@acms-subir/core 0.3.34 → 0.3.36

package/src/lib/mobile/bookings.ts

@@ -4,33 +4,38 @@ import type { Booking } from '../schema';
 import { ApiError, readJson } from '../api';
 import { sha256Hex } from '../api-keys';
 import { siteOrigin } from '../seo';
-import { eventIsPublic, expandEvents } from '../calendar/events';
 import { createResourceBooking, createRsvp, bookingJson } from '../booking/service';
 import { waitUntilFrom } from '../webhooks';
 import { requireCalendar } from './calendar';
+import { appAnswers, joinAnswers } from './forms';
+import { rsvpClosed, rsvpOccurrence, rsvpQuestions } from './rsvp';
 
 const common = {
   start: z.string().datetime({ offset: true }),
   name: z.string().trim().min(1).max(120), email: z.string().trim().email().max(200).transform(v => v.toLowerCase()),
   phone: z.string().trim().max(40).default(''),
+  answers: appAnswers.default({}),
 };
 export const bookingInput = z.union([
   z.object({ ...common, resource: z.string().min(1).max(200), link: z.string().min(1).max(200),
-    minutes: z.number().int().min(1).max(44640).optional(), answers: z.record(z.string().max(2000)).default({}),
+    minutes: z.number().int().min(1).max(44640).optional(),
   }).strict(),
-  z.object({ ...common, event: z.string().min(1).max(200), seats: z.number().int().min(1).max(1000).default(1), answers: z.record(z.string().max(2000)).default({}), formVersion: z.string().optional() }).strict(),
+  // formVersion: from GET /events/{slug}/rsvp; required when the event asks questions
+  z.object({ ...common, event: z.string().min(1).max(200), seats: z.number().int().min(1).max(1000).default(1), formVersion: z.string().max(100).optional() }).strict(),
 ]);
 function canonical(value: unknown): string {
   if (value && typeof value === 'object' && !Array.isArray(value)) return `{${Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k,v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(',')}}`;
   return JSON.stringify(value);
 }
 const bookingData = (booking: Booking) => ({ booking: bookingJson(booking), manageToken: booking.manageToken });
+// RSVPs need only the calendar (like the event's web page); room bookings need bookings too
 export async function submitBooking(repo: ContentRepository, request: Request, locals?: unknown) {
-  requireCalendar(true);
+  requireCalendar();
   const key = request.headers.get('idempotency-key') ?? '';
   // Treat the key as a secret receipt. Require a fresh UUID per user intent.
   if (!/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(key)) throw new ApiError(400, 'Send a random UUID v4 in Idempotency-Key and reuse it only for retries.');
   const body = bookingInput.parse(await readJson(request, 50000));
+  if (!('event' in body)) requireCalendar(true);
   const idempotency = { keyHash: await sha256Hex(key.toLowerCase()), requestHash: await sha256Hex(canonical(body)) };
   const replay = async () => {
     const record = await repo.getBookingRequest(idempotency.keyHash);
@@ -46,21 +51,22 @@ export async function submitBooking(repo: ContentRepository, request: Request, l
     const settings = await repo.getSettings();
     const flow = { origin: siteOrigin(settings, new URL(request.url)), locals, waitUntil: waitUntilFrom(locals), idempotency };
     const start = Date.parse(body.start);
+    const booker = { ...body, answers: joinAnswers(body.answers) };
     let booking: Booking;
     if ('event' in body) {
-      const event = await repo.getEventBySlug(body.event) ?? await repo.getEvent(body.event);
-      const calendars = new Map((await repo.listCalendars()).map(c => [c.id, c]));
-      if (!event || !eventIsPublic(event, calendars)) throw new ApiError(404, 'Event not found.');
+      const occurrence = await rsvpOccurrence(repo, body.event, body.start);
+      const { event } = occurrence;
       if (body.seats > (event.rsvp.maxSeats || 1)) throw new ApiError(400, 'Too many seats for one RSVP.');
-      const occurrence = expandEvents([event], settings, { displayTz: settings.timezone || 'UTC', now: Date.now(), windowStartMs: start, windowEndMs: start + 1 }).find(o => o.start === start);
-      if (!occurrence) throw new ApiError(400, 'Start must match an event occurrence exactly.');
-      booking = await createRsvp(repo, { event, start, end: occurrence.end, seats: body.seats, booker: body, source: 'web' }, flow);
+      // the app must have seen the current questions: a changed form then answers 409, as on the website
+      // (closed dates fall through to createRsvp's own answer)
+      if (!body.formVersion && rsvpQuestions(event) && !rsvpClosed(occurrence)) throw new ApiError(400, 'This event asks questions. Send formVersion from GET /api/v1/events/{slug}/rsvp with the answers.');
+      booking = await createRsvp(repo, { event, start, end: occurrence.end, seats: body.seats, booker, source: 'app' }, flow);
     } else {
       const resource = await repo.getResourceBySlug(body.resource);
       const link = resource ? await repo.getBookingLinkBySlug(resource.id, body.link) : null;
       if (!resource || !link) throw new ApiError(404, 'Resource or booking link not found.');
       const minutes = body.minutes ?? (link.mode === 'day' ? 1440 : link.mode === 'range' ? link.lengths[0] ?? link.duration : link.duration);
-      booking = await createResourceBooking(repo, { resource, link, start, end: start + minutes * 60000, booker: body, source: 'web' }, flow);
+      booking = await createResourceBooking(repo, { resource, link, start, end: start + minutes * 60000, booker, source: 'app' }, flow);
     }
     return { data: bookingData(booking), replayed: false };
   } catch (error) {

package/src/lib/mobile/forms.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import type { ContentRepository } from '../repo/types';
-import type { SavedForm } from '../forms/schema';
+import type { FormDefinition, SavedForm } from '../forms/schema';
 import { collectResponse, formVersion } from '../forms/service';
 import { ApiError, readJson } from '../api';
 import { sha256Hex } from '../api-keys';
@@ -24,14 +24,11 @@ async function publishedForm(repo: ContentRepository, id: string): Promise<Saved
   return form;
 }
 
-export async function getForm(repo: ContentRepository, url: URL, id: string) {
-  z.object({}).strict().parse(queryParams(url));
-  await requireAccess(repo, 'forms');
-  const form = await publishedForm(repo, id);
-  const d = form.definition;
+/** A form's questions for apps; `version` is the one collectResponse accepts (also for event RSVPs). */
+export async function formJson(d: FormDefinition) {
   return {
-    id: form.id, version: await formVersion(d),
-    title: d.title || form.name, intro: d.intro, submitLabel: d.submitLabel || 'Submit', confirmation: d.confirmation,
+    version: await formVersion(d),
+    title: d.title, intro: d.intro, submitLabel: d.submitLabel, confirmation: d.confirmation,
     fields: d.fields.map((f) => ({
       id: f.id, type: f.type, label: f.label, required: f.required, help: f.help, options: f.options,
       placeholder: f.placeholder ?? '', width: f.width ?? 'full', allowOther: f.allowOther ?? false,
@@ -39,9 +36,22 @@ export async function getForm(repo: ContentRepository, url: URL, id: string) {
   };
 }
 
+export async function getForm(repo: ContentRepository, url: URL, id: string) {
+  z.object({}).strict().parse(queryParams(url));
+  await requireAccess(repo, 'forms');
+  const form = await publishedForm(repo, id);
+  const d = form.definition;
+  return { id: form.id, ...await formJson(d), title: d.title || form.name, submitLabel: d.submitLabel || 'Submit' };
+}
+
+// field id → answer; checkbox groups send a list. "Other" answers send the typed text.
+export const appAnswers = z.record(z.union([z.string().max(2000), z.array(z.string().max(2000)).max(51)]));
+/** lists become the stored newline-joined form */
+export const joinAnswers = (answers: z.infer<typeof appAnswers>): Record<string, string> =>
+  Object.fromEntries(Object.entries(answers).map(([k, v]) => [k, Array.isArray(v) ? v.map((x) => x.trim()).filter(Boolean).join('\n') : v]));
+
 export const formResponseInput = z.object({
-  // field id → answer; checkbox groups send a list. "Other" answers send the typed text.
-  answers: z.record(z.union([z.string().max(2000), z.array(z.string().max(2000)).max(51)])).refine((a) => Object.keys(a).length <= 30, 'Too many answers.'),
+  answers: appAnswers.refine((a) => Object.keys(a).length <= 30, 'Too many answers.'),
   // the version from GET /forms/{id}; a changed form answers 409 instead of saving
   version: z.string().max(100).optional(),
   // spam trap: apps leave it out or empty
@@ -57,7 +67,7 @@ export async function submitFormResponse(c: PublicContext) {
   if (body.website) throw new ApiError(400, 'Could not submit this form.');
   const form = await publishedForm(c.repo, id);
   if (!await c.repo.email.rateLimit(`forms:app:${await sha256Hex(`${form.id}:${c.address}`)}`, 10, 60_000)) throw new ApiError(429, 'Too many responses. Please try again in a minute.');
-  const answers = Object.fromEntries(Object.entries(body.answers).map(([k, v]) => [k, Array.isArray(v) ? v.map((x) => x.trim()).filter(Boolean).join('\n') : v]));
+  const answers = joinAnswers(body.answers);
   // the key is the stored response id: a retry of a saved response answers
   // as before and costs nothing (also after the form changed); the same key
   // with different answers is a 409

package/src/lib/mobile/manage.ts

@@ -63,6 +63,8 @@ function view(m: Managed, booking = m.booking) {
     // the web page for this booking (the same private link the emails carry)
     manageUrl: origin + manageUrl(booking.manageToken),
     can,
+    // the RSVP form as it was when they sent it (like the web page), else the booking type's message
+    confirmation: booking.formResponse?.definition.confirmation || link?.confirmMessage || null,
   };
 }
 const flow = (m: Managed, c: PublicContext) => ({ origin: m.origin, locals: c.locals, waitUntil: waitUntilFrom(c.locals) });

package/src/lib/mobile/openapi.ts

@@ -4,6 +4,7 @@ import type { ContentRepository } from '../repo/types';
 import { contentQuery, contentDetailQuery } from './content';
 import { eventsQuery, availabilityQuery } from './calendar';
 import { bookingInput } from './bookings';
+import { rsvpQuery } from './rsvp';
 import { pagesQuery } from './pages';
 import { searchQuery } from './search';
 import { manageAvailabilityQuery, rescheduleInput } from './manage';
@@ -33,7 +34,10 @@ const errors = Object.fromEntries([400, 404, 405, 429, 500].map(status => [statu
   ...(status === 429 ? { headers: { 'Retry-After': { description: 'Seconds to wait: 60 for per-minute limits, longer for hourly, daily and lockout limits.', schema: { type: 'string' } } } } : {}),
 }]));
 function parameters(query: z.AnyZodObject) {
-  return Object.entries(query.shape).map(([name, schema]) => ({ name, in: 'query', required: !(schema as z.ZodTypeAny).isOptional(), schema: jsonSchema(schema as z.ZodTypeAny) }));
+  return Object.entries(query.shape).map(([name, schema]) => {
+    const s = schema as z.ZodTypeAny;
+    return { name, in: 'query', required: !s.isOptional(), ...(s.description ? { description: s.description } : {}), schema: jsonSchema(s) };
+  });
 }
 export async function getOpenApi(_repo: ContentRepository, url: URL) {
   empty.parse(queryParams(url));
@@ -48,6 +52,7 @@ export async function getOpenApi(_repo: ContentRepository, url: URL) {
     ['/search', 'Ranked matches across posts, pages and events (top limit per group); requires search', searchQuery, ref('SearchResults')],
     ['/events', 'Public event occurrences; requires calendar', eventsQuery, ref('Events')],
     ['/calendars', 'Public calendars; requires calendar', empty, ref('Calendars')],
+    ['/events/{slug}/rsvp', 'RSVP status of one date (start = the occurrence start exactly): open or why not, live seats, the questions and their version; never cached; requires calendar', rsvpQuery, ref('RsvpStatus'), false],
     ['/resources', 'Public resources and booking links; requires bookings', z.object(pageQuery).strict(), ref('Resources')],
     ['/availability', 'Current availability; requires bookings', availabilityQuery, ref('Availability'), false],
     ['/push/topics', 'Topics an app can offer as notification toggles, named in the requested language; requires push', localeOnlyQuery, ref('PushTopics')],
@@ -73,8 +78,8 @@ export async function getOpenApi(_repo: ContentRepository, url: URL) {
   }
   paths['/api/v1/bookings'] = {
     post: {
-      summary: 'Create a guest booking or replay an existing request; requires bookings',
-      description: '20 attempts/minute/client address. JSON body up to 50,000 bytes. Responses use no-store. Reuse a random UUID v4 once per booking intent.',
+      summary: 'Create a guest booking or an RSVP, or replay an existing request; RSVPs require calendar, room bookings also bookings',
+      description: '20 attempts/minute/client address. JSON body up to 50,000 bytes. Responses use no-store. Reuse a random UUID v4 once per booking intent. Checkbox groups send a list of answers. An RSVP to an event with questions needs formVersion from GET /events/{slug}/rsvp; a changed form answers 409.',
       parameters: [{ name: 'Idempotency-Key', in: 'header', required: true, schema: { type: 'string', format: 'uuid', pattern: '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$' } }],
       requestBody: { required: true, content: media(jsonSchema(bookingInput)) },
       responses: { ...errors,

package/src/lib/mobile/rsvp.ts

@@ -0,0 +1,65 @@
+import { z } from 'zod';
+import type { ContentRepository } from '../repo/types';
+import type { CalEvent } from '../schema';
+import { ApiError } from '../api';
+import { answerFields } from '../forms/schema';
+import { eventIsPublic, expandEvents, type Occurrence } from '../calendar/events';
+import { seatsTaken } from '../booking/service';
+import { localizeDoc } from '../translations';
+import { queryParams } from './http';
+import { requireCalendar } from './calendar';
+import { formJson } from './forms';
+import { localeQuery, mobileLocale } from './locale';
+
+// RSVP status of one date of an event, for apps: whether it takes RSVPs now,
+// live seats and the questions with their version. The same rules as the
+// event's web page: open until the date ends, no deadline or waitlist.
+// Never cached; seats change with every RSVP. POST /bookings saves one.
+
+/** a public event (slug or id) and its occurrence starting exactly at `start` */
+export async function rsvpOccurrence(repo: ContentRepository, ref: string, start: string): Promise<Occurrence> {
+  const event = await repo.getEventBySlug(ref) ?? await repo.getEvent(ref);
+  const calendars = new Map((await repo.listCalendars()).map(c => [c.id, c]));
+  if (!event || !eventIsPublic(event, calendars)) throw new ApiError(404, 'Event not found.');
+  const settings = await repo.getSettings();
+  const at = Date.parse(start);
+  const occurrence = expandEvents([event], settings, { displayTz: settings.timezone || 'UTC', now: Date.now(), windowStartMs: at, windowEndMs: at + 1 }).find(o => o.start === at);
+  if (!occurrence) throw new ApiError(400, 'Start must match an event occurrence exactly.');
+  return occurrence;
+}
+/** the RSVP form when it asks something; apps must then send its version */
+export const rsvpQuestions = (e: CalEvent) => e.rsvp.form && answerFields(e.rsvp.form).length ? e.rsvp.form : null;
+/** why this date takes no RSVPs (seats aside), or null */
+export function rsvpClosed(o: Occurrence, now = Date.now()) {
+  if (!o.event.rsvp.enabled) return 'disabled' as const;
+  if (o.cancelled) return 'cancelled' as const;
+  if (o.end <= now) return 'ended' as const;
+  return null;
+}
+
+export const rsvpQuery = z.object({
+  start: z.string().datetime({ offset: true }).describe('The occurrence’s start exactly as GET /events returns it, a UTC ISO date-time such as 2026-10-05T14:00:00.000Z. A start that isn’t one of the event’s dates answers 400.'),
+  locale: localeQuery,
+}).strict();
+export async function getRsvpStatus(repo: ContentRepository, url: URL, slug: string) {
+  requireCalendar();
+  const q = rsvpQuery.parse(queryParams(url));
+  const locale = mobileLocale(q.locale);
+  const o = await rsvpOccurrence(repo, slug, q.start);
+  const { rsvp } = o.event;
+  // pending and confirmed RSVPs hold seats, as in the capacity check
+  const going = rsvp.enabled ? await seatsTaken(repo, o.event.id, o.start) : 0;
+  const left = rsvp.capacity ? Math.max(0, rsvp.capacity - going) : null;
+  const closed = rsvpClosed(o);
+  const reason = closed ?? (left === 0 ? 'full' as const : null);
+  const form = rsvpQuestions(o.event);
+  const title = localizeDoc(o.event, locale ?? undefined).title;
+  return {
+    event: { id: o.event.id, slug: o.event.slug, title },
+    start: new Date(o.start).toISOString(), end: new Date(o.end).toISOString(),
+    open: !reason, reason, going, left, capacity: rsvp.capacity,
+    // seats one RSVP may take right now
+    maxSeats: Math.min(rsvp.maxSeats || 1, left ?? Infinity), autoConfirm: rsvp.autoConfirm,
+    form: form ? { ...await formJson(form), submitLabel: form.submitLabel || (rsvp.autoConfirm ? 'Confirm my seat' : 'Request a seat') } : null,
+  };
+}

package/src/lib/mobile/schemas.ts

@@ -8,7 +8,7 @@ const Palette = z.object({ bg: str, ink: str, muted: str, line: str, accent: str
 export const Site = z.object({
   name: str, description: str, logo: str, logoDark: str, icon: str, menu: z.array(z.object({ label: str, href: str })),
   languages: z.object({ default: locale, locales: z.array(z.object({ code: str, name: str })) }),
-  features: z.object({ blog: z.array(z.object({ key: str, name: str, url: str, redirectFrom: strings })), calendar: bool, bookings: bool, search: bool, bookingChanges: bool, guestSignIn: bool, forms: bool, links: bool, live: bool, announcements: bool }),
+  features: z.object({ blog: z.array(z.object({ key: str, name: str, url: str, redirectFrom: strings })), calendar: bool, bookings: bool, rsvp: bool, search: bool, bookingChanges: bool, guestSignIn: bool, forms: bool, links: bool, live: bool, announcements: bool }),
   legal: z.object({ privacy: str.nullable(), terms: str.nullable() }), apiVersion: z.literal(1),
 });
 export const Theme = z.object({
@@ -68,6 +68,12 @@ export const Form = z.object({
   })),
 });
 export const FormReceipt = z.object({ received: z.literal(true), confirmation: str });
+export const RsvpStatus = z.object({
+  event: z.object({ id: str, slug: str, title: str }), start: date, end: date,
+  open: bool, reason: z.enum(['disabled', 'ended', 'cancelled', 'full']).nullable(),
+  going: z.number().int(), left: z.number().int().nullable(), capacity: z.number().int(), maxSeats: z.number().int(), autoConfirm: bool,
+  form: Form.omit({ id: true }).nullable(),
+});
 const GuestChanges = z.object({ cancel: bool, reschedule: bool, cutoffHours: z.number().int(), closed: bool });
 export const ManagedBooking = z.object({
   booking: z.object({
@@ -79,6 +85,8 @@ export const ManagedBooking = z.object({
   link: z.object({ slug: str, name: str, mode: z.enum(['slots', 'range', 'day']), lengths: z.array(z.number()) }).nullable(),
   event: z.object({ slug: str, title: str, url: str }).nullable(),
   manageUrl: str, can: GuestChanges,
+  // what the web page says once it's confirmed: the RSVP form's or booking type's message
+  confirmation: str.nullable(),
 });
 export const GuestCodeSent = z.object({ sent: z.literal(true), expiresInMinutes: z.number().int() });
 export const GuestToken = z.object({ accessToken: str, tokenType: z.literal('Bearer'), email: str, idleDays: z.number().int() });

package/src/lib/mobile/site.ts

@@ -37,7 +37,9 @@ export async function getSite(repo: ContentRepository, url: URL, _id = '', local
     features: {
       // redirectFrom: old addresses the website 301s to url, so apps can follow them too,
       // minus any another collection now lives at (the website serves that one first)
-      blog: Object.entries(CONTENT.collections).map(([key, c]) => ({ key, name: c.plural, url: safeUrl(c.base, origin), redirectFrom: legacyBases(key, c).filter(from => !bases.has(from)).map(from => safeUrl(from, origin)) })), calendar: CALENDAR.enabled, bookings: bookingsEnabled(), search: SEARCH.enabled,
+      blog: Object.entries(CONTENT.collections).map(([key, c]) => ({ key, name: c.plural, url: safeUrl(c.base, origin), redirectFrom: legacyBases(key, c).filter(from => !bases.has(from)).map(from => safeUrl(from, origin)) })), calendar: CALENDAR.enabled, bookings: bookingsEnabled(),
+      // RSVPs from apps (GET /events/{slug}/rsvp, POST /bookings) come with the calendar
+      rsvp: CALENDAR.enabled, search: SEARCH.enabled,
       // Admin → Mobile app → App access
       bookingChanges: CALENDAR.enabled && settings.mobileAccess.bookingChanges, guestSignIn: await guestSignInReady(repo, locals),
       forms: settings.mobileAccess.forms, links: settings.mobileAccess.links,

package/src/lib/push/api.ts

@@ -101,10 +101,11 @@ export async function adminPushState(repo: ContentRepository, url: URL, locals?:
   const now = Date.now();
   const settings = await repo.getSettings();
   const expo = expoOptions(locals);
-  const [stats, topics, calendars, links, log] = await Promise.all([
+  const [stats, topics, calendars, links, log, tags] = await Promise.all([
     repo.push.stats(now), pushTopics(repo),
     CALENDAR.enabled ? repo.listCalendars() : Promise.resolve([]),
     linkTargets(repo), repo.push.listNotifications(50),
+    CALENDAR.enabled ? repo.listTags() : Promise.resolve([]),
   ]);
   return {
     enabled: PUSH.enabled, retentionDays: PUSH.retentionDays,
@@ -115,6 +116,8 @@ export async function adminPushState(repo: ContentRepository, url: URL, locals?:
     // "we're live" needs live video on (Integrations → Live video)
     liveMode: settings.live.mode,
     calendars: calendars.filter((c) => c.visibility === 'public').map((c) => ({ id: c.id, slug: c.slug, name: c.name, color: c.color })),
+    // suggestions for the event-change rule's "Only events tagged"
+    tags: tags.map((t) => t.name),
     expo: { accessToken: Boolean(expo.accessToken), customEndpoint: expo.base !== EXPO_PUSH_BASE },
   };
 }
@@ -152,11 +155,20 @@ export async function adminPushAction(repo: ContentRepository, input: z.infer<ty
       const collections = new Set(Object.keys(CONTENT.collections));
       const calendars = new Set((CALENDAR.enabled ? await repo.listCalendars() : []).filter((c) => c.visibility === 'public').map((c) => c.id));
       const cals = (ids: string[]) => [...new Set(ids)].filter((id) => id === '*' || calendars.has(id));
+      const changes = input.auto.eventChanges;
+      const tags = changes?.tags ?? [];
+      const known = await knownTopics(repo);
       const auto = {
         newPost: { collections: [...new Set(input.auto.newPost.collections)].filter((k) => collections.has(k)) },
         newEvent: { calendars: CALENDAR.enabled ? cals(input.auto.newEvent.calendars) : [] },
         startingSoon: { calendars: CALENDAR.enabled ? cals(input.auto.startingSoon.calendars) : [], minutes: input.auto.startingSoon.minutes },
         live: { enabled: input.auto.live?.enabled === true },
+        eventChanges: CALENDAR.enabled ? {
+          calendars: cals(changes?.calendars ?? []),
+          // one of each tag, whatever its case (matching ignores case too)
+          tags: tags.filter((t, i) => tags.findIndex((x) => x.toLowerCase() === t.toLowerCase()) === i),
+          topics: [...new Set(changes?.topics ?? [])].filter((t) => known.has(t)),
+        } : { calendars: [], tags: [], topics: [] },
       };
       await repo.updateSettings({ push: { auto } });
       return { auto };