@acms-subir/core 0.3.55 → 0.3.56

package/src/pages/admin/calendar/requests.astro

@@ -0,0 +1,298 @@
+---
+import Admin from '../../../layouts/Admin.astro';
+import Modal from '../../../components/Modal.astro';
+import { getRepo } from '../../../lib/repo';
+import { ApiError } from '../../../lib/api';
+import { extraLocales, localeName, localePath } from '../../../lib/i18n';
+import { PUSH } from '../../../lib/push/config';
+import { accessFor, forbiddenUnless } from '../../../lib/permissions/access';
+import type { Permission } from '../../../lib/permissions/catalog';
+import { REQUESTS } from '../../../lib/calendar/request-config';
+import { MEMBERS } from '../../../lib/calendar/members-config';
+import { approveRequest, declineRequest, deleteRequest, replyToRequest, requestRecipients, requestableRooms, requestSettings } from '../../../lib/calendar/request-service';
+import { pendingCount, requestRows, settingsFromForm, type RequestTab } from '../../../lib/calendar/request-admin';
+import { approveEventRequest, declineEventRequest } from '../../../lib/calendar/requests';
+
+// Calendar → Requests (acms({ requests })): requests from the app, the
+// website and hosts in one list, with Pending, Approved and Declined tabs and
+// what takes the rooms on each row. Approve opens a filled-in draft (or the
+// event a change is about); Reply and Decline email the person in their
+// language. Reading needs "Create and edit content", answering "Publish
+// content", the settings "Manage rooms and calendars". The rules are
+// lib/calendar/request-service.ts; the list lib/calendar/request-admin.ts.
+if (!REQUESTS.enabled) return new Response(null, { status: 404 });
+const repo = await getRepo(Astro.locals);
+const denied = await forbiddenUnless(Astro.request, Astro.cookies, repo, 'content.edit');
+if (denied) return denied;
+const access = (await accessFor(Astro.request, Astro.cookies, repo))!;
+const who = { id: access.userId, can: (p: string) => access.can(p as Permission) };
+const hooks = { url: Astro.url, locals: Astro.locals };
+const back = (notice: string, tab = Astro.url.searchParams.get('tab') ?? '') => {
+  const p = new URLSearchParams();
+  if (tab) p.set('tab', tab);
+  if (notice) p.set('notice', notice);
+  const q = p.toString();
+  return Astro.redirect(q ? '/admin/calendar/requests?' + q : '/admin/calendar/requests');
+};
+
+if (Astro.request.method === 'POST') {
+  const form = await Astro.request.formData();
+  const op = String(form.get('op') ?? '');
+  const id = String(form.get('id') ?? '');
+  const seen = Number(form.get('at')) || undefined;
+  const nope = await forbiddenUnless(Astro.request, Astro.cookies, repo, op === 'settings' ? 'schedule.manage' : 'content.publish');
+  if (nope) return nope;
+  try {
+    if (op === 'approve') {
+      const done = await approveRequest(repo, who, id, hooks, seen, { message: String(form.get('message') ?? ''), email: form.get('email') === '1' });
+      return Astro.redirect(done.next);
+    }
+    if (op === 'decline') {
+      // the email choice is only offered for requests from the app or the website (hosts are always told)
+      const email = form.has('email-offered') ? form.get('email') === '1' : true;
+      await declineRequest(repo, who, id, String(form.get('reason') ?? ''), hooks, seen, { email });
+      return back(email ? 'Declined. The person was emailed.' : 'Declined, without an email.');
+    }
+    if (op === 'delete') {
+      await deleteRequest(repo, who, id);
+      return back('Deleted as spam. Nobody was emailed.');
+    }
+    if (op === 'reply') {
+      await replyToRequest(repo, who, id, String(form.get('message') ?? ''), hooks);
+      return back('Reply sent.');
+    }
+    // members' requests staged on their events (My events)
+    if (op === 'member-approve') {
+      const e = await approveEventRequest(repo, who, id, hooks, seen);
+      return back(`Approved “${e.title}”.`);
+    }
+    if (op === 'member-decline') {
+      const e = await declineEventRequest(repo, who, id, String(form.get('reason') ?? ''), hooks, seen);
+      return back(`Declined “${e.title}”.`);
+    }
+    if (op === 'settings') {
+      const settings = await repo.getSettings();
+      const calendars = (await repo.listCalendars()).filter((c) => c.kind === 'native').map((c) => c.id);
+      const requests = settingsFromForm(form, requestSettings(settings), calendars);
+      await repo.updateSettings({ calendar: { ...settings.calendar, requests } });
+      return back('Request settings saved.');
+    }
+    return back('');
+  } catch (err) {
+    return back(err instanceof ApiError ? err.message : 'Couldn’t do that. Try again.');
+  }
+}
+
+const settings = await repo.getSettings();
+const rq = requestSettings(settings);
+const tab = (['pending', 'approved', 'declined'] as const).find((t) => t === Astro.url.searchParams.get('tab')) ?? 'pending';
+const page = Math.min(1000, Math.max(1, Number.parseInt(Astro.url.searchParams.get('page') ?? '', 10) || 1));
+const [{ rows, more }, waiting, rooms, calendars, recipients] = await Promise.all([
+  requestRows(repo, settings, tab as RequestTab, Date.now(), page), pendingCount(repo), requestableRooms(repo),
+  repo.listCalendars().then((cs) => cs.filter((c) => c.kind === 'native')), requestRecipients(repo, settings),
+]);
+const notice = Astro.url.searchParams.get('notice') ?? '';
+const canAnswer = access.can('content.publish');
+const canSet = access.can('schedule.manage');
+const langs = extraLocales();
+// the kinds there are, plus a few empty rows to add more (12 at most)
+const typeRows = [...rq.types, ...Array.from({ length: Math.min(3, 12 - rq.types.length) }, () => null)];
+const TABS = [['pending', 'Pending'], ['approved', 'Approved'], ['declined', 'Declined']] as const;
+const formUrl = REQUESTS.page ? REQUESTS.path : '';
+const pageHref = (n: number) => '/admin/calendar/requests?' + new URLSearchParams({ ...(tab === 'pending' ? {} : { tab }), ...(n > 1 ? { page: String(n) } : {}) }).toString();
+const empty = { pending: 'Nothing waiting. Requests from the app, the website and hosts show up here.', approved: 'No approved requests yet.', declined: 'No declined requests.' }[tab];
+---
+
+<Admin title="Requests" section="calendar:requests">
+  <div class="page-head">
+    <div>
+      <h1>Requests</h1>
+      <p class="sub">From the app, the website{MEMBERS.enabled ? ' and hosts' : ''}, in one list{formUrl && <> · the form is at <a href={formUrl} target="_blank" rel="noopener">{formUrl}</a>{langs.map((l) => <> and <a href={localePath(formUrl, l)} target="_blank" rel="noopener">{localePath(formUrl, l)}</a></>)}</>}</p>
+    </div>
+    <div class="page-actions">
+      {!rq.open && <span class="rq-closed">Closed</span>}
+      {canSet && <button class="btn" type="button" data-modal="rq-settings">Settings</button>}
+    </div>
+  </div>
+
+  {notice && <p class="notice" role="status">{notice}</p>}
+
+  <nav class="seg rq-tabs" aria-label="Show">
+    {TABS.map(([k, l]) => (
+      <a href={k === 'pending' ? '/admin/calendar/requests' : '/admin/calendar/requests?tab=' + k} class={tab === k ? 'on' : ''} aria-current={tab === k ? 'page' : undefined}>
+        {l}{k === 'pending' && waiting > 0 && <span class="rq-count">{waiting}</span>}
+      </a>
+    ))}
+  </nav>
+
+  {rows.length === 0 ? <p class="hint rq-empty">{empty}</p> : (
+    <section class="card rq-list">
+      {rows.map((r) => (
+        <article class="rq-row" id={r.dom}>
+          <small class="rq-head">{r.head}</small>
+          <b class="rq-title">{r.href ? <a href={r.href}>{r.title}</a> : r.title}</b>
+          {r.line && <span class="rq-line">{r.line}</span>}
+          <span class="rq-who">{r.who}</span>
+          {r.note && <p class="rq-note">“{r.note}”</p>}
+          {r.clash && <p class={r.clash.taken ? 'rq-clash is-taken' : 'rq-clash'}>{r.clash.text}</p>}
+          {r.answer && <p class="rq-answer">{r.answer}{r.reply && <> — “{r.reply}”</>}</p>}
+          {tab === 'pending' && canAnswer && (
+            <div class="rq-acts">
+              {(r.kind === 'new' || r.kind === 'change') && <button class="btn sm primary" type="button" data-modal={'approve-' + r.dom}>Approve…</button>}
+              {r.kind === 'move' && <form method="post"><input type="hidden" name="op" value="approve" /><input type="hidden" name="id" value={r.id} /><input type="hidden" name="at" value={r.at} /><button class="btn sm primary" type="submit">Approve</button></form>}
+              {(r.kind === 'move' || r.kind === 'from-date') && r.href && <a class="btn sm ghost" href={r.href}>Open the event</a>}
+              {r.kind === 'member-new' || r.kind === 'member-changes' ? (
+                <>
+                  <a class="btn sm ghost" href={r.href}>Open</a>
+                  <form method="post"><input type="hidden" name="op" value="member-approve" /><input type="hidden" name="id" value={r.id} /><input type="hidden" name="at" value={r.at} /><button class="btn sm primary" type="submit">Approve</button></form>
+                </>
+              ) : r.canReply && r.email && <button class="btn sm ghost" type="button" data-modal={'reply-' + r.dom}>Reply</button>}
+              {r.kind !== 'from-date' && <button class="btn sm ghost" type="button" data-modal={'decline-' + r.dom}>Decline…</button>}
+            </div>
+          )}
+          {tab !== 'pending' && r.canReply && r.email && canAnswer && <div class="rq-acts"><button class="btn sm ghost" type="button" data-modal={'reply-' + r.dom}>Reply</button></div>}
+        </article>
+      ))}
+    </section>
+  )}
+  {(page > 1 || more) && (
+    <nav class="rq-pager" aria-label="Pages">
+      {page > 1 && <a class="btn sm ghost" href={pageHref(page - 1)}>Previous</a>}
+      <span class="hint">Page {page}</span>
+      {more && <a class="btn sm ghost" href={pageHref(page + 1)}>Next</a>}
+    </nav>
+  )}
+  {tab === 'pending' && rows.length > 0 && !canAnswer && <p class="hint">Someone whose role can publish content answers these.</p>}
+
+  {canAnswer && rows.map((r) => (
+    <>
+      {tab === 'pending' && (r.kind === 'new' || r.kind === 'change') && (
+        <Modal id={'approve-' + r.dom} title={r.kind === 'new' ? 'Approve and make a draft' : 'Approve this change'}>
+          <form method="post">
+            <input type="hidden" name="op" value="approve" /><input type="hidden" name="id" value={r.id} /><input type="hidden" name="at" value={r.at} />
+            <p class="hint">{r.kind === 'new'
+              ? 'You’ll get a draft with the title, time, repeat, rooms held and the kind’s tag and calendar. Check it, then publish it. Their contact details stay here, never on the event.'
+              : 'The event opens (or that date’s Move… dialog) so you can make the change.'}</p>
+            <label class="field"><span>Message <em class="hint">optional</em></span><textarea name="message" rows="3" maxlength="2000" placeholder="See you then!"></textarea></label>
+            <label class="check-row"><input type="checkbox" name="email" value="1" checked /> Email them that it’s approved, in their language</label>
+            <div class="modal-foot"><button class="btn ghost" type="button" data-close>Cancel</button><button class="btn primary" type="submit">Approve</button></div>
+          </form>
+        </Modal>
+      )}
+      {r.canReply && r.email && (
+        <Modal id={'reply-' + r.dom} title="Reply">
+          <form method="post">
+            <input type="hidden" name="op" value="reply" /><input type="hidden" name="id" value={r.id} />
+            <p class="hint">Emailed to {r.email} with a short line in their language. The request stays {tab === 'pending' ? 'waiting' : tab}.</p>
+            <label class="field"><span>Your reply</span><textarea name="message" rows="5" maxlength="2000" required placeholder="Could you come at 3 instead? The room is free then."></textarea></label>
+            <div class="modal-foot"><button class="btn ghost" type="button" data-close>Cancel</button><button class="btn primary" type="submit">Send reply</button></div>
+          </form>
+        </Modal>
+      )}
+      {tab === 'pending' && r.kind !== 'from-date' && (
+        <Modal id={'decline-' + r.dom} title="Decline this request">
+          <form method="post">
+            <input type="hidden" name="op" value={r.kind === 'member-new' || r.kind === 'member-changes' ? 'member-decline' : 'decline'} /><input type="hidden" name="id" value={r.id} /><input type="hidden" name="at" value={r.at} />
+            <p class="hint">{r.kind === 'member-new' || r.kind === 'member-changes' || r.kind === 'move'
+              ? 'They’re emailed that it can’t go ahead' + (r.kind === 'member-new' ? '; the draft stays for them to change and send again.' : r.kind === 'move' ? '; the date stays as it is.' : '.')
+              : 'It moves to Declined, and is deleted with the rest after the time you keep requests.'}</p>
+            <label class="field"><span>Reason <em class="hint">optional</em></span><textarea name="reason" rows="3" maxlength="2000" placeholder="The Sanctuary is booked that weekend."></textarea></label>
+            {(r.kind === 'new' || r.kind === 'change') && <label class="check-row"><input type="hidden" name="email-offered" value="1" /><input type="checkbox" name="email" value="1" checked /> Email them, in their language</label>}
+            <div class="modal-foot"><button class="btn ghost" type="button" data-close>Cancel</button><button class="btn primary" type="submit">Decline</button></div>
+          </form>
+          {(r.kind === 'new' || r.kind === 'change') && (
+            <form method="post" class="rq-spam">
+              <input type="hidden" name="op" value="delete" /><input type="hidden" name="id" value={r.id} />
+              <p class="hint">Spam? Delete it now, without an email to the address it gave.</p>
+              <button class="btn sm ghost" type="submit">Delete as spam</button>
+            </form>
+          )}
+        </Modal>
+      )}
+    </>
+  ))}
+
+  {canSet && (
+    <Modal id="rq-settings" title="Request settings" open={Astro.url.searchParams.has('settings')}>
+      <form method="post" class="rq-settings">
+        <input type="hidden" name="op" value="settings" />
+        <div>
+          <label class="check-row"><input type="checkbox" name="open" value="1" checked={rq.open} /> Taking requests</label>
+          <p class="hint">When off, the form and the app say so and show the office phone. They never disappear.</p>
+        </div>
+        <fieldset>
+          <legend>Kinds people choose from</legend>
+          <p class="hint">Approving a request makes a draft with the kind’s tag, in its calendar (else the default calendar).</p>
+          <div class="rq-type rq-type-h" aria-hidden="true"><span>Kind</span>{langs.map((l) => <span>{localeName(l, true)}</span>)}<span>Tag</span><span>Calendar</span></div>
+          {typeRows.map((t, i) => (
+            <div class="rq-type">
+              {t && <input type="hidden" name={'type-id-' + i} value={t.id} />}
+              <input name={'type-label-' + i} value={t?.label ?? ''} placeholder={t || i > rq.types.length ? '' : rq.types.length ? 'Add a kind' : 'Class'} aria-label="Kind" maxlength="60" />
+              {langs.map((l) => <input name={'type-' + l + '-' + i} value={t?.translations[l] ?? ''} placeholder={localeName(l, true)} aria-label={'Kind in ' + localeName(l)} maxlength="60" />)}
+              <input name={'type-tag-' + i} value={t?.tag ?? ''} placeholder="Tag" aria-label="Tag" maxlength="60" />
+              <select name={'type-cal-' + i} aria-label="Calendar">
+                <option value="">Default calendar</option>
+                {calendars.map((c) => <option value={c.id} selected={t?.calendarId === c.id}>{c.name}</option>)}
+              </select>
+            </div>
+          ))}
+        </fieldset>
+        <label class="field"><span>Reply time <em class="hint">“We usually answer within …”</em></span><input name="replyTime" value={rq.replyTime} placeholder="3 days" maxlength="60" /></label>
+        <label class="field"><span>Notice at the top of the form <em class="hint">optional</em></span><textarea name="notice" rows="2" maxlength="400" placeholder="The church office reviews every request. It isn’t on the calendar until they confirm it.">{rq.notice}</textarea></label>
+        {langs.map((l) => (
+          <fieldset>
+            <legend>{localeName(l, true)}</legend>
+            <label class="field"><span>Reply time</span><input name={'replyTime-' + l} value={rq.translations[l]?.replyTime ?? ''} maxlength="60" /></label>
+            <label class="field"><span>Notice</span><textarea name={'notice-' + l} rows="2" maxlength="400">{rq.translations[l]?.notice ?? ''}</textarea></label>
+          </fieldset>
+        ))}
+        <label class="field"><span>Office phone <em class="hint">shown when requests are closed, and after sending</em></span><input name="phone" inputmode="tel" autocomplete="off" value={rq.phone} maxlength="40" /></label>
+        <label class="field"><span>Who hears about new requests</span><textarea name="notify" rows="2" placeholder={recipients.join(', ')}>{rq.notify.join(', ')}</textarea><em class="hint">Email addresses. Empty: {MEMBERS.notify.length ? 'the members notify list in the site’s config' : 'the owners'} ({recipients.join(', ') || 'nobody yet'}).</em></label>
+        {PUSH.enabled && (
+          <div>
+            <label class="check-row"><input type="hidden" name="phones" value="0" /><input type="checkbox" name="phones" value="1" checked={rq.phones} /> Also notify their linked phones</label>
+            <p class="hint">A push saying a request arrived and for when, without names.</p>
+          </div>
+        )}
+        <div class="field-row">
+          <label class="field"><span>New requests a day <em class="hint">0 = no limit</em></span><input name="perDay" type="number" min="0" max="10000" value={rq.perDay} /></label>
+          <label class="field"><span>Keep requests for (days) <em class="hint">after the answer, or after they arrive if nobody answers</em></span><input name="keepDays" type="number" min="7" max="1095" value={rq.keepDays} /></label>
+        </div>
+        <p class="hint">Rooms people can ask for: {rooms.length ? rooms.map((r) => r.name).join(', ') : 'none yet'}. Turn on “Anyone can check if it’s free” on a room to offer it.</p>
+        <div class="modal-foot"><button class="btn ghost" type="button" data-close>Cancel</button><button class="btn primary" type="submit">Save</button></div>
+      </form>
+    </Modal>
+  )}
+</Admin>
+
+<style>
+  .rq-tabs { margin: 0 0 14px; }
+  .rq-count { font-size: 11px; font-weight: 700; color: var(--amber); background: var(--amber-soft); border-radius: var(--r-full); padding: 0 6px; margin-left: 6px; }
+  .rq-closed { font-size: 12.5px; font-weight: 600; color: var(--amber); background: var(--amber-soft); border-radius: var(--r-full); padding: 3px 10px; }
+  .rq-empty { padding: 24px 8px; }
+  .rq-list { padding: 0; }
+  .rq-row { display: grid; gap: 3px; padding: 14px 18px; border-top: 1px solid var(--line); scroll-margin-top: 80px; }
+  .rq-row:first-child { border-top: 0; }
+  .rq-row:target { background: var(--amber-soft); }
+  .rq-head { color: var(--text-2); font-size: 12.5px; }
+  .rq-title { font-size: 15.5px; }
+  .rq-title a { color: inherit; }
+  .rq-line, .rq-who { font-size: 13.5px; color: var(--text-2); }
+  .rq-note { margin: 4px 0 0; font-style: italic; font-size: 14px; }
+  .rq-clash { margin: 4px 0 0; font-size: 13px; color: var(--green); }
+  .rq-clash.is-taken { color: var(--amber); }
+  .rq-answer { margin: 4px 0 0; font-size: 13px; color: var(--text-2); }
+  .rq-acts { display: flex; gap: 6px; flex-wrap: wrap; margin-top: 8px; }
+  .rq-acts form { margin: 0; }
+  .rq-pager { display: flex; align-items: center; gap: 10px; margin: 12px 0 0; }
+  .rq-spam { display: flex; align-items: center; justify-content: space-between; gap: 12px; border-top: 1px solid var(--line); margin-top: 14px; padding-top: 12px; }
+  .rq-spam .hint { margin: 0; }
+  .rq-settings { display: grid; gap: 12px; }
+  .rq-settings fieldset { border: 1px solid var(--line); border-radius: 10px; padding: 10px 12px; margin: 0; display: grid; gap: 8px; }
+  .rq-settings legend { font-weight: 600; font-size: 13.5px; padding: 0 4px; }
+  .rq-settings .hint { margin: 2px 0 0; }
+  .rq-type { display: grid; grid-auto-flow: column; grid-auto-columns: minmax(0, 1fr); gap: 6px; }
+  .rq-type > * { min-width: 0; }
+  .rq-type-h span { font-size: 12px; color: var(--text-2); }
+  :global(dialog#rq-settings.modal) { width: min(680px, calc(100vw - 32px)); max-width: none; }
+</style>

package/src/pages/api/v1/requests/index.ts

@@ -0,0 +1,6 @@
+import { postRequest } from '../../../../lib/mobile/requests';
+import { privateRoute } from '../../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../lib/mobile/http';
+export const POST = privateRoute(postRequest, { write: true, status: 201 });
+export const ALL = () => methodNotAllowed('POST, OPTIONS');

package/src/pages/api/v1/requests/options.ts

@@ -0,0 +1,7 @@
+import { getRequestOptions } from '../../../../lib/mobile/requests';
+import { privateRoute } from '../../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../lib/mobile/http';
+// never cached: closing requests or marking a room requestable shows at once
+export const GET = privateRoute(getRequestOptions);
+export const ALL = () => methodNotAllowed('GET, OPTIONS');

package/src/pages/request/index.astro

@@ -0,0 +1,182 @@
+---
+import Site from '../../layouts/Site.astro';
+import { getRepo } from '../../lib/repo';
+import { ApiError } from '../../lib/api';
+import { readForm } from '../../lib/forms/http';
+import { I18N, localePath, requestLocale as pageLocale } from '../../lib/i18n';
+import { siteLang, siteLocale } from '../../lib/dates';
+import { LEGAL } from '../../lib/legal/config';
+import { fill } from '../../lib/live/words';
+import { REQUESTS } from '../../lib/calendar/request-config';
+import { requestOptions, submitRequest, requestLocale, type RequestRefusal } from '../../lib/calendar/request-service';
+import { requestStrings } from '../../lib/calendar/request-words';
+import { formRequest, sentSummary } from '../../lib/calendar/request-page';
+
+// Request an event (acms({ requests })): the same request as the app's
+// screen, for anyone, without an account, at /request and under each
+// language's prefix (/es/request). The page posts to itself; the rules,
+// limits and emails are lib/calendar/request-service.ts. Themed through the
+// site's tokens (the booking form's pc-bk-* fields); a site file at this path
+// replaces it, and acms({ requests: { page: false } }) drops it.
+if (!REQUESTS.enabled) return new Response(null, { status: 404 });
+Astro.response.headers.set('Cache-Control', 'private, no-store');
+
+const repo = await getRepo(Astro.locals);
+const settings = await repo.getSettings();
+const locale = I18N.enabled ? requestLocale(pageLocale(Astro.url, Astro.locals)) : '';
+const lang = locale || (I18N.enabled && I18N.defaultLocale) || siteLang(settings);
+const dateLocale = lang.split('-')[0] === siteLang(settings) ? siteLocale(settings) : lang;
+const w = requestStrings(lang);
+const options = await requestOptions(repo, locale);
+
+let error = '';
+let field = '';
+let values: Record<string, string | string[]> = { kind: 'new', repeat: 'once' };
+let key: string = crypto.randomUUID();
+let sent: { email: string; title: string; line: string } | null = null;
+if (Astro.request.method === 'POST') {
+  try {
+    const data = await readForm(Astro.request);
+    values = Object.fromEntries([...new Set(data.keys())].map((k) => [k, k === 'rooms' ? data.getAll(k).map(String) : String(data.get(k) ?? '')]));
+    key = String(data.get('requestId') ?? '');
+    const { request } = await submitRequest(repo, formRequest(data, locale), { source: 'web', key, address: Astro.clientAddress, locals: Astro.locals });
+    sent = { email: request.requester?.email ?? '', ...await sentSummary(repo, request, settings, lang, dateLocale) };
+  } catch (e) {
+    const code = (e as { code?: RequestRefusal }).code;
+    field = code ?? '';
+    error = code ? w.errors[code] : e instanceof ApiError && e.status !== 500 ? e.message : w.errors.failed;
+    Astro.response.status = e instanceof ApiError ? e.status : 500;
+    // a refused request can be fixed and sent again with the same key; one that went through can't
+    if (code === 'changed') key = crypto.randomUUID();
+  }
+}
+const v = (k: string) => { const x = values[k]; return Array.isArray(x) ? x[0] ?? '' : x ?? ''; };
+const chosenRooms = Array.isArray(values.rooms) ? values.rooms : values.rooms ? [values.rooms] : [];
+const today = new Intl.DateTimeFormat('en-CA', { timeZone: settings.timezone || 'UTC', year: 'numeric', month: '2-digit', day: '2-digit' }).format(Date.now());
+const privacy = LEGAL.enabled ? localePath('/privacy', locale) : '';
+const self = localePath(REQUESTS.path, locale);
+const tel = (p: string) => 'tel:' + p.replace(/[^\d+]/g, '');
+const invalid = (...codes: string[]) => (codes.includes(field) ? 'true' : undefined);
+const fieldWords = { free: w.free, taken: w.taken };
+---
+<Site title={w.heading}>
+  <section class="pc-simple-form pc-rq">
+    <h1>{sent ? w.sent : w.heading}</h1>
+    {sent ? (
+      <div class="pc-rq-sent" role="status">
+        <p>{options.replyTime ? fill(w.answerWithin, { time: options.replyTime, email: sent.email }) : fill(w.answerBy, { email: sent.email })}</p>
+        <div class="pc-rq-card"><small>{w.yours}</small><b>{sent.title}</b><span>{sent.line}</span></div>
+        <p class="pc-bk-hint">{w.notYet}{options.phone && <> <a href={tel(options.phone)}>{fill(w.sooner, { phone: options.phone })}</a></>}</p>
+        <p><a href={self}>{w.another}</a></p>
+      </div>
+    ) : !options.open ? (
+      <div class="pc-rq-closed" role="status">
+        <p>{w.closed}</p>
+        {options.phone && <p><a href={tel(options.phone)}>{fill(w.call, { phone: options.phone })}</a></p>}
+      </div>
+    ) : (
+      <form method="post" action={self} class="pc-rq-form" data-tz={options.timezone} data-words={JSON.stringify(fieldWords)}>
+        <p class="pc-rq-notice">{options.notice || w.notice}</p>
+        {error && <p class="pc-bk-error" role="alert">{error}</p>}
+        <input type="hidden" name="requestId" value={key} />
+        <div class="pc-form-trap" aria-hidden="true"><label>Leave empty<input name="website" tabindex="-1" autocomplete="off" /></label></div>
+        <fieldset class="pc-rq-kind">
+          <legend class="pc-rq-sr">{w.heading}</legend>
+          <label><input type="radio" name="kind" value="new" checked={v('kind') !== 'change'} /><span>{w.somethingNew}</span></label>
+          <label><input type="radio" name="kind" value="change" checked={v('kind') === 'change'} /><span>{w.change}</span></label>
+        </fieldset>
+
+        <div class="pc-rq-new">
+          <label class="pc-bk-field"><span>{w.what}</span><input name="title" maxlength="200" value={v('title')} aria-invalid={invalid('title')} /></label>
+          {options.types.length > 0 && (
+            <fieldset class="pc-bk-field pc-bk-choices"><legend>{w.type}</legend>
+              <div class="pc-rq-chips">{options.types.map((t) => <label class="pc-bk-option"><input type="radio" name="type" value={t.id} checked={v('type') === t.id} /><span>{t.label}</span></label>)}</div>
+            </fieldset>
+          )}
+          <div class="pc-rq-when">
+            <label class="pc-bk-field"><span>{w.date}</span><input type="date" name="date" min={today} value={v('date')} aria-invalid={invalid('start', 'past', 'far')} /></label>
+            <label class="pc-bk-field"><span>{w.starts}</span><input type="time" name="start" step="300" value={v('start')} aria-invalid={invalid('start', 'past')} /></label>
+            <label class="pc-bk-field"><span>{w.ends}</span><input type="time" name="end" step="300" value={v('end')} aria-invalid={invalid('end')} /></label>
+          </div>
+          <fieldset class="pc-bk-field pc-bk-choices"><legend>{w.repeats}</legend>
+            <div class="pc-rq-chips">
+              <label class="pc-bk-option"><input type="radio" name="repeat" value="once" checked={v('repeat') !== 'weekly' && v('repeat') !== 'other'} /><span>{w.once}</span></label>
+              <label class="pc-bk-option"><input type="radio" name="repeat" value="weekly" checked={v('repeat') === 'weekly'} /><span>{w.weekly}</span></label>
+              <label class="pc-bk-option"><input type="radio" name="repeat" value="other" checked={v('repeat') === 'other'} /><span>{w.other}</span></label>
+            </div>
+            <label class="pc-bk-field pc-rq-other"><span>{w.otherHint}</span><input name="repeatText" maxlength="200" value={v('repeatText')} aria-invalid={invalid('repeat')} /></label>
+          </fieldset>
+          {options.rooms.length > 0 && (
+            <fieldset class="pc-bk-field pc-bk-choices"><legend>{w.room}</legend>
+              <div class="pc-rq-chips">
+                {options.rooms.map((r) => <label class="pc-bk-option"><input type="checkbox" name="rooms" value={r.slug} data-name={r.name} checked={chosenRooms.includes(r.slug)} /><span>{r.name}</span></label>)}
+                <label class="pc-bk-option"><input type="checkbox" name="roomsUnsure" value="1" checked={v('roomsUnsure') === '1'} /><span>{w.notSure}</span></label>
+              </div>
+              <p class="pc-rq-free" aria-live="polite"></p>
+            </fieldset>
+          )}
+          <label class="pc-bk-field"><span>{w.people} <em>{w.optional}</em></span><input type="number" name="people" min="1" max="100000" inputmode="numeric" value={v('people')} aria-invalid={invalid('people')} /></label>
+          <label class="pc-bk-field"><span>{w.message} <em>{w.optional}</em></span><textarea name="message" rows="3" maxlength="2000">{v('message')}</textarea></label>
+        </div>
+
+        <div class="pc-rq-change">
+          <label class="pc-bk-field"><span>{w.event}</span>
+            <select name="event" aria-invalid={invalid('event')}>
+              <option value="">{w.pickEvent}</option>
+              {options.events.map((e) => <option value={e.slug} selected={v('event') === e.slug}>{e.title}</option>)}
+            </select>
+          </label>
+          <label class="pc-bk-field"><span>{w.onDate} <em>{w.optional}</em></span><input type="date" name="onDate" min={today} value={v('onDate')} aria-invalid={invalid('date')} /><small>{w.onDateHint}</small></label>
+          <label class="pc-bk-field"><span>{w.whatChange}</span><textarea name="whatChange" rows="3" maxlength="2000" aria-invalid={invalid('what')}>{v('whatChange')}</textarea></label>
+        </div>
+
+        <fieldset class="pc-rq-contact">
+          <legend>{w.contact}</legend>
+          <label class="pc-bk-field"><span>{w.name}</span><input name="name" required maxlength="120" autocomplete="name" value={v('name')} aria-invalid={invalid('name')} /></label>
+          <div class="pc-form-row">
+            <label class="pc-bk-field"><span>{w.email}</span><input type="email" name="email" required maxlength="254" autocomplete="email" value={v('email')} aria-invalid={invalid('email')} /></label>
+            <label class="pc-bk-field"><span>{w.phone} <em>{w.optional}</em></span><input type="tel" name="phone" maxlength="40" autocomplete="tel" value={v('phone')} aria-invalid={invalid('phone')} /></label>
+          </div>
+          <p class="pc-bk-hint">{w.contactWhy}{privacy && <> <a href={privacy}>{w.privacy}</a></>}</p>
+        </fieldset>
+        <button class="pc-bk-submit" type="submit">{w.send}</button>
+      </form>
+    )}
+  </section>
+</Site>
+
+<script>
+  // "Sanctuary looks free then": free or busy for the chosen rooms
+  // (GET /api/v1/rooms/free, no names), in the site's zone
+  const form = document.querySelector<HTMLFormElement>('.pc-rq-form');
+  const out = form?.querySelector<HTMLElement>('.pc-rq-free');
+  if (form && out) {
+    const tz = form.dataset.tz || 'UTC';
+    const words = JSON.parse(form.dataset.words || '{}') as { free: string; taken: string };
+    const wall = (iso: string) => {
+      const p = Object.fromEntries(new Intl.DateTimeFormat('en-CA', { timeZone: tz, year: 'numeric', month: '2-digit', day: '2-digit', hour: '2-digit', minute: '2-digit', hourCycle: 'h23' })
+        .formatToParts(new Date(iso)).map((x) => [x.type, x.value]));
+      return p.year + '-' + p.month + '-' + p.day + 'T' + p.hour + ':' + p.minute;
+    };
+    const next = (day: string) => { const d = new Date(day + 'T12:00:00Z'); d.setUTCDate(d.getUTCDate() + 1); return d.toISOString().slice(0, 10); };
+    let run = 0;
+    const check = async () => {
+      const mine = ++run;
+      const get = (n: string) => (form.elements.namedItem(n) as HTMLInputElement | null)?.value || '';
+      const day = get('date'), start = get('start'), end = get('end');
+      const rooms = [...form.querySelectorAll<HTMLInputElement>('input[name=rooms]:checked')];
+      if (!day || !start || !end || end <= start || !rooms.length) { out.textContent = ''; return; }
+      const from = day + 'T' + start, to = day + 'T' + end;
+      const lines = await Promise.all(rooms.map(async (r) => {
+        const res = await fetch('/api/v1/rooms/free?room=' + encodeURIComponent(r.value) + '&start=' + day + '&end=' + next(day)).catch(() => null);
+        if (!res?.ok) return '';
+        const { data } = await res.json() as { data: { busy: { start: string; end: string }[] } };
+        const taken = data.busy.some((b) => wall(b.start) < to && wall(b.end) > from);
+        return (taken ? words.taken : words.free).replace('{room}', r.dataset.name || r.value);
+      }));
+      if (mine === run) out.textContent = lines.filter(Boolean).join(' ');
+    };
+    form.addEventListener('change', (e) => { if ((e.target as HTMLInputElement).name !== 'roomsUnsure') void check(); });
+    void check();
+  }
+</script>

package/src/server/index.ts

@@ -38,6 +38,8 @@ export type { CalEvent, Occurrence };
 export type { EventRequestInput } from '../lib/calendar/requests';
 export type { EventClash, BusySlot, Hold } from '../lib/booking/holds';
 export type { MoveInput, MoveResult } from '../lib/calendar/moves';
+export type { RequestRecord, RequestKind, RequestState, RequestSource, Requester } from '../lib/schema';
+export type { RequestInput, RequestRefusal, NewEventDetails, Answered, RequestClash } from '../lib/calendar/request-service';
 
 export interface ListEventsOptions {
   /** only published events (default: every event except archived ones) */
@@ -360,7 +362,6 @@ export async function setHostedOccurrence(repo: Repo, who: Who, eventId: string,
 
 const hostRequests = () => import('../lib/calendar/host-requests');
 export type { HostMoveResult, MoveRequestData } from '../lib/calendar/host-requests';
-export type { RequestRecord } from '../lib/schema';
 
 /** A host moves one date: `{ moved }` at once, or `{ request }` when moves need approval. Errors as moveOccurrence's, plus `code` room-not-allowed (a room the event doesn't use and nobody may request). */
 export async function moveHostedDate(repo: Repo, who: Who, eventId: string, occurrenceKey: string, input: import('../lib/calendar/moves').MoveInput, context: WriteContext): Promise<import('../lib/calendar/host-requests').HostMoveResult> {
@@ -402,3 +403,57 @@ export async function approveDateRequest(repo: Repo, who: Who, requestId: string
 export async function declineDateRequest(repo: Repo, who: Who, requestId: string, reply: string, context: WriteContext, seen?: number): Promise<import('../lib/schema').RequestRecord> {
   return (await hostRequests()).declineDateRequest(internal(repo), who, requestId, reply, context, seen);
 }
+
+// ---- event requests without an account ---------------------------------------
+// The rules behind the built-in /request form, POST /api/v1/requests and
+// Calendar → Requests (acms({ requests })), for a site that builds its own
+// form or list. Asking needs no account; reading the list needs "Create and
+// edit content", answering "Publish content". Refusals carry a `status` and a
+// `code` (RequestRefusal: which field, closed, busy…) with an English message;
+// the built-in form shows each code in the visitor's language.
+
+const asks = () => import('../lib/calendar/request-service');
+
+/** What the request form offers: open or closed, the types and requestable rooms, and the site's words in this language. */
+export async function requestOptions(repo: Repo, locale = '') {
+  return (await asks()).requestOptions(internal(repo), locale);
+}
+
+/**
+ * Send a request from the site's own form. `key` is a random UUID v4 the page
+ * kept for this form (a retry with it never makes a second request); `address`
+ * is the client address (Astro.clientAddress) for the rate limit. The person
+ * is emailed that it arrived, and staff get an alert.
+ */
+export async function submitRequest(repo: Repo, input: import('../lib/calendar/request-service').RequestInput, opts: { key: string; address: string; context: WriteContext }): Promise<{ id: string; created: boolean }> {
+  const { id, created } = await (await asks()).submitRequest(internal(repo), input, { source: 'web', key: opts.key, address: opts.address, locals: opts.context.locals });
+  return { id, created };
+}
+
+/** Requests for staff ("Create and edit content"): filter by state, kind, event or member; pending ones oldest first, the rest newest first. */
+export async function listRequests(repo: Repo, who: Who, q: import('../lib/calendar/request-store').RequestQuery = {}): Promise<import('../lib/schema').RequestRecord[]> {
+  if (!who) throw Object.assign(new Error('Sign in to continue.'), { status: 401 });
+  if (!who.can('content.edit')) throw Object.assign(new Error('Your role doesn’t include “Create and edit content”.'), { status: 403 });
+  const pending = q.states?.length === 1 && q.states[0] === 'pending';
+  return internal(repo).requests.list({ order: pending ? 'oldest' : 'newest', ...q });
+}
+
+/** Staff approve: a new event becomes a filled-in draft; a change points at its event. `next` is where to go in the admin. */
+export async function approveRequest(repo: Repo, who: Who, id: string, context: WriteContext, seen?: number, opts: { message?: string; email?: boolean } = {}) {
+  return (await asks()).approveRequest(internal(repo), who, id, context, seen, opts);
+}
+
+/** Staff decline, with an optional reason emailed to the person in their language (`email: false` sends nothing). */
+export async function declineRequest(repo: Repo, who: Who, id: string, reason: string, context: WriteContext, seen?: number, opts: { email?: boolean } = {}) {
+  return (await asks()).declineRequest(internal(repo), who, id, reason, context, seen, opts);
+}
+
+/** Staff delete a request from the app or the website as spam, without emailing anyone. */
+export async function deleteRequest(repo: Repo, who: Who, id: string): Promise<void> {
+  return (await asks()).deleteRequest(internal(repo), who, id);
+}
+
+/** Staff email the person about their request (it stays as it is). */
+export async function replyToRequest(repo: Repo, who: Who, id: string, message: string, context: WriteContext) {
+  return (await asks()).replyToRequest(internal(repo), who, id, message, context);
+}

package/src/styles/site.css

@@ -1226,6 +1226,35 @@ li::marker { color: var(--muted); }
 .pc-simple-form form { display: grid; gap: 16px; }
 .pc-simple-form .pc-bk-field { margin: 0; }
 .pc-form-trap { position: absolute; left: -10000px; width: 1px; height: 1px; overflow: hidden; }
+/* Request an event (pages/request/index.astro). The kind toggle shows one set
+   of fields; without :has() both show and the server reads the chosen kind's. */
+.pc-rq .pc-rq-notice { color: var(--muted); margin: 0; }
+.pc-rq-sr { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; }
+.pc-rq-kind { display: grid; grid-template-columns: 1fr 1fr; gap: 4px; border: 1px solid var(--line-2, var(--line)); border-radius: 12px; padding: 4px; margin: 0; background: var(--soft); }
+.pc-rq-kind label { display: block; position: relative; }
+.pc-rq-kind input { position: absolute; opacity: 0; pointer-events: none; }
+.pc-rq-kind span { display: block; text-align: center; padding: 8px 10px; border-radius: 9px; font-size: 14.5px; font-weight: 550; cursor: pointer; color: var(--muted); }
+.pc-rq-kind input:checked + span { background: var(--panel); color: var(--ink); box-shadow: var(--sh-1); }
+.pc-rq-kind input:focus-visible + span { box-shadow: 0 0 0 3px color-mix(in srgb, var(--accent) 22%, transparent); }
+.pc-rq-new, .pc-rq-change { display: grid; gap: 16px; }
+.pc-rq-form:has(input[name=kind][value=change]:checked) .pc-rq-new,
+.pc-rq-form:has(input[name=kind][value=new]:checked) .pc-rq-change { display: none; }
+.pc-rq-when { display: grid; grid-template-columns: 2fr 1fr 1fr; gap: 12px; }
+.pc-rq-when .pc-bk-field { margin: 0; }
+@media (max-width: 520px) { .pc-rq-when { grid-template-columns: 1fr 1fr; } .pc-rq-when > :first-child { grid-column: 1 / -1; } }
+.pc-rq-chips { display: flex; flex-wrap: wrap; gap: 6px; }
+.pc-rq-chips .pc-bk-option { min-height: 38px; padding: 6px 12px; }
+.pc-rq .pc-rq-other { margin: 8px 0 0; }
+.pc-rq-form:not(:has(input[name=repeat][value=other]:checked)) .pc-rq-other { display: none; }
+.pc-rq-free { margin: 8px 0 0; font-size: 14px; color: var(--muted); }
+.pc-rq-free:empty { display: none; }
+.pc-rq-contact { border: 0; padding: 0; margin: 0; display: grid; gap: 12px; min-width: 0; }
+.pc-rq-contact legend { font-weight: 650; font-size: 17px; padding: 0; margin-bottom: 8px; }
+.pc-rq-contact .pc-bk-hint { margin: 0; }
+.pc-rq-card { display: grid; gap: 2px; border: 1px solid var(--line); border-radius: var(--r); background: var(--panel); padding: 14px 16px; margin: 16px 0; }
+.pc-rq-card small { color: var(--muted); font-size: 12.5px; }
+.pc-rq-card span { color: var(--muted); font-size: 14.5px; }
+.pc-rq [aria-invalid=true] { border-color: var(--danger); }
 .pc-bk-check { display: flex; gap: 8px; align-items: start; margin-block: 12px; }
 .pc-bk-check input { width: auto; margin-top: 5px; }
 .pc-bk-check small, .pc-bk-field small { display: block; font-size: .85em; opacity: .8; }