@acms-subir/core 0.3.54 → 0.3.56

package/src/server/index.ts

@@ -38,6 +38,8 @@ export type { CalEvent, Occurrence };
 export type { EventRequestInput } from '../lib/calendar/requests';
 export type { EventClash, BusySlot, Hold } from '../lib/booking/holds';
 export type { MoveInput, MoveResult } from '../lib/calendar/moves';
+export type { RequestRecord, RequestKind, RequestState, RequestSource, Requester } from '../lib/schema';
+export type { RequestInput, RequestRefusal, NewEventDetails, Answered, RequestClash } from '../lib/calendar/request-service';
 
 export interface ListEventsOptions {
   /** only published events (default: every event except archived ones) */
@@ -205,6 +207,55 @@ export async function moveOccurrenceBack(repo: Repo, who: Who | typeof GOOGLE_SY
   return back(internal(repo), who, eventId, occurrenceKey, { url: context.url, locals: context.locals }, opts);
 }
 
+// ---- Google Calendar sync ----------------------------------------------------
+// The two-way sync is set up in the admin (Calendar settings → Synced with
+// Google) and runs from the scheduler. These read what it did, for a site's
+// own pages (a "Synced with Google" badge, a staff report). They don't check
+// permissions and their results name Google calendars: show them to staff.
+
+/** The internal tag on appointments booked through a Google booking page (they come in titled "Booked"). Never shown publicly. */
+export const GOOGLE_BOOKING_TAG = '#google-booking';
+
+export interface GoogleCopy {
+  /** the Google calendar's name and id */
+  googleCalendar: string;
+  googleCalendarId: string;
+  /** the Google event's own page */
+  htmlLink: string;
+  /** when the pair last synced (ms) */
+  syncedAt: number;
+  /** created in Google and its description never edited on the site: Google's description is used */
+  descriptionFromGoogle: boolean;
+  /** a booked appointment from a Google booking page */
+  booking: boolean;
+  /** the latest field both sides changed (the site kept its value), until someone picks one */
+  clash: { field: string; site: string; google: string; at: number } | null;
+}
+
+/** The Google copies of one event (an event in two linked calendars has two). Empty when it isn't synced. */
+export async function googleCopies(repo: Repo, eventId: string): Promise<GoogleCopy[]> {
+  const r = internal(repo);
+  const items = (await r.gcal.itemsForEvent(eventId)).filter((i) => i.kind !== 'segment' && !i.gone);
+  if (!items.length) return [];
+  const links = new Map((await r.gcal.listLinks()).map((l) => [l.id, l]));
+  return items.map((i) => ({
+    googleCalendar: links.get(i.linkId)?.googleName ?? '', googleCalendarId: links.get(i.linkId)?.googleId ?? '', htmlLink: i.htmlLink, syncedAt: i.syncedAt,
+    descriptionFromGoogle: i.descGoogle, booking: i.booking, clash: i.conflict && { field: i.conflict.field, site: i.conflict.site, google: i.conflict.google, at: i.conflict.at },
+  }));
+}
+
+/** Recent changes the sync made (newest first, kept 90 days): direction in/out/clash/info, the event, and what changed in words. */
+export async function googleSyncHistory(repo: Repo, opts: { eventId?: string; limit?: number } = {}) {
+  return (await internal(repo).gcal.listLog({ eventId: opts.eventId, limit: opts.limit ?? 50 }))
+    .map(({ id, at, eventId, direction, action, title, summary, resolved }) => ({ id, at, eventId, direction, action, title, summary, resolved }));
+}
+
+/** Runs the sync once now, as the scheduler does every minute (changes out; each link reads Google every 2 minutes). Returns how many changes it handled. */
+export async function syncGoogleCalendar(repo: Repo, context: Pick<WriteContext, 'locals'>): Promise<number> {
+  const { syncGoogle } = await import('../lib/calendar/google/service');
+  return syncGoogle(internal(repo), context.locals);
+}
+
 // ---- rooms -----------------------------------------------------------------
 // Events hold rooms (CalEvent.roomHold) while they happen. These find where
 // two things want the same room. They don't check permissions, and their
@@ -311,7 +362,6 @@ export async function setHostedOccurrence(repo: Repo, who: Who, eventId: string,
 
 const hostRequests = () => import('../lib/calendar/host-requests');
 export type { HostMoveResult, MoveRequestData } from '../lib/calendar/host-requests';
-export type { RequestRecord } from '../lib/schema';
 
 /** A host moves one date: `{ moved }` at once, or `{ request }` when moves need approval. Errors as moveOccurrence's, plus `code` room-not-allowed (a room the event doesn't use and nobody may request). */
 export async function moveHostedDate(repo: Repo, who: Who, eventId: string, occurrenceKey: string, input: import('../lib/calendar/moves').MoveInput, context: WriteContext): Promise<import('../lib/calendar/host-requests').HostMoveResult> {
@@ -353,3 +403,57 @@ export async function approveDateRequest(repo: Repo, who: Who, requestId: string
 export async function declineDateRequest(repo: Repo, who: Who, requestId: string, reply: string, context: WriteContext, seen?: number): Promise<import('../lib/schema').RequestRecord> {
   return (await hostRequests()).declineDateRequest(internal(repo), who, requestId, reply, context, seen);
 }
+
+// ---- event requests without an account ---------------------------------------
+// The rules behind the built-in /request form, POST /api/v1/requests and
+// Calendar → Requests (acms({ requests })), for a site that builds its own
+// form or list. Asking needs no account; reading the list needs "Create and
+// edit content", answering "Publish content". Refusals carry a `status` and a
+// `code` (RequestRefusal: which field, closed, busy…) with an English message;
+// the built-in form shows each code in the visitor's language.
+
+const asks = () => import('../lib/calendar/request-service');
+
+/** What the request form offers: open or closed, the types and requestable rooms, and the site's words in this language. */
+export async function requestOptions(repo: Repo, locale = '') {
+  return (await asks()).requestOptions(internal(repo), locale);
+}
+
+/**
+ * Send a request from the site's own form. `key` is a random UUID v4 the page
+ * kept for this form (a retry with it never makes a second request); `address`
+ * is the client address (Astro.clientAddress) for the rate limit. The person
+ * is emailed that it arrived, and staff get an alert.
+ */
+export async function submitRequest(repo: Repo, input: import('../lib/calendar/request-service').RequestInput, opts: { key: string; address: string; context: WriteContext }): Promise<{ id: string; created: boolean }> {
+  const { id, created } = await (await asks()).submitRequest(internal(repo), input, { source: 'web', key: opts.key, address: opts.address, locals: opts.context.locals });
+  return { id, created };
+}
+
+/** Requests for staff ("Create and edit content"): filter by state, kind, event or member; pending ones oldest first, the rest newest first. */
+export async function listRequests(repo: Repo, who: Who, q: import('../lib/calendar/request-store').RequestQuery = {}): Promise<import('../lib/schema').RequestRecord[]> {
+  if (!who) throw Object.assign(new Error('Sign in to continue.'), { status: 401 });
+  if (!who.can('content.edit')) throw Object.assign(new Error('Your role doesn’t include “Create and edit content”.'), { status: 403 });
+  const pending = q.states?.length === 1 && q.states[0] === 'pending';
+  return internal(repo).requests.list({ order: pending ? 'oldest' : 'newest', ...q });
+}
+
+/** Staff approve: a new event becomes a filled-in draft; a change points at its event. `next` is where to go in the admin. */
+export async function approveRequest(repo: Repo, who: Who, id: string, context: WriteContext, seen?: number, opts: { message?: string; email?: boolean } = {}) {
+  return (await asks()).approveRequest(internal(repo), who, id, context, seen, opts);
+}
+
+/** Staff decline, with an optional reason emailed to the person in their language (`email: false` sends nothing). */
+export async function declineRequest(repo: Repo, who: Who, id: string, reason: string, context: WriteContext, seen?: number, opts: { email?: boolean } = {}) {
+  return (await asks()).declineRequest(internal(repo), who, id, reason, context, seen, opts);
+}
+
+/** Staff delete a request from the app or the website as spam, without emailing anyone. */
+export async function deleteRequest(repo: Repo, who: Who, id: string): Promise<void> {
+  return (await asks()).deleteRequest(internal(repo), who, id);
+}
+
+/** Staff email the person about their request (it stays as it is). */
+export async function replyToRequest(repo: Repo, who: Who, id: string, message: string, context: WriteContext) {
+  return (await asks()).replyToRequest(internal(repo), who, id, message, context);
+}

package/src/styles/site.css

@@ -1226,6 +1226,35 @@ li::marker { color: var(--muted); }
 .pc-simple-form form { display: grid; gap: 16px; }
 .pc-simple-form .pc-bk-field { margin: 0; }
 .pc-form-trap { position: absolute; left: -10000px; width: 1px; height: 1px; overflow: hidden; }
+/* Request an event (pages/request/index.astro). The kind toggle shows one set
+   of fields; without :has() both show and the server reads the chosen kind's. */
+.pc-rq .pc-rq-notice { color: var(--muted); margin: 0; }
+.pc-rq-sr { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; }
+.pc-rq-kind { display: grid; grid-template-columns: 1fr 1fr; gap: 4px; border: 1px solid var(--line-2, var(--line)); border-radius: 12px; padding: 4px; margin: 0; background: var(--soft); }
+.pc-rq-kind label { display: block; position: relative; }
+.pc-rq-kind input { position: absolute; opacity: 0; pointer-events: none; }
+.pc-rq-kind span { display: block; text-align: center; padding: 8px 10px; border-radius: 9px; font-size: 14.5px; font-weight: 550; cursor: pointer; color: var(--muted); }
+.pc-rq-kind input:checked + span { background: var(--panel); color: var(--ink); box-shadow: var(--sh-1); }
+.pc-rq-kind input:focus-visible + span { box-shadow: 0 0 0 3px color-mix(in srgb, var(--accent) 22%, transparent); }
+.pc-rq-new, .pc-rq-change { display: grid; gap: 16px; }
+.pc-rq-form:has(input[name=kind][value=change]:checked) .pc-rq-new,
+.pc-rq-form:has(input[name=kind][value=new]:checked) .pc-rq-change { display: none; }
+.pc-rq-when { display: grid; grid-template-columns: 2fr 1fr 1fr; gap: 12px; }
+.pc-rq-when .pc-bk-field { margin: 0; }
+@media (max-width: 520px) { .pc-rq-when { grid-template-columns: 1fr 1fr; } .pc-rq-when > :first-child { grid-column: 1 / -1; } }
+.pc-rq-chips { display: flex; flex-wrap: wrap; gap: 6px; }
+.pc-rq-chips .pc-bk-option { min-height: 38px; padding: 6px 12px; }
+.pc-rq .pc-rq-other { margin: 8px 0 0; }
+.pc-rq-form:not(:has(input[name=repeat][value=other]:checked)) .pc-rq-other { display: none; }
+.pc-rq-free { margin: 8px 0 0; font-size: 14px; color: var(--muted); }
+.pc-rq-free:empty { display: none; }
+.pc-rq-contact { border: 0; padding: 0; margin: 0; display: grid; gap: 12px; min-width: 0; }
+.pc-rq-contact legend { font-weight: 650; font-size: 17px; padding: 0; margin-bottom: 8px; }
+.pc-rq-contact .pc-bk-hint { margin: 0; }
+.pc-rq-card { display: grid; gap: 2px; border: 1px solid var(--line); border-radius: var(--r); background: var(--panel); padding: 14px 16px; margin: 16px 0; }
+.pc-rq-card small { color: var(--muted); font-size: 12.5px; }
+.pc-rq-card span { color: var(--muted); font-size: 14.5px; }
+.pc-rq [aria-invalid=true] { border-color: var(--danger); }
 .pc-bk-check { display: flex; gap: 8px; align-items: start; margin-block: 12px; }
 .pc-bk-check input { width: auto; margin-top: 5px; }
 .pc-bk-check small, .pc-bk-field small { display: block; font-size: .85em; opacity: .8; }

package/src/virtual.d.ts

@@ -24,6 +24,7 @@ declare module 'virtual:acms-config' {
     permissions?: { key: string; label: string; description: string; defaults: string[]; sensitive: boolean }[];
     members?: { enabled: boolean; base: string; notify: string[]; hostMoves?: 'direct' | 'approve' };
     announcements?: { enabled: boolean; base: string; pages: boolean; topics: Partial<Record<'event' | 'registration' | 'help' | 'info', string>> };
+    requests?: { enabled: boolean; path: string; page: boolean };
     // set in astro:config:setup (lib/origin-check.ts): off only when the site turned security.checkOrigin off
     originCheck?: { enabled: boolean; signedRoutes: string[] };
     // resolved by integration.mjs (lib/calendar/config.ts documents the shape)