@acms-subir/core 0.3.47 → 0.3.49

package/CHANGELOG.md

@@ -1,5 +1,61 @@
 # @acms-subir/core
 
+## 0.3.49
+
+### Patch Changes
+
+- a25078e: Amazon SES delivery webhooks and the apps now reach the site. Astro's cross-site form check (`security.checkOrigin`, on by default) refused them on every built site with `403 Cross-site POST form submissions are forbidden`, before ACMS saw the request. It doesn't run in `astro dev`, which is why nobody noticed:
+
+  - **SES:** Amazon SNS posts to `/api/email/webhooks/ses` as `text/plain` without an Origin header. SES deliveries, bounces and complaints were never recorded, bounced addresses weren't suppressed, and the SNS subscription could never be confirmed. Resend and Mailgun send JSON and weren't affected.
+  - **Apps:** apps send no Origin either, so every app request with no body, or a form body, was refused. With the published `@acms-subir/client`, that's turning notifications off (`unregisterDevice`, so the phone stayed registered and kept getting pushes), unlinking a staff phone, cancelling or confirming a booking, and guest sign-out. Editor apps couldn't sign in, refresh or sign out, upload media, or delete a resource, booking link, time block or calendar.
+
+  ACMS now runs the check itself, first thing in its middleware, and turns Astro's copy off. Anything a page on another site can post with a visitor's cookies gets exactly Astro's answer, as before. That covers a POST whose Origin isn't the site's, or that has none, when its body is a form, `text/plain` or missing, to admin pages, Actions, public forms, member pages and the APIs. A unit test compares the two rules on every combination of method, Origin, Content-Type, headers and route that such a page can send. What goes through now:
+
+  - requests a browser only sends to another site after asking it first (PUT, PATCH and DELETE, and requests with `Authorization: Bearer …` or `Booking-Token`). ACMS's CORS answers never let cookies ride along. Basic auth doesn't count, since browsers add it to form posts on their own.
+  - `/api/email/webhooks/[provider]`, which checks the provider's signature.
+  - the editor apps' OAuth form posts to `/api/v1/auth/token` and `/api/v1/auth/revoke`, which carry their own code or token and never use cookies.
+
+  The check now also runs in `astro dev`, so local work and the e2e suites see what a built site does. A site that set `security: { checkOrigin: false }` in `astro.config` keeps it off everywhere. If a dev server behind a proxy starts refusing your own admin forms, the proxy's Host doesn't match the browser's Origin.
+
+  Sites with their own signature-checked webhooks (an SMS or payment provider that posts form data) can list those route patterns in `acms({ signedRoutes: ['/api/sms/[event]'] })`. Admin pages, Astro's own routes and ACMS's routes can't be listed.
+
+  After updating, nothing needs to change, and apps work again without an update. On a site that uses SES, check the SNS topic's subscription to `https://<site>/api/email/webhooks/ses`. If it isn't "Confirmed", choose **Request confirmation**, or create it again if SNS has removed it. The site now confirms it.
+
+## 0.3.48
+
+### Patch Changes
+
+- 9505051: Moved dates: one date of a repeating event can move to another day, time or room and stay that date, keeping its key, its sign-ups, its hosts and its page. Moving one date used to split it off into a copy.
+
+  **Where staff move a date:**
+
+  - the event editor's new **Single dates** list: the next dates, each with **Move…** (date, times, rooms for that date and a public note), **Cancel date**, and **Move back** or **Restore**. These apply at once, even on a published event, and leave unpublished edits alone;
+  - the Schedule: dragging one date of a series stores a moved date, and in the week view a drag moves by time as well as day (in 15-minute steps, whole series too). **Undo** reverses it, and a moved date's pop-up shows "Moved here from Thu, Jan 10 · 6:00 PM" with **Move back**. When another event, booking or block holds the room at the new time, the toast says so.
+
+  **What follows a moved date:**
+
+  - It comes out at its new time everywhere with its original key and `moved: { from: { start, end }, note }`. It's labelled **Moved** with the old time and the note on the event page ("Moved from Thu, Jan 10 · 6:00 PM."), on `/calendar` and event cards, and on the hosts' My events. The words are in English, Spanish, French, German and Portuguese.
+  - `?on=` finds it by its new day or the day it moved from.
+  - `calendar.ics` and the event's `.ics` get an override (`RECURRENCE-ID` of the old date with the new `DTSTART`), so calendar apps move that one date.
+  - Its RSVPs move with it. Each person with a seat gets a "This date moved" email in their own language, with the note and the button to view or cancel their spot; places in line move quietly. Reminders and "starting soon" go at the new time.
+  - Its room hold moves to the new time, and to the date's own rooms when it moved into others.
+  - The "When an event changes" push rule announces it, keeping the 10-minute merge: "Music class · Moved to Wed, Jan 9, 5:00 PM (was Thu, Jan 10, 6:00 PM)". Moving it back is announced too, and several moved dates are listed by day.
+
+  A date is moved or cancelled, never both. Cancelling a moved date cancels it at its new time and drops the move; a cancelled date must be restored before it can move. Moving the whole series keeps a moved date at its new time, under its new key.
+
+  **API:**
+
+  - `/api/v1/events`, `/api/v1/events/:slug`, `/api/v1/search` and `/api/calendar/events` occurrences carry `moved` (`null` when not moved), and `/api/calendar/events` occurrences also carry their `key`.
+  - Events carry the public `movedDates` (`{ start, end, note }` by original key). Staff callers (an `events:read` API key, the agent tools) also see the date's rooms, place and who moved it. Moves fire the `event.updated` webhook.
+  - New in `@acms-subir/core/server`:
+    - `moveOccurrence(repo, who, eventId, key, { start, end?, roomIds?, location?, note? }, ctx, { quiet? })` and `moveOccurrenceBack(...)`. Both check who is acting: staff ("Create and edit content") and the new `GOOGLE_SYNC` actor (a calendar sync acting with staff rights) may move any date, and get a room taken at the new time back as `clashes`, a warning. A host of the event may move its dates only while the rooms are free (409 otherwise), and staff (`members.notify`, else the owners) are emailed "Date moved".
+    - `quiet: true` skips the push and that staff email, for a sync catching up; the RSVP emails still go.
+    - Moving a date to where it already is returns `changed: false` and writes, sends and emails nothing, so a sync can retry safely. Cancelling an already cancelled date, or restoring one that isn't cancelled, is likewise a no-op, now even after the date has passed.
+    - Refusals carry a `code` beside the `status`: `one-off`, `not-a-date`, `started`, `past`, `original-passed`, `bad-time`, `cancelled-event`, `cancelled-date`, `room-taken`. The table is in `npx acms docs calendar`.
+  - Occurrences carry `moved`, calendar views carry `key` and `moved`, and holds follow a moved date's own rooms.
+
+  Migration 66 adds `events.moved_dates`, a column on the events row, so row-level triggers on `events` see moves. It recreates the `event_changes` triggers (from 0.3.46) with it, so a move or move-back sends `event.updated` and the change push through that queue, and a quiet move is recorded as quiet. Moves are included in backups and environment sync. `npx acms docs calendar` has a Moved dates section, and `npx acms docs server` covers the two new functions.
+
 ## 0.3.47
 
 ### Patch Changes

package/cli/migrations.generated.mjs

@@ -84,24 +84,24 @@ function trigger(name, action, table, when, event, data) {
 function content(kind) {
   const table = `${kind}s`;
   const fields = kind === "post" ? ["collection", "slug", "title", "status", "body", "body_json", "body_html", "excerpt", "tags", "cover", "cover_alt", "seo_title", "seo_desc", "featured", "author_id", "template", "published_at"] : ["slug", "title", "status", "is_home", "locale", "blocks", "body_json", "body_html", "seo_title", "seo_desc", "template"];
-  const snapshot2 = (row) => `json_object('id',${row}.id,'slug',${row}.slug,'title',${row}.title,'status',${row}.status,
+  const snapshot = (row) => `json_object('id',${row}.id,'slug',${row}.slug,'title',${row}.title,'status',${row}.status,
     ${kind === "post" ? `'collection',${row}.collection` : `'locale',${row}.locale,'isHome',json(CASE WHEN ${row}.is_home THEN 'true' ELSE 'false' END)`})`;
-  const changed2 = fields.map((f) => `OLD.${f} IS NOT NEW.${f}`).join(" OR ");
+  const changed = fields.map((f) => `OLD.${f} IS NOT NEW.${f}`).join(" OR ");
   const event = `CASE WHEN OLD.status!='published' THEN '${kind}.published'
     WHEN NEW.status!='published' THEN '${kind}.unpublished' ELSE '${kind}.updated' END`;
   return [
-    trigger(`webhook_${kind}_insert`, "INSERT", table, "NEW.status='published'", `'${kind}.published'`, `json_object('${kind}',${snapshot2("NEW")})`),
+    trigger(`webhook_${kind}_insert`, "INSERT", table, "NEW.status='published'", `'${kind}.published'`, `json_object('${kind}',${snapshot("NEW")})`),
     trigger(
       `webhook_${kind}_update`,
       "UPDATE",
       table,
-      `(OLD.status='published' OR NEW.status='published') AND (${changed2})`,
+      `(OLD.status='published' OR NEW.status='published') AND (${changed})`,
       event,
-      `json_object('${kind}',json(CASE WHEN NEW.status='published' THEN ${snapshot2("NEW")}
-        ELSE json_set(${snapshot2("OLD")},'$.status',NEW.status) END),
-        'previous',json(CASE WHEN OLD.status='published' THEN ${snapshot2("OLD")} ELSE 'null' END))`
+      `json_object('${kind}',json(CASE WHEN NEW.status='published' THEN ${snapshot("NEW")}
+        ELSE json_set(${snapshot("OLD")},'$.status',NEW.status) END),
+        'previous',json(CASE WHEN OLD.status='published' THEN ${snapshot("OLD")} ELSE 'null' END))`
     ),
-    trigger(`webhook_${kind}_delete`, "DELETE", table, "OLD.status='published'", `'${kind}.deleted'`, `json_object('${kind}',${snapshot2("OLD")})`)
+    trigger(`webhook_${kind}_delete`, "DELETE", table, "OLD.status='published'", `'${kind}.deleted'`, `json_object('${kind}',${snapshot("OLD")})`)
   ];
 }
 var media = (row) => `json_object('media',json_object('id',${row}.id,'key',${row}.key,'filename',${row}.filename,
@@ -220,7 +220,7 @@ var ROOM_HOLD_MIGRATION = { version: 41, statements: [
 
 // src/lib/calendar/change-migration.ts
 var now4 = "CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER)";
-var EVENT_CHANGE_SNAPSHOT = [
+var V65_SNAPSHOT = [
   "id",
   "slug",
   "title",
@@ -251,7 +251,7 @@ var EVENT_CHANGE_SNAPSHOT = [
   "created_at",
   "updated_at"
 ];
-var EVENT_CHANGE_COLUMNS = [
+var V65_COLUMNS = [
   "slug",
   "title",
   "body_json",
@@ -283,12 +283,25 @@ var EVENT_CHANGE_COLUMNS = [
   "start_at",
   "end_at"
 ];
-var snapshot = (row) => `json_object(${EVENT_CHANGE_SNAPSHOT.map((c) => `'${c}',${row}.${c}`).join(",")})`;
+var EVENT_CHANGE_SNAPSHOT = [...V65_SNAPSHOT, "moved_dates"];
+var EVENT_CHANGE_COLUMNS = [...V65_COLUMNS, "moved_dates"];
+var snapshotOf = (cols, row) => `json_object(${cols.map((c) => `'${c}',${row}.${c}`).join(",")})`;
 var live = "(SELECT suppressed FROM webhook_control WHERE id=1)=0";
 var quiet = "COALESCE((SELECT quiet FROM push_control WHERE id=1),0)";
 var record = (id, before, after) => `INSERT INTO event_changes (event_id,old_row,new_row,quiet,created_at)
   VALUES (${id},${before},${after},${quiet},${now4});`;
-var changed = EVENT_CHANGE_COLUMNS.map((c) => `OLD.${c} IS NOT NEW.${c}`).join(" OR ");
+function eventChangeTriggers(snapshotCols, changedCols) {
+  const changed = changedCols.map((c) => `OLD.${c} IS NOT NEW.${c}`).join(" OR ");
+  return [
+    `CREATE TRIGGER event_changes_insert AFTER INSERT ON events WHEN NEW.status='published' AND ${live}
+    BEGIN ${record("NEW.id", "NULL", snapshotOf(snapshotCols, "NEW"))} END`,
+    `CREATE TRIGGER event_changes_update AFTER UPDATE ON events
+    WHEN (OLD.status='published' OR NEW.status='published') AND (${changed}) AND ${live}
+    BEGIN ${record("NEW.id", snapshotOf(snapshotCols, "OLD"), snapshotOf(snapshotCols, "NEW"))} END`,
+    `CREATE TRIGGER event_changes_delete AFTER DELETE ON events WHEN OLD.status='published' AND ${live}
+    BEGIN ${record("OLD.id", snapshotOf(snapshotCols, "OLD"), "NULL")} END`
+  ];
+}
 var skipped = `CASE WHEN (SELECT suppressed FROM webhook_control WHERE id=1)=1 OR ${quiet}=1 THEN 'skipped' ELSE 'pending' END`;
 var ledger = `INSERT INTO push_queue (key,kind,doc_id,occurrence,status,notification_id,created_at,updated_at)
     SELECT 'event:'||NEW.id,'event',NEW.id,NULL,${skipped},NULL,${now4},${now4}
@@ -302,19 +315,22 @@ var EVENT_CHANGES_MIGRATION = { version: 65, statements: [
   `CREATE INDEX event_changes_event ON event_changes (event_id, claimed_until)`,
   `CREATE TABLE push_control (id INTEGER PRIMARY KEY CHECK(id=1), quiet INTEGER NOT NULL DEFAULT 0)`,
   `INSERT INTO push_control (id,quiet) VALUES (1,0)`,
-  `CREATE TRIGGER event_changes_insert AFTER INSERT ON events WHEN NEW.status='published' AND ${live}
-    BEGIN ${record("NEW.id", "NULL", snapshot("NEW"))} END`,
-  `CREATE TRIGGER event_changes_update AFTER UPDATE ON events
-    WHEN (OLD.status='published' OR NEW.status='published') AND (${changed}) AND ${live}
-    BEGIN ${record("NEW.id", snapshot("OLD"), snapshot("NEW"))} END`,
-  `CREATE TRIGGER event_changes_delete AFTER DELETE ON events WHEN OLD.status='published' AND ${live}
-    BEGIN ${record("OLD.id", snapshot("OLD"), "NULL")} END`,
+  ...eventChangeTriggers(V65_SNAPSHOT, V65_COLUMNS),
   `DROP TRIGGER push_event_insert`,
   `DROP TRIGGER push_event_publish`,
   `CREATE TRIGGER push_event_insert AFTER INSERT ON events WHEN NEW.status='published' BEGIN ${ledger} END`,
   `CREATE TRIGGER push_event_publish AFTER UPDATE OF status ON events
       WHEN NEW.status='published' AND OLD.status IS NOT 'published' BEGIN ${ledger} END`
 ] };
+var MOVED_DATES_MIGRATION = (contentVersionUpdate) => ({ version: 66, statements: [
+  `ALTER TABLE events ADD COLUMN moved_dates TEXT NOT NULL DEFAULT '{}'`,
+  `DROP TRIGGER content_version_events_update`,
+  contentVersionUpdate,
+  `DROP TRIGGER event_changes_insert`,
+  `DROP TRIGGER event_changes_update`,
+  `DROP TRIGGER event_changes_delete`,
+  ...eventChangeTriggers([...V65_SNAPSHOT, "moved_dates"], [...V65_COLUMNS, "moved_dates"])
+] });
 
 // src/lib/maps/migration.ts
 var PLACES_MIGRATION = { version: 43, statements: [
@@ -566,8 +582,8 @@ var CONTENT_VERSION_COLUMNS = {
 };
 var BUMP_CONTENT_VERSION = "UPDATE settings SET content_version = content_version + 1 WHERE id = 1;";
 function contentVersionTriggers(table, columns) {
-  const changed2 = columns.map((c) => `OLD.${c} IS NOT NEW.${c}`).join(" OR ");
-  const update = `CREATE TRIGGER content_version_${table}_update AFTER UPDATE OF ${columns.join(", ")} ON ${table} WHEN ${changed2} BEGIN ${BUMP_CONTENT_VERSION} END`;
+  const changed = columns.map((c) => `OLD.${c} IS NOT NEW.${c}`).join(" OR ");
+  const update = `CREATE TRIGGER content_version_${table}_update AFTER UPDATE OF ${columns.join(", ")} ON ${table} WHEN ${changed} BEGIN ${BUMP_CONTENT_VERSION} END`;
   if (table === "settings") return [update];
   return [
     `CREATE TRIGGER content_version_${table}_insert AFTER INSERT ON ${table} BEGIN ${BUMP_CONTENT_VERSION} END`,
@@ -1247,12 +1263,15 @@ var MIGRATIONS = [
   ] },
   // every change to a published event, from any write path, queued for its
   // side effects (webhooks, "event changed" pushes, slug redirects)
-  EVENT_CHANGES_MIGRATION
+  EVENT_CHANGES_MIGRATION,
+  // single dates of a series moved (CalEvent.movedDates): a column on the
+  // row, so the triggers on events (content version, event_changes) see a move
+  MOVED_DATES_MIGRATION(contentVersionTriggers("events", [...CONTENT_VERSION_COLUMNS.events, "cancelled_dates", "moved_dates"])[2])
 ];
 var CURRENT_CONTENT_VERSION_COLUMNS = {
   ...CONTENT_VERSION_COLUMNS,
   settings: [...CONTENT_VERSION_COLUMNS.settings, "links_verified", "links_avatar_shape", "links_avatar_fit", "links_avatar_scale", "legal"],
-  events: [...CONTENT_VERSION_COLUMNS.events, "cancelled_dates"],
+  events: [...CONTENT_VERSION_COLUMNS.events, "cancelled_dates", "moved_dates"],
   resources: [...CONTENT_VERSION_COLUMNS.resources, "color", "show_on_events"],
   announcements: ANNOUNCEMENT_VISIBLE_COLUMNS
 };

package/docs/calendar.md

@@ -49,6 +49,86 @@ stays listed, struck through as "Cancelled", so nobody wonders where it went:
 
 The keys are stored in `cancelledDates`. `restoreOccurrence` undoes a cancellation.
 
+## Moved dates
+
+One date of a series can move to another day, time or room and stay that same date.
+Its key, its sign-ups, its hosts and its page all stay with it. Ways to move a date:
+
+- the event editor's **Single dates** list: **Move…** (date, times, rooms and a public
+  note), next to **Cancel date**;
+- dragging one date on the Schedule. The week view moves by time as well as day.
+  **Undo** and the date's **Move back** put it back;
+- `moveOccurrence` from site code.
+
+A moved date:
+
+- comes out at its new time everywhere, keeping its original key, with `moved: {
+  from: { start, end }, note }`;
+- is labelled **Moved** with its old time and the note on the event page, `/calendar`,
+  event cards, the app API (`occurrences[].moved`) and the hosts' My events;
+- takes `?on=` with either day: its new one or the one it moved from;
+- is an override in `calendar.ics` (same UID, `RECURRENCE-ID` of the old date, the new
+  `DTSTART`/`DTEND`), so calendar apps move that one date;
+- holds its rooms at the new time: its own `roomIds` when it moved into other rooms,
+  else the event's;
+- takes its RSVPs with it. Their start moves too, and each person with a seat gets the
+  "new time" email in their own language, with the note and the button to view or
+  cancel their spot. Places in line move quietly;
+- gets reminders and "starting soon" notices at the new time;
+- is announced by the "When an event changes" rule, still merged over 10 minutes:
+  "Music class · Moved to Wed, Jan 9, 5:00 PM (was Thu, Jan 10, 6:00 PM)". Moving it
+  back is announced the same way.
+
+A date is moved or cancelled, never both. To move a cancelled date, restore it first.
+Cancelling a moved date cancels it at its new time (its RSVPs too) and drops the move.
+Moving the whole series keeps a moved date at its new time, under its new key.
+
+Moves are stored on the event row as `movedDates`, keyed by the original occurrence key:
+`{ start, end, roomIds?, location?, note, by, at }`, with `start`/`end` in wall-clock
+time like the event's own. There's no per-date title. Public JSON shows `start`, `end`
+and `note`. `by` (who moved it: a user id, or `google-sync`) and `at` are for staff.
+
+### Who can move a date
+
+`moveOccurrence(repo, who, eventId, key, { start, end?, roomIds?, location?, note? }, ctx, { quiet? })`
+and `moveOccurrenceBack(repo, who, eventId, key, ctx, { quiet? })` check who is acting:
+
+- **Staff** with "Create and edit content" may move any date. If another event, booking,
+  block or busy calendar takes the rooms at the new time, the move still happens, and
+  the result's `clashes` lists what else is there.
+- **`GOOGLE_SYNC`** is a calendar sync acting with staff rights. A clash only warns,
+  since the change already happened in Google.
+- **A host of the event** may move its dates while the rooms are free; a taken room
+  refuses the move (409). Staff (`members.notify`, else the owners) are emailed about
+  each move a host makes.
+- Anyone else gets 404, and nobody signed in gets 401.
+
+`end` defaults to the date's own length. `roomIds`, `location` and `note` replace the
+date's own when given, and omitting them keeps what it had. `quiet: true` skips the app
+notice and the staff email, for a sync catching up on changes people already know about.
+The RSVP emails still go, because those people's own sign-ups moved.
+
+Moving a date to exactly where it already is (same times, rooms, place and note), or
+moving back a date that isn't moved, changes nothing and returns `changed: false`: no
+write, webhook, push or email. A sync can retry, or re-apply what it already applied,
+safely. Cancelling a date that's already cancelled, or restoring one that isn't, is a
+no-op too, even after the date has passed.
+
+Errors carry a `status`, a message safe to show people, and a `code`:
+
+| status | code | when |
+|---|---|---|
+| 400 | `one-off` | the event doesn't repeat |
+| 400 | `not-a-date` | the key isn't one of its dates |
+| 400 | `started` | the date has started or passed |
+| 400 | `past` | the new time has passed |
+| 400 | `original-passed` | moving back to a time that has passed |
+| 400 | `bad-time` | the times aren't valid, or don't fit an all-day or timed event |
+| 409 | `cancelled-event` | the whole event is cancelled |
+| 409 | `cancelled-date` | the date is cancelled (restore it first) |
+| 409 | `room-taken` | a host moving into a taken room |
+| 401, 404 | | who is acting |
+
 ## Rooms
 
 Rooms, people and equipment are **Resources** (Admin → Calendar → Rooms; they need

package/docs/server.md

@@ -12,6 +12,7 @@ import {
   getRepo, currentUser,
   listEvents, getEvent, listOccurrences,
   cancelOccurrence, restoreOccurrence,
+  moveOccurrence, moveOccurrenceBack, GOOGLE_SYNC,
   eventRoomClashes, roomBusy,
   listMyEvents, listEventRequests, submitEventRequest, updateEventRequest,
   withdrawEventRequest, approveEventRequest, declineEventRequest, setHostedOccurrence,
@@ -33,6 +34,8 @@ getEvent(repo: Repo, id: string): Promise<CalEvent | null>
 listOccurrences(repo: Repo, w: { eventId?: string; from: Date | number; to: Date | number; tag?: string; excludeTag?: string }): Promise<Occurrence[]>
 cancelOccurrence(repo: Repo, eventId: string, occurrenceKey: string, ctx: WriteContext): Promise<CalEvent>
 restoreOccurrence(repo: Repo, eventId: string, occurrenceKey: string, ctx: WriteContext): Promise<CalEvent>
+moveOccurrence(repo: Repo, who: ServerUser | null | typeof GOOGLE_SYNC, eventId: string, occurrenceKey: string, input: MoveInput, ctx: WriteContext, opts?: { quiet?: boolean }): Promise<MoveResult>
+moveOccurrenceBack(repo: Repo, who: ServerUser | null | typeof GOOGLE_SYNC, eventId: string, occurrenceKey: string, ctx: WriteContext, opts?: { quiet?: boolean }): Promise<MoveResult>
 eventRoomClashes(repo: Repo, event: string | CalEvent, opts?: { horizonDays?: number; now?: Date | number }): Promise<EventClash[]>
 roomBusy(repo: Repo, q: { roomIds: string[]; from: Date | number; to: Date | number; ignore?: { eventId: string; key?: string } }): Promise<BusySlot[]>
 
@@ -48,7 +51,9 @@ setHostedOccurrence(repo: Repo, who: ServerUser | null, eventId: string, occurre
 
 type Role = 'owner' | 'administrator' | 'editor' | 'author' | 'contributor' | (string & {})
 interface ServerUser { id: string; email: string; name: string; role: Role; staff: boolean; can(permission: string): boolean }
-interface Occurrence { event: CalEvent; start: number; end: number; allDay: boolean; days: number; key: string; cancelled: boolean; roomIds: string[] }
+interface Occurrence { event: CalEvent; start: number; end: number; allDay: boolean; days: number; key: string; cancelled: boolean; roomIds: string[]; moved?: { from: { start: number; end: number }; note: string; location?: EventLocation } }
+interface MoveInput { start: string; end?: string; roomIds?: string[]; location?: Partial<EventLocation> | null; note?: string }
+interface MoveResult { event: CalEvent; clashes: BusySlot[]; changed: boolean }
 interface Hold { resourceId: string; eventId: string; key: string; title: string; start: number; end: number; eventStart: number; eventEnd: number }
 interface EventClash { hold: Hold; other: Hold }
 interface BusySlot { resourceId: string; start: number; end: number; kind: 'event' | 'booking' | 'block' | 'calendar'; title: string; eventId?: string; key?: string; bookingId?: string }
@@ -56,8 +61,8 @@ interface WriteContext { url: URL; locals: unknown }
 ```
 
 The types `Repo`, `Role`, `ServerUser`, `CalEvent`, `Occurrence`, `ListEventsOptions`,
-`OccurrenceWindow`, `WriteContext`, `EventRequestInput`, `Hold`, `EventClash` and
-`BusySlot` are exported too.
+`OccurrenceWindow`, `WriteContext`, `EventRequestInput`, `Hold`, `EventClash`,
+`BusySlot`, `MoveInput` and `MoveResult` are exported too.
 
 - **`getRepo(locals)`**: the site's content store for this request. Pass `Astro.locals`
   (or the endpoint/action's `locals`). `Repo` is an opaque handle; pass it to the other
@@ -128,6 +133,26 @@ another day (the admin's drag-to-move), its cancelled dates move with it. If its
 or rule is edited instead, keys that no longer match an occurrence are ignored, not an
 error.
 
+## Moved dates
+
+- **`moveOccurrence(repo, who, eventId, key, input, ctx, opts?)`**: moves one date of a
+  repeating event to `input.start`, wall-clock in the event's timezone (`end` defaults
+  to the date's own length). It applies at once, keeps the date's key, moves its RSVPs
+  (each person is emailed) and its room hold, and shows it as "Moved" with its old time
+  everywhere. It checks `who`: staff ("Create and edit content") and `GOOGLE_SYNC` may
+  move any date, and get what else takes its rooms then in `clashes`. A host of the
+  event may move it only while its rooms are free (409 otherwise), and staff are
+  emailed. `opts.quiet` skips the app notice and that staff email.
+- **`moveOccurrenceBack(...)`**: puts it back where the series has it. Idempotent.
+
+Moving a date to where it already is returns `changed: false` without writing or
+sending anything, so retries are safe. Errors carry `status` and `code` (`one-off`,
+`not-a-date`, `started`, `past`, `bad-time`, `cancelled-date`, `room-taken`…; the
+full table is in `npx acms docs calendar`).
+
+`npx acms docs calendar` has the details: what follows a moved date, how it shows,
+and the error statuses.
+
 ## Rooms
 
 Events hold rooms (`event.roomHold.resourceIds`, the Rooms box in the event editor)

package/docs/theme-authoring.md

@@ -55,7 +55,7 @@ const date = new Intl.DateTimeFormat('en', { dateStyle: 'medium', timeZone: Astr
 </section>}
 ```
 
-`calendarConfig()` returns a fresh `{ enabled, base, eventsBase }` object; `eventUrl(slug)` uses the configured event base. `upcomingEvents(Astro, options?)` resolves storage through `Astro.locals` and loads the site's timezone settings. It returns the next or ongoing occurrence of each distinct published, publicly listed native event, soonest first, including recurring and all-day events. Private/unlisted calendars and external feed entries are excluded; cancelled public events remain visible so templates can label them. `tag` keeps only events with that tag and `excludeTag` leaves them out (a tag's name in any case, or its slug), e.g. `upcomingEvents(Astro, { tag: 'Class' })` for a Classes page. Disabled calendars and a zero limit return `[]` without accessing storage. Storage errors propagate to the template.
+`calendarConfig()` returns a fresh `{ enabled, base, eventsBase }` object; `eventUrl(slug)` uses the configured event base. `upcomingEvents(Astro, options?)` resolves storage through `Astro.locals` and loads the site's timezone settings. It returns the next or ongoing occurrence of each distinct published, publicly listed native event, soonest first, including recurring and all-day events. Private/unlisted calendars and external feed entries are excluded; cancelled public events remain visible so templates can label them, and a date moved to another time carries `moved` (`{ from: { start, end }, note }`) so templates can say "Moved from …". `tag` keeps only events with that tag and `excludeTag` leaves them out (a tag's name in any case, or its slug), e.g. `upcomingEvents(Astro, { tag: 'Class' })` for a Classes page. Disabled calendars and a zero limit return `[]` without accessing storage. Storage errors propagate to the template.
 
 Options default to `{ limit: 6, horizonDays: 400 }`. The limit must be a non-negative safe integer and the horizon a positive finite number. Each `UpcomingEvent` contains `{ event, start, end, allDay, days }`, with start/end in Unix milliseconds. Format occurrence timestamps using the site's timezone rather than the authored `event.start` when displaying recurring events. `UpcomingEvent`, `UpcomingEventsOptions`, and `ThemeCalendarConfig` are exported types.
 

package/integration.mjs

@@ -465,6 +465,22 @@ function resolveAnnouncements(announcements, reserved) {
   if (announcements.pages !== undefined && typeof announcements.pages !== 'boolean') throw new Error('acms: announcements.pages must be true or false');
   return { enabled: true, base, pages: announcements.pages ?? true, topics: { ...topics } };
 }
+// acms({ signedRoutes }): the site's own routes that take posts from other
+// servers and check the sender's signature themselves, so the cross-site
+// form check skips them (lib/origin-check.ts). Route patterns as Astro writes
+// them. Admin pages, Astro's own routes (/_actions…) and core's routes can't
+// be listed (acms() checks the last against its route table).
+function resolveSignedRoutes(routes) {
+  if (routes === undefined) return [];
+  if (!Array.isArray(routes) || routes.length > 20) throw new Error('acms: signedRoutes must be a list of at most 20 route patterns, e.g. [\'/api/sms/[event]\']');
+  return routes.map((r, i) => {
+    if (!isSitePath(r) || /[?#*]/.test(r) || r.endsWith('/')) {
+      throw new Error(`acms: signedRoutes[${i}] must be a route pattern such as "/api/sms/[event]" (no query, wildcard or trailing slash) — got "${r}"`);
+    }
+    if (/^\/(admin|_)/.test(r)) throw new Error(`acms: signedRoutes[${i}] "${r}" is an admin or Astro route — those always keep the cross-site check`);
+    return r;
+  });
+}
 function resolveRoles(roles, members) {
   if (roles === undefined) return [];
   if (!Array.isArray(roles)) throw new Error('acms: roles must be an array of { key, label } objects');
@@ -691,6 +707,15 @@ function acmsVitePlugin(userConfig) {
  *   `topics` picks the push topic each kind starts with in the composer, e.g.
  *   `{ registration: 'registrations', help: 'help' }` (otherwise a topic named
  *   after the kind, such as `events` or `help`, else everyone).
+ * @param {string[]} [options.signedRoutes]
+ *   The site's own routes that receive posts from another server and check
+ *   its signature themselves (an SMS or payment provider's webhook), as route
+ *   patterns, e.g. `['/api/sms/[event]']`. ACMS refuses cross-site form posts
+ *   the way Astro's `security.checkOrigin` does (it takes that check over);
+ *   these routes skip it, since such senders send no Origin header and often
+ *   post form data or text/plain. List only routes that verify a signature.
+ *   Admin pages, Actions and ACMS's own routes can't be listed; ACMS's email
+ *   webhooks already skip it.
  * @returns {import('astro').AstroIntegration}
  */
 export default function acms(options = {}) {
@@ -713,6 +738,7 @@ export default function acms(options = {}) {
   const roles = resolveRoles(options.roles, members);
   const permissions = resolvePermissions(options.permissions, roles);
   const maps = resolveMaps(options.maps);
+  const signedRoutes = resolveSignedRoutes(options.signedRoutes);
   const legal = { enabled: true, operatorName: '', contactEmail: '', address: '', country: '', updatedAt: '', ...(options.legal === false ? { enabled: false } : options.legal ?? {}) };
   if (typeof legal.enabled !== 'boolean' || ['operatorName','contactEmail','address','country','updatedAt'].some(k => typeof legal[k] !== 'string')) throw new Error('acms: invalid legal configuration');
   legal.country = legal.country.trim().toUpperCase();
@@ -909,6 +935,9 @@ export default function acms(options = {}) {
       [`${members.base}/events/[id]`, 'members/events/[id].astro'],
     );
   }
+  // core's own routes keep the check (its signed webhooks are listed in lib/origin-check.ts)
+  const builtIn = signedRoutes.find((r) => routes.some(([pattern]) => pattern === r));
+  if (builtIn) throw new Error(`acms: signedRoutes "${builtIn}" is an ACMS route — list only the site's own routes`);
   let cacheDir = '';
   return {
     name: 'acms',
@@ -920,6 +949,14 @@ export default function acms(options = {}) {
           mkdirSync(discoveryDir, {recursive:true});
           writeFileSync(join(discoveryDir,'acms-project.json'), JSON.stringify({ themeApiVersion:1, collections:userConfig.content.collections, calendar:userConfig.calendar, mobile:userConfig.mobile ?? {}, roles:userConfig.roles, permissions:userConfig.permissions, members:userConfig.members }));
         }
+        // Astro's CSRF origin check (security.checkOrigin, on by default) runs
+        // before any middleware and no route can opt out, so signed webhooks
+        // from other servers and the apps got its 403. Core's middleware runs
+        // the same rule for what a browser can send instead (lib/origin-check.ts).
+        // A site that turned the check off in astro.config keeps it off.
+        const originCheck = config.security?.checkOrigin !== false;
+        userConfig.originCheck = { enabled: originCheck, signedRoutes };
+        if (originCheck) updateConfig({ security: { checkOrigin: false } });
         updateConfig({ vite: { plugins: [acmsVitePlugin(userConfig)] } });
 
         // Installed from npm, core's admin islands are source files inside

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acms-subir/core",
-  "version": "0.3.47",
+  "version": "0.3.49",
   "publishConfig": {
     "access": "public"
   },

package/src/actions/index.ts

@@ -30,7 +30,9 @@ import { loadFeed } from '../lib/calendar/ics';
 import { NATIVE_ALL } from '../lib/calendar/render';
 import { collectViewEvents } from '../lib/calendar/data';
 import { loadBoard } from '../lib/calendar/board';
-import { cancelOccurrence, duplicateEvent, moveOccurrence, moveSeries, quickCreate, restoreOccurrence, undoMove } from '../lib/calendar/schedule';
+import { cancelOccurrence, duplicateEvent, moveDateBy, moveSeries, quickCreate, restoreOccurrence, undoMove } from '../lib/calendar/schedule';
+import { moveOccurrence, moveOccurrenceBack, upcomingDates } from '../lib/calendar/moves';
+import type { BusySlot } from '../lib/booking/holds';
 import { waitUntilFrom } from '../lib/webhooks';
 import { siteOrigin } from '../lib/seo';
 import type { CalEvent } from '../lib/schema';
@@ -56,6 +58,21 @@ async function requireAdmin(ctx: ActionAPIContext) {
     throw new ActionError({ code: 'UNAUTHORIZED', message: 'Not signed in.' });
   }
 }
+// the person acting, for the rules that check who it is (lib/calendar/moves.ts)
+const actorOf = (access: Awaited<ReturnType<typeof requireCan>>) => ({ id: access.userId, can: (p: string) => access.can(p as Permission) });
+// "Hall is also taken then: Choir · 6:30 – 7:30 PM" ('' when it's free)
+async function clashWarning(repo: Awaited<ReturnType<typeof getRepo>>, clashes: BusySlot[]): Promise<string> {
+  if (!clashes.length) return '';
+  const [settings, resources] = await Promise.all([repo.getSettings(), repo.listResources()]);
+  const names = new Map(resources.map((r) => [r.id, r.name]));
+  const time = new Intl.DateTimeFormat(siteLocale(settings), { hour: 'numeric', minute: '2-digit', timeZone: settings.timezone || 'UTC' });
+  const what = (c: BusySlot) => c.kind === 'calendar' ? 'its busy calendar' : c.kind === 'block' ? `blocked${c.title ? ` (${c.title})` : ''}` : c.title || 'a booking';
+  const first = clashes[0];
+  const more = clashes.length > 1 ? ` and ${clashes.length - 1} more` : '';
+  let range: string;
+  try { range = time.formatRange(first.start, first.end); } catch { range = `${time.format(first.start)} – ${time.format(first.end)}`; }
+  return `${names.get(first.resourceId) ?? 'The room'} is also taken then: ${what(first)} · ${range}${more}. Both keep the room.`;
+}
 // …and that their role grants the permission (Team → Roles)
 async function requireCan(ctx: ActionAPIContext, permission: Permission) {
   const access = await accessFor(ctx.request, ctx.cookies, await getRepo(ctx.locals));
@@ -1134,28 +1151,76 @@ export const server = {
         try { const e = await quickCreate(repo, input, await publishHooks(ctx)); return { id: e.id, status: e.status }; } catch (e) { asActionError(e); }
       },
     }),
-    // Schedule: drag to another day. `occurrence` + mode 'one' moves a single
-    // repeat; otherwise the whole event moves.
+    // Schedule: drag to another day (and, in the week view, another time:
+    // `minutes` more). `occurrence` + mode 'one' moves a single date of a
+    // series (a moved date that keeps its RSVPs); otherwise the whole event
+    // moves. `warning`: what else takes its rooms at the new time.
     move: defineAction({
-      input: z.object({ id: z.string(), days: z.number().int(), mode: z.enum(['series', 'one']).default('series'), occurrence: z.string().max(20).default('') }),
-      handler: async ({ id, days, mode, occurrence }, ctx) => {
-        await requireCan(ctx, 'content.edit');
+      input: z.object({ id: z.string(), days: z.number().int(), minutes: z.number().int().min(-1440).max(1440).default(0), mode: z.enum(['series', 'one']).default('series'), occurrence: z.string().max(20).default('') }),
+      handler: async ({ id, days, minutes, mode, occurrence }, ctx) => {
+        const who = actorOf(await requireCan(ctx, 'content.edit'));
         const repo = await getRepo(ctx.locals);
         try {
-          const r = mode === 'one' ? await moveOccurrence(repo, id, occurrence, days, await publishHooks(ctx)) : await moveSeries(repo, id, days, await publishHooks(ctx));
-          return { id: r.event.id, undo: r.undo };
+          if (mode === 'one') {
+            const r = await moveDateBy(repo, who, id, occurrence, days * 1440 + minutes, await publishHooks(ctx));
+            return { id: r.event.id, undo: r.undo, warning: await clashWarning(repo, r.clashes) };
+          }
+          const r = await moveSeries(repo, id, days, await publishHooks(ctx), minutes);
+          return { id: r.event.id, undo: r.undo, warning: '' };
         } catch (e) { asActionError(e); }
       },
     }),
     undoMove: defineAction({
       input: z.union([
-        z.object({ kind: z.literal('series'), id: z.string(), days: z.number().int() }),
+        z.object({ kind: z.literal('series'), id: z.string(), days: z.number().int(), minutes: z.number().int().optional() }),
+        z.object({ kind: z.literal('date'), id: z.string(), key: z.string().max(20), previous: z.object({
+          start: z.string().max(20), end: z.string().max(20), roomIds: z.array(z.string()).max(50).optional(), note: z.string().max(500).default(''),
+          location: z.object({ name: z.string().max(300).default(''), address: z.string().max(500).default(''), url: z.string().max(2000).default('') }).partial().optional(),
+        }).nullable() }),
         z.object({ kind: z.literal('split'), id: z.string(), seriesId: z.string(), occurrence: z.string().max(20) }),
       ]),
       handler: async (undo, ctx) => {
-        await requireCan(ctx, 'content.edit');
+        const who = actorOf(await requireCan(ctx, 'content.edit'));
+        const repo = await getRepo(ctx.locals);
+        try { await undoMove(repo, who, undo as Parameters<typeof undoMove>[2], await publishHooks(ctx)); return { ok: true }; } catch (e) { asActionError(e); }
+      },
+    }),
+    // Event editor → Dates: move one date (new date, time, rooms and a public
+    // note), at once like cancelling it. `warning`: what else takes its rooms then.
+    moveDate: defineAction({
+      input: z.object({ id: z.string(), key: z.string().max(20), start: z.string().max(20), end: z.string().max(20).default(''),
+        roomIds: z.array(z.string()).max(50).optional(), note: z.string().max(500).default('') }),
+      handler: async ({ id, key, start, end, roomIds, note }, ctx) => {
+        const who = actorOf(await requireCan(ctx, 'content.edit'));
+        const repo = await getRepo(ctx.locals);
+        try {
+          const r = await moveOccurrence(repo, who, id, key, { start, end: end || undefined, roomIds, note }, await publishHooks(ctx));
+          return { id, warning: await clashWarning(repo, r.clashes) };
+        } catch (e) { asActionError(e); }
+      },
+    }),
+    // …and put a moved date back where the series has it
+    moveDateBack: defineAction({
+      input: z.object({ id: z.string(), key: z.string().max(20) }),
+      handler: async ({ id, key }, ctx) => {
+        const who = actorOf(await requireCan(ctx, 'content.edit'));
+        const repo = await getRepo(ctx.locals);
+        try {
+          const r = await moveOccurrenceBack(repo, who, id, key, await publishHooks(ctx));
+          return { id, warning: await clashWarning(repo, r.clashes) };
+        } catch (e) { asActionError(e); }
+      },
+    }),
+    // Event editor → Single dates: the next dates of a series (as saved), each
+    // moved, cancelled or as planned, and the rooms a date can move into
+    dates: defineAction({
+      input: z.object({ id: z.string(), limit: z.number().int().min(1).max(52).default(12) }),
+      handler: async ({ id, limit }, ctx) => {
+        await requireAdmin(ctx);
         const repo = await getRepo(ctx.locals);
-        try { await undoMove(repo, undo, await publishHooks(ctx)); return { ok: true }; } catch (e) { asActionError(e); }
+        const [e, settings, resources] = await Promise.all([repo.getEvent(id), repo.getSettings(), bookingsEnabled() ? repo.listResources() : Promise.resolve([])]);
+        if (!e) throw new ActionError({ code: 'NOT_FOUND', message: 'Event not found.' });
+        return { allDay: e.allDay, roomIds: e.roomHold.resourceIds, dates: upcomingDates(e, settings, limit), rooms: resources.map((r) => ({ id: r.id, name: r.name })) };
       },
     }),
     // Schedule: cancel (or restore) one date of a repeating event, at once