@acms-subir/core 0.3.38 → 0.3.40

package/src/lib/booking/service.ts

@@ -9,8 +9,12 @@ import { loadFeed, expandVEvents } from '../calendar/ics';
 import { emitWebhook } from '../webhooks';
 import { parseFrom } from '../email/config';
 import { kickEmail } from '../email/service';
+import type { RsvpStaffNotice } from '../email/types';
+import { LEGAL } from '../legal/config';
+import { isRole } from '../roles';
+import { siteLocale } from '../dates';
 import { eventUrl } from '../calendar/config';
-import { eventTimeZone, locationLine, occurrenceKey } from '../calendar/events';
+import { eventTimeZone, locationLine, occurrenceKey, rsvpDeadline } from '../calendar/events';
 import { normalizePageLocale } from '../i18n';
 import { localizeDoc } from '../translations';
 import { bookingStrings } from '../email/booking-words';
@@ -18,6 +22,8 @@ import { bookingEmail, bookingLanguage, bookingManagePath, whenText, type Bookin
 import { holdOf, isBookable, resourceZone, spanEnd, type AvailabilityContext, type Interval } from './availability';
 import { decideStatus, linkApproval } from './approval';
 import { eventHolds } from './holds';
+import { MEMBERS, memberEventsPath } from '../calendar/members-config';
+import { principalCan } from '../permissions/access';
 
 export interface FlowOptions {
   origin: string;
@@ -28,7 +34,8 @@ export interface FlowOptions {
 }
 
 export class BookingError extends Error {
-  constructor(public status: number, message: string) { super(message); }
+  // code: why, when the status alone doesn't say (apps get it as the error code)
+  constructor(public status: number, message: string, public code?: 'duplicate') { super(message); }
 }
 
 const token = () => {
@@ -87,7 +94,7 @@ async function describe(repo: ContentRepository, b: Booking, settings: Settings,
     const ev = raw && locale ? localizeDoc(raw, locale) : raw;
     const tz = ev ? eventTimeZone(ev, settings) : settings.timezone || 'UTC';
     return {
-      resource: null, link: null, event: ev,
+      resource: null, link: null, event: ev, tz,
       title: ev?.title ?? 'Event',
       location: ev ? locationLine(ev.location) : '',
       when: whenText(b, tz, settings, ev?.allDay),
@@ -96,7 +103,7 @@ async function describe(repo: ContentRepository, b: Booking, settings: Settings,
   const [resource, link] = await Promise.all([repo.getResource(b.resourceId), b.linkId ? repo.getBookingLink(b.linkId) : Promise.resolve(null)]);
   const tz = resource ? resourceZone(resource, settings.timezone) : settings.timezone || 'UTC';
   return {
-    resource, link, event: null as CalEvent | null,
+    resource, link, event: null as CalEvent | null, tz,
     title: [resource?.name, link?.name].filter(Boolean).join(' · ') || 'Booking',
     location: resource?.name ?? '',
     when: whenText(b, tz, settings, link?.mode === 'day'),
@@ -113,10 +120,17 @@ export function bookingJson(b: Booking, extra: { title?: string; resourceSlug?:
   };
 }
 
-export async function bookingMail(repo: ContentRepository, b: Booking, kind: BookingEmail, origin: string, from = '', snapshot?: { message?: string; eventTitle?: string; eventLocation?: string; eventAllDay?: number }) {
+// the booking in the admin; an RSVP among its event's (a cancelled one under Cancelled)
+const adminBookingUrl = (origin: string, b: Booking, kind: BookingEmail) =>
+  `${origin}/admin/calendar/bookings?${b.eventId ? `event=${encodeURIComponent(b.eventId)}&` : ''}${kind === 'staff-rsvp-cancelled' ? 'tab=cancelled&' : ''}b=${b.id}`;
+
+// snapshot.locale: the language to use instead of the booking's (a link sent
+// again); taken/why/via: a staff RSVP email's job (rsvpStaffJobs)
+export async function bookingMail(repo: ContentRepository, b: Booking, kind: BookingEmail, origin: string, from = '', snapshot?: { message?: string; eventTitle?: string; eventLocation?: string; eventAllDay?: number; locale?: string; taken?: number; why?: RsvpStaffNotice['why']; via?: Booking['source'] }, recipient = '') {
   const site = await repo.getSettings();
+  const staff = kind.startsWith('staff-');
   // the guest hears in the language they booked in; staff in the main one
-  const language = bookingLanguage(kind === 'staff-new' ? { locale: '' } : b, site);
+  const language = bookingLanguage(staff ? { locale: '' } : typeof snapshot?.locale === 'string' ? { locale: snapshot.locale } : b, site);
   const settings = language.settings;
   const d = await describe(repo,b,settings,language.locale);
   if (b.kind === 'rsvp' && !d.event && snapshot?.eventTitle) {
@@ -124,10 +138,42 @@ export async function bookingMail(repo: ContentRepository, b: Booking, kind: Boo
     try { d.location = locationLine(JSON.parse(snapshot.eventLocation || '{}')); } catch { d.location = ''; }
     d.when = whenText(b,b.timezone || settings.timezone || 'UTC',settings,!!snapshot.eventAllDay);
   }
+  // "Fri Nov 7": the subject's date, in the event's zone
+  const counts = kind === 'staff-rsvp' || kind === 'staff-rsvp-cancelled' ? {
+    date: new Intl.DateTimeFormat(siteLocale(settings), { weekday: 'short', month: 'short', day: 'numeric', timeZone: d.tz }).format(b.start).replace(/,/g, ''),
+    taken: snapshot?.taken ?? await seatsTaken(repo, b.eventId, b.start), capacity: d.event?.rsvp.capacity ?? 0,
+    why: snapshot?.why ?? 'hosts', via: snapshot?.via ?? b.source,
+  } : undefined;
+  // a host without Manage bookings (a member who hosts) gets their My events
+  // page for the event instead of an admin page they can't open
+  const mine = counts && d.event && recipient ? await memberHostPath(repo, d.event, recipient) : '';
   return bookingEmail(kind, { booking:b,resource:d.resource,link:d.link,title:d.title,location:d.location,when:d.when,
-    manageUrl:kind === 'staff-new' ? `${origin}/admin/calendar/bookings?b=${b.id}` : origin + bookingManagePath(b),
+    manageUrl:mine ? origin + mine : staff ? adminBookingUrl(origin, b, kind) : origin + bookingManagePath({ manageToken: b.manageToken, locale: language.locale }),
+    mineLink: !!mine,
     siteTitle:settings.siteTitle,host:new URL(origin).host,organizer:parseFrom(from)?.email,message:snapshot?.message,
-    allDay:d.link?.mode==='day'||!!d.event?.allDay||(!d.event&&!!snapshot?.eventAllDay), lang:language.lang });
+    allDay:d.link?.mode==='day'||!!d.event?.allDay||(!d.event&&!!snapshot?.eventAllDay), lang:language.lang, rsvpStaff: counts });
+}
+
+/** The member's My events page for an event they host, when they can't manage bookings in the admin ('' otherwise). */
+async function memberHostPath(repo: ContentRepository, e: CalEvent, email: string): Promise<string> {
+  const user = (await repo.listUsers()).find((u) => u.email && u.email.trim().toLowerCase() === email.trim().toLowerCase());
+  if (!user || !MEMBERS.enabled || !e.hostIds.includes(user.id)) return '';
+  return (await principalCan(repo, { user }, 'schedule.bookings')) ? '' : `${memberEventsPath()}/${encodeURIComponent(e.id)}`;
+}
+
+/**
+ * Who hears about an event's RSVPs (rsvp.notifyStaff): its hosts, else the
+ * contact email in Settings → Legal (then acms({ legal }), as legalOperator
+ * reads it), else the owners. Accounts that were removed, or whose role the
+ * site no longer has, are skipped. via: where the person did it.
+ */
+export async function rsvpStaff(repo: ContentRepository, e: CalEvent, settings: Settings, via: Booking['source']): Promise<RsvpStaffNotice | undefined> {
+  if (!e.rsvp.notifyStaff) return undefined;
+  const contact = settings.legal.contactEmail || LEGAL.contactEmail;
+  const users = e.hostIds.length || !contact ? (await repo.listUsers()).filter((u) => u.email && isRole(u.role)) : [];
+  const hosts = users.filter((u) => e.hostIds.includes(u.id)).map((u) => u.email);
+  const to = hosts.length ? hosts : contact ? [contact] : users.filter((u) => u.role === 'owner').map((u) => u.email);
+  return { to: [...new Set(to.map((a) => a.trim().toLowerCase()))].filter(Boolean), why: hosts.length ? 'hosts' : 'contact', via };
 }
 async function notify(repo: ContentRepository, _b: Booking, _kinds: BookingEmail[], opts: FlowOptions, _message?: string) {
   // Repository mutations already committed their outbox jobs atomically.
@@ -203,12 +249,15 @@ export function guestChanges(b: Booking, link: BookingLink | null, now = Date.no
   };
 }
 
-export async function guestCancel(repo: ContentRepository, b: Booking, opts: FlowOptions): Promise<Booking> {
+// via: where they cancelled (the manage page, or an app)
+export async function guestCancel(repo: ContentRepository, b: Booking, opts: FlowOptions, via: Booking['source'] = 'web'): Promise<Booking> {
   const link = b.linkId ? await repo.getBookingLink(b.linkId) : null;
   if (b.status === 'cancelled') return b;
   const can = guestChanges(b, link, opts.now);
   if (!can.cancel) throw new BookingError(409, can.closed ? `Changes close ${can.cutoffHours} hours before the start. Please contact us to cancel.` : 'This booking can’t be cancelled.');
-  return setBookingStatus(repo, b, 'cancelled', opts);
+  // the person cancelled an RSVP: its hosts hear about it (staff cancelling never emails staff)
+  const event = b.kind === 'rsvp' && b.eventId ? await repo.getEvent(b.eventId) : null;
+  return setBookingStatus(repo, b, 'cancelled', opts, undefined, event ? await rsvpStaff(repo, event, await repo.getSettings(), via) : undefined);
 }
 
 /** the link as a guest moving a booking sees it: no new time inside the change cutoff */
@@ -275,29 +324,56 @@ export async function createRsvp(
   opts: FlowOptions
 ): Promise<Booking> {
   const e = args.event;
+  const now = opts.now ?? Date.now();
   if (!e.rsvp.enabled) throw new BookingError(400, 'This event doesn’t take RSVPs.');
   if (e.cancelled) throw new BookingError(410, 'This event is cancelled.');
-  if (args.end <= (opts.now ?? Date.now())) throw new BookingError(410, 'This event has already happened.');
-  if (e.cancelledDates?.length && e.cancelledDates.includes(occurrenceKey(e, args.start, await repo.getSettings()))) {
+  if (args.end <= now) throw new BookingError(410, 'This event has already happened.');
+  const settings = await repo.getSettings();
+  if (e.cancelledDates?.length && e.cancelledDates.includes(occurrenceKey(e, args.start, settings))) {
     throw new BookingError(410, 'This date is cancelled.');
   }
+  const deadline = rsvpDeadline({ event: e, start: args.start, end: args.end }, settings);
+  if (deadline !== null && deadline <= now) throw new BookingError(410, 'RSVPs for this date are closed.');
   const seats = Math.max(1, Math.min(e.rsvp.maxSeats || 1, Math.floor(args.seats) || 1));
   const booker = validateBooker(null, args.booker);
-  await checkEmailCap(repo, booker.email, args.source, await repo.getSettings(), opts.now);
+  await checkEmailCap(repo, booker.email, args.source, settings, opts.now);
   const formResponse = e.rsvp.form ? await collectResponse(e.rsvp.form, args.booker.answers ?? {}, args.booker.formVersion) : undefined;
   if (formResponse) booker.answers = displayAnswers(formResponse);
+  // one RSVP per address and date on public channels; staff may add more
+  const once = args.source !== 'admin';
+  const source = args.source ?? 'web';
+  // the hosts' email is queued with the RSVP: a duplicate or a replay inserts nothing, so it emails no one
   const b = await repo.createBooking({
     kind: 'rsvp', resourceId: '', linkId: '', eventId: e.id, status: e.rsvp.autoConfirm ? 'confirmed' : 'pending',
     start: args.start, end: args.end, holdStart: args.start, holdEnd: args.end, timezone: e.timezone, ...booker, seats,
-    formResponse, notes: '', manageToken: token(), source: args.source ?? 'web', locale: normalizePageLocale(args.booker.locale ?? ''),
-  }, { capacity: e.rsvp.capacity, idempotency: opts.idempotency });
-  if (!b) throw new BookingError(409, e.rsvp.capacity ? 'Sorry — that’s more seats than are left.' : 'Couldn’t save your RSVP.');
-  await notify(repo, b, [b.status === 'confirmed' ? 'confirmed' : 'received'], opts);
+    formResponse, notes: '', manageToken: token(), source, locale: normalizePageLocale(args.booker.locale ?? ''),
+  }, { capacity: e.rsvp.capacity, oncePerEmail: once, idempotency: opts.idempotency, staff: await rsvpStaff(repo, e, settings, source) });
+  if (!b) {
+    // a retry of a request that just committed: the caller replays that one
+    const retry = opts.idempotency ? await repo.getBookingRequest(opts.idempotency.keyHash) : null;
+    const mine = once && !retry ? (await repo.listBookings({ eventId: e.id, email: booker.email, from: args.start - 1, to: args.start + 1, statuses: ['pending', 'confirmed'], kinds: ['rsvp'] })).find((x) => x.start === args.start) : undefined;
+    if (mine) {
+      await resendManageLink(repo, mine, args.booker.locale === undefined ? mine.locale : normalizePageLocale(args.booker.locale), opts);
+      // anyone can type an address: say only that it has one
+      throw new BookingError(409, 'You already have an RSVP for this date. We sent you an email with a link to change it.', 'duplicate');
+    }
+    throw new BookingError(409, e.rsvp.capacity ? 'Sorry — that’s more seats than are left.' : 'Couldn’t save your RSVP.');
+  }
+  await notify(repo, b, [b.status === 'confirmed' ? 'confirmed' : 'received', 'staff-rsvp'], opts);
   await hook(repo, 'booking.created', b, opts);
   if (b.status === 'confirmed') await hook(repo, 'booking.confirmed', b, opts);
   return b;
 }
 
+// The address gets its RSVP's own link again, in the language it just used,
+// at most once per 10 minutes per RSVP so the form can't flood an inbox.
+async function resendManageLink(repo: ContentRepository, b: Booking, locale: string, opts: FlowOptions) {
+  if (!await repo.email.rateLimit(`rsvp-link:${b.id}`, 1, 10 * 60_000)) return;
+  await repo.email.enqueue({dedupe:`${b.id}:${b.notificationVersion}:link:${Date.now()}`,kind:'booking',recipient:b.email,
+    payload:JSON.stringify({bookingId:b.id,version:b.notificationVersion,kind:'link',locale}),configVersion:(await repo.email.config())?.version||0,expiresAt:b.end});
+  await kickEmail(repo,opts.locals,opts.waitUntil);
+}
+
 const TRANSITIONS: Record<BookingStatus, BookingStatus[]> = {
   pending: ['confirmed', 'declined', 'cancelled'],
   confirmed: ['cancelled'],
@@ -305,7 +381,8 @@ const TRANSITIONS: Record<BookingStatus, BookingStatus[]> = {
   cancelled: ['confirmed'],
 };
 
-export async function setBookingStatus(repo: ContentRepository, b: Booking, status: BookingStatus, opts: FlowOptions, message?: string): Promise<Booking> {
+// staff: who to tell that the person cancelled (guestCancel); staff changes tell no one
+export async function setBookingStatus(repo: ContentRepository, b: Booking, status: BookingStatus, opts: FlowOptions, message?: string, staff?: RsvpStaffNotice): Promise<Booking> {
   if (b.status === status) return b;
   if (!TRANSITIONS[b.status].includes(status)) throw new BookingError(409, `A ${b.status} booking can’t become ${status}.`);
   // re-confirming a declined/cancelled booking must re-check the slot
@@ -314,7 +391,7 @@ export async function setBookingStatus(repo: ContentRepository, b: Booking, stat
       .some((x) => x.id !== b.id && x.kind !== 'rsvp' && x.holdStart < b.holdEnd && x.holdEnd > b.holdStart);
     if (clash) throw new BookingError(409, 'That time has been booked since — it can’t be restored.');
   }
-  await repo.updateBooking(b.id, { status, notificationMessage: message });
+  await repo.updateBooking(b.id, { status, notificationMessage: message, staff });
   const next = (await repo.getBooking(b.id))!;
   if (!next || next.status !== status) throw new BookingError(409, 'This booking changed. Refresh and try again.');
   if (b.kind !== 'block') {

package/src/lib/calendar/api.ts

@@ -27,7 +27,8 @@ export interface EventJson {
   cancelledDates: string[];
   location: CalEvent['location'];
   cta: CalEvent['cta'];
-  rsvp?: CalEvent['rsvp'];
+  // notifyStaff (whether the hosts get RSVP emails) only for staff callers
+  rsvp?: Omit<CalEvent['rsvp'], 'notifyStaff'> & Partial<Pick<CalEvent['rsvp'], 'notifyStaff'>>;
   image: string;
   imageAlt: string;
   tags: string[];
@@ -59,7 +60,7 @@ export function eventToJson(e: CalEvent, origin: string, calendars: Map<string,
     cancelledDates: e.cancelledDates ?? [],
     location: e.location,
     cta: e.cta,
-    rsvp: e.rsvp,
+    rsvp: opts.includePrivate ? e.rsvp : (({ notifyStaff: _, ...rsvp }) => rsvp)(e.rsvp),
     image: e.cover ? abs(origin, e.cover) : '',
     imageAlt: e.coverAlt,
     tags: e.tags.filter((t) => !t.startsWith('#')),

package/src/lib/calendar/events.ts

@@ -154,6 +154,17 @@ export function expandEvents(events: CalEvent[], settings: Pick<Settings, 'timez
   return out.sort((a, b) => a.start - b.start || a.event.title.localeCompare(b.event.title));
 }
 
+// When RSVPs to one date close (UTC ms), or null when they stay open until it
+// ends: the event's closesAt (wall time in its zone, one instant for every
+// date), else closeBefore minutes before this date's start. A deadline at or
+// after the end isn't one.
+export function rsvpDeadline(o: Pick<Occurrence, 'event' | 'start' | 'end'>, settings: Pick<Settings, 'timezone'>): number | null {
+  const { closesAt, closeBefore } = o.event.rsvp;
+  const w = parseWall(closesAt);
+  const at = w && !w.dateOnly ? wallToMs(w, eventTimeZone(o.event, settings)) : closeBefore > 0 ? o.start - closeBefore * 60_000 : null;
+  return at !== null && at < o.end ? at : null;
+}
+
 // The occurrence of a series with this key (null when the series has no
 // such date: never generated, skipped by exdates, or the series moved)
 export function findOccurrence(e: CalEvent, key: string, settings: Pick<Settings, 'timezone'>, displayTz = settings.timezone || 'UTC'): Occurrence | null {

package/src/lib/calendar/members-config.ts

@@ -0,0 +1,5 @@
+import { userConfig } from 'virtual:acms-config';
+
+/** where the built-in member pages live (acms({ members })); `notify` hears about new requests */
+export const MEMBERS: { enabled: boolean; base: string; notify: string[] } = { enabled: false, base: '/members', notify: [], ...(userConfig.members ?? {}) };
+export const memberEventsPath = () => `${MEMBERS.base}/events`;

package/src/lib/calendar/requests.ts

@@ -1,4 +1,3 @@
-import { userConfig } from 'virtual:acms-config';
 import type { ContentRepository } from '../repo/types';
 import type { CalEvent, EventRequest } from '../schema';
 import { EventLocation } from '../schema';
@@ -20,9 +19,10 @@ import { kickEmail } from '../email/service';
 // Everything here checks who is acting, so the built-in member pages and a
 // site's own pages (through @acms-subir/core/server) share the same rules.
 
-/** where the built-in member pages live (acms({ members })); `notify` hears about new requests */
-export const MEMBERS: { enabled: boolean; base: string; notify: string[] } = { enabled: false, base: '/members', notify: [], ...(userConfig.members ?? {}) };
-export const memberEventsPath = () => `${MEMBERS.base}/events`;
+// acms({ members }) and the My events path live on their own, so booking
+// emails (which this code depends on) can read them without an import cycle
+export { MEMBERS, memberEventsPath } from './members-config';
+import { MEMBERS, memberEventsPath } from './members-config';
 
 /** who is acting: currentUser() from @acms-subir/core/server fits */
 export interface Actor { id: string; can(permission: string): boolean }

package/src/lib/calendar/rsvp-words.ts

@@ -1,8 +1,8 @@
 // Words of the built-in RSVP: the event page's RSVP block, the RSVP's own
 // page (book/manage) and the app's default button (GET /events/:slug/rsvp).
 // The same wording as the app's RSVP panel (packages/native strings.ts).
-// Plain strings with {count}, {email} and {title} slots (live/words.ts
-// `fill`); of a pair (`spotLeft`/`spotsLeft`), the first is for 1 and the
+// Plain strings with {count}, {email}, {title}, {date} and {time} slots
+// (live/words.ts `fill`); of a pair (`spotLeft`/`spotsLeft`), the first is for 1 and the
 // second for any other number. The event's own form title, questions and
 // button keep their words. Other languages fall back to English.
 export interface RsvpStrings {
@@ -21,6 +21,12 @@ export interface RsvpStrings {
   requestSeat: string;
   full: string;
   closed: string;
+  /** the event's RSVP deadline ({date} and {time}: deadlineParts): before, and once it passed (under `closed`) */
+  closesOn: string;
+  closedOn: string;
+  /** the address already has an RSVP for this date (nothing else about it is shown) */
+  duplicate: string;
+  duplicateNote: string;
   saveError: string;
   /** the RSVP's own page */
   booked: string;
@@ -53,6 +59,8 @@ const STRINGS: Record<string, RsvpStrings> = {
     personGoing: '{count} going', peopleGoing: '{count} going', spotLeft: '{count} spot left', spotsLeft: '{count} spots left',
     saveSeat: 'Save my seat', nameField: 'Your name', emailField: 'Email', seatsField: 'Seats', confirmSeat: 'Confirm my seat', requestSeat: 'Request a seat',
     full: 'This event is full.', closed: 'RSVPs are closed.', saveError: 'Couldn’t save your RSVP. Please try again.',
+    closesOn: 'RSVPs close {date} at {time}', closedOn: 'They closed on {date}. Questions? Contact us.',
+    duplicate: 'You already have an RSVP for this date.', duplicateNote: 'We sent you an email with a link to change it. Need more seats? Change it there.',
     booked: 'You’re booked', yours: 'Your booking', requestSent: 'Request sent', awaitingApproval: 'Waiting for approval', notAvailable: 'Not available', cancelledTitle: 'Booking cancelled',
     emailWhenApproved: 'We’ll email {email} once it’s approved.', confirmationOnItsWay: 'A confirmation is on its way to {email}.',
     declined: 'Sorry, the organiser couldn’t confirm it.', cancelledText: 'This booking is cancelled.',
@@ -65,6 +73,8 @@ const STRINGS: Record<string, RsvpStrings> = {
     personGoing: '{count} va', peopleGoing: '{count} van', spotLeft: '{count} lugar disponible', spotsLeft: '{count} lugares disponibles',
     saveSeat: 'Apartar mi lugar', nameField: 'Tu nombre', emailField: 'Correo electrónico', seatsField: 'Lugares', confirmSeat: 'Confirmar mi lugar', requestSeat: 'Solicitar un lugar',
     full: 'Este evento está lleno.', closed: 'Las confirmaciones están cerradas.', saveError: 'No se pudo guardar tu confirmación. Inténtalo de nuevo.',
+    closesOn: 'Las confirmaciones cierran el {date}, {time}', closedOn: 'Cerraron el {date}. ¿Preguntas? Contáctanos.',
+    duplicate: 'Ya tienes una confirmación para esta fecha.', duplicateNote: 'Te enviamos un correo con un enlace para cambiarla. ¿Necesitas más lugares? Cámbiala ahí.',
     booked: 'Ya tienes tu lugar', yours: 'Tu confirmación', requestSent: 'Solicitud enviada', awaitingApproval: 'En espera de aprobación', notAvailable: 'No se pudo confirmar', cancelledTitle: 'Confirmación cancelada',
     emailWhenApproved: 'Te escribiremos a {email} cuando se apruebe.', confirmationOnItsWay: 'Te enviamos la confirmación a {email}.',
     declined: 'Lo sentimos, el organizador no pudo confirmarla.', cancelledText: 'Esta confirmación se canceló.',
@@ -77,6 +87,8 @@ const STRINGS: Record<string, RsvpStrings> = {
     personGoing: '{count} participant', peopleGoing: '{count} participants', spotLeft: '{count} place restante', spotsLeft: '{count} places restantes',
     saveSeat: 'Réserver ma place', nameField: 'Votre nom', emailField: 'E-mail', seatsField: 'Places', confirmSeat: 'Confirmer ma place', requestSeat: 'Demander une place',
     full: 'Cet événement est complet.', closed: 'Les inscriptions sont closes.', saveError: 'Impossible d’enregistrer votre inscription. Veuillez réessayer.',
+    closesOn: 'Les inscriptions ferment le {date} à {time}', closedOn: 'Elles ont fermé le {date}. Des questions ? Contactez-nous.',
+    duplicate: 'Vous avez déjà une inscription pour cette date.', duplicateNote: 'Nous vous avons envoyé un e-mail avec un lien pour la modifier. Besoin de plus de places ? Modifiez-la depuis ce lien.',
     booked: 'Votre place est réservée', yours: 'Votre inscription', requestSent: 'Demande envoyée', awaitingApproval: 'En attente de validation', notAvailable: 'Non confirmée', cancelledTitle: 'Inscription annulée',
     emailWhenApproved: 'Nous écrirons à {email} dès qu’elle sera validée.', confirmationOnItsWay: 'Une confirmation est en route vers {email}.',
     declined: 'Désolés, l’organisateur n’a pas pu la confirmer.', cancelledText: 'Cette inscription est annulée.',
@@ -89,6 +101,8 @@ const STRINGS: Record<string, RsvpStrings> = {
     personGoing: '{count} Zusage', peopleGoing: '{count} Zusagen', spotLeft: '{count} Platz frei', spotsLeft: '{count} Plätze frei',
     saveSeat: 'Platz reservieren', nameField: 'Ihr Name', emailField: 'E-Mail', seatsField: 'Plätze', confirmSeat: 'Platz bestätigen', requestSeat: 'Platz anfragen',
     full: 'Diese Veranstaltung ist ausgebucht.', closed: 'Anmeldungen sind geschlossen.', saveError: 'Ihre Anmeldung konnte nicht gespeichert werden. Bitte versuchen Sie es erneut.',
+    closesOn: 'Anmeldung bis {date}, {time}', closedOn: 'Die Anmeldung endete am {date}. Fragen? Kontaktieren Sie uns.',
+    duplicate: 'Sie haben für diesen Termin schon eine Anmeldung.', duplicateNote: 'Wir haben Ihnen eine E-Mail mit einem Link zum Ändern geschickt. Mehr Plätze nötig? Ändern Sie sie dort.',
     booked: 'Ihr Platz ist reserviert', yours: 'Ihre Anmeldung', requestSent: 'Anfrage gesendet', awaitingApproval: 'Wartet auf Freigabe', notAvailable: 'Nicht bestätigt', cancelledTitle: 'Anmeldung storniert',
     emailWhenApproved: 'Wir schreiben an {email}, sobald sie freigegeben ist.', confirmationOnItsWay: 'Eine Bestätigung ist unterwegs an {email}.',
     declined: 'Leider konnte der Veranstalter sie nicht bestätigen.', cancelledText: 'Diese Anmeldung ist storniert.',
@@ -101,6 +115,8 @@ const STRINGS: Record<string, RsvpStrings> = {
     personGoing: '{count} confirmado', peopleGoing: '{count} confirmados', spotLeft: '{count} vaga disponível', spotsLeft: '{count} vagas disponíveis',
     saveSeat: 'Reservar minha vaga', nameField: 'Seu nome', emailField: 'E-mail', seatsField: 'Vagas', confirmSeat: 'Confirmar minha vaga', requestSeat: 'Solicitar uma vaga',
     full: 'Este evento está lotado.', closed: 'As inscrições estão encerradas.', saveError: 'Não foi possível salvar sua inscrição. Tente novamente.',
+    closesOn: 'As inscrições se encerram em {date}, {time}', closedOn: 'Elas se encerraram em {date}. Dúvidas? Fale com a gente.',
+    duplicate: 'Você já tem uma inscrição para esta data.', duplicateNote: 'Enviamos um e-mail com um link para alterá-la. Precisa de mais vagas? Altere por lá.',
     booked: 'Sua vaga está reservada', yours: 'Sua inscrição', requestSent: 'Solicitação enviada', awaitingApproval: 'Aguardando aprovação', notAvailable: 'Não confirmada', cancelledTitle: 'Inscrição cancelada',
     emailWhenApproved: 'Vamos escrever para {email} assim que for aprovada.', confirmationOnItsWay: 'Uma confirmação está a caminho de {email}.',
     declined: 'Desculpe, o organizador não pôde confirmá-la.', cancelledText: 'Esta inscrição foi cancelada.',
@@ -119,3 +135,16 @@ export function aroundCount(count: number, one: string, other: string): [string,
   const [before, after = ''] = (count === 1 ? one : other).split('{count}');
   return [before, after];
 }
+
+/** A deadline's date and time in the event's zone for closesOn/closedOn: { date: 'Fri, Oct 24', time: '9 PM' } (minutes only when it has some). */
+export function deadlineParts(at: number, tz: string, locale: string): { date: string; time: string } {
+  const f = (o: Intl.DateTimeFormatOptions) => {
+    try { return new Intl.DateTimeFormat(locale, { ...o, timeZone: tz }); }
+    catch { return new Intl.DateTimeFormat('en-US', { ...o, timeZone: 'UTC' }); }
+  };
+  const time = f({ hour: 'numeric', minute: '2-digit' });
+  const hour = f({ hour: 'numeric' }).format(at);
+  // "9 PM", "21 Uhr"; a bare "21" (Portuguese) keeps its minutes
+  const whole = time.formatToParts(at).find((p) => p.type === 'minute')?.value === '00' && /\D/.test(hour);
+  return { date: f({ weekday: 'short', month: 'short', day: 'numeric' }).format(at), time: whole ? hour : time.format(at) };
+}

package/src/lib/content-service.ts

@@ -6,7 +6,7 @@ import { ApiError } from './api';
 import { deniedMessage } from './permissions/catalog';
 import { CONTENT, collectionUrl } from './content';
 import { CALENDAR } from './calendar/config';
-import { isValidTimeZone, normalizeEventTimes } from './calendar/events';
+import { formatWall, isValidTimeZone, normalizeEventTimes, parseWall } from './calendar/events';
 import { eventChanged } from './calendar/hooks';
 import { normalizePageLocale } from './i18n';
 import { siteOrigin } from './seo';
@@ -37,10 +37,12 @@ export type PageSave = Omit<Parameters<ContentRepository['updatePage']>[1], 'blo
 // location (see mergeLocationInput) — older clients send name/address/url only
 // cancelledDates is left out: single dates are cancelled at once through
 // cancelOccurrence/restoreOccurrence (lib/calendar/schedule.ts), never staged
-export type EventSave = Partial<Omit<CalEvent, 'id' | 'draft' | 'startAt' | 'endAt' | 'createdAt' | 'updatedAt' | 'sourceUid' | 'publishedAt' | 'location' | 'cancelledDates'>> & {
+// rsvp may leave out the deadline and notifyStaff (older clients): the current ones stay
+export type EventSave = Partial<Omit<CalEvent, 'id' | 'draft' | 'startAt' | 'endAt' | 'createdAt' | 'updatedAt' | 'sourceUid' | 'publishedAt' | 'location' | 'cancelledDates' | 'rsvp'>> & {
   location?: Partial<EventLocation>;
+  rsvp?: Omit<CalEvent['rsvp'], 'closesAt' | 'closeBefore' | 'notifyStaff'> & Partial<Pick<CalEvent['rsvp'], 'closesAt' | 'closeBefore' | 'notifyStaff'>>;
 };
-type EventClean = Omit<EventSave, 'location'> & { location?: EventLocation };
+type EventClean = Omit<EventSave, 'location' | 'rsvp'> & { location?: EventLocation; rsvp?: CalEvent['rsvp'] };
 
 const live = (status: string) => status === 'published' || status === 'scheduled';
 /** publishing, scheduling, unpublishing or applying staged edits needs Publish content */
@@ -130,18 +132,31 @@ export async function applyPageUpdate(repo: ContentRepository, id: string, hooks
 // Validate + normalize an event save. Times are checked as a PAIR against the
 // merged (staged) state so a half-edited range can't slip through.
 export async function cleanEventInput(repo: ContentRepository, data: EventSave, before: CalEvent): Promise<EventClean> {
-  const { location, ...rest } = data;
+  const { location, rsvp, ...rest } = data;
   const out: EventClean = { ...rest };
-  // Older editor clients resend the original RSVP shape. Omission must not
-  // erase questions that were authored in a newer editor.
-  if (out.rsvp && !Object.hasOwn(out.rsvp, 'form')) {
-    const previous = mergeEventDraft(before).rsvp.form;
-    if (previous) out.rsvp = { ...out.rsvp, form: previous };
-  }
-  if (out.rsvp?.form !== undefined) {
-    const form = FormDefinition.safeParse(out.rsvp.form);
-    if (!form.success) throw new ApiError(400, form.error.issues[0]?.message || 'Invalid registration form.');
-    out.rsvp = { ...out.rsvp, form: form.data };
+  if (rsvp) {
+    // Older editor clients resend the original RSVP shape. Omission must not
+    // erase questions, a deadline or the staff emails setting that were
+    // authored in a newer editor.
+    const previous = mergeEventDraft(before).rsvp;
+    const next: CalEvent['rsvp'] = { ...rsvp, closesAt: rsvp.closesAt === undefined ? previous.closesAt ?? null : rsvp.closesAt || null, closeBefore: rsvp.closeBefore ?? previous.closeBefore ?? 0,
+      notifyStaff: rsvp.notifyStaff ?? previous.notifyStaff ?? true };
+    if (!Object.hasOwn(rsvp, 'form') && previous.form) next.form = previous.form;
+    if (next.form !== undefined) {
+      const form = FormDefinition.safeParse(next.form);
+      if (!form.success) throw new ApiError(400, form.error.issues[0]?.message || 'Invalid registration form.');
+      next.form = form.data;
+    }
+    if (next.closesAt !== null) {
+      const w = parseWall(next.closesAt);
+      if (!w || w.dateOnly) throw new ApiError(400, 'The RSVP deadline must be a date and time (YYYY-MM-DDTHH:mm).');
+      next.closesAt = formatWall(w);
+    }
+    if (!Number.isInteger(next.closeBefore) || next.closeBefore < 0 || next.closeBefore > 60 * 1440) {
+      throw new ApiError(400, 'The RSVP deadline can be at most 60 days before each date (closeBefore: 0–86400 minutes).');
+    }
+    if (typeof next.notifyStaff !== 'boolean') throw new ApiError(400, 'rsvp.notifyStaff must be true or false.');
+    out.rsvp = next;
   }
   if (location !== undefined) out.location = mergeLocationInput(mergeEventDraft(before).location, location);
   if (out.slug !== undefined) {

package/src/lib/drafts.ts

@@ -52,6 +52,8 @@ export function pickEventDraft(draft: Record<string, unknown>): Partial<Pick<Cal
     const loc = EventLocation.safeParse(out.location);
     if (loc.success) out.location = loc.data; else delete out.location;
   }
+  // and before RSVP deadlines: none; before staff RSVP emails: on
+  if (out.rsvp) out.rsvp = { ...out.rsvp, closesAt: out.rsvp.closesAt ?? null, closeBefore: out.rsvp.closeBefore ?? 0, notifyStaff: out.rsvp.notifyStaff ?? true };
   return out;
 }
 export function pickPageDraft(draft: Record<string, unknown>): Partial<Pick<Page, PageDraftKey>> {

package/src/lib/editor/documents.ts

@@ -160,7 +160,10 @@ export const EventFields = z.object({ ...common, excerpt: text(1000), tags: z.ar
   }).partial({ lat: true, lng: true, placeId: true, showMap: true, mapImage: true, mapImageDark: true }).strict(),
   cta: z.object({ label: text(120), href: text(1000), style: z.enum(['primary', 'outline']) }).strict(),
   calendarIds: z.array(text(100)).max(50), fields: z.record(text(2000)),
-  rsvp: z.object({ enabled: z.boolean(), capacity: z.number().int().min(0).max(100000), autoConfirm: z.boolean(), maxSeats: z.number().int().min(1).max(50), form: FormDefinition.optional() }).strict(),
+  // closesAt: wall time in the event's zone ('YYYY-MM-DDTHH:mm'); closeBefore: minutes before each date;
+  // notifyStaff: the hosts get an email about each new or cancelled RSVP. Left out = kept
+  rsvp: z.object({ enabled: z.boolean(), capacity: z.number().int().min(0).max(100000), autoConfirm: z.boolean(), maxSeats: z.number().int().min(1).max(50),
+    closesAt: text(40).nullable().optional(), closeBefore: z.number().int().min(0).max(86400).optional(), notifyStaff: z.boolean().optional(), form: FormDefinition.optional() }).strict(),
 }).partial().strict();
 export const SaveInput = z.object({ revision: z.string().max(60), fields: z.record(z.unknown()) }).strict();
 

package/src/lib/editor/schemas.ts

@@ -47,7 +47,7 @@ export const EditorDocument = EditorDocumentSummary.extend({
   event: z.object({
     start: str, end: str, allDay: bool, timezone: str, rrule: str, exdates: z.array(str), cancelled: bool,
     location: z.object({ name: str, address: str, url: str, lat: num.nullable(), lng: num.nullable(), placeId: str, showMap: bool, mapImage: str, mapImageDark: str }), cta: z.object({ label: str, href: str, style: z.enum(['primary', 'outline']) }),
-    calendarIds: z.array(str), fields: z.record(str), rsvp: z.object({ enabled: bool, capacity: num, autoConfirm: bool, maxSeats: num, form: FormDefinition.optional() }),
+    calendarIds: z.array(str), fields: z.record(str), rsvp: z.object({ enabled: bool, capacity: num, autoConfirm: bool, maxSeats: num, closesAt: str.nullable(), closeBefore: num, notifyStaff: bool, form: FormDefinition.optional() }),
   }).nullable(),
   languages: z.array(str),
 });