" value={rules.deadlineHours || 48} /> hours,</label>
+              <select name="deadlineAction" aria-label="What happens then">
+                <option value="approve" selected={rules.deadlineAction === 'approve'}>approve it</option>
+                <option value="decline" selected={rules.deadlineAction === 'decline'}>decline it</option>
+              </select>
+            </div>
+            <div class="cs-foot">
+              <small>{links.length - own} of {links.length} booking link{links.length === 1 ? '' : 's'} follow this setting{own ? `; ${own} use their own.` : '.'}</small>
+              {own > 0 && <label class="cs-check"><input type="checkbox" name="apply" value="all" /> Make all {links.length} follow it</label>}
+              <button class="btn primary" type="submit">Save approval</button>
+            </div>
+          </form>
+        </section>
+      )}
+
+      <!-- Defaults -->
+      <section class="cs-sect" id="defaults">
+        <header><div><h2>Defaults</h2><p>How the Schedule looks and where new events go.</p></div></header>
+        <form method="post" class="cs-form">
+          <input type="hidden" name="op" value="defaults" />
+          <label class="cs-field"><span>Weeks start on</span>
+            <select name="weekStart">
+              <option value="0" selected={settings.calendar.weekStart === 0}>Sunday</option>
+              <option value="1" selected={settings.calendar.weekStart === 1}>Monday</option>
+            </select>
+          </label>
+          <label class="cs-field"><span>New events go in</span>
+            <select name="defaultCalendarId">
+              <option value="">No calendar</option>
+              {natives.map((c) => <option value={c.id} selected={settings.calendar.defaultCalendarId === c.id}>{c.name}</option>)}
+            </select>
+          </label>
+          {bookingsEnabled() && (
+            <label class="cs-check"><input type="checkbox" name="showBookings" checked={settings.calendar.showBookings} /> Show bookings and blocked time on the Schedule</label>
+          )}
+          <div class="cs-foot"><span /><button class="btn primary" type="submit">Save defaults</button></div>
+        </form>
+      </section>
+    </div>
+  </div>
+
+  {calendars.map((c) => (
+    <Modal id={`cal-edit-${c.id}`} title={`Edit ${c.name}`}>
+      <form method="post">
+        <input type="hidden" name="op" value="update" /><input type="hidden" name="id" value={c.id} />
+        <div class="field-row">
+          <label class="field"><span>Name</span><input type="text" name="name" value={c.name} required /></label>
+          <label class="field"><span>Color</span><input type="color" name="color" value={safeColor(c.color)} /></label>
+        </div>
+        <label class="field"><span>URL name</span><input class="mono" type="text" name="slug" value={c.slug} /></label>
+        {c.kind === 'feed' && <label class="field"><span>Calendar link</span><input class="mono" type="text" name="feedUrl" value={c.feedUrl} /></label>}
+        <label class="field"><span>Description</span><input type="text" name="description" value={c.description} placeholder="Shown on the calendar page filter" /></label>
+        <label class="field">
+          <span>Visibility</span>
+          <select name="visibility">{VIS.map((v) => <option value={v} selected={c.visibility === v}>{VIS_LABEL[v]}</option>)}</select>
+        </label>
+        <div class="modal-foot">
+          <button class="btn danger ghost" type="submit" name="op" value="delete" formnovalidate data-confirm={c.kind === 'feed' ? `Remove “${c.name}”? Its events disappear from your Schedule.` : `Delete “${c.name}”? Events stay, they just lose this calendar.`}>{c.kind === 'feed' ? 'Remove' : 'Delete'}</button>
+          <span class="spacer" />
+          <button class="btn ghost" type="button" data-close>Cancel</button>
+          <button class="btn primary" type="submit">Save</button>
+        </div>
+      </form>
+    </Modal>
+  ))}
+
+  <Modal id="cal-new" title="New calendar" open={Astro.url.searchParams.has('new')}>
+    <form method="post">
+      <input type="hidden" name="op" value="create" />
+      <div class="field-row">
+        <label class="field"><span>Name</span><input type="text" name="name" placeholder="Youth" required autofocus /></label>
+        <label class="field"><span>Color</span><input type="color" name="color" value="#4f46e5" /></label>
+      </div>
+      <label class="field"><span>Description</span><input type="text" name="description" placeholder="Optional" /></label>
+      <label class="field">
+        <span>Visibility</span>
+        <select name="visibility">{VIS.map((v) => <option value={v}>{VIS_LABEL[v]}</option>)}</select>
+      </label>
+      <div class="modal-foot">
+        <button class="btn ghost" type="button" data-close>Cancel</button>
+        <button class="btn primary" type="submit">Create calendar</button>
+      </div>
+    </form>
+  </Modal>
+
+  <Modal id="cal-subscribe" title="Subscribe to a calendar" open={Astro.url.searchParams.has('subscribe')}>
+    <form method="post">
+      <input type="hidden" name="op" value="subscribe" />
+      <p class="hint">Follow a Google, Apple or Outlook calendar. Its events show on your Schedule, read-only, and stay in sync.</p>
+      <div class="field-row">
+        <label class="field"><span>Name</span><input type="text" name="name" placeholder="Staff calendar" required /></label>
+        <label class="field"><span>Color</span><input type="color" name="color" value="#2f9e6e" /></label>
+      </div>
+      <label class="field"><span>Calendar link</span><input class="mono" type="text" name="feedUrl" placeholder="Google Calendar link, calendar ID, or .ics link" required /></label>
+      <label class="field">
+        <span>Visibility</span>
+        <select name="visibility">{VIS.map((v) => <option value={v}>{VIS_LABEL[v]}</option>)}</select>
+      </label>
+      <div class="modal-foot">
+        <button class="btn ghost" type="button" data-close>Cancel</button>
+        <button class="btn primary" type="submit">Subscribe</button>
+      </div>
+    </form>
+  </Modal>
+</Admin>
+
+<style>
+  .cs-crumb { margin: 0 0 2px; }
+  .cs-crumb a { color: var(--muted); }
+  .cs { display: grid; grid-template-columns: 180px minmax(0, 1fr); gap: 24px; align-items: start; }
+  .cs-nav { position: sticky; top: 64px; display: flex; flex-direction: column; gap: 2px; font-size: 13px; }
+  .cs-nav a { padding: 6px 10px; border-radius: 8px; color: var(--text-2); }
+  .cs-nav a:hover { background: var(--hover); color: var(--text); }
+  .cs-body { display: flex; flex-direction: column; gap: 18px; min-width: 0; }
+  .cs-sect { background: var(--panel); border: 1px solid var(--line); border-radius: var(--r-lg); overflow: hidden; scroll-margin-top: 64px; }
+  .cs-sect > header { display: flex; justify-content: space-between; align-items: flex-start; gap: 16px; padding: 14px 16px; border-bottom: 1px solid var(--line); }
+  .cs-sect h2 { font-size: 14.5px; margin: 0; }
+  .cs-sect header p { margin: 2px 0 0; color: var(--muted); font-size: 12.5px; max-width: 560px; }
+  .cs-empty { color: var(--muted); font-size: 13px; margin: 0; padding: 14px 16px; }
+  .cs-row { display: grid; grid-template-columns: 14px minmax(0, 1fr) auto; gap: 12px; align-items: center; padding: 11px 16px; border-bottom: 1px solid var(--line); }
+  .cs-row:last-child { border-bottom: 0; }
+  .cs-main { display: flex; flex-direction: column; min-width: 0; }
+  .cs-main b { font-weight: 600; font-size: 13.5px; }
+  .cs-main small { color: var(--muted); font-size: 12px; }
+  .cs-actions, .cs-share { display: flex; align-items: center; gap: 6px; }
+  .cs-share input { width: min(340px, 38vw); font-size: 12px; padding: 4px 8px; border: 1px solid var(--line); border-radius: 7px; background: var(--bg); color: var(--text-2); }
+  .cs-form { padding: 14px 16px; display: flex; flex-direction: column; gap: 12px; }
+  .cs-choices { display: flex; flex-direction: column; gap: 8px; }
+  .cs-choice { display: grid; grid-template-columns: 18px 1fr; gap: 10px; padding: 11px 13px; border: 1px solid var(--line); border-radius: 10px; background: var(--bg); cursor: pointer; }
+  .cs-choice:has(input:checked) { border-color: var(--accent-ring); background: var(--accent-soft); }
+  .cs-choice input { accent-color: var(--accent); margin-top: 2px; }
+  .cs-choice b { display: block; font-size: 13.5px; }
+  .cs-choice small { color: var(--muted); font-size: 12px; }
+  .cs-rules { border: 1px solid var(--line); border-radius: 10px; padding: 10px 13px 12px; margin: 0; display: flex; flex-direction: column; gap: 8px; }
+  .cs-rules legend { color: var(--muted); font-size: 12px; padding: 0 4px; }
+  .cs-check { display: flex; flex-wrap: wrap; align-items: center; gap: 6px; font-size: 13px; color: var(--text-2); }
+  .cs-check input[type='checkbox'] { accent-color: var(--accent); }
+  .cs-check input[type='number'] { width: 70px; padding: 3px 6px; border: 1px solid var(--line-strong); border-radius: 7px; background: var(--bg); color: var(--text); font: inherit; }
+  .cs-deadline { display: flex; align-items: center; gap: 6px; flex-wrap: wrap; }
+  .cs-deadline select, .cs-field select { padding: 4px 8px; border: 1px solid var(--line-strong); border-radius: 7px; background: var(--bg); color: var(--text); font: inherit; font-size: 13px; }
+  .cs-field { display: grid; grid-template-columns: 160px auto; align-items: center; gap: 10px; font-size: 13px; color: var(--text-2); justify-content: start; }
+  .cs-foot { display: flex; align-items: center; gap: 12px; justify-content: space-between; flex-wrap: wrap; border-top: 1px solid var(--line); padding-top: 12px; }
+  .cs-foot small { color: var(--muted); font-size: 12px; }
+  [hidden] { display: none !important; }
+  @media (max-width: 860px) {
+    .cs { grid-template-columns: 1fr; }
+    .cs-nav { position: static; flex-direction: row; overflow-x: auto; scrollbar-width: none; margin: 0 -4px; }
+    .cs-nav a { white-space: nowrap; }
+    .cs-row { grid-template-columns: 14px minmax(0, 1fr); }
+    .cs-actions, .cs-share { grid-column: 2; flex-wrap: wrap; }
+    .cs-share input { width: 100%; }
+    .cs-field { grid-template-columns: 1fr; gap: 4px; }
+  }
+</style>
+
+<script>
+  document.addEventListener('click', async (e) => {
+    const b = e.target instanceof Element ? e.target.closest<HTMLButtonElement>('[data-copy]') : null;
+    if (b) {
+      await navigator.clipboard.writeText(b.dataset.copy ?? '');
+      const label = b.textContent;
+      b.textContent = 'Copied';
+      setTimeout(() => (b.textContent = label), 1200);
+    }
+    const c = e.target instanceof Element ? e.target.closest<HTMLElement>('[data-confirm]') : null;
+    if (c && !confirm(c.dataset.confirm)) e.preventDefault();
+  });
+  // approval: rules only for "unless…", the deadline only when bookings can wait
+  const form = document.querySelector<HTMLFormElement>('[data-approval]');
+  form?.addEventListener('change', () => {
+    const mode = new FormData(form).get('approval');
+    form.querySelector<HTMLElement>('[data-rules]')!.hidden = mode !== 'rules';
+    form.querySelector<HTMLElement>('[data-deadline]')!.hidden = mode === 'auto';
+  });
+</script>

package/src/pages/admin/integrations.astro

@@ -4,12 +4,11 @@ import Modal from '../../components/Modal.astro';
 import { getRepo } from '../../lib/repo';
 import { API_SCOPES, WEBHOOK_EVENTS, type ApiScope } from '../../lib/schema';
 import { validateSession, SESSION_COOKIE, OWNER_ENV } from '../../lib/auth';
-import { CALENDAR, bookingsEnabled, calendarFeedUrl } from '../../lib/calendar/config';
+import { CALENDAR, bookingsEnabled } from '../../lib/calendar/config';
 import { issueApiKey } from '../../lib/api-keys';
 import { attemptDelivery, generateWebhookSecret, validateWebhookUrl } from '../../lib/webhooks';
 import { resolveConfig } from '../../lib/email/config';
 import { env } from '../../lib/env';
-import { siteOrigin } from '../../lib/seo';
 
 // Site-wide integrations. Owners manage keys and webhook subscriptions;
 // calendar-specific feeds and API help appear only when enabled.
@@ -18,7 +17,6 @@ const sessionId = (await validateSession(Astro.cookies.get(SESSION_COOKIE)?.valu
 const me = sessionId && sessionId !== OWNER_ENV ? await repo.getUser(sessionId) : null;
 const isOwner = sessionId === OWNER_ENV || me?.role === 'owner';
 const settings = await repo.getSettings();
-const origin = siteOrigin(settings, Astro.url);
 let notice = '';
 let error = '';
 let newKey = '';
@@ -72,7 +70,7 @@ if (Astro.request.method === 'POST') {
   }
 }
 
-const [keys, hooks, calendars] = await Promise.all([repo.listApiKeys(), repo.listWebhooks(), repo.listCalendars()]);
+const [keys, hooks] = await Promise.all([repo.listApiKeys(), repo.listWebhooks()]);
 const logs = new Map(await Promise.all(hooks.map(async (h) => [h.id, await repo.listDeliveries(h.id, 5)] as const)));
 const emailConfig = resolveConfig(await repo.email.config(), Astro.locals);
 const provider = emailConfig.error ? 'none' : emailConfig.provider;
@@ -86,10 +84,6 @@ const SCOPE_LABEL: Record<string, string> = {
   'bookings:read': 'Read bookings and guest details', 'bookings:write': 'Create, confirm and cancel bookings',
   'resources:read': 'Read resources and links', 'resources:write': 'Edit resources and links',
 };
-const feeds = [
-  { label: 'Everything public', url: origin + calendarFeedUrl() },
-  ...calendars.filter((c) => c.kind === 'native' && c.visibility !== 'private').map((c) => ({ label: c.name, url: origin + calendarFeedUrl(c.slug) })),
-];
 ---
 
 <Admin title="API & webhooks" section="integrations">
@@ -186,9 +180,9 @@ const feeds = [
         ) : <p class="hint">Sending as <code>{emailConfig.config.from}</code>. Guests get confirmations, updates and a reminder the day before.</p>}
       </section>
       {CALENDAR.enabled && <section class="card card-pad">
-        <div class="card-head"><b>Subscribe feeds</b></div>
-        {feeds.map((f) => <div class="int-feed"><span>{f.label}</span><div class="cal-feed"><input type="text" class="mono" readonly value={f.url} /><button class="btn sm" type="button" data-copy={f.url}>Copy</button></div></div>)}
-        <p class="hint">Private calendars and resource staff feeds have secret links on their own screens.</p>
+        <div class="card-head"><b>Calendar share links</b></div>
+        <p class="hint">The .ics links people paste into Google, Apple or Outlook live in one place.</p>
+        <p><a href="/admin/calendar/settings#share">Calendar settings → Share links →</a></p>
       </section>}
       <section class="card card-pad">
         <div class="card-head"><b>Quick start</b></div>

package/src/pages/admin/login.astro

@@ -1,12 +1,15 @@
 ---
+import { safeNext } from '../../lib/editor/next';
 import { checkPassword, createSessionToken, verifyPassword, validateSession, SESSION_COOKIE } from '../../lib/auth';
 import { getRepo } from '../../lib/repo';
 import { BRAND } from '../../lib/brand';
 import ThemeScript from '../../components/ThemeScript.astro';
 import '../../styles/admin.css';
 
+// ?next= returns to the editor-app sign-in page only (never another site)
+const next = safeNext(Astro.url.searchParams.get('next'), Astro.url);
 if ((await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals))) {
-  return Astro.redirect('/admin');
+  return Astro.redirect(next ?? '/admin');
 }
 
 let error = '';
@@ -40,7 +43,7 @@ if (Astro.request.method === 'POST') {
       maxAge: 7 * 24 * 60 * 60,
       secure: Astro.url.protocol === 'https:',
     });
-    return Astro.redirect('/admin');
+    return Astro.redirect(next ?? '/admin');
   }
 }
 ---
@@ -67,6 +70,7 @@ if (Astro.request.method === 'POST') {
           </svg>
           <div class="brand-name">{BRAND.name}</div>
         </div>
+        {next && !error && <p class="hint login-for-app">Sign in to connect the app to your account.</p>}
         {error && <div class="flash error">{error}</div>}
         <form method="post">
           <label class="field">

package/src/pages/admin/logout.ts

@@ -1,7 +1,10 @@
 import type { APIRoute } from 'astro';
 import { SESSION_COOKIE } from '../../lib/auth';
+import { safeNext } from '../../lib/editor/next';
 
-export const GET: APIRoute = ({ cookies, redirect }) => {
+export const GET: APIRoute = ({ cookies, redirect, url }) => {
   cookies.delete(SESSION_COOKIE, { path: '/' });
-  return redirect('/admin/login');
+  // "Switch account" on the editor-app sign-in page comes back to it
+  const next = safeNext(url.searchParams.get('next'), url);
+  return redirect(next ? `/admin/login?next=${encodeURIComponent(next)}` : '/admin/login');
 };

package/src/pages/admin/mobile.astro

@@ -0,0 +1,18 @@
+---
+import Admin from '../../layouts/Admin.astro';
+import MobileApp from '../../components/MobileApp';
+import { getRepo } from '../../lib/repo';
+import { requireSession } from '../../lib/api';
+const repo = await getRepo(Astro.locals);
+try { await requireSession(Astro.request, Astro.cookies, repo, true); }
+catch { return new Response('Owner access is required.', { status: 403 }); }
+---
+<Admin title="Mobile app" section="mobile">
+  <div class="page-head">
+    <div>
+      <h1>Mobile app</h1>
+      <p class="sub">Notifications for people who installed your app.</p>
+    </div>
+  </div>
+  <MobileApp client:only="react" />
+</Admin>