@acms-subir/core 0.3.54 → 0.3.55

package/src/lib/live/crypto.ts

@@ -1,28 +1,7 @@
-import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
-import { env } from '../env';
-import { ApiError } from '../api';
-function key(locals?: unknown) {
-  const runtime = (locals as { runtime?: { env?: Record<string, unknown> } } | undefined)?.runtime?.env;
-  const secret = String(runtime?.LIVE_ENCRYPTION_KEY || env('LIVE_ENCRYPTION_KEY') || runtime?.SESSION_SECRET || env('SESSION_SECRET'));
-  if (secret.length < 32) throw new ApiError(503, 'Set LIVE_ENCRYPTION_KEY or SESSION_SECRET to at least 32 random characters on your host before storing live credentials.');
-  return createHash('sha256').update(`acms:live:v1:${secret}`).digest();
-}
-export const hash = (value: string) => createHash('sha256').update(value).digest('hex');
-export const randomToken = () => randomBytes(32).toString('base64url');
-export function encryptionReady(locals?: unknown) { try { key(locals); return true; } catch { return false; } }
-export function encrypt(value: unknown, context: string, locals?: unknown) {
-  const iv = randomBytes(12), cipher = createCipheriv('aes-256-gcm', key(locals), iv);
-  cipher.setAAD(Buffer.from(`acms:live:${context}`));
-  const data = Buffer.concat([cipher.update(JSON.stringify(value), 'utf8'), cipher.final()]);
-  return [iv, cipher.getAuthTag(), data].map(v => v.toString('base64url')).join('.');
-}
-export function decrypt<T>(encrypted: string, context: string, locals?: unknown): T {
-  try {
-    const parts = encrypted.split('.');
-    if (parts.length !== 3) throw new Error();
-    const [iv, tag, data] = parts.map(v => Buffer.from(v, 'base64url'));
-    const cipher = createDecipheriv('aes-256-gcm', key(locals), iv);
-    cipher.setAAD(Buffer.from(`acms:live:${context}`)); cipher.setAuthTag(tag);
-    return JSON.parse(Buffer.concat([cipher.update(data), cipher.final()]).toString('utf8'));
-  } catch { throw new ApiError(503, 'Saved live credentials cannot be decrypted. Re-enter the credentials and reconnect.'); }
-}
+import { sealer } from '../sealed';
+// Live video credentials (lib/sealed.ts): the same key and wire format as before it was shared.
+const live = sealer('live', 'live credentials');
+export { hash, randomToken } from '../sealed';
+export const encryptionReady = (locals?: unknown) => live.ready(locals);
+export const encrypt = (value: unknown, context: string, locals?: unknown) => live.encrypt(value, context, locals);
+export const decrypt = <T>(encrypted: string, context: string, locals?: unknown): T => live.decrypt<T>(encrypted, context, locals);

package/src/lib/repo/migrations.ts

@@ -12,6 +12,7 @@ import { SYNC_MIGRATION } from '../sync/migration';
 import { ANNOUNCEMENT_TABLE, ANNOUNCEMENT_VISIBLE_COLUMNS } from '../announcements/migration';
 import { SCREENS_MIGRATION } from '../display/store';
 import { REQUEST_TABLE } from '../calendar/request-migration';
+import { GCAL_MIGRATION } from '../calendar/google/migration';
 // Versioned schema migrations shared by the two SQLite-dialect adapters
 // (D1 and libSQL). Applied versions are recorded in the `migrations` table;
 // each adapter's runner applies whatever is newer, in order, at startup.
@@ -734,6 +735,9 @@ export const MIGRATIONS: Migration[] = [
   // calendar requests on their own rows (RequestRecord): new events and
   // changes asked for without an account, and hosts' date moves
   { version: 68, statements: REQUEST_TABLE },
+  // two-way Google Calendar sync: the account, links, pairs, outgoing queue
+  // (triggers on events) and Recent changes. Not public, so no cache trigger.
+  GCAL_MIGRATION,
 ];
 
 // Current cache coverage; keep earlier migration inputs frozen for upgrade compatibility.

package/src/lib/repo/sql.ts

@@ -4,6 +4,7 @@ import { AuthStore } from '../auth/store';
 import { FormStore, formInsert, submissionInsert } from '../forms/store';
 import { GuestStore } from '../mobile/guest-store';
 import { LiveStore } from '../live/store';
+import { GcalStore } from '../calendar/google/store';
 import { PushStore } from '../push/store';
 import { AnnouncementStore, announcementInsert } from '../announcements/store';
 import { ScreenStore, screenInsert, screenKey } from '../display/store';
@@ -159,6 +160,10 @@ function parseMovedDates(raw: unknown): CalEvent['movedDates'] {
   for (const [key, entry] of Object.entries(value)) { const m = MovedDate.safeParse(entry); if (m.success) out[key] = m.data; }
   return out;
 }
+// quiet: the event change it records sends its webhook but no member push
+// (push_control.quiet shares the write's transaction)
+const quietly = (write: SqlStatement, quiet?: boolean): SqlStatement[] =>
+  quiet ? [{ sql: 'UPDATE push_control SET quiet=1 WHERE id=1' }, write, { sql: 'UPDATE push_control SET quiet=0 WHERE id=1' }] : [write];
 function rowToEvent(r: Row): CalEvent {
   return CalEvent.parse({
     id: r.id, slug: r.slug, title: r.title, bodyJson: r.body_json ?? '', bodyHtml: r.body_html ?? '',
@@ -293,6 +298,7 @@ export class SqlRepository implements ContentRepository {
   readonly forms: FormStore;
   readonly guests: GuestStore;
   readonly live: LiveStore;
+  readonly gcal: GcalStore;
   readonly push: PushStore;
   readonly announcements: AnnouncementStore;
   readonly requests: RequestStore;
@@ -307,6 +313,7 @@ export class SqlRepository implements ContentRepository {
     this.forms = new FormStore(async () => { await this.ready; return this.driver; });
     this.guests = new GuestStore(async () => { await this.ready; return this.driver; });
     this.live = new LiveStore(async () => { await this.ready; return this.driver; });
+    this.gcal = new GcalStore(async () => { await this.ready; return this.driver; });
     this.push = new PushStore(async () => { await this.ready; return this.driver; });
     this.announcements = new AnnouncementStore(async () => { await this.ready; return this.driver; });
     this.requests = new RequestStore(async () => { await this.ready; return this.driver; });
@@ -880,13 +887,14 @@ export class SqlRepository implements ContentRepository {
     await this.syncEventIndex(id);
     return (await this.getEvent(id))!;
   }
-  async updateEvent(id: string, data: EventUpdate) {
+  async updateEvent(id: string, data: EventUpdate, opts: { keepDraft?: boolean; quiet?: boolean } = {}) {
     await this.ready;
     const current = await this.getEvent(id);
     if (!current) return;
     // a direct live write supersedes any staged edits (applyEventDraft routes
-    // through here too, so applying clears the snapshot in the same UPDATE)
-    const sets: string[] = ['updated_at = ?', 'draft = NULL'];
+    // through here too, so applying clears the snapshot in the same UPDATE);
+    // keepDraft: a change made elsewhere (the Google sync) leaves them staged
+    const sets: string[] = opts.keepDraft ? ['updated_at = ?'] : ['updated_at = ?', 'draft = NULL'];
     const args: unknown[] = [Date.now()];
     const plain: Record<string, string> = {
       title: 'title', slug: 'slug', bodyJson: 'body_json', bodyHtml: 'body_html', excerpt: 'excerpt',
@@ -946,8 +954,8 @@ export class SqlRepository implements ContentRepository {
           start_at=CASE WHEN ? THEN (SELECT start_at FROM events WHERE id=?) ELSE start_at END,
           end_at=CASE WHEN ? THEN (SELECT end_at FROM events WHERE id=?) ELSE end_at END
           WHERE event_id=? AND kind='rsvp' AND status IN ('waitlisted','offered')`,args:[cancelled?1:0,id,siteTimezone,cancelled?1:0,single?1:0,id,single?1:0,id,id]},
-        ...notifications]);
-    } else await this.driver.batch([eventWrite]);
+        ...notifications].flatMap((st) => st === eventWrite ? quietly(eventWrite, opts.quiet) : [st]));
+    } else await this.driver.batch(quietly(eventWrite, opts.quiet));
     await this.syncEventIndex(id);
   }
   async saveEventDraft(id: string, data: Parameters<ContentRepository['saveEventDraft']>[1]) {
@@ -967,17 +975,16 @@ export class SqlRepository implements ContentRepository {
     await this.updateEvent(id, pickEventDraft(draft));
   }
   // per-date cancellations apply at once and never touch a staged draft
-  async setEventCancelledDates(id: string, dates: string[]) {
+  async setEventCancelledDates(id: string, dates: string[], opts: { quiet?: boolean } = {}) {
     await this.ready;
-    await this.driver.run('UPDATE events SET cancelled_dates = ?, updated_at = ? WHERE id = ?', [JSON.stringify(dates), Date.now(), id]);
+    await this.driver.batch(quietly({ sql: 'UPDATE events SET cancelled_dates = ?, updated_at = ? WHERE id = ?', args: [JSON.stringify(dates), Date.now(), id] }, opts.quiet));
   }
   async setEventMovedDates(id: string, moved: CalEvent['movedDates'], cancelledDates?: string[], opts: { quiet?: boolean } = {}) {
     await this.ready;
     const write = cancelledDates
       ? { sql: 'UPDATE events SET moved_dates = ?, cancelled_dates = ?, updated_at = ? WHERE id = ?', args: [JSON.stringify(moved), JSON.stringify(cancelledDates), Date.now(), id] }
       : { sql: 'UPDATE events SET moved_dates = ?, updated_at = ? WHERE id = ?', args: [JSON.stringify(moved), Date.now(), id] };
-    // quiet: the change it records sends its webhook but no member push (the flag shares this transaction)
-    await this.driver.batch(opts.quiet ? [{ sql: 'UPDATE push_control SET quiet=1 WHERE id=1' }, write, { sql: 'UPDATE push_control SET quiet=0 WHERE id=1' }] : [write]);
+    await this.driver.batch(quietly(write, opts.quiet));
   }
   async cancelOccurrenceRsvps(id: string, start: number) {
     await this.ready;
@@ -2008,6 +2015,8 @@ export class SqlRepository implements ContentRepository {
     if (authRecovery) stmts.push({ sql: `UPDATE auth_identities SET disabled=0 WHERE issuer=? AND subject=? AND user_id=? AND EXISTS(SELECT 1 FROM users WHERE id=? AND role='owner')`, args: [authRecovery.issuer, authRecovery.subject, authRecovery.userId, authRecovery.userId] });
     const settingsWrite = this.settingsStatement({ ...content.settings, live: { ...LiveConfig.parse(content.settings.live ?? {}), mode: 'off', manual: { watchUrl: '', title: 'We’re live', until: 0 } } });
     stmts.push({ sql: "UPDATE live_connections SET enabled=0,tested_at=0,revision=revision+1,lease='',lease_until=0,snapshot=NULL,upcoming=NULL,error='Restored content. Test this connection before enabling automatic checks.'" }, { sql: 'DELETE FROM live_oauth_states' });
+    // Google Calendar links pause until someone checks them (the restored events may be older than Google's)
+    stmts.push(...GcalStore.restoreStatements());
     if (settingsWrite) stmts.push(settingsWrite);
     stmts.push(
       { sql: 'UPDATE webhook_control SET suppressed=0 WHERE id=1' },

package/src/lib/repo/types.ts

@@ -5,6 +5,7 @@ import type { BackupStore } from '../backup/store';
 import type { GuestStore } from '../mobile/guest-store';
 import type { SavedForm, FormSubmission } from '../forms/schema';
 import type { LiveStore } from '../live/store';
+import type { GcalStore } from '../calendar/google/store';
 import type { BookingRequest } from '../backup/content';
 import type { EmailStore } from '../email/store';
 import type { RsvpStaffNotice } from '../email/types';
@@ -81,6 +82,8 @@ export interface ContentRepository {
   readonly backups: BackupStore;
   readonly guests: GuestStore;
   readonly live: LiveStore;
+  /** two-way Google Calendar sync (lib/calendar/google/) */
+  readonly gcal: GcalStore;
   readonly push: PushStore;
   readonly announcements: AnnouncementStore;
   // calendar requests on their own rows (lib/calendar/request-store.ts)
@@ -163,7 +166,8 @@ export interface ContentRepository {
   getEvent(id: string): Promise<CalEvent | null>;
   getEventBySlug(slug: string): Promise<CalEvent | null>;
   createEvent(data: Partial<Omit<CalEvent, 'id' | 'draft' | 'startAt' | 'endAt' | 'createdAt' | 'updatedAt'>> & { title: string; slug: string; start: string }): Promise<CalEvent>;
-  updateEvent(id: string, data: EventUpdate): Promise<void>;
+  /** keepDraft: leave staged edits staged (a change made elsewhere); quiet: no member push for it */
+  updateEvent(id: string, data: EventUpdate, opts?: { keepDraft?: boolean; quiet?: boolean }): Promise<void>;
   saveEventDraft(id: string, data: Omit<EventUpdate, 'status' | 'scheduledAt' | 'publishedAt'>): Promise<void>;
   /** the Team members who host an event (lib/calendar/requests.ts) */
   setEventHosts(id: string, hostIds: string[]): Promise<void>;
@@ -172,7 +176,7 @@ export interface ContentRepository {
   applyEventDraft(id: string): Promise<void>;
   discardEventDraft(id: string): Promise<void>;
   /** replace an event's cancelled occurrence keys at once, keeping any staged draft */
-  setEventCancelledDates(id: string, dates: string[]): Promise<void>;
+  setEventCancelledDates(id: string, dates: string[], opts?: { quiet?: boolean }): Promise<void>;
   /** replace an event's moved dates (and cancelled dates, when given) at once, keeping any staged draft; quiet: no member push for it */
   setEventMovedDates(id: string, moved: CalEvent['movedDates'], cancelledDates?: string[], opts?: { quiet?: boolean }): Promise<void>;
   /** Cancels the RSVPs for one date of an event (they get the "cancelled" email). Returns how many. */

package/src/lib/scheduler.ts

@@ -10,6 +10,7 @@ import { GUEST_IDLE_MS } from './mobile/guest-store';
 import { pushHeartbeat, pushUrlFor } from './monitoring';
 import { syncCachePurge } from './cache/purge';
 import { runOffsiteBackup } from './backup/offsite';
+import { syncGoogle } from './calendar/google/service';
 
 // All work is awaited on both hosts. Traffic-triggered fallbacks do not mark
 // this heartbeat: monitoring must prove the independent scheduler ran.
@@ -20,6 +21,8 @@ export async function runScheduledTasks(repo: ContentRepository, locals?: unknow
     publish: () => repo.publishDuePosts(startedAt),
     // changes to published events (scheduled publishing above included): webhooks, change pushes, redirects
     events: () => flushEventChanges(repo),
+    // two-way Google Calendar sync: site changes go out every run, each link reads Google every 2 minutes
+    gcal: () => syncGoogle(repo, locals, { now: startedAt }),
     webhooks: () => processDueDeliveries(repo),
     reminders: () => sendDueReminders(repo, { origin: settings.siteUrl, locals, now: startedAt }),
     // pending bookings past their approval deadline (Calendar settings → Bookings)

package/src/lib/sealed.ts

@@ -0,0 +1,46 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
+import { env } from './env';
+import { ApiError } from './api';
+
+// Credentials for connected services (YouTube/Twitch live video, Google
+// Calendar) are sealed with AES-256-GCM under a key derived from
+// LIVE_ENCRYPTION_KEY, else SESSION_SECRET. Each service has its own domain:
+// a different derived key and associated data, so one service's ciphertext
+// never opens as another's. `context` narrows it further (a provider, a
+// pending OAuth state).
+export interface Sealer {
+  ready(locals?: unknown): boolean;
+  encrypt(value: unknown, context: string, locals?: unknown): string;
+  decrypt<T>(encrypted: string, context: string, locals?: unknown): T;
+}
+
+/** `what` names the credentials in the errors people see ("live credentials"). */
+export function sealer(domain: string, what: string): Sealer {
+  function key(locals?: unknown) {
+    const runtime = (locals as { runtime?: { env?: Record<string, unknown> } } | undefined)?.runtime?.env;
+    const secret = String(runtime?.LIVE_ENCRYPTION_KEY || env('LIVE_ENCRYPTION_KEY') || runtime?.SESSION_SECRET || env('SESSION_SECRET'));
+    if (secret.length < 32) throw new ApiError(503, `Set LIVE_ENCRYPTION_KEY or SESSION_SECRET to at least 32 random characters on your host before storing ${what}.`);
+    return createHash('sha256').update(`acms:${domain}:v1:${secret}`).digest();
+  }
+  return {
+    ready(locals) { try { key(locals); return true; } catch { return false; } },
+    encrypt(value, context, locals) {
+      const iv = randomBytes(12), cipher = createCipheriv('aes-256-gcm', key(locals), iv);
+      cipher.setAAD(Buffer.from(`acms:${domain}:${context}`));
+      const data = Buffer.concat([cipher.update(JSON.stringify(value), 'utf8'), cipher.final()]);
+      return [iv, cipher.getAuthTag(), data].map(v => v.toString('base64url')).join('.');
+    },
+    decrypt<T>(encrypted: string, context: string, locals?: unknown): T {
+      try {
+        const parts = encrypted.split('.');
+        if (parts.length !== 3) throw new Error();
+        const [iv, tag, data] = parts.map(v => Buffer.from(v, 'base64url'));
+        const cipher = createDecipheriv('aes-256-gcm', key(locals), iv);
+        cipher.setAAD(Buffer.from(`acms:${domain}:${context}`)); cipher.setAuthTag(tag);
+        return JSON.parse(Buffer.concat([cipher.update(data), cipher.final()]).toString('utf8'));
+      } catch { throw new ApiError(503, `Saved ${what} cannot be decrypted. Re-enter the credentials and reconnect.`); }
+    },
+  };
+}
+export const hash = (value: string) => createHash('sha256').update(value).digest('hex');
+export const randomToken = () => randomBytes(32).toString('base64url');

package/src/pages/admin/calendar/events/[id].astro

@@ -14,6 +14,8 @@ import { accessFor, forbiddenUnless } from '../../../../lib/permissions/access';
 import type { Permission } from '../../../../lib/permissions/catalog';
 import { ApiError } from '../../../../lib/api';
 import { roleLabel } from '../../../../lib/roles';
+import { eventClashes } from '../../../../lib/booking/holds';
+import { fieldWord } from '../../../../lib/calendar/google/map';
 import ThemeScript from '../../../../components/ThemeScript.astro';
 import ClerkSession from '../../../../components/auth/ClerkSession.astro';
 import Modal from '../../../../components/Modal.astro';
@@ -92,7 +94,20 @@ const hosts = event.hostIds.map((id) => ({ id, name: nameOf(id) })).filter((h) =
 const people = [...users].sort((a, b) => (a.name || a.email).localeCompare(b.name || b.email));
 const notice = Astro.url.searchParams.get('notice') ?? '';
 const error = Astro.url.searchParams.get('error') ?? '';
-const showBar = Boolean(req) || canEdit || hosts.length > 0 || Boolean(notice || error);
+// Synced with Google (lib/calendar/google/): which Google calendars have a copy, the latest
+// field both sides changed (the site kept its value; "Use Google's version" takes Google's),
+// whether the description still comes from Google (Q8), and room clashes a change from Google made
+const gItems = (await repo.gcal.itemsForEvent(event.id)).filter((i) => i.kind !== 'segment' && !i.gone);
+const gLinks = gItems.length ? new Map((await repo.gcal.listLinks()).map((l) => [l.id, l])) : new Map();
+const synced = gItems.map((i) => ({ ...i, googleName: gLinks.get(i.linkId)?.googleName ?? 'Google' }));
+const gConflict = synced.map((i) => i.conflict).filter((c): c is NonNullable<typeof c> => !!c).sort((a, b) => b.at - a.at)[0] ?? null;
+const gDescFromGoogle = synced.some((i) => i.descGoogle);
+const gTz = settings.timezone || 'UTC';
+const gTime = (ts: number) => new Intl.DateTimeFormat(settings.locale || 'en', { month: 'short', day: 'numeric', hour: 'numeric', minute: '2-digit', timeZone: gTz }).format(ts);
+const gClashes = synced.length && event.status === 'published' && !event.cancelled && event.roomHold.resourceIds.length
+  ? (await eventClashes(repo, settings, event, { horizonDays: 120 }).catch(() => ({ clashes: [] }))).clashes : [];
+const gRooms = gClashes.length ? new Map((await repo.listResources()).map((r) => [r.id, r.name])) : new Map<string, string>();
+const showBar = Boolean(req) || canEdit || hosts.length > 0 || Boolean(notice || error) || synced.length > 0;
 const ago = (ts: number) => {
   const s = Math.max(0, Math.floor((Date.now() - ts) / 1000));
   if (s < 60) return 'just now';
@@ -162,6 +177,27 @@ const approveLabel = pending?.kind === 'changes' ? 'Approve changes' : isLive ?
             {declined.kind === 'new' && !isLive && ` It stays a draft until ${requester} sends it again.`}
           </p>
         )}
+        {synced.length > 0 && (
+          <div class="evreq-gcal">
+            <p class="evreq-line">
+              <span class="evreq-label">Synced with Google</span>
+              {synced.map((i) => <span class="evreq-chip">{i.googleName}{i.syncedAt ? ` · ${gTime(i.syncedAt)}` : ''}{i.htmlLink && <> · <a href={i.htmlLink} target="_blank" rel="noopener">Open in Google ↗</a></>}</span>)}
+            </p>
+            {gConflict && (
+              <div class="evreq-gcal-clash">
+                <span>Changed in both places at {gTime(gConflict.at)}. The site kept its {fieldWord(gConflict.field).toLowerCase()}, “{gConflict.site}”. Google had “{gConflict.google}”.</span>
+                {(canPublish || access?.can('schedule.manage')) && (
+                  <form method="post" action="/admin/calendar/google" data-evreq>
+                    <input type="hidden" name="op" value="use" /><input type="hidden" name="log" value={gConflict.logId} /><input type="hidden" name="return" value={self} />
+                    <button class="btn sm" type="submit">Use Google’s version</button>
+                  </form>
+                )}
+              </div>
+            )}
+            {gDescFromGoogle && <p class="evreq-muted">Created in Google. Its description comes from Google until someone edits it here.</p>}
+            {gClashes.length > 0 && <p class="evreq-gcal-room">Room clash: {gRooms.get(gClashes[0].hold.resourceId) ?? 'a room'} is also held by “{gClashes[0].other.title}” on {gTime(gClashes[0].hold.eventStart)}{gClashes.length > 1 ? ` (and ${gClashes.length - 1} more)` : ''}. Changes from Google keep their rooms: check Bookings.</p>}
+          </div>
+        )}
         <div class="evreq-hosts">
           <span class="evreq-label">Hosts</span>
           {hosts.length ? hosts.map((h) => <span class="evreq-chip">{h.name}</span>) : <span class="evreq-muted">None</span>}
@@ -306,6 +342,11 @@ const approveLabel = pending?.kind === 'changes' ? 'Approve changes' : isLive ?
   .evreq-hosts { display: flex; flex-wrap: wrap; align-items: center; gap: 6px; margin-left: auto; }
   .evreq-label { font-size: 11px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.07em; color: var(--muted); margin-right: 2px; }
   .evreq-chip { font-size: 12px; font-weight: 500; color: var(--text-2); background: var(--panel); border: 1px solid var(--line); border-radius: var(--r-full); padding: 1px 9px; white-space: nowrap; }
+  .evreq-gcal { flex: 1 1 480px; min-width: 0; display: flex; flex-direction: column; gap: 4px; }
+  .evreq-gcal .evreq-chip a { color: var(--accent-deep); }
+  .evreq-gcal-clash { display: flex; flex-wrap: wrap; align-items: center; gap: 6px 12px; color: var(--text); }
+  .evreq-gcal-clash form { margin: 0; }
+  .evreq-gcal-room { color: var(--red); }
   .evreq-modal-hint { margin: 0 0 12px; }
   .evreq-find { width: 100%; margin-bottom: 10px; }
   .evreq-people { max-height: min(320px, 50vh); overflow-y: auto; margin: 0 -4px; padding: 2px 4px; }

package/src/pages/admin/calendar/google/match.astro

@@ -0,0 +1,160 @@
+---
+import Admin from '../../../../layouts/Admin.astro';
+import { getRepo } from '../../../../lib/repo';
+import { ApiError } from '../../../../lib/api';
+import { CALENDAR } from '../../../../lib/calendar/config';
+import { forbiddenUnless } from '../../../../lib/permissions/access';
+import { reviewMatch } from '../../../../lib/calendar/google/service';
+import type { CalEvent } from '../../../../lib/schema';
+import type { MatchGoogle, MatchPair } from '../../../../lib/calendar/google/types';
+
+// Step 2 of linking a Google calendar: what's on both sides, before anything
+// is written. Decisions save at once ("Save and finish later" just leaves);
+// "Start syncing" pairs, copies the rest each way and sends no notifications.
+if (!CALENDAR.enabled) return new Response(null, { status: 404, statusText: 'Not found' });
+const repo = await getRepo(Astro.locals);
+const denied = await forbiddenUnless(Astro.request, Astro.cookies, repo, 'schedule.manage');
+if (denied) return denied;
+const linkId = Astro.url.searchParams.get('link') ?? '';
+let link = await repo.gcal.getLink(linkId);
+if (!link) return Astro.redirect('/admin/calendar/settings#google');
+if (link.state !== 'matching') return Astro.redirect(`/admin/calendar/settings?notice=${encodeURIComponent('That link is already past its first match.')}#google`);
+let error = Astro.url.searchParams.get('error') ?? '';
+if (!link.match && !error) {
+  try { await reviewMatch(repo, link.id, Astro.locals); link = (await repo.gcal.getLink(link.id))!; }
+  catch (e) { error = e instanceof ApiError ? e.message : 'Couldn’t read the Google calendar. Try again.'; }
+}
+const [settings, calendar, events] = await Promise.all([repo.getSettings(), repo.getCalendar(link.calendarId), repo.listEvents()]);
+const byId = new Map(events.map((e) => [e.id, e]));
+const m = link.match;
+const tz = settings.timezone || 'UTC';
+const fmt = (ms: number, allDay: boolean) => new Intl.DateTimeFormat(settings.locale || 'en', allDay ? { weekday: 'short', month: 'short', day: 'numeric', timeZone: tz } : { weekday: 'short', month: 'short', day: 'numeric', hour: 'numeric', minute: '2-digit', timeZone: tz }).format(ms);
+const siteWhen = (e: CalEvent) => `${fmt(e.startAt, e.allDay)}${e.rrule ? ', repeats' : ''}`;
+const googleWhen = (g: MatchGoogle) => `${fmt(g.start, g.allDay)}${g.repeats ? ', repeats' : ''}`;
+const pairs = (m?.pairs ?? []).filter((p) => byId.has(p.eventId) && m?.google[p.googleId]);
+const waiting = pairs.filter((p) => p.state === 'suggested').length;
+const apart = pairs.filter((p) => p.state === 'apart');
+const toGoogle = (m?.siteOnly.length ?? 0) + apart.length;
+const fromGoogle = (m?.googleOnly.length ?? 0) + apart.length;
+const STATE: Record<MatchPair['state'], string> = { linked: 'Linked', suggested: 'Same?', apart: 'Not the same' };
+const WHY: Record<MatchPair['reason'], string> = {
+  'hidden-id': 'Linked before (Google’s copy carries the site’s hidden link)', uid: 'Same Google ID (copied from Google earlier)',
+  'title-time': 'Same title and time', 'time-repeat': 'Same time and repeat, different title',
+};
+const out = link.direction !== 'in', inn = link.direction !== 'out';
+---
+
+<Admin title="Match events" section="calendar:schedule">
+  <div class="page-head">
+    <div>
+      <p class="sub"><a href="/admin/calendar/settings#google">Calendar settings</a> › Synced with Google</p>
+      <h1>Match events: {calendar?.name ?? 'Calendar'} {link.direction === 'both' ? '⇄' : link.direction === 'out' ? '→' : '←'} {link.googleName}</h1>
+      <p class="sub">Step 2 of 2. Nothing has been written to either side yet.</p>
+    </div>
+    <form method="post" action="/admin/calendar/google"><input type="hidden" name="op" value="match-build" /><input type="hidden" name="link" value={link.id} /><button class="btn" type="submit">Read both sides again</button></form>
+  </div>
+  {error && <p class="notice warn" role="alert">{error}</p>}
+  {m && (
+    <>
+      <nav class="gm-tabs" aria-label="Groups">
+        <a href="#both">On both · {pairs.length}</a>
+        <a href="#site">Only on the site · {m.siteOnly.length}</a>
+        <a href="#google">Only in Google · {m.googleOnly.length}</a>
+      </nav>
+
+      <section class="card gm-sect" id="both">
+        <table class="gm-table">
+          <thead><tr><th>On the site</th><th>In Google</th><th>Why they match</th><th><span class="gm-sr">Decision</span></th></tr></thead>
+          <tbody>
+            {pairs.length === 0 && <tr><td colspan="4" class="hint">No events look like they’re on both sides.</td></tr>}
+            {pairs.map((p) => { const e = byId.get(p.eventId)!; const g = m.google[p.googleId]; return (
+              <tr id={p.googleId} class={`is-${p.state}`}>
+                <td><b>{e.title}</b><small>{siteWhen(e)}</small></td>
+                <td><b>{g.title || '(no title)'}</b><small>{googleWhen(g)}</small></td>
+                <td><small>{WHY[p.reason]}</small></td>
+                <td>
+                  <form method="post" action="/admin/calendar/google" class="gm-acts">
+                    <input type="hidden" name="op" value="match-decide" /><input type="hidden" name="link" value={link.id} /><input type="hidden" name="googleId" value={p.googleId} />
+                    {p.state === 'suggested' ? (<>
+                      <button class="btn sm primary" type="submit" name="decision" value="link">Link</button>
+                      <button class="btn sm ghost" type="submit" name="decision" value="apart">Not the same</button>
+                    </>) : (<>
+                      <span class={`gm-state is-${p.state}`}>{STATE[p.state]}</span>
+                      <button class="btn sm ghost" type="submit" name="decision" value={p.state === 'linked' ? 'apart' : 'link'}>{p.state === 'linked' ? 'Undo' : 'Link'}</button>
+                    </>)}
+                  </form>
+                </td>
+              </tr>
+            ); })}
+          </tbody>
+        </table>
+      </section>
+
+      <section class="card gm-sect" id="site">
+        <h2>Only on the site · {m.siteOnly.length}</h2>
+        {m.siteOnly.length === 0 ? <p class="hint">None.</p> : (
+          <ul class="gm-list">{m.siteOnly.map((id) => byId.get(id)).filter(Boolean).slice(0, 200).map((e) => <li><b>{e!.title}</b> <small>{siteWhen(e!)}</small></li>)}</ul>
+        )}
+      </section>
+
+      <section class="card gm-sect" id="google">
+        <h2>Only in Google · {m.googleOnly.length}</h2>
+        {m.googleOnly.length === 0 ? <p class="hint">None.</p> : (
+          <ul class="gm-list">{m.googleOnly.map((id) => m.google[id]).filter(Boolean).slice(0, 200).map((g) => <li><b>{g.booking ? 'Booked' : g.title || '(no title)'}</b> <small>{googleWhen(g)}{g.booking ? ' · a booked appointment' : ''}</small></li>)}</ul>
+        )}
+      </section>
+
+      <div class="card gm-foot">
+        <p>
+          When you start:
+          {out ? ` the ${toGoogle} event${toGoogle === 1 ? '' : 's'} only on the site ${toGoogle === 1 ? 'is' : 'are'} copied to Google.` : ' events only on the site stay on the site.'}
+          {inn ? ` The ${fromGoogle} only in Google come to the site as published events in ${calendar?.name ?? 'this calendar'}${link.roomIds.length ? ', holding its room' : ''}${link.rules.length ? `, and titles starting with ${link.rules.map((r) => `“${r.prefix}”`).join(' or ')} get their tag` : ''}.` : ' Events only in Google stay in Google.'}
+          {' '}Linked pairs keep both titles as they are until someone edits one. Pairs you mark “Not the same” are treated as two events. No member notifications are sent for any of this.
+        </p>
+        <div class="gm-buttons">
+          <a class="btn ghost" href="/admin/calendar/settings#google">Back</a>
+          <a class="btn" href="/admin/calendar/settings#google" title="Your decisions are saved as you make them">Save and finish later</a>
+          <form method="post" action="/admin/calendar/google">
+            <input type="hidden" name="op" value="match-start" /><input type="hidden" name="link" value={link.id} />
+            <button class="btn primary" type="submit" disabled={waiting > 0} title={waiting ? `Decide the ${waiting} suggested pair${waiting === 1 ? '' : 's'} first` : undefined}>Start syncing</button>
+          </form>
+        </div>
+        {waiting > 0 && <p class="hint">Decide the {waiting} suggested pair{waiting === 1 ? '' : 's'} first: Link, or Not the same.</p>}
+      </div>
+    </>
+  )}
+</Admin>
+
+<style>
+  .gm-tabs { display: flex; gap: 6px; flex-wrap: wrap; margin-bottom: 12px; font-size: 13px; }
+  .gm-tabs a { padding: 6px 12px; border: 1px solid var(--line); border-radius: 999px; color: var(--text-2); background: var(--panel); }
+  .gm-sect { margin-bottom: 14px; padding: 0; overflow: hidden; scroll-margin-top: 64px; }
+  .gm-sect h2 { font-size: 14px; margin: 0; padding: 12px 16px; border-bottom: 1px solid var(--line); }
+  .gm-sect .hint { padding: 12px 16px; margin: 0; }
+  .gm-table { width: 100%; border-collapse: collapse; font-size: 13px; }
+  .gm-table th { text-align: left; font-weight: 600; color: var(--muted); padding: 8px 16px; border-bottom: 1px solid var(--line); font-size: 12px; }
+  .gm-table td { padding: 10px 16px; border-bottom: 1px solid var(--line); vertical-align: top; }
+  .gm-table tr:last-child td { border-bottom: 0; }
+  .gm-table td b { display: block; font-weight: 600; }
+  .gm-table td small { color: var(--muted); font-size: 12px; }
+  .gm-table tr.is-apart td:not(:last-child) { opacity: 0.6; }
+  .gm-acts { display: flex; gap: 6px; align-items: center; justify-content: flex-end; flex-wrap: wrap; }
+  .gm-state { font-size: 12px; font-weight: 600; color: var(--text-2); }
+  .gm-state.is-linked { color: var(--green); }
+  .gm-list { list-style: none; margin: 0; padding: 0; }
+  .gm-list li { padding: 8px 16px; border-bottom: 1px solid var(--line); font-size: 13px; }
+  .gm-list li:last-child { border-bottom: 0; }
+  .gm-list small { color: var(--muted); }
+  .gm-foot { padding: 14px 16px; display: flex; flex-direction: column; gap: 10px; font-size: 13px; color: var(--text-2); }
+  .gm-foot p { margin: 0; }
+  .gm-buttons { display: flex; gap: 8px; justify-content: flex-end; flex-wrap: wrap; }
+  .gm-buttons .btn:disabled { opacity: 0.45; cursor: not-allowed; }
+  .gm-sr { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); }
+  @media (max-width: 760px) {
+    .gm-table thead { display: none; }
+    .gm-table tr { display: grid; grid-template-columns: 1fr 1fr; border-bottom: 1px solid var(--line); }
+    .gm-table td { border: 0; }
+    .gm-table td:nth-child(3), .gm-table td:nth-child(4) { grid-column: span 2; padding-top: 0; }
+    .gm-acts { justify-content: flex-start; }
+  }
+</style>

package/src/pages/admin/calendar/google.astro

@@ -0,0 +1,107 @@
+---
+import { getRepo } from '../../../lib/repo';
+import { ApiError } from '../../../lib/api';
+import { CALENDAR } from '../../../lib/calendar/config';
+import { accessFor } from '../../../lib/permissions/access';
+import { deniedMessage, type Permission } from '../../../lib/permissions/catalog';
+import { requestSessionBinding } from '../../../lib/auth/request';
+import { beginGoogleConnect, disconnectGoogle, finishGoogleConnect, refreshGoogleCalendars, saveGoogleClient } from '../../../lib/calendar/google/connect';
+import { createLink, pauseLink, resumeLink, unlink, updateLink } from '../../../lib/calendar/google/links';
+import { decideMatch } from '../../../lib/calendar/google/match';
+import { reviewMatch, syncLinkNow, useGoogleVersion } from '../../../lib/calendar/google/service';
+
+// The forms of Calendar settings → Synced with Google, the first-match page
+// and the event editor's sync note post here, then go back with a notice.
+// Connecting and disconnecting Google need "Connected services"; linking,
+// pausing and reviewing need "Manage rooms and calendars"; using Google's
+// version of a field changes the live event, so "Publish content" does too.
+if (!CALENDAR.enabled) return new Response(null, { status: 404, statusText: 'Not found' });
+if (Astro.request.method !== 'POST') return Astro.redirect('/admin/calendar/settings#google');
+
+const repo = await getRepo(Astro.locals);
+const access = await accessFor(Astro.request, Astro.cookies, repo);
+const form = await Astro.request.formData();
+const op = String(form.get('op') ?? '');
+const linkId = String(form.get('link') ?? '');
+const NEEDS: Record<string, Permission> = { client: 'services.manage', connect: 'services.manage', finish: 'services.manage', disconnect: 'services.manage' };
+const need = NEEDS[op] ?? (op === 'use' ? (access?.can('content.publish') ? 'content.publish' : 'schedule.manage') : 'schedule.manage');
+if (!access?.can(need)) return new Response(deniedMessage(need), { status: 403, headers: { 'Content-Type': 'text/plain; charset=utf-8', 'Cache-Control': 'no-store' } });
+
+// only back to the admin (an event page or the match page)
+const ret = String(form.get('return') ?? '');
+const home = ret.startsWith('/admin/') && !ret.startsWith('//') ? ret : '/admin/calendar/settings';
+const back = (key: 'notice' | 'error', text: string, hash = home === '/admin/calendar/settings' ? '#google' : '') => {
+  const [path, query = ''] = home.split('?');
+  const params = new URLSearchParams(query);
+  params.set(key, text);
+  return Astro.redirect(`${path}?${params}${hash}`);
+};
+const list = (name: string) => form.getAll(name).map(String).filter(Boolean);
+// rules come as rows of prefix + tag fields; booking titles one per line
+const linkFields = () => ({
+  direction: String(form.get('direction') || 'both'),
+  roomIds: list('roomIds'),
+  noRoom: form.has('noRoom'),
+  rules: form.getAll('rulePrefix').map((p, i) => ({ prefix: String(p).trim(), tag: String(form.getAll('ruleTag')[i] ?? '').trim() })).filter((r) => r.prefix && r.tag),
+  bookingTitles: String(form.get('bookingTitles') ?? '').split(/\n|,/).map((t) => t.trim()).filter(Boolean),
+});
+
+try {
+  switch (op) {
+    case 'client':
+      await saveGoogleClient(repo, { clientId: String(form.get('clientId') ?? ''), clientSecret: String(form.get('clientSecret') ?? '') }, Astro.locals);
+      return back('notice', 'Saved. Next, connect Google.');
+    case 'connect':
+      return Astro.redirect(await beginGoogleConnect(repo, await requestSessionBinding(Astro.request, Astro.cookies, Astro.locals), Astro.url, Astro.locals));
+    case 'finish': {
+      const account = await finishGoogleConnect(repo, await requestSessionBinding(Astro.request, Astro.cookies, Astro.locals), Astro.url, access.userId, Astro.locals);
+      return back('notice', `Connected ${account.email || 'Google'}. Link a calendar next.`);
+    }
+    case 'disconnect':
+      await disconnectGoogle(repo, Astro.locals);
+      return back('notice', 'Google is disconnected. Links are paused, and every event stays in both places.');
+    case 'refresh':
+      await refreshGoogleCalendars(repo, Astro.locals);
+      return back('notice', 'Google calendars listed again.');
+    case 'link-new': {
+      const link = await createLink(repo, { ...linkFields(), calendarId: String(form.get('calendarId') ?? ''), googleId: String(form.get('googleId') ?? ''), startDate: String(form.get('startDate') || '') || undefined });
+      return Astro.redirect(`/admin/calendar/google/match?link=${encodeURIComponent(link.id)}`);
+    }
+    case 'link-edit':
+      await updateLink(repo, linkId, linkFields());
+      return back('notice', 'Link saved. Events that now belong to it go out at the next sync, and ones that don’t are removed from Google.');
+    case 'pause':
+      await pauseLink(repo, linkId);
+      return back('notice', 'Paused. Changes on either side wait until you resume.');
+    case 'resume': {
+      const link = await resumeLink(repo, linkId);
+      if (link.state === 'matching') return Astro.redirect(`/admin/calendar/google/match?link=${encodeURIComponent(link.id)}`);
+      return back('notice', 'Resumed. It reads Google again from the start date, quietly, and catches up.');
+    }
+    case 'unlink':
+      await unlink(repo, linkId);
+      return back('notice', 'Unlinked. Every event stays in both places; linking again pairs them up.');
+    case 'sync':
+      await syncLinkNow(repo, linkId, Astro.locals);
+      return back('notice', 'Synced.');
+    case 'match-build':
+      await reviewMatch(repo, linkId, Astro.locals);
+      return Astro.redirect(`/admin/calendar/google/match?link=${encodeURIComponent(linkId)}`);
+    case 'match-decide':
+      await decideMatch({ repo }, linkId, String(form.get('googleId') ?? ''), form.get('decision') === 'link' ? 'link' : 'apart');
+      return Astro.redirect(`/admin/calendar/google/match?link=${encodeURIComponent(linkId)}#${encodeURIComponent(String(form.get('googleId') ?? ''))}`);
+    case 'match-start':
+      await syncLinkNow(repo, linkId, Astro.locals, { start: true });
+      return Astro.redirect(`/admin/calendar/settings?notice=${encodeURIComponent('Syncing. Recent changes lists what was copied each way.')}#google`);
+    case 'use':
+      await useGoogleVersion(repo, Number(form.get('log')), Astro.url, Astro.locals);
+      return back('notice', 'Using Google’s version. The other copies follow at the next sync.');
+  }
+  return back('error', 'Unknown action.');
+} catch (e) {
+  const message = e instanceof ApiError ? e.message : e instanceof Error && e.name === 'ZodError' ? 'Check the link’s settings and try again.' : 'That didn’t work. Try again.';
+  if (!(e instanceof ApiError)) console.error('acms google sync admin:', e);
+  if (op.startsWith('match-')) return Astro.redirect(`/admin/calendar/google/match?link=${encodeURIComponent(linkId)}&error=${encodeURIComponent(message)}`);
+  return back('error', message);
+}
+---