@acms-subir/core 0.3.53 → 0.3.55

package/src/lib/calendar/host-requests.ts

@@ -0,0 +1,247 @@
+// Hosts moving single dates of the events they host (C3), on top of
+// lib/calendar/moves.ts. acms({ members: { hostMoves } }) decides how:
+// - 'direct' (default): the move applies at once while the date's rooms are
+//   free, and staff get the "Date moved" email. A taken room refuses it
+//   (409 room-taken); the host can send that same move as a request instead;
+// - 'approve': every host move, and every move back, is a request.
+// Requests are rows in event_requests (repo.requests, RequestRecord kind
+// 'move', data: MoveRequestData) that staff who can publish approve (the move
+// runs as them, recorded as the host's) or decline with a note.
+//
+// Like requests.ts, everything checks who is acting, so the built-in My
+// events page and a site's own pages share the rules. Hosts need no
+// permission beyond being in hostIds; staff ("Create and edit content") who
+// host an event always move at once.
+import type { ContentRepository } from '../repo/types';
+import type { CalEvent, RequestRecord } from '../schema';
+import { ApiError, coded } from '../api';
+import type { SaveHooks } from '../content-service';
+import { GOOGLE_SYNC, checkMove, moveOccurrence, moveOccurrenceBack, type MoveInput, type MoveResult } from './moves';
+import { eventTimeZone, findOccurrence, type Occurrence } from './events';
+import { MEMBERS } from './members-config';
+import { siteLocale } from '../dates';
+import { kickEmail } from '../email/service';
+import { waitUntilFrom } from '../webhooks';
+import type { BusySlot } from '../booking/holds';
+
+/** who is acting: currentUser() from @acms-subir/core/server fits */
+export interface HostActor { id: string; can(permission: string): boolean }
+
+/** RequestRecord.data of a 'move' request: the move to make (MoveInput), or `back` to put the date back */
+export interface MoveRequestData {
+  start: string;
+  end: string;
+  roomIds?: string[];
+  /** the public note shown with the moved date */
+  note: string;
+  /** put a moved date back where the series has it (start and end are '') */
+  back?: boolean;
+}
+
+/** What a host's move did: moved at once (`moved`), or became a request (`request`). */
+export type HostMoveResult = { moved: MoveResult; request?: undefined } | { request: RequestRecord; moved?: undefined };
+
+const DAY = 86_400_000;
+const LIMITS = { note: 1000, pending: 20 };
+const text = (v: unknown, max: number) => String(v ?? '').replace(/\r\n?/g, '\n').replace(/[\u0000-\u0009\u000b-\u001f\u007f]/g, '').trim().slice(0, max);
+
+const staff = (who: HostActor) => who.can('content.edit');
+
+async function hosted(repo: ContentRepository, who: HostActor | null, id: string): Promise<CalEvent> {
+  if (!who) throw coded(401, 'sign-in', 'Sign in to continue.');
+  const e = await repo.getEvent(id);
+  if (!e || e.status === 'archived' || (!e.hostIds.includes(who.id) && !staff(who))) throw coded(404, 'not-found', 'Event not found.');
+  return e;
+}
+
+/**
+ * A host moves one date of an event they host. With hostMoves 'direct' (or
+ * when they're staff) it applies at once and refuses a taken room (409,
+ * code room-taken); with 'approve' it's sent to staff as a request.
+ */
+export async function moveHostedDate(repo: ContentRepository, who: HostActor | null, id: string, key: string, input: MoveInput, hooks: SaveHooks): Promise<HostMoveResult> {
+  await hosted(repo, who, id);
+  if (MEMBERS.hostMoves === 'approve' && !staff(who!)) return { request: await requestDateMove(repo, who, id, key, input, '', hooks) };
+  const moved = await moveOccurrence(repo, who, id, key, input, hooks);
+  await settleWaiting(repo, who!, id, key);
+  return { moved };
+}
+
+// a move the host made at once replaces any move of that date they asked staff for
+async function settleWaiting(repo: ContentRepository, who: HostActor, eventId: string, key: string) {
+  for (const r of await repo.requests.list({ eventId, userId: who.id, kinds: ['move'], states: ['pending'], limit: -1 })) {
+    if (r.key === key) await repo.requests.update(r.id, { state: 'withdrawn', reviewedAt: Date.now() }, { state: 'pending' });
+  }
+}
+
+/** A host puts back a date they moved: at once ('direct') or as a request ('approve'). */
+export async function moveHostedDateBack(repo: ContentRepository, who: HostActor | null, id: string, key: string, hooks: SaveHooks): Promise<HostMoveResult> {
+  await hosted(repo, who, id);
+  if (MEMBERS.hostMoves === 'approve' && !staff(who!)) return { request: await requestDateMove(repo, who, id, key, null, '', hooks) };
+  const moved = await moveOccurrenceBack(repo, who, id, key, hooks);
+  await settleWaiting(repo, who!, id, key);
+  return { moved };
+}
+
+/**
+ * A host asks staff to move one date (`input`), or to put it back (null):
+ * checked like the move itself, then saved as a pending request. A taken
+ * room is fine here: staff decide. Asking again about the same date replaces
+ * the waiting request. `message` is for staff only.
+ */
+export async function requestDateMove(repo: ContentRepository, who: HostActor | null, id: string, key: string, input: MoveInput | null, message: string, hooks: SaveHooks): Promise<RequestRecord> {
+  const e = await hosted(repo, who, id);
+  if (!e.hostIds.includes(who!.id)) throw coded(404, 'not-found', 'Event not found.');
+  // as the host: the same refusals a move gets, except the taken room (a request carries no place of its own)
+  const check = await checkMove(repo, who, id, key, input ? { ...input, location: undefined } : null);
+  if (!check.changed) throw coded(400, 'unchanged', input ? 'That date is already there.' : 'That date isn’t moved.');
+  if (!await repo.email.rateLimit(`event-request:${who!.id}`, 20, 3_600_000)) throw coded(429, 'rate-limit', 'That’s a lot of requests in an hour. Try again later.', 3600);
+  // moving it to where the series has it is asking to move it back
+  const data: MoveRequestData = input && !check.back
+    ? { start: check.start!, end: check.end!, ...(input.roomIds !== undefined ? { roomIds: [...new Set(input.roomIds)] } : {}), note: check.note ?? '' }
+    : { start: '', end: '', note: '', back: true };
+  const note = text(message, LIMITS.note);
+  const waiting = (await repo.requests.list({ eventId: id, userId: who!.id, kinds: ['move'], states: ['pending'], limit: -1 })).find((r) => r.key === key);
+  let saved: RequestRecord | null;
+  if (waiting) saved = await repo.requests.update(waiting.id, { data: { ...data }, note }, { state: 'pending' });
+  else {
+    if (await repo.requests.count({ userId: who!.id, states: ['pending'] }) >= LIMITS.pending) throw coded(429, 'too-many-waiting', 'You have many requests waiting already. Wait for the team to answer them first.');
+    const now = Date.now();
+    saved = await repo.requests.create({ id: crypto.randomUUID(), kind: 'move', state: 'pending', source: 'member', userId: who!.id, requester: null,
+      eventId: id, key, data: { ...data }, note, reply: '', reviewedBy: '', reviewedAt: 0, createdAt: now, updatedAt: now });
+  }
+  if (!saved) throw coded(409, 'answered', 'That request was just answered. Look at My events again.');
+  await alertStaff(repo, saved, hooks);
+  return saved;
+}
+
+/** A host's own move requests (all states, newest first): `eventId` narrows to one event. */
+export async function myDateRequests(repo: ContentRepository, userId: string, eventId?: string): Promise<RequestRecord[]> {
+  return repo.requests.list({ userId, kinds: ['move', 'from-date'], ...(eventId ? { eventId } : {}), limit: 200 });
+}
+
+/** A host takes back a waiting request of theirs. */
+export async function withdrawDateRequest(repo: ContentRepository, who: HostActor | null, requestId: string): Promise<void> {
+  if (!who) throw coded(401, 'sign-in', 'Sign in to continue.');
+  const r = await repo.requests.get(requestId);
+  if (!r || r.userId !== who.id || (r.kind !== 'move' && r.kind !== 'from-date')) throw coded(404, 'request-not-found', 'Request not found.');
+  if (r.state !== 'pending') return;
+  await repo.requests.update(requestId, { state: 'withdrawn', reviewedAt: Date.now() }, { state: 'pending' });
+}
+
+/** A host clears an answered request from My events (it's deleted with the others later anyway). */
+export async function dismissDateRequest(repo: ContentRepository, who: HostActor | null, requestId: string): Promise<void> {
+  if (!who) throw coded(401, 'sign-in', 'Sign in to continue.');
+  const r = await repo.requests.get(requestId);
+  if (!r || r.userId !== who.id || (r.kind !== 'move' && r.kind !== 'from-date')) throw coded(404, 'request-not-found', 'Request not found.');
+  if (r.state === 'declined' || r.state === 'approved') await repo.requests.delete(requestId);
+}
+
+/** What else takes the rooms of a waiting move request at its new time (names included: staff only). */
+export async function dateRequestClashes(repo: ContentRepository, r: RequestRecord): Promise<BusySlot[]> {
+  if (r.kind !== 'move' || r.state !== 'pending') return [];
+  const d = r.data as MoveRequestData;
+  try {
+    return (await checkMove(repo, GOOGLE_SYNC, r.eventId, r.key, d.back ? null : { start: d.start, end: d.end, roomIds: d.roomIds, note: d.note })).clashes;
+  } catch { return []; }
+}
+
+// ---- answering (staff who can publish) ---------------------------------------
+
+function requireApprover(who: HostActor | null): asserts who is HostActor {
+  if (!who) throw coded(401, 'sign-in', 'Sign in to continue.');
+  if (!who.can('content.publish')) throw new ApiError(403, 'Your role doesn’t include “Publish content”, which approving requests needs.');
+}
+
+async function answerable(repo: ContentRepository, id: string, seen?: number): Promise<RequestRecord> {
+  const r = await repo.requests.get(id);
+  if (!r || (r.kind !== 'move' && r.kind !== 'from-date')) throw coded(404, 'request-not-found', 'Request not found.');
+  if (r.state !== 'pending') throw coded(409, 'answered', 'This request was already answered or withdrawn.');
+  if (seen !== undefined && r.updatedAt !== seen) throw coded(409, 'changed', 'This request changed after you opened it. Look at it again, then answer.');
+  return r;
+}
+
+/** Staff approve a host's move request: the move runs as them (room clashes warn), recorded as the host's, and the host is emailed. Pass `seen` (the request's updatedAt they reviewed). */
+export async function approveDateRequest(repo: ContentRepository, who: HostActor | null, id: string, hooks: SaveHooks, seen?: number): Promise<{ request: RequestRecord; moved: MoveResult }> {
+  requireApprover(who);
+  const r = await answerable(repo, id, seen);
+  if (r.kind !== 'move') throw coded(400, 'unavailable', 'Open the event to apply this change.');
+  const d = r.data as MoveRequestData;
+  // worded before it moves: "where it was → where it goes"
+  const when = await dateRequestWhen(repo, r);
+  const request = await claim(repo, r, who);
+  let moved: MoveResult;
+  try {
+    moved = d.back
+      ? await moveOccurrenceBack(repo, who, r.eventId, r.key, hooks)
+      : await moveOccurrence(repo, who, r.eventId, r.key, { start: d.start, end: d.end, roomIds: d.roomIds, note: d.note }, hooks, { by: r.userId });
+  } catch (err) { await release(repo, id); throw err; }
+  await tellHost(repo, request, 'move-approved', '', when, hooks);
+  return { request, moved };
+}
+
+// Approving claims the request first (only as staff saw it, and only once),
+// so two approvals at once, or a host's edit meanwhile, can't both go
+// through; a change that then fails puts it back to waiting.
+async function claim(repo: ContentRepository, r: RequestRecord, who: HostActor): Promise<RequestRecord> {
+  const claimed = await repo.requests.update(r.id, { state: 'approved', reviewedBy: who.id, reviewedAt: Date.now() }, { state: 'pending', updatedAt: r.updatedAt });
+  if (!claimed) throw coded(409, 'changed', 'This request was just answered or changed. Look at it again, then answer.');
+  return claimed;
+}
+const release = (repo: ContentRepository, id: string) => repo.requests.update(id, { state: 'pending', reviewedBy: '', reviewedAt: 0 }, { state: 'approved' });
+
+/** Staff decline a host's request, with an optional note the host reads. */
+export async function declineDateRequest(repo: ContentRepository, who: HostActor | null, id: string, reply: string, hooks: SaveHooks, seen?: number): Promise<RequestRecord> {
+  requireApprover(who);
+  const r = await answerable(repo, id, seen);
+  const answer = text(reply, LIMITS.note);
+  const request = await repo.requests.update(id, { state: 'declined', reply: answer, reviewedBy: who.id, reviewedAt: Date.now() }, { state: 'pending', updatedAt: r.updatedAt });
+  if (!request) throw coded(409, 'changed', 'This request changed after you opened it. Look at it again, then answer.');
+  await tellHost(repo, request, r.kind === 'move' ? 'move-declined' : 'from-date-declined', answer, await dateRequestWhen(repo, r), hooks);
+  return request;
+}
+
+// ---- email ------------------------------------------------------------
+
+/** Where a move request's date is now and where it would go ("Thu, Jan 10, 6:00 PM", "Wed, Jan 9, 5:00 PM"), in the site's language; '' when it isn't a date any more. */
+export async function dateRequestTimes(repo: ContentRepository, r: RequestRecord): Promise<{ from: string; to: string }> {
+  const e = await repo.getEvent(r.eventId);
+  if (!e) return { from: '', to: '' };
+  const settings = await repo.getSettings();
+  const d = r.data as MoveRequestData;
+  const tz = e.allDay ? settings.timezone || 'UTC' : eventTimeZone(e, settings);
+  const fmt = (o: Occurrence | null) => {
+    if (!o) return '';
+    try { return new Intl.DateTimeFormat(siteLocale(settings), e.allDay ? { weekday: 'short', month: 'short', day: 'numeric', timeZone: tz } : { weekday: 'short', month: 'short', day: 'numeric', hour: 'numeric', minute: '2-digit', timeZone: tz }).format(o.start); }
+    catch { return new Date(o.start).toISOString(); }
+  };
+  const to = d.back ? findOccurrence({ ...e, movedDates: {} }, r.key, settings)
+    : findOccurrence({ ...e, movedDates: { ...e.movedDates, [r.key]: { start: d.start, end: d.end, note: d.note, by: '', at: 0, ...(d.roomIds ? { roomIds: d.roomIds } : {}) } } }, r.key, settings);
+  return { from: fmt(findOccurrence(e, r.key, settings)), to: fmt(to) };
+}
+
+/** "Thu, Jan 10, 6:00 PM → Wed, Jan 9, 5:00 PM" for a move request (dateRequestTimes) */
+export async function dateRequestWhen(repo: ContentRepository, r: RequestRecord): Promise<string> {
+  const t = await dateRequestTimes(repo, r);
+  return t.from && t.to ? `${t.from} → ${t.to}` : t.from || t.to;
+}
+
+// staff: "Date move to review" (members.notify, else the owners)
+async function alertStaff(repo: ContentRepository, r: RequestRecord, hooks: SaveHooks) {
+  const to = MEMBERS.notify.length ? MEMBERS.notify : (await repo.listUsers()).filter((u) => u.role === 'owner' && u.email).map((u) => u.email);
+  await queue(repo, r, to, r.kind === 'move' ? 'staff-move-request' : 'staff-from-date-request', '', await dateRequestWhen(repo, r), hooks);
+}
+async function tellHost(repo: ContentRepository, r: RequestRecord, kind: string, reply: string, when: string, hooks: SaveHooks) {
+  const host = r.userId ? await repo.getUser(r.userId) : null;
+  if (host?.email) await queue(repo, r, [host.email], kind, reply, when, hooks);
+}
+// `when` is worded now: by the time it's sent the date may have moved
+async function queue(repo: ContentRepository, r: RequestRecord, to: string[], kind: string, reply: string, when: string, hooks: SaveHooks) {
+  if (!to.length) return;
+  const version = (await repo.email.config().catch(() => null))?.version ?? 0;
+  for (const recipient of to) {
+    await repo.email.enqueue({ dedupe: `date-request:${r.id}:${r.updatedAt}:${kind}:${recipient}`, kind: 'event-request', recipient,
+      payload: JSON.stringify({ eventId: r.eventId, requestId: r.id, kind, at: r.updatedAt, reply, when }), configVersion: version, expiresAt: Date.now() + 7 * DAY });
+  }
+  await kickEmail(repo, hooks.locals, waitUntilFrom(hooks.locals)).catch(() => {});
+}

package/src/lib/calendar/member-form.ts

@@ -1,7 +1,8 @@
-import type { CalEvent, EventRequest } from '../schema';
+import type { CalEvent, EventRequest, RequestRecord } from '../schema';
 import type { EventRequestInput } from './requests';
 import { CALENDAR, type EventFieldConfig } from './config';
 import { describeRepeat } from './rrule';
+import { memberStrings, type MemberStrings } from './member-words';
 
 // The event request form on the built-in "My events" pages, as pure
 // functions: the HTML form's fields → EventRequestInput (requests.ts checks
@@ -30,7 +31,7 @@ export interface MemberEventForm {
   note: string;
 }
 
-/** the request form's "Repeats" choices */
+/** the request form's "Repeats" choices (labels in English; repeatChoices words them in the page's language) */
 export const REPEAT_CHOICES: readonly { value: string; label: string }[] = [
   { value: '', label: 'Does not repeat' },
   { value: 'FREQ=DAILY', label: 'Every day' },
@@ -38,6 +39,7 @@ export const REPEAT_CHOICES: readonly { value: string; label: string }[] = [
   { value: 'FREQ=WEEKLY;INTERVAL=2', label: 'Every 2 weeks' },
   { value: 'FREQ=MONTHLY', label: 'Every month' },
 ];
+const CHOICE_WORD = ['none', 'daily', 'weekly', 'biweekly', 'monthly'] as const;
 
 /** the patterns requests.ts accepts from members (kept in step with its REPEAT) */
 const MEMBER_REPEAT = /^FREQ=(DAILY|WEEKLY|MONTHLY)(;INTERVAL=[1-9]\d?)?(;COUNT=[1-9]\d{0,2})?$/;
@@ -134,19 +136,23 @@ export function eventFormValues(e: FormEvent, opts: { description: string; calen
 /**
  * The "Repeats" select for a value: the standard choices, plus the event's
  * own pattern (e.g. every 3 weeks, or one only the admin can set, like weekly
- * on two days), selected, so sending the form unchanged keeps it.
+ * on two days), selected, so sending the form unchanged keeps it. `lang`
+ * words them (memberStrings; English by default).
  */
-export function repeatChoices(current: string, start: string): { options: { value: string; label: string }[]; value: string; note: string } {
+export function repeatChoices(current: string, start: string, lang?: string): { options: { value: string; label: string }[]; value: string; note: string } {
+  const w = memberStrings(lang).form;
   const rule = current.trim().replace(/^RRULE:/i, '').toUpperCase();
-  const options = [...REPEAT_CHOICES];
+  const options = REPEAT_CHOICES.map((o, i) => ({ value: o.value, label: w.repeat[CHOICE_WORD[i]] }));
   if (!rule || options.some((o) => o.value === rule)) return { options, value: rule, note: '' };
-  if (MEMBER_REPEAT.test(rule)) return { options: [...options, { value: rule, label: describeRepeat(rule, start) }], value: rule, note: '' };
+  if (MEMBER_REPEAT.test(rule)) return { options: [...options, { value: rule, label: describeRepeat(rule, start, undefined, lang) }], value: rule, note: '' };
   // set up by the team: members can keep it (requests.ts accepts an unchanged rule) or pick another
-  return { options: [...options, { value: rule, label: `${describeRepeat(rule, start)} (as set by the team)` }], value: rule, note: '' };
+  return { options: [...options, { value: rule, label: w.asSetByTeam.replace('{repeat}', describeRepeat(rule, start, undefined, lang)) }], value: rule, note: '' };
 }
 
-/** how a request reads on "My events" */
-export function requestLabel(r: Pick<EventRequest, 'kind' | 'state'>): string {
-  if (r.kind === 'changes') return r.state === 'pending' ? 'Changes waiting for approval' : 'Changes declined';
-  return r.state === 'pending' ? 'Waiting for approval' : 'Declined';
+/** how a request reads on "My events": a member's request on its event (EventRequest), or a host's date request (RequestRecord 'move' / 'from-date') */
+export function requestLabel(r: Pick<EventRequest, 'kind' | 'state'> | Pick<RequestRecord, 'kind' | 'state'>, w: MemberStrings = memberStrings('en')): string {
+  if (r.kind === 'changes') return r.state === 'pending' ? w.changesWaiting : w.changesDeclined;
+  if (r.kind === 'move') return r.state === 'pending' ? w.moveWaiting : r.state === 'approved' ? w.moveApproved : w.moveDeclined;
+  if (r.kind === 'from-date') return r.state === 'pending' ? w.fromDateWaiting : r.state === 'approved' ? w.fromDateApproved : w.fromDateDeclined;
+  return r.state === 'pending' ? w.waiting : w.declined;
 }