@acms-subir/core 0.3.55 → 0.3.56

package/src/lib/calendar/request-page.ts

@@ -0,0 +1,52 @@
+import type { ContentRepository } from '../repo/types';
+import type { RequestRecord, Settings } from '../schema';
+import { requestWhen } from './request-mail';
+import { requestSettings, type NewEventDetails, type RequestInput } from './request-service';
+import { requestStrings } from './request-words';
+import { fill } from '../live/words';
+
+// The built-in request form (pages/request/index.astro): what the posted
+// form means as a request, and the "Request sent" summary. A site's own form
+// can use the server API instead.
+
+const str = (data: FormData, name: string) => String(data.get(name) ?? '');
+
+/** The posted form as RequestInput (the date and times come as separate fields). */
+export function formRequest(data: FormData, locale: string): RequestInput {
+  const kind = str(data, 'kind') === 'change' ? 'change' : 'new';
+  const common = { name: str(data, 'name'), email: str(data, 'email'), phone: str(data, 'phone'), locale, website: str(data, 'website') };
+  if (kind === 'change') return { kind, event: str(data, 'event'), date: str(data, 'onDate'), message: str(data, 'whatChange'), ...common };
+  const date = str(data, 'date');
+  const repeat = str(data, 'repeat');
+  const people = Number.parseInt(str(data, 'people'), 10);
+  return {
+    kind, type: str(data, 'type'), title: str(data, 'title'),
+    start: date && str(data, 'start') ? `${date}T${str(data, 'start')}` : date, end: str(data, 'end'),
+    repeat: repeat === 'weekly' || repeat === 'other' ? repeat : 'once', repeatText: str(data, 'repeatText'),
+    rooms: data.getAll('rooms').map(String).slice(0, 10), roomsUnsure: data.get('roomsUnsure') === '1',
+    people: Number.isFinite(people) && people > 0 ? Math.min(people, 1_000_000) : null, message: str(data, 'message'), ...common,
+  };
+}
+
+/** "Request sent": the request as the person sent it, in their language. */
+export async function sentSummary(repo: ContentRepository, q: RequestRecord, settings: Settings, lang: string, locale: string): Promise<{ title: string; line: string }> {
+  const w = requestStrings(lang);
+  if (q.kind === 'change') {
+    const e = await repo.getEvent(q.eventId);
+    const day = q.key ? new Date(`${q.key.slice(0, 10)}T12:00:00Z`) : null;
+    let date = w.everyDate;
+    if (day) { try { date = new Intl.DateTimeFormat(locale, { weekday: 'short', month: 'short', day: 'numeric', timeZone: 'UTC' }).format(day); } catch { date = q.key.slice(0, 10); } }
+    return { title: fill(w.changeTo, { title: e?.title ?? String(q.data.title ?? '') }), line: date };
+  }
+  const d = q.data as unknown as NewEventDetails;
+  const rooms = await repo.listResources();
+  const type = requestSettings(settings).types.find((t) => t.id === d.type);
+  const line = [
+    requestWhen(d.start, d.end, settings, locale),
+    d.repeat === 'weekly' ? w.weekly : d.repeat === 'other' ? d.repeatText : '',
+    d.roomIds.map((id) => rooms.find((r) => r.id === id)?.name).filter(Boolean).join(', '),
+    d.people ? fill(w.aboutPeople, { count: String(d.people) }) : '',
+    type ? (lang && type.translations[lang]) || type.label : '',
+  ].filter(Boolean).join(' · ');
+  return { title: d.title, line };
+}

package/src/lib/calendar/request-service.ts

@@ -0,0 +1,535 @@
+import { z } from 'zod';
+import type { ContentRepository } from '../repo/types';
+import { RequestRecord, RoomHold, type CalEvent, type RequestSettings, type Resource, type Settings } from '../schema';
+import { ApiError, coded } from '../api';
+import { sha256Hex } from '../api-keys';
+import { validAddress } from '../email/config';
+import { kickEmail } from '../email/service';
+import { I18N } from '../i18n';
+import { PUSH } from '../push/config';
+import { isStaffRole } from '../roles';
+import { waitUntilFrom } from '../webhooks';
+import { saveEvent, type SaveHooks } from '../content-service';
+import { roomBusy } from '../booking/holds';
+import { REQUESTS } from './request-config';
+import { MEMBERS } from './members-config';
+import { eventIsPublic, expandEvents, findOccurrence, parseWall } from './events';
+import { zonedToUtc } from './ics';
+import { uniqueSlug } from './schedule';
+import type { Actor } from './requests';
+
+// Event requests from people without an account (acms({ requests })): anyone
+// asks for a new event, or a change to one, from the app (POST
+// /api/v1/requests) or the website's form. Each is a row of its own
+// (RequestRecord, kind 'new' or 'change'; lib/calendar/request-store.ts).
+// Staff answer on Calendar → Requests: approving a new one makes a filled-in
+// draft (its type's tag and calendar, the rooms held); approving a change
+// opens the event, or that date's Move… dialog. Reply and Decline email the
+// person in the language they asked in. Hosts' date moves (kind 'move' and
+// 'from-date') share the table and these answers.
+//
+// The rules live here, so the built-in form, the app API and a site's own
+// pages (through @acms-subir/core/server) share them.
+
+const DAY = 86_400_000;
+export const REQUEST_LIMITS = { title: 200, message: 2000, repeatText: 200, name: 120, phone: 40, people: 100_000, perMinute: 10, perAddressDay: 20, perEmailDay: 5, mailsPerDay: 3 };
+
+/** Why a request was refused (error.code, with error.status). The built-in form shows each in the visitor's language. */
+export type RequestRefusal = 'closed' | 'trap' | 'busy' | 'full' | 'changed' | 'title' | 'type' | 'start' | 'end' | 'past' | 'far'
+  | 'repeat' | 'room' | 'people' | 'event' | 'date' | 'what' | 'name' | 'email' | 'phone';
+const refuse = (status: number, code: RequestRefusal, message: string, retryAfter?: number) => coded(status, code, message, retryAfter);
+
+/** what the app or a form sends (POST /api/v1/requests) */
+export const RequestInput = z.object({
+  kind: z.enum(['new', 'change']),
+  // new: one of the site's types (GET /api/v1/requests/options), a title, when (site-local
+  // YYYY-MM-DDTHH:mm; the end may be just HH:mm: that day, or the next when it's before the start), how it repeats, rooms, people
+  type: z.string().max(40).optional(),
+  title: z.string().max(400).optional(),
+  start: z.string().max(25).optional(),
+  end: z.string().max(25).optional(),
+  repeat: z.enum(['once', 'weekly', 'other']).optional(),
+  repeatText: z.string().max(400).optional(),
+  rooms: z.array(z.string().max(200)).max(10).optional(),
+  roomsUnsure: z.boolean().optional(),
+  people: z.number().int().min(0).max(1_000_000).nullable().optional(),
+  // change: the event's slug, and one date of it (YYYY-MM-DD) or none for every date
+  event: z.string().max(200).optional(),
+  date: z.string().max(25).optional(),
+  // new: anything else; change: what should change (required)
+  message: z.string().max(4000).optional(),
+  name: z.string().max(400),
+  email: z.string().max(400),
+  phone: z.string().max(100).optional(),
+  // the language they asked in (a site language; anything else is the main one)
+  locale: z.string().max(35).optional(),
+  // spam trap: apps leave it out or empty
+  website: z.string().max(200).optional(),
+}).strict();
+export type RequestInput = z.infer<typeof RequestInput>;
+
+/** a new event's details as stored (RequestRecord.data) */
+export interface NewEventDetails {
+  type: string; title: string; start: string; end: string;
+  repeat: 'once' | 'weekly' | 'other'; repeatText: string;
+  roomIds: string[]; roomsUnsure: boolean; people: number | null;
+}
+
+const text = (v: unknown, max: number) => String(v ?? '').replace(/\r\n?/g, '\n').replace(/[\u0000-\u0009\u000b-\u001f\u007f]/g, '').trim().slice(0, max);
+const line = (v: unknown, max: number) => text(v, max).replace(/\s+/g, ' ');
+const WALL = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}$/;
+const wallAt = (s: string, tz: string) => { const w = parseWall(s)!; return zonedToUtc(w.y, w.m, w.d, w.hh, w.mm, 0, tz); };
+const validWall = (s: string) => {
+  const w = WALL.test(s) ? parseWall(s) : null;
+  return !!w && w.m >= 1 && w.m <= 12 && w.d >= 1 && w.d <= new Date(Date.UTC(w.y, w.m, 0)).getUTCDate() && w.hh < 24 && w.mm < 60;
+};
+
+/** the request settings in effect (Calendar → Requests) */
+export const requestSettings = (settings: Settings): RequestSettings => settings.calendar.requests;
+
+/** a site language other than the main one, else '' (the main language) */
+export function requestLocale(raw: string | undefined): string {
+  const want = String(raw ?? '').trim().toLowerCase();
+  if (!want || !I18N.enabled) return '';
+  const hit = I18N.locales.find((l) => l.toLowerCase() === want) ?? I18N.locales.find((l) => l.toLowerCase() === want.split('-')[0]);
+  return hit && hit !== I18N.defaultLocale ? hit : '';
+}
+
+/** rooms anyone may ask for (Resource.requestable), in the admin's order */
+export async function requestableRooms(repo: ContentRepository): Promise<Resource[]> {
+  return (await repo.listResources()).filter((r) => r.requestable).sort((a, b) => a.order - b.order || a.name.localeCompare(b.name));
+}
+
+/** an event "Change to an event" offers: its next dates (site-local YYYY-MM-DD) */
+export interface ChangeChoice { slug: string; title: string; dates: string[] }
+
+/**
+ * Public events with a date in the next year, by title (at most 300), each
+ * with its dates in the next 120 days (at most 30): what a change can be about.
+ */
+export async function changeChoices(repo: ContentRepository, settings: Settings, now = Date.now()): Promise<ChangeChoice[]> {
+  const calendars = new Map((await repo.listCalendars()).map((c) => [c.id, c]));
+  const events = (await repo.listEvents()).filter((e) => eventIsPublic(e, calendars) && !e.cancelled);
+  const tz = settings.timezone || 'UTC';
+  const day = (o: { start: number; allDay: boolean; key: string }) => (o.allDay ? o.key.slice(0, 10) : new Intl.DateTimeFormat('en-CA', { timeZone: tz, year: 'numeric', month: '2-digit', day: '2-digit' }).format(o.start));
+  const out = new Map<string, ChangeChoice>();
+  for (const o of expandEvents(events, settings, { displayTz: tz, now, windowStartMs: now, windowEndMs: now + 366 * DAY })) {
+    if (o.cancelled && !o.event.rrule) continue;
+    const c = out.get(o.event.id) ?? out.set(o.event.id, { slug: o.event.slug, title: o.event.title, dates: [] }).get(o.event.id)!;
+    const d = day(o);
+    if (!o.cancelled && o.start < now + 120 * DAY && c.dates.length < 30 && !c.dates.includes(d)) c.dates.push(d);
+  }
+  return [...out.values()].sort((a, b) => a.title.localeCompare(b.title)).slice(0, 300);
+}
+
+/** a type's label in this language ('' = the main language) */
+const typeLabel = (t: RequestSettings['types'][number], locale: string) => (locale && t.translations[locale]) || t.label;
+
+/**
+ * What the form needs (GET /api/v1/requests/options): whether requests are
+ * open, the types, rooms and events to choose from, and the site's words (in
+ * this language where they're translated). The phone number is there for
+ * when requests are closed.
+ */
+export async function requestOptions(repo: ContentRepository, locale = '', now = Date.now()) {
+  const settings = await repo.getSettings();
+  const rq = requestSettings(settings);
+  const lang = requestLocale(locale);
+  const words = (lang && rq.translations[lang]) || null;
+  return {
+    open: rq.open,
+    types: rq.types.map((t) => ({ id: t.id, label: typeLabel(t, lang) })),
+    rooms: (await requestableRooms(repo)).map((r) => ({ slug: r.slug, name: r.name, color: /^#[0-9a-f]{6}$/i.test(r.color) ? r.color.toLowerCase() : '' })),
+    replyTime: words?.replyTime || rq.replyTime,
+    notice: words?.notice || rq.notice,
+    phone: rq.phone,
+    timezone: settings.timezone || 'UTC',
+    events: rq.open ? await changeChoices(repo, settings, now) : [],
+  };
+}
+
+// ---- asking -------------------------------------------------------------
+
+/** the cleaned request, or why not: what gets stored */
+async function clean(repo: ContentRepository, input: RequestInput, settings: Settings, now: number) {
+  const rq = requestSettings(settings);
+  const tz = settings.timezone || 'UTC';
+  const name = line(input.name, REQUEST_LIMITS.name);
+  if (!name) throw refuse(400, 'name', 'Add your name.');
+  const email = text(input.email, 254).toLowerCase();
+  if (!validAddress(email)) throw refuse(400, 'email', 'Add a valid email address.');
+  const phone = line(input.phone, REQUEST_LIMITS.phone);
+  if (phone && (!/^[+\d\s().\-–#*x]+$/i.test(phone) || (phone.match(/\d/g)?.length ?? 0) < 5)) throw refuse(400, 'phone', 'Check the phone number, or leave it empty.');
+  const requester = { name, email, phone, locale: requestLocale(input.locale) };
+
+  if (input.kind === 'change') {
+    const slug = text(input.event, 200);
+    const e = slug ? await repo.getEventBySlug(slug) : null;
+    const calendars = new Map((await repo.listCalendars()).map((c) => [c.id, c]));
+    if (!e || !eventIsPublic(e, calendars)) throw refuse(400, 'event', 'Choose an event from the list.');
+    const key = text(input.date, 25) ? dateKey(e, text(input.date, 25), settings, now) : '';
+    const note = text(input.message, REQUEST_LIMITS.message);
+    if (!note) throw refuse(400, 'what', 'Tell us what should change.');
+    return { kind: 'change' as const, requester, eventId: e.id, key, note, data: { title: e.title } as Record<string, unknown> };
+  }
+
+  const title = line(input.title, REQUEST_LIMITS.title);
+  if (!title) throw refuse(400, 'title', 'Say what you’re planning.');
+  const type = text(input.type, 40);
+  if (rq.types.length ? !rq.types.some((t) => t.id === type) : type) throw refuse(400, 'type', 'Choose a kind from the list.');
+  const start = text(input.start, 16);
+  if (!validWall(start)) throw refuse(400, 'start', 'Pick a date and a start time.');
+  let end = text(input.end, 16);
+  // just a time: that day, or the next when it's before the start (20:00 → 01:00)
+  if (/^\d{2}:\d{2}$/.test(end)) end = `${end >= start.slice(11) ? start.slice(0, 10) : shiftDays(start, 1).slice(0, 10)}T${end}`;
+  if (!validWall(end)) throw refuse(400, 'end', 'Pick an end time.');
+  const startAt = wallAt(start, tz), endAt = wallAt(end, tz);
+  if (endAt <= startAt) throw refuse(400, 'end', 'The end has to come after the start.');
+  if (endAt - startAt > DAY) throw refuse(400, 'end', 'Keep it within one day, and tell us more in your message.');
+  if (startAt <= now) throw refuse(400, 'past', 'Pick a time that hasn’t passed.');
+  if (startAt > now + 2 * 366 * DAY) throw refuse(400, 'far', 'Pick a date within the next two years.');
+  const repeat = input.repeat ?? 'once';
+  const repeatText = repeat === 'other' ? line(input.repeatText, REQUEST_LIMITS.repeatText) : '';
+  if (repeat === 'other' && !repeatText) throw refuse(400, 'repeat', 'Tell us how it repeats.');
+  const rooms = await requestableRooms(repo);
+  const roomIds: string[] = [];
+  const roomsUnsure = input.roomsUnsure === true;
+  for (const slug of roomsUnsure ? [] : input.rooms ?? []) {
+    const room = rooms.find((r) => r.slug === slug);
+    if (!room) throw refuse(400, 'room', 'Choose a room from the list.');
+    if (!roomIds.includes(room.id)) roomIds.push(room.id);
+  }
+  const people = input.people || null;
+  if (people !== null && people > REQUEST_LIMITS.people) throw refuse(400, 'people', 'Check the number of people.');
+  const data: NewEventDetails = { type, title, start, end, repeat, repeatText, roomIds, roomsUnsure, people };
+  return { kind: 'new' as const, requester, eventId: '', key: '', note: text(input.message, REQUEST_LIMITS.message), data: data as unknown as Record<string, unknown> };
+}
+
+/** the occurrence key of an event's date (YYYY-MM-DD, or a key) that hasn't passed */
+function dateKey(e: CalEvent, date: string, settings: Settings, now: number): string {
+  const day = date.slice(0, 10);
+  const tz = settings.timezone || 'UTC';
+  const w = /^\d{4}-\d{2}-\d{2}$/.test(day) ? parseWall(day) : null;
+  if (!w) throw refuse(400, 'date', 'Pick the date from the event’s dates.');
+  const from = zonedToUtc(w.y, w.m, w.d, 0, 0, 0, tz);
+  if (from + DAY <= now) throw refuse(400, 'past', 'Pick a date that hasn’t passed.');
+  // an all-day date is keyed by its day (apps send all-day dates as that day too)
+  if (e.allDay) { const o = findOccurrence(e, day, settings); if (o) return o.key; }
+  // a date that happens that day (a moved one at its new day), else one moved away from it
+  const hit = expandEvents([e], settings, { displayTz: tz, now, windowStartMs: from, windowEndMs: from + DAY }).find((o) => o.start >= from && o.start < from + DAY);
+  const key = hit?.key ?? Object.keys(e.movedDates ?? {}).find((k) => k.slice(0, 10) === day);
+  if (!key) throw refuse(400, 'date', 'That event doesn’t happen on that date.');
+  return key;
+}
+
+/**
+ * What was sent, as a hash (RequestRecord.data.sent): a retry must send the
+ * same, while the event, the clock and the rooms may have moved on since.
+ */
+async function fingerprint(input: RequestInput): Promise<string> {
+  const { website: _, ...sent } = input;
+  return sha256Hex(JSON.stringify(Object.keys(sent).sort().map((k) => [k, sent[k as keyof typeof sent]])));
+}
+/** the client address for daily limits: an IPv6 address by its /64, which one connection usually owns */
+function addressBucket(address: string) {
+  const a = address.trim().toLowerCase();
+  if (!a.includes(':') || /^::ffff:\d/.test(a)) return a.replace(/^::ffff:/, '');
+  const [head, tail = ''] = a.split('::');
+  const left = head ? head.split(':') : [], right = tail ? tail.split(':') : [];
+  const full = a.includes('::') ? [...left, ...Array(Math.max(0, 8 - left.length - right.length)).fill('0'), ...right] : left;
+  return full.slice(0, 4).map((h) => h.replace(/^0+(?=.)/, '')).join(':') + '::/64';
+}
+
+export interface SubmitContext {
+  source: 'app' | 'web';
+  /** a UUID v4 the sender keeps for retries (the app's Idempotency-Key, the form's hidden id): it becomes the request's id */
+  key: string;
+  /** the client address (rate limits) */
+  address: string;
+  locals?: unknown;
+  now?: number;
+}
+const UUID4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+/**
+ * Someone without an account asks for a new event or a change. A retry with
+ * the same key answers as before (and costs nothing); the same key with other
+ * details is a 409. New requests: 10 a minute per address and the site's
+ * daily cap. They get an email saying it arrived (without their own words,
+ * so the form can't send someone else a message), and staff get an alert.
+ */
+export async function submitRequest(repo: ContentRepository, raw: unknown, ctx: SubmitContext): Promise<{ id: string; created: boolean; request: RequestRecord }> {
+  if (!REQUESTS.enabled) throw new ApiError(404, 'Not found.');
+  if (!UUID4.test(ctx.key)) throw new ApiError(400, 'Send a random UUID v4 in Idempotency-Key and reuse it only for retries.');
+  const input = RequestInput.parse(raw);
+  if (input.website) throw refuse(400, 'trap', 'Could not send this request.');
+  const id = ctx.key.toLowerCase();
+  const sent = await fingerprint(input);
+  // a retry answers as before, whatever has changed since, and costs nothing
+  const replay = (prior: RequestRecord) => {
+    if (prior.data.sent !== sent) throw refuse(409, 'changed', 'This request was already sent with other details. Reload to send a new one.');
+    return { id, created: false, request: prior };
+  };
+  const prior = await repo.requests.get(id);
+  if (prior) return replay(prior);
+  const bucket = await sha256Hex(addressBucket(ctx.address));
+  if (!await repo.email.rateLimit(`requests:ip:${bucket}`, REQUEST_LIMITS.perMinute, 60_000)) throw refuse(429, 'busy', 'Too many requests. Try again in a minute.');
+  const now = ctx.now ?? Date.now();
+  const settings = await repo.getSettings();
+  const rq = requestSettings(settings);
+  // closed: say so before anything about the fields
+  if (!rq.open) throw refuse(409, 'closed', rq.phone ? `We aren’t taking requests here right now. Call ${rq.phone}.` : 'We aren’t taking requests here right now.');
+  const c = await clean(repo, input, settings, now);
+  // a day's worth per sender (address and email) before the site's own cap, so one sender can't use it all up
+  const full = () => refuse(429, 'full', 'We’ve had a lot of requests today. Please try again tomorrow.', 86_400);
+  if (!await repo.email.rateLimit(`requests:ipday:${bucket}`, REQUEST_LIMITS.perAddressDay, DAY)) throw full();
+  if (!await repo.email.rateLimit(`requests:email:${await sha256Hex(c.requester.email)}`, REQUEST_LIMITS.perEmailDay, DAY)) throw full();
+  if (rq.perDay && !await repo.email.rateLimit('requests:day', rq.perDay, DAY)) throw full();
+  const record = RequestRecord.parse({ id, ...c, data: { ...c.data, sent }, state: 'pending', source: ctx.source, createdAt: now, updatedAt: now });
+  const saved = await repo.requests.create(record);
+  if (!saved) {
+    // the same key, sent twice at once: the first one won
+    const won = await repo.requests.get(id);
+    if (!won) throw refuse(409, 'changed', 'This request was already sent with other details. Reload to send a new one.');
+    return replay(won);
+  }
+  // a problem with emails never loses a request
+  await announce(repo, saved, ctx.locals).catch((e) => console.error('acms requests: alerts failed', e));
+  return { id, created: true, request: saved };
+}
+
+// ---- telling people ----------------------------------------------------------
+
+/** what a queued request email carries: ids and the kind, plus staff's words for replies */
+export interface RequestMailPayload {
+  requestId: string;
+  kind: 'received' | 'staff-new' | 'reply' | 'approved' | 'declined';
+  /** the request's updatedAt when it was queued (staff alerts skip one answered since) */
+  at: number;
+  message?: string;
+}
+
+async function enqueue(repo: ContentRepository, q: RequestRecord, to: string[], kind: RequestMailPayload['kind'], message = '') {
+  if (!to.length) return;
+  const version = (await repo.email.config().catch(() => null))?.version ?? 0;
+  const now = Date.now();
+  for (const recipient of to) {
+    const payload: RequestMailPayload = { requestId: q.id, kind, at: q.updatedAt, ...(message ? { message } : {}) };
+    // a reply is its own email each time; the rest go once
+    const dedupe = `calendar-request:${q.id}:${kind}${kind === 'reply' ? `:${now}` : ''}:${recipient}`;
+    await repo.email.enqueue({ dedupe, kind: 'calendar-request', recipient, payload: JSON.stringify(payload), configVersion: version, expiresAt: now + 7 * DAY });
+  }
+}
+
+/** who hears about new requests: Calendar → Requests' list, else acms({ members.notify }), else the owners */
+export async function requestRecipients(repo: ContentRepository, settings: Settings): Promise<string[]> {
+  const rq = requestSettings(settings);
+  const list = rq.notify.length ? rq.notify : MEMBERS.notify;
+  if (list.length) return [...new Set(list.map((e) => e.trim().toLowerCase()))].filter(validAddress);
+  return [...new Set((await repo.listUsers()).filter((u) => u.role === 'owner' && u.email).map((u) => u.email.trim().toLowerCase()))];
+}
+
+/** the person who asked: their email, and the language for it */
+async function requesterAddress(repo: ContentRepository, q: RequestRecord): Promise<string> {
+  if (q.requester) return q.requester.email;
+  const user = q.userId ? await repo.getUser(q.userId) : null;
+  return user?.email ?? '';
+}
+
+/**
+ * Staff hear about a new request: an email to each address on the list and,
+ * when Calendar → Requests says so, a push to the linked phones of staff on
+ * that list (saying only that one arrived, and for when). Hosts' move
+ * requests call this too.
+ */
+export async function requestAlert(repo: ContentRepository, q: RequestRecord, locals?: unknown) {
+  const settings = await repo.getSettings();
+  const to = await requestRecipients(repo, settings);
+  await enqueue(repo, q, to, 'staff-new');
+  const waitUntil = waitUntilFrom(locals);
+  await kickEmail(repo, locals, waitUntil).catch(() => {});
+  if (!requestSettings(settings).phones || !PUSH.enabled) return;
+  const push = alertPhones(repo, q, to, settings, locals).catch((e) => console.error('acms requests: push failed', e));
+  if (waitUntil) waitUntil(push); else await push;
+}
+
+async function alertPhones(repo: ContentRepository, q: RequestRecord, to: string[], settings: Settings, locals: unknown) {
+  const users = (await repo.listUsers()).filter((u) => u.email && isStaffRole(u.role) && to.includes(u.email.trim().toLowerCase()));
+  const devices = (await Promise.all(users.map((u) => repo.push.staffDevices(u.id)))).flat();
+  if (!devices.length) return;
+  const [{ sendNotification }, { requestPush }] = await Promise.all([import('../push/service'), import('./request-mail')]);
+  // no link (the app can't open the admin) and nothing the person typed
+  await sendNotification(repo, { ...await requestPush(repo, q, settings), url: '', audience: [], devices: devices.map((d) => d.id),
+    locale: null, source: 'request', sourceKey: `request:${q.id}` }, { locals });
+}
+
+/** a new request from the form or the app: "we got it" to the person (a few a day per address), and the staff alert */
+async function announce(repo: ContentRepository, q: RequestRecord, locals?: unknown) {
+  const email = q.requester?.email;
+  if (email && await repo.email.rateLimit(`requests:mail:${await sha256Hex(email)}`, REQUEST_LIMITS.mailsPerDay, DAY)) await enqueue(repo, q, [email], 'received');
+  await requestAlert(repo, q, locals);
+}
+
+// ---- answering ---------------------------------------------------------------
+
+function requireAnswerer(who: Actor | null): asserts who is Actor {
+  if (!who) throw new ApiError(401, 'Sign in to continue.');
+  if (!who.can('content.publish')) throw new ApiError(403, 'Your role doesn’t include “Publish content”, which answering requests needs.');
+}
+async function pendingRequest(repo: ContentRepository, id: string, seen?: number) {
+  const q = await repo.requests.get(id);
+  if (!q) throw new ApiError(404, 'Request not found.');
+  if (q.state !== 'pending') throw new ApiError(409, 'This request was already answered or withdrawn.');
+  if (seen !== undefined && q.updatedAt !== seen) throw new ApiError(409, 'This request changed after you opened it. Look at it again, then answer.');
+  return q;
+}
+/** state change as a compare-and-set: someone else answering first gets the 409 */
+async function decide(repo: ContentRepository, q: RequestRecord, patch: Parameters<ContentRepository['requests']['update']>[1]) {
+  const done = await repo.requests.update(q.id, patch, { state: 'pending', updatedAt: q.updatedAt });
+  if (!done) throw new ApiError(409, 'This request was answered or changed while you looked at it. Look at it again.');
+  return done;
+}
+async function tell(repo: ContentRepository, q: RequestRecord, kind: 'reply' | 'approved' | 'declined', message: string, hooks: Pick<SaveHooks, 'locals'>) {
+  const to = await requesterAddress(repo, q);
+  if (!to) return;
+  await enqueue(repo, q, [to], kind, message);
+  await kickEmail(repo, hooks.locals, waitUntilFrom(hooks.locals)).catch(() => {});
+}
+
+export interface Answered {
+  request: RequestRecord;
+  /** the draft a new request became, or the event a change is about (null when it's gone) */
+  event: CalEvent | null;
+  /** where staff go next: the draft, the event (with ?move=<key> for one date), else the list */
+  next: string;
+}
+
+/**
+ * Staff approve. A host's date move runs (lib/calendar/host-requests.ts,
+ * which emails the host). A new event becomes a draft that's already filled in (its
+ * title and times, weekly when asked, its type's tag and calendar, the rooms
+ * held while it's a draft), never with the person's details; a change keeps
+ * the event as it is and points staff at it. The person gets an email (with
+ * `message`, if any) unless `email` is false. `seen`: the request's
+ * updatedAt staff reviewed, so a later edit isn't approved unseen.
+ */
+export async function approveRequest(repo: ContentRepository, who: Actor | null, id: string, hooks: SaveHooks, seen?: number, opts: { message?: string; email?: boolean } = {}): Promise<Answered> {
+  requireAnswerer(who);
+  const q = await pendingRequest(repo, id, seen);
+  const message = text(opts.message, REQUEST_LIMITS.message);
+  const answer = { state: 'approved' as const, reviewedBy: who.id, reviewedAt: Date.now(), reply: message };
+  let done: RequestRecord, event: CalEvent | null, next: string;
+  if (q.kind === 'new') {
+    event = await draftFrom(repo, q, hooks);
+    try { done = await decide(repo, q, { ...answer, eventId: event.id }); }
+    catch (e) { await repo.deleteEvent(event.id); throw e; }
+    next = `/admin/calendar/events/${event.id}`;
+  } else if (q.kind === 'change') {
+    event = await repo.getEvent(q.eventId);
+    if (!event) throw new ApiError(409, 'That event was deleted. Decline the request, or reply to the person.');
+    done = await decide(repo, q, answer);
+    next = `/admin/calendar/events/${event.id}${q.key ? `?move=${encodeURIComponent(q.key)}` : ''}`;
+  } else if (q.kind === 'move') {
+    // a host's date move (lib/calendar/host-requests.ts): it runs, and the host hears about it there
+    const { approveDateRequest } = await import('./host-requests');
+    const { request, moved } = await approveDateRequest(repo, who, id, hooks, seen);
+    return { request, event: moved.event, next: `/admin/calendar/events/${request.eventId}` };
+  } else {
+    throw new ApiError(400, 'Open the event to answer this request.');
+  }
+  if (opts.email !== false) await tell(repo, done, 'approved', message, hooks);
+  return { request: done, event, next };
+}
+
+/** the draft a new request becomes */
+async function draftFrom(repo: ContentRepository, q: RequestRecord, hooks: SaveHooks): Promise<CalEvent> {
+  const d = q.data as unknown as NewEventDetails;
+  const settings = await repo.getSettings();
+  const type = requestSettings(settings).types.find((t) => t.id === d.type);
+  const native = new Set((await repo.listCalendars()).filter((c) => c.kind === 'native').map((c) => c.id));
+  const calendarId = [type?.calendarId, settings.calendar.defaultCalendarId].find((c) => c && native.has(c)) ?? '';
+  // rooms deleted since are left out
+  const rooms = new Set((await repo.listResources()).map((r) => r.id));
+  const created = await repo.createEvent({
+    title: d.title, slug: await uniqueSlug(repo, d.title), start: d.start, allDay: false, status: 'draft',
+    calendarIds: calendarId ? [calendarId] : [], tags: type?.tag ? [type.tag] : [],
+    roomHold: RoomHold.parse({ resourceIds: d.roomIds.filter((r) => rooms.has(r)), whileDraft: d.roomIds.length > 0 }),
+  });
+  // times and repeat go through the editor's own validation; a draft that couldn't be finished doesn't stay holding rooms
+  try { return await saveEvent(repo, created.id, { start: d.start, end: d.end, allDay: false, rrule: d.repeat === 'weekly' ? 'FREQ=WEEKLY' : '' }, { url: hooks.url, locals: hooks.locals }); }
+  catch (e) { await repo.deleteEvent(created.id).catch(() => {}); throw e; }
+}
+
+/** Staff decline, with an optional reason for the person (emailed in their language unless `email` is false). */
+export async function declineRequest(repo: ContentRepository, who: Actor | null, id: string, reply: string, hooks: SaveHooks, seen?: number, opts: { email?: boolean } = {}): Promise<RequestRecord> {
+  requireAnswerer(who);
+  const q = await pendingRequest(repo, id, seen);
+  if (q.kind === 'move') return (await import('./host-requests')).declineDateRequest(repo, who, id, reply, hooks, seen);
+  if (q.kind !== 'new' && q.kind !== 'change') throw new ApiError(400, 'Open the event to answer this request.');
+  const reason = text(reply, REQUEST_LIMITS.message);
+  const done = await decide(repo, q, { state: 'declined', reviewedBy: who.id, reviewedAt: Date.now(), reply: reason });
+  if (opts.email !== false) await tell(repo, done, 'declined', reason, hooks);
+  return done;
+}
+
+/** Staff delete a request from the app or the website as spam: gone at once, and nobody is emailed. Hosts' requests are declined instead. */
+export async function deleteRequest(repo: ContentRepository, who: Actor | null, id: string): Promise<void> {
+  requireAnswerer(who);
+  const q = await repo.requests.get(id);
+  if (!q) throw new ApiError(404, 'Request not found.');
+  if (q.source === 'member') throw new ApiError(400, 'A host’s request can be declined, not deleted.');
+  await repo.requests.delete(id);
+}
+
+/** Staff write to the person (their language's greeting around staff's words); the request keeps its state. */
+export async function replyToRequest(repo: ContentRepository, who: Actor | null, id: string, message: string, hooks: SaveHooks): Promise<RequestRecord> {
+  requireAnswerer(who);
+  const q = await repo.requests.get(id);
+  if (!q) throw new ApiError(404, 'Request not found.');
+  const words = text(message, REQUEST_LIMITS.message);
+  if (!words) throw new ApiError(400, 'Write your reply first.');
+  if (!await requesterAddress(repo, q)) throw new ApiError(409, 'There’s no email address to reply to.');
+  if (!await repo.email.rateLimit(`requests:reply:${q.id}`, 10, DAY)) throw new ApiError(429, 'That’s a lot of replies to one request today. Try again tomorrow.', 86_400);
+  const done = (await repo.requests.update(q.id, { reply: words }))!;
+  await tell(repo, done, 'reply', words, hooks);
+  return done;
+}
+
+/** Requests go keepDays (Calendar → Requests) after their answer, or after they arrived if nobody answered (the scheduler runs this). */
+export async function pruneRequests(repo: ContentRepository, now = Date.now()): Promise<number> {
+  const keep = requestSettings(await repo.getSettings()).keepDays;
+  return repo.requests.prune(now - keep * DAY);
+}
+
+// ---- the list staff see -------------------------------------------------------
+
+/** a room that's taken for a requested time (names are for staff) */
+export interface RequestClash { room: string; start: number; end: number; title: string }
+
+/**
+ * Whether a new request's rooms are free: its time and, for weekly ones, the
+ * same time for 12 weeks. Lists what takes them (first ones first).
+ */
+export async function requestClashes(repo: ContentRepository, q: RequestRecord, settings: Settings, rooms?: Resource[]): Promise<RequestClash[]> {
+  if (q.kind !== 'new') return [];
+  const d = q.data as unknown as NewEventDetails;
+  if (!d.roomIds?.length || !validWall(d.start) || !validWall(d.end)) return [];
+  const tz = settings.timezone || 'UTC';
+  const start = wallAt(d.start, tz), end = wallAt(d.end, tz);
+  const names = new Map((rooms ?? await repo.listResources()).map((r) => [r.id, r.name]));
+  const weeks = d.repeat === 'weekly' ? 12 : 1;
+  // to the last week's end at its own wall time (a clock change moves it)
+  const busy = await roomBusy(repo, settings, { resourceIds: d.roomIds, from: start, to: Math.max(end, wallAt(shiftDays(d.end, (weeks - 1) * 7), tz)) });
+  const out: RequestClash[] = [];
+  for (let w = 0; w < weeks; w++) {
+    // the same wall time each week (across a clock change too)
+    const s = wallAt(shiftDays(d.start, w * 7), tz), e = wallAt(shiftDays(d.end, w * 7), tz);
+    for (const b of busy) if (b.start < e && b.end > s) out.push({ room: names.get(b.resourceId) ?? '', start: b.start, end: b.end, title: b.title });
+  }
+  return out;
+}
+function shiftDays(wall: string, days: number) {
+  const w = parseWall(wall)!;
+  const t = new Date(Date.UTC(w.y, w.m - 1, w.d + days));
+  return `${t.toISOString().slice(0, 10)}${wall.slice(10)}`;
+}

package/src/lib/calendar/request-store.ts

@@ -97,8 +97,8 @@ export class RequestStore {
   async delete(id: string): Promise<boolean> {
     return (await this.all('DELETE FROM event_requests WHERE id=? RETURNING id', [id])).length > 0;
   }
-  /** Deletes requests answered or withdrawn before `before` (ms); pending ones stay. Returns how many went. */
+  /** Deletes requests answered or withdrawn before `before` (ms), and ones still waiting that arrived before it. Returns how many went. */
   async prune(before: number): Promise<number> {
-    return (await this.all(`DELETE FROM event_requests WHERE state<>'pending' AND reviewed_at>0 AND reviewed_at<? RETURNING id`, [before])).length;
+    return (await this.all(`DELETE FROM event_requests WHERE (state<>'pending' AND reviewed_at>0 AND reviewed_at<?) OR (state='pending' AND created_at<?) RETURNING id`, [before, before])).length;
   }
 }