@acms-subir/core 0.3.9 → 0.3.10

package/src/components/AppAccess.tsx

@@ -0,0 +1,117 @@
+import { useEffect, useRef, useState } from 'react';
+import type { AppAccessState } from '../lib/mobile/access-admin';
+import type { MobileAccess } from '../lib/schema';
+
+// Admin → Mobile app → App access: what visitor and staff apps may do on
+// this site. Each change saves at once; switching something off makes its
+// app routes answer "turned off" immediately.
+
+const ENDPOINT = '/api/mobile/access';
+async function api(body?: Record<string, unknown>): Promise<AppAccessState> {
+  const res = await fetch(ENDPOINT, {
+    method: body ? 'POST' : 'GET', credentials: 'same-origin',
+    headers: body ? { 'content-type': 'application/json', accept: 'application/json' } : { accept: 'application/json' },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  const data = await res.json().catch(() => null);
+  if (!res.ok) throw new Error(data?.issues?.[0]?.message || data?.error || `${res.status} ${res.statusText || 'Request failed'}`);
+  return data as AppAccessState;
+}
+const errText = (e: unknown) => (e instanceof Error ? e.message : String(e));
+
+const BLOCKER: Record<NonNullable<AppAccessState['guestSignIn']['blocker']>, string> = {
+  calendar: 'Turn on the calendar to use guest sign-in.',
+  email: 'Set up email sending in Settings → Email first; sign-in codes go out by email.',
+  encryption: 'Add EMAIL_ENCRYPTION_KEY to the server first; it protects codes waiting to be sent.',
+};
+
+export default function AppAccess() {
+  const [state, setState] = useState<AppAccessState | null>(null);
+  const [error, setError] = useState('');
+  const [saved, setSaved] = useState('');
+  // overlapping saves: only the newest reply may replace what's on screen
+  const latest = useRef(0);
+  useEffect(() => { api().then(setState, (e) => setError(errText(e))); }, []);
+  if (!state) return error ? <p className="flash error">{error}</p> : <div className="ma-skel" aria-busy="true" aria-label="Loading"><i /><i /></div>;
+  const a = state.access;
+
+  const save = async (patch: Partial<MobileAccess>, note = 'Saved.') => {
+    setError(''); setSaved('');
+    const n = ++latest.current;
+    // show the change at once; reload the server's copy if it is refused
+    setState((s) => s && { ...s, access: { ...s.access, ...patch } });
+    try { const next = await api({ action: 'save', access: patch }); if (n === latest.current) { setState(next); setSaved(note); } }
+    catch (e) { setError(errText(e)); if (n === latest.current) api().then(setState, () => {}); }
+  };
+  const signOutAll = async () => {
+    if (!confirm(`Sign out ${state.guestSignIn.devices === 1 ? 'the 1 device' : `all ${state.guestSignIn.devices} devices`}? People sign in again with a new code.`)) return;
+    try { setState(await api({ action: 'signOutGuests' })); setSaved('Everyone was signed out.'); } catch (e) { setError(errText(e)); }
+  };
+  const Switch = ({ on, label, onChange, disabled }: { on: boolean; label: string; onChange: (v: boolean) => void; disabled?: boolean }) => (
+    <button type="button" role="switch" aria-checked={on} aria-label={label} disabled={disabled} className={`acc-switch${on ? ' on' : ''}`} onClick={() => onChange(!on)}><i /></button>
+  );
+  const Num = ({ value, min, max, label, field }: { value: number; min: number; max: number; label: string; field: 'bookingsPerEmailDay' | 'responsesPerFormDay' }) => (
+    <input className="acc-num" type="number" inputMode="numeric" min={min} max={max} defaultValue={value} aria-label={label}
+      onBlur={(e) => { const n = Math.round(Number(e.currentTarget.value)); if (Number.isFinite(n) && n !== value && n >= min && n <= max) save({ [field]: n }); else e.currentTarget.value = String(value); }} />
+  );
+  const guest = state.guestSignIn;
+
+  return (
+    <div className="acc">
+      {(error || saved) && <p className={`flash ${error ? 'error' : 'ok'}`} role="status">{error || saved}</p>}
+      <section className="card card-pad">
+        <div className="card-head"><b>App access</b><span className="hint">What visitor apps can do on this site</span></div>
+        {state.modules.calendar && (
+          <div className="acc-row">
+            <div><b>Change bookings from the app</b><small>Visitors can view, cancel and move a booking with its private link.</small></div>
+            <Switch on={a.bookingChanges} label="Change bookings from the app" onChange={(v) => save({ bookingChanges: v })} />
+          </div>
+        )}
+        {state.modules.calendar && (
+          <div className="acc-row">
+            <div>
+              <b>Guest sign-in</b>
+              <small>“My bookings” with a code sent by email. {guest.devices > 0 ? `${guest.devices.toLocaleString()} ${guest.devices === 1 ? 'device' : 'devices'} signed in.` : 'No devices signed in.'}</small>
+              {guest.blocker && a.guestSignIn && <small className="acc-warn">{BLOCKER[guest.blocker]}</small>}
+            </div>
+            <div className="acc-actions">
+              {guest.devices > 0 && <button type="button" className="btn sm ghost danger" onClick={signOutAll}>Sign out all</button>}
+              <Switch on={a.guestSignIn} label="Guest sign-in" onChange={(v) => save({ guestSignIn: v })} />
+            </div>
+          </div>
+        )}
+        <div className="acc-row">
+          <div><b>Form responses from the app</b><small>Published forms can be filled in from the app.</small></div>
+          <Switch on={a.forms} label="Form responses from the app" onChange={(v) => save({ forms: v })} />
+        </div>
+        <div className="acc-row">
+          <div><b>Links page</b><small>The app can show your links page.</small></div>
+          <Switch on={a.links} label="Links page" onChange={(v) => save({ links: v })} />
+        </div>
+      </section>
+
+      <section className="card card-pad">
+        <div className="card-head"><b>Limits</b><span className="hint">0 means no limit</span></div>
+        {state.modules.calendar && (
+          <div className="acc-row">
+            <div><b>Bookings per email per day</b><small>New bookings and RSVPs from one address, on the website and in apps. Staff bookings don’t count.</small></div>
+            <Num value={a.bookingsPerEmailDay} min={0} max={1000} label="Bookings per email per day" field="bookingsPerEmailDay" />
+          </div>
+        )}
+        <div className="acc-row">
+          <div><b>Responses per form per day</b><small>From apps. Extra responses are refused until tomorrow.</small></div>
+          <Num value={a.responsesPerFormDay} min={0} max={100000} label="Responses per form per day" field="responsesPerFormDay" />
+        </div>
+        {state.modules.calendar && (
+          <div className="acc-row">
+            <div><b>Who changes rooms, hours and calendars</b><small>In the staff app. Bookings, events and content stay open to all staff.</small></div>
+            <div className="seg" role="group" aria-label="Who changes rooms, hours and calendars">
+              <button type="button" aria-pressed={a.scheduleRoles === 'admins'} onClick={() => a.scheduleRoles !== 'admins' && save({ scheduleRoles: 'admins' })}>Admins + owners</button>
+              <button type="button" aria-pressed={a.scheduleRoles === 'staff'} onClick={() => a.scheduleRoles !== 'staff' && save({ scheduleRoles: 'staff' })}>All staff</button>
+            </div>
+          </div>
+        )}
+      </section>
+    </div>
+  );
+}

package/src/components/MonitoringSettings.tsx

@@ -0,0 +1,112 @@
+import { useEffect, useState } from 'react';
+import type { MonitoringState, MonitorStatus } from '../lib/monitoring';
+
+// Settings → Monitoring: this site's own health, its Uptime Kuma monitors
+// (read from a public Kuma status page) and the scheduler's push URL.
+
+const ENDPOINT = '/api/monitoring';
+async function api(body?: Record<string, unknown>): Promise<MonitoringState> {
+  const res = await fetch(ENDPOINT, {
+    method: body ? 'POST' : 'GET', credentials: 'same-origin',
+    headers: body ? { 'content-type': 'application/json', accept: 'application/json' } : { accept: 'application/json' },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  const data = await res.json().catch(() => null);
+  if (!res.ok) throw new Error(data?.issues?.[0]?.message || data?.error || `${res.status} ${res.statusText || 'Request failed'}`);
+  return data as MonitoringState;
+}
+const errText = (e: unknown) => (e instanceof Error ? e.message : String(e));
+
+function ago(iso: string | null, now = Date.now()) {
+  if (!iso) return '';
+  const s = Math.max(0, Math.round((now - Date.parse(iso)) / 1000));
+  if (s < 60) return `${s} s`;
+  if (s < 3600) return `${Math.round(s / 60)} min`;
+  if (s < 86_400) return `${Math.round(s / 3600)} h`;
+  return `${Math.round(s / 86_400)} d`;
+}
+// 99.98%, 50%, 100%: never rounds a bad day up to 100%
+const pct = (n: number | null) => (n === null ? '' : `${String(Math.floor(n * 10_000) / 100)}%`);
+const WORD: Record<MonitorStatus['status'], string> = { up: 'Up', down: 'Down', pending: 'Pending', maintenance: 'Maintenance', unknown: 'No data' };
+const CHECK: Record<string, string> = { ok: 'OK', down: 'down', stalled: 'stopped', stuck: 'stuck', off: 'off' };
+
+function Tile({ m }: { m: MonitorStatus }) {
+  // segments never break inside ("100%\u00a0(24\u00a0h)")
+  const sub = m.status === 'unknown' ? ['No checks yet']
+    : [`${WORD[m.status]}${m.since ? ` for ${ago(m.since)}` : ''}`, m.uptime24h !== null ? `${pct(m.uptime24h)} (24 h)` : ''].filter(Boolean);
+  return (
+    <div className={`mon-tile${m.status === 'down' ? ' is-down' : ''}`}>
+      <div className="mon-name"><span className={`mon-dot ${m.status}`} aria-hidden="true" />{m.name}</div>
+      <div className="mon-sub">{sub.map((s, i) => <span key={i}>{i > 0 && ' · '}<span className="nw">{s}</span></span>)}</div>
+      {m.status === 'down' && m.message && <div className="mon-msg">{m.message}</div>}
+      <div className="mon-beats" aria-hidden="true">{m.recent.map((b, i) => <i key={i} className={b} />)}</div>
+    </div>
+  );
+}
+
+export default function MonitoringSettings() {
+  const [state, setState] = useState<MonitoringState | null>(null);
+  const [error, setError] = useState('');
+  const [note, setNote] = useState('');
+  const [busy, setBusy] = useState('');
+  const [push, setPush] = useState('');
+  const [page, setPage] = useState('');
+  useEffect(() => { api().then((s) => { setState(s); setPage(s.statusPage); }, (e) => setError(errText(e))); }, []);
+  if (!state) return error ? <p className="flash error">{error}</p> : <div className="ma-skel" aria-busy="true" aria-label="Loading"><i /><i /></div>;
+
+  const run = async (what: string, body: Record<string, unknown>, done: string) => {
+    setBusy(what); setError(''); setNote('');
+    try { const s = await api(body); setState(s); setPage(s.statusPage); setPush(''); setNote(done); }
+    catch (e) { setError(errText(e)); }
+    finally { setBusy(''); }
+  };
+  const save = () => run('save', { action: 'save', statusPage: page, ...(push.trim() ? { pushUrl: push } : {}) }, 'Saved.');
+  const h = state.health;
+  const changed = page.trim() !== state.statusPage || push.trim() !== '';
+
+  return (
+    <div className="mon">
+      {(error || note) && <p className={`flash ${error ? 'error' : ''}`} role="status">{error || note}</p>}
+
+      <div className="mon-self">
+        <div><span className={`mon-dot ${h.status === 'ok' ? 'up' : h.status === 'degraded' ? 'pending' : 'down'}`} aria-hidden="true" /><b>This site</b></div>
+        <span>Database {CHECK[h.checks.database]}</span>
+        <span>Scheduler {CHECK[h.checks.scheduler]}{state.lastRun ? `, last ran ${ago(state.lastRun)} ago` : ', never ran'}</span>
+        <span>Email {CHECK[h.checks.email]}</span>
+        <a href="/api/health" target="_blank" rel="noreferrer">/api/health</a>
+      </div>
+
+      {state.statusPage && state.monitors === null && <p className="flash error">Couldn’t read the status page. Check the address and that the page is published in Kuma.</p>}
+      {state.monitors && (state.monitors.length
+        ? <div className="mon-grid">{state.monitors.map((m) => <Tile key={m.id} m={m} />)}</div>
+        : <p className="hint">The status page has no monitors yet. Add them to it in Kuma.</p>)}
+      {!state.statusPage && (
+        <div className="mon-empty">
+          <b>Set up Uptime Kuma</b>
+          <p>From the site folder, run:</p>
+          <code className="mon-cmd">npx acms monitor kuma --url https://your-site --kuma https://your-kuma</code>
+          <p>It creates the website, app API, staff app API, health and scheduler monitors plus a status page in Kuma, and prints the two addresses to paste below.</p>
+        </div>
+      )}
+
+      <div className="mon-fields">
+        <label className="mon-field">
+          <span>Scheduler heartbeat <small>Kuma push monitor URL{state.pushFromEnv ? ' (set by UPTIME_PUSH_URL on the server)' : ''}</small></span>
+          <div className="mon-inline">
+            <input type="url" inputMode="url" placeholder={state.pushUrl || 'https://uptime.example.com/api/push/…'} value={push} onChange={(e) => setPush(e.currentTarget.value)} disabled={state.pushFromEnv} aria-label="Kuma push URL" />
+            <button type="button" className="btn" disabled={!state.pushUrl || !!busy} onClick={() => run('test', { action: 'test' }, 'Kuma received the test beat.')}>{busy === 'test' ? 'Sending…' : 'Send test'}</button>
+          </div>
+          {state.pushUrl && !state.pushFromEnv && <small>Saved as <code>{state.pushUrl}</code> · paste a new one to replace it</small>}
+        </label>
+        <label className="mon-field">
+          <span>Status page <small>Public Kuma status page with this site’s monitors</small></span>
+          <input type="url" inputMode="url" placeholder="https://uptime.example.com/status/my-site" value={page} onChange={(e) => setPage(e.currentTarget.value)} aria-label="Kuma status page" />
+        </label>
+        <div className="mon-actions">
+          {state.pushUrl && !state.pushFromEnv && <button type="button" className="btn ghost danger" disabled={!!busy} onClick={() => run('save', { action: 'save', pushUrl: '' }, 'Heartbeat removed.')}>Remove heartbeat</button>}
+          <button type="button" className="btn primary" disabled={!changed || !!busy} onClick={save}>{busy === 'save' ? 'Saving…' : 'Save'}</button>
+        </div>
+      </div>
+    </div>
+  );
+}

package/src/layouts/Admin.astro

@@ -4,7 +4,6 @@ import { getRepo } from '../lib/repo';
 import { BRAND } from '../lib/brand';
 import { CONTENT } from '../lib/content';
 import { CALENDAR, bookingsEnabled } from '../lib/calendar/config';
-import { PUSH } from '../lib/push/config';
 import { validateSession, SESSION_COOKIE, OWNER_ENV } from '../lib/auth';
 import ThemeScript from '../components/ThemeScript.astro';
 import CommandPalette from '../components/CommandPalette';
@@ -128,8 +127,8 @@ const groups: { id: string; label: string; items: Item[] }[] = [
       { key: 'design', label: 'Design', href: '/admin/design', icon: icons.design, count: null },
       { key: 'navigation', label: 'Navigation', href: '/admin/navigation', icon: icons.navigation, count: null },
       { key: 'links', label: 'Links page', href: '/admin/links', icon: icons.links, count: links.length },
-      // push notifications: only when acms({ mobile: { push } }) is on, owners only
-      ...(PUSH.enabled && me.role === 'Owner' ? [{ key: 'mobile', label: 'Mobile app', href: '/admin/mobile', icon: icons.phone, count: null }] : []),
+      // app access switches (+ push notifications when acms({ mobile: { push } }) is on), owners only
+      ...(me.role === 'Owner' ? [{ key: 'mobile', label: 'Mobile app', href: '/admin/mobile', icon: icons.phone, count: null }] : []),
     ],
   },
   {

package/src/lib/api.ts

@@ -4,7 +4,8 @@ import { validateSession, OWNER_ENV, SESSION_COOKIE } from './auth';
 import type { ContentRepository } from './repo/types';
 
 export class ApiError extends Error {
-  constructor(public status: number, message: string) { super(message); }
+  /** retryAfter: seconds a 429 should wait (mobile API Retry-After; default 60) */
+  constructor(public status: number, message: string, public retryAfter?: number) { super(message); }
 }
 export const json = (body: unknown, status = 200) => Response.json(body, {
   status, headers: { 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff' },

package/src/lib/backup/content.ts

@@ -38,7 +38,7 @@ export async function exportContent(repo: ContentRepository, now = Date.now()) {
   ]);
   return {
     format: 'acms-backup' as const, version: 6, exportedAt: new Date(now).toISOString(),
-    settings: { ...settings, live: { ...settings.live, mode: 'off' as const, manual: { watchUrl: '', title: 'We’re live', until: 0 } }, ai: { ...settings.ai, enabled: false, encryptedKey: '' }, agent: { ...settings.agent, enabled: false, keyHash: '', keyPrefix: '', allowPublish: false } },
+    settings: { ...settings, live: { ...settings.live, mode: 'off' as const, manual: { watchUrl: '', title: 'We’re live', until: 0 } }, ai: { ...settings.ai, enabled: false, encryptedKey: '' }, agent: { ...settings.agent, enabled: false, keyHash: '', keyPrefix: '', allowPublish: false }, monitoring: { ...settings.monitoring, pushUrl: '' } },
     pages, posts, media, links, tags, navItems, users, redirects,
     calendars: calendars.map(c => ({ ...c, feedToken: '' })), events,
     resources: resources.map(r => ({ ...r, feedToken: '' })), bookingLinks, ...bookingState, places, forms, formSubmissions,

package/src/lib/booking/availability.ts

@@ -147,7 +147,8 @@ export function slotsForDay(ctx: AvailabilityContext, date: string, minutes?: nu
     return out;
   }
   const step = Math.max(5, ctx.link.step) * MIN;
-  const lengths = minutes ? [minutes] : linkLengths(ctx.link);
+  // a requested length must be one the booking type offers (a 30-minute slot can't be held for 8 hours)
+  const lengths = minutes ? linkLengths(ctx.link).filter((l) => l === minutes) : linkLengths(ctx.link);
   const out: Slot[] = [];
   const [y, m, d] = date.split('-').map(Number);
   for (const [a, b] of dayRanges(ctx.resource, ctx.link, date)) {
@@ -195,10 +196,22 @@ export function nextOpenings(ctx: AvailabilityContext, count: number, horizonDay
   return out;
 }
 
+/**
+ * Day bookings run midnight to midnight in the resource zone, so across a DST
+ * change a "1 day" span lasts 23 or 25 hours. Callers send start + n × 1440
+ * minutes; this snaps the end to the real local midnight (other modes unchanged).
+ */
+export function spanEnd(resource: Resource, link: BookingLink, siteTimezone: string, start: number, end: number): number {
+  if (link.mode !== 'day') return end;
+  const tz = resourceZone(resource, siteTimezone);
+  return localMidnight(addDaysYmd(ymd(start, tz), Math.max(1, Math.round((end - start) / DAY))), tz);
+}
+
 // server-side check before an insert (the DB guard backs it up for races)
 export function isBookable(ctx: AvailabilityContext, start: number, end: number): boolean {
   const tz = resourceZone(ctx.resource, ctx.siteTimezone);
-  const minutes = Math.round((end - start) / MIN);
+  // day spans are counted in local days (a 25-hour DST day is still 1440)
+  const minutes = ctx.link.mode === 'day' ? Math.round((end - start) / DAY) * 1440 : Math.round((end - start) / MIN);
   return slotsForDay(ctx, ymd(start, tz), minutes).some((s) => s.start === start && s.end === end);
 }
 

package/src/lib/booking/service.ts

@@ -12,7 +12,7 @@ import { kickEmail } from '../email/service';
 import { manageUrl as manageUrlFor, eventUrl } from '../calendar/config';
 import { eventTimeZone, locationLine } from '../calendar/events';
 import { bookingEmail, whenText, type BookingEmail } from './emails';
-import { holdOf, isBookable, resourceZone, type AvailabilityContext, type Interval } from './availability';
+import { holdOf, isBookable, resourceZone, spanEnd, type AvailabilityContext, type Interval } from './availability';
 import { decideStatus, linkApproval } from './approval';
 import { eventHolds } from './holds';
 
@@ -165,6 +165,54 @@ export function validateBooker(link: Pick<BookingLink, 'questions' | 'askPhone'>
 
 // ---- workflows ---------------------------------------------------------------
 
+// App access limit: new bookings + RSVPs per address per day, on every public
+// channel. Staff adding a booking by hand is never capped.
+async function checkEmailCap(repo: ContentRepository, email: string, source: Booking['source'] | undefined, settings: Settings, now = Date.now()) {
+  const cap = settings.mobileAccess.bookingsPerEmailDay;
+  if (!cap || source === 'admin') return;
+  if (await repo.countBookingsByEmail(email, now - 86_400_000) >= cap) throw new BookingError(429, 'That’s the most bookings one email address can make in a day. Please try again tomorrow or contact us.');
+}
+
+/**
+ * What the booker may still do themselves (manage page, apps). A booking
+ * type's change cutoff closes guest changes that many hours before the
+ * start; staff can always act from the admin.
+ */
+export function guestChanges(b: Booking, link: BookingLink | null, now = Date.now()) {
+  const active = b.status === 'pending' || b.status === 'confirmed';
+  const cutoff = b.kind === 'booking' ? (link?.changeCutoff ?? 0) : 0;
+  const closed = active && cutoff > 0 && b.start - now < cutoff * 3_600_000;
+  const open = active && b.end > now && !closed;
+  return {
+    cancel: open,
+    reschedule: open && b.kind === 'booking' && b.start > now && !!link?.active,
+    // hours before the start when guest changes close; 0 = until it ends
+    cutoffHours: cutoff,
+    closed,
+  };
+}
+
+export async function guestCancel(repo: ContentRepository, b: Booking, opts: FlowOptions): Promise<Booking> {
+  const link = b.linkId ? await repo.getBookingLink(b.linkId) : null;
+  if (b.status === 'cancelled') return b;
+  const can = guestChanges(b, link, opts.now);
+  if (!can.cancel) throw new BookingError(409, can.closed ? `Changes close ${can.cutoffHours} hours before the start. Please contact us to cancel.` : 'This booking can’t be cancelled.');
+  return setBookingStatus(repo, b, 'cancelled', opts);
+}
+
+/** the link as a guest moving a booking sees it: no new time inside the change cutoff */
+export const guestMoveLink = (link: BookingLink): BookingLink =>
+  link.changeCutoff > 0 ? { ...link, minNotice: Math.max(link.minNotice, link.changeCutoff * 60) } : link;
+
+export async function guestReschedule(repo: ContentRepository, b: Booking, start: number, end: number, opts: FlowOptions): Promise<Booking> {
+  const link = b.linkId ? await repo.getBookingLink(b.linkId) : null;
+  const can = guestChanges(b, link, opts.now);
+  if (!can.reschedule) throw new BookingError(409, can.closed ? `Changes close ${can.cutoffHours} hours before the start. Please contact us to move it.` : 'This booking can’t be moved.');
+  // the new time must respect the cutoff too
+  if (link && link.changeCutoff > 0 && start - (opts.now ?? Date.now()) < link.changeCutoff * 3_600_000) throw new BookingError(409, `Pick a time at least ${link.changeCutoff} hours from now.`);
+  return rescheduleBooking(repo, b, start, end, opts);
+}
+
 export async function createResourceBooking(
   repo: ContentRepository,
   args: { resource: Resource; link: BookingLink; start: number; end: number; booker: BookerInput; source?: Booking['source']; status?: BookingStatus },
@@ -173,7 +221,9 @@ export async function createResourceBooking(
   const { resource, link } = args;
   if (!link.active) throw new BookingError(410, 'This booking link is turned off.');
   const settings = await repo.getSettings();
+  args = { ...args, end: spanEnd(resource, link, settings.timezone, args.start, args.end) };
   const booker = validateBooker(link, args.booker);
+  await checkEmailCap(repo, booker.email, args.source, settings, opts.now);
   // staff adding a booking by hand may ignore notice windows, never overlaps
   const ctx = await availabilityContext(repo, resource, link, settings, opts.now ?? Date.now());
   if (args.source !== 'admin' && !isBookable(ctx, args.start, args.end)) throw new BookingError(409, 'That time was just taken or isn’t available. Please pick another.');
@@ -219,6 +269,7 @@ export async function createRsvp(
   if (args.end <= (opts.now ?? Date.now())) throw new BookingError(410, 'This event has already happened.');
   const seats = Math.max(1, Math.min(e.rsvp.maxSeats || 1, Math.floor(args.seats) || 1));
   const booker = validateBooker(null, args.booker);
+  await checkEmailCap(repo, booker.email, args.source, await repo.getSettings(), opts.now);
   const formResponse = e.rsvp.form ? await collectResponse(e.rsvp.form, args.booker.answers ?? {}, args.booker.formVersion) : undefined;
   if (formResponse) booker.answers = displayAnswers(formResponse);
   const b = await repo.createBooking({
@@ -264,6 +315,7 @@ export async function rescheduleBooking(repo: ContentRepository, b: Booking, sta
   if (b.status !== 'pending' && b.status !== 'confirmed') throw new BookingError(409, 'Only active bookings can be moved.');
   const [resource, link, settings] = await Promise.all([repo.getResource(b.resourceId), repo.getBookingLink(b.linkId), repo.getSettings()]);
   if (!resource || !link) throw new BookingError(404, 'This booking’s room or link no longer exists.');
+  end = spanEnd(resource, link, settings.timezone, start, end);
   if (!opts.skipRules) {
     const ctx = await availabilityContext(repo, resource, link, settings, opts.now ?? Date.now(), b.id);
     if (!isBookable(ctx, start, end)) throw new BookingError(409, 'That time isn’t available.');

package/src/lib/calendar/admin.ts

@@ -0,0 +1,41 @@
+import type { ContentRepository } from '../repo/types';
+import type { Calendar } from '../schema';
+import { slugify } from '../schema';
+import { ApiError } from '../api';
+import { normalizeCalendarSrc } from './src';
+import { safeColor } from './events';
+
+// Create or edit a calendar: the admin's Calendar settings and editor apps
+// share these rules (feed URL normalization, unique slug, safe color).
+export interface CalendarInput {
+  name: string; slug?: string; color?: string; description?: string;
+  kind?: 'native' | 'feed'; feedUrl?: string; visibility?: Calendar['visibility'];
+}
+export async function saveCalendar(repo: ContentRepository, id: string | undefined, data: CalendarInput): Promise<Calendar> {
+  const existing = id ? await repo.getCalendar(id) : null;
+  if (id && !existing) throw new ApiError(404, 'Calendar not found.');
+  const kind = existing?.kind ?? data.kind ?? 'native';
+  let feedUrl = existing?.feedUrl ?? '';
+  if (kind === 'feed' && (data.feedUrl !== undefined || !existing)) {
+    const normalized = normalizeCalendarSrc(data.feedUrl ?? '');
+    if (!normalized) throw new ApiError(400, 'Paste a Google Calendar link, a calendar ID, or an .ics feed URL.');
+    feedUrl = normalized;
+  }
+  const base = slugify(data.slug || data.name);
+  let slug = base;
+  for (let n = 2; ; n++) {
+    const clash = await repo.getCalendarBySlug(slug);
+    if (!clash || clash.id === id) break;
+    slug = `${base}-${n}`;
+  }
+  const fields = {
+    name: data.name, slug, color: safeColor(data.color ?? existing?.color ?? '#4f46e5'),
+    description: data.description ?? existing?.description ?? '', feedUrl,
+    visibility: data.visibility ?? existing?.visibility ?? 'public',
+  };
+  if (existing) {
+    await repo.updateCalendar(existing.id, fields);
+    return (await repo.getCalendar(existing.id))!;
+  }
+  return repo.createCalendar({ ...fields, kind });
+}

package/src/lib/editor/me.ts

@@ -5,6 +5,7 @@ import { I18N, extraLocales, localeName } from '../i18n';
 import { translationEngine } from '../translate';
 import { siteOrigin } from '../seo';
 import type { EditorPrincipal } from './auth';
+import { canManageSchedule, isAdmin } from './roles';
 
 /** who is signed in on this device, and what this site lets them do */
 export async function me(repo: ContentRepository, who: EditorPrincipal, url: URL, locals: unknown) {
@@ -25,6 +26,9 @@ export async function me(repo: ContentRepository, who: EditorPrincipal, url: URL
       documents: { edit: true, publish: true },
       sections: { editContent: true, editLocked: owner, publishSection: true, changeLayout: false },
       bookings: bookingsEnabled(),
+      schedule: { view: CALENDAR.enabled, manage: CALENDAR.enabled && canManageSchedule(who, settings), ignoreRules: bookingsEnabled() && isAdmin(who) },
+      forms: { list: true, readResponses: isAdmin(who) },
+      links: { edit: true, editHtml: isAdmin(who) },
     },
   };
 }

package/src/lib/editor/openapi.ts

@@ -4,6 +4,8 @@ import { ActionInput, CreateInput, EventFields, PageFields, PostFields, listQuer
 import { SectionPatch, SectionsQuery, RevisionInput } from './sections';
 import { AiDocInput, AiSectionInput, ReviewDocInput, ReviewSectionInput, SetDocInput, SetSectionInput } from './translations';
 import { BookingActionInput, InboxQuery } from './bookings';
+import { BlockInput, CalendarBody, CalendarPatch, LinkInput, LinkPatch, RescheduleInput, ResourceInput, ResourcePatch, ScheduleQuery, StaffBookingInput } from './schedule';
+import { LinksPut, ResponsesQuery } from './site-data';
 import { pageQuery } from '../mobile/http';
 
 // OpenAPI for editor apps: device sign-in (/api/v1/auth/*) and the bearer-only
@@ -106,7 +108,53 @@ export function editorPaths(jsonSchema: Json) {
         description: 'Images up to 30 MB, documents up to 25 MB; optional variant_<width> WebP fields (max 8). Compress images on the device first.' }),
       options: preflight,
     },
-    [`${P}/bookings`]: { get: op(`${P}/bookings`, 'Bookings inbox (pending first); requires bookings', 'EditorBookingList', { query: InboxQuery }), options: preflight },
+    [`${P}/bookings`]: {
+      get: op(`${P}/bookings`, 'Bookings inbox (pending first); requires bookings', 'EditorBookingList', { query: InboxQuery }),
+      post: op(`${P}/bookings`, 'Book on someone’s behalf (the guest gets the usual emails); requires bookings', 'EditorBooking', { body: StaffBookingInput, write: true, status: 201,
+        description: 'Normal availability rules apply. ignoreRules (administrators and owners) books outside hours and notice, never over another booking.' }),
+      options: preflight,
+    },
+    [`${P}/bookings/{id}/reschedule`]: {
+      post: op(`${P}/bookings/{id}/reschedule`, 'Move a booking (the guest is emailed); ignoreRules for administrators and owners', 'EditorBooking', { body: RescheduleInput, write: true }),
+      options: preflight,
+    },
+    [`${P}/schedule`]: { get: op(`${P}/schedule`, 'Bookings, blocked time, events and subscribed calendars for up to 63 days; requires calendar', 'EditorSchedule', { query: ScheduleQuery.innerType() }), options: preflight },
+    [`${P}/resources`]: {
+      get: op(`${P}/resources`, 'Rooms and services with hours and booking types; requires bookings', 'EditorResourceList'),
+      post: op(`${P}/resources`, 'Add a room or service (schedule role)', 'EditorResource', { body: ResourceInput, write: true, status: 201 }),
+      options: preflight,
+    },
+    [`${P}/resources/{id}`]: {
+      get: op(`${P}/resources/{id}`, 'One room or service', 'EditorResource'),
+      patch: op(`${P}/resources/{id}`, 'Edit a room or service: details, weekly hours, date overrides (schedule role)', 'EditorResource', { body: ResourcePatch, write: true }),
+      delete: op(`${P}/resources/{id}`, 'Delete a room or service (schedule role)', 'EditorDeleted', { write: true }),
+      options: preflight,
+    },
+    [`${P}/resources/{id}/links`]: { post: op(`${P}/resources/{id}/links`, 'Add a booking type (schedule role)', 'EditorBookingLink', { body: LinkInput, write: true, status: 201 }), options: preflight },
+    [`${P}/resources/{id}/links/{linkId}`]: {
+      patch: op(`${P}/resources/{id}/links/{linkId}`, 'Edit a booking type (schedule role)', 'EditorBookingLink', { body: LinkPatch, write: true }),
+      delete: op(`${P}/resources/{id}/links/{linkId}`, 'Delete a booking type (schedule role)', 'EditorDeleted', { write: true }),
+      options: preflight,
+    },
+    [`${P}/resources/{id}/blocks`]: { post: op(`${P}/resources/{id}/blocks`, 'Block time on a room (no booking can land on it)', 'EditorBlock', { body: BlockInput.innerType(), write: true, status: 201 }), options: preflight },
+    [`${P}/resources/{id}/blocks/{blockId}`]: { delete: op(`${P}/resources/{id}/blocks/{blockId}`, 'Remove blocked time', 'EditorDeleted', { write: true }), options: preflight },
+    [`${P}/calendars`]: {
+      get: op(`${P}/calendars`, 'Every calendar, private ones included; requires calendar', 'EditorCalendarList'),
+      post: op(`${P}/calendars`, 'Add a calendar or subscribe to a feed (schedule role)', 'EditorCalendar', { body: CalendarBody, write: true, status: 201 }),
+      options: preflight,
+    },
+    [`${P}/calendars/{id}`]: {
+      patch: op(`${P}/calendars/{id}`, 'Rename, recolor, change visibility or feed (schedule role)', 'EditorCalendar', { body: CalendarPatch, write: true }),
+      delete: op(`${P}/calendars/{id}`, 'Delete a calendar (schedule role)', 'EditorDeleted', { write: true }),
+      options: preflight,
+    },
+    [`${P}/forms`]: { get: op(`${P}/forms`, 'Forms with response counts', 'EditorFormList'), options: preflight },
+    [`${P}/forms/{id}/responses`]: { get: op(`${P}/forms/{id}/responses`, 'Form responses, newest first (administrators and owners)', 'EditorFormResponses', { query: ResponsesQuery }), options: preflight },
+    [`${P}/links`]: {
+      get: op(`${P}/links`, 'The links page: profile and every block (hidden ones included)', 'EditorLinksPage'),
+      put: op(`${P}/links`, 'Replace the links page (profile + blocks in order) at the revision from GET; 409 when someone changed it since (nothing is saved). HTML blocks need an administrator or owner', 'EditorLinksPage', { body: LinksPut, write: true }),
+      options: preflight,
+    },
     ...Object.fromEntries((['approve', 'decline', 'cancel'] as const).map((action) => [`${P}/bookings/{id}/${action}`, {
       post: op(`${P}/bookings/{id}/${action}`, `${action[0].toUpperCase()}${action.slice(1)} a booking (the guest is emailed)`, 'EditorBooking', { body: BookingActionInput, write: true }),
       options: preflight,

package/src/lib/editor/roles.ts

@@ -0,0 +1,20 @@
+import type { Settings } from '../schema';
+import { ApiError } from '../api';
+import type { EditorPrincipal } from './auth';
+
+// Role checks for editor apps. The role is read live on every request
+// (authenticateDevice), so a demotion takes effect on the next call.
+
+const ADMIN = new Set(['administrator', 'owner']);
+export const isAdmin = (who: EditorPrincipal) => ADMIN.has(who.user.role);
+
+/** form responses, raw HTML link blocks, overriding booking rules */
+export function requireAdmin(who: EditorPrincipal, what = 'do this') {
+  if (!isAdmin(who)) throw new ApiError(403, `Only administrators and owners can ${what}.`);
+}
+
+/** rooms, booking types, hours and calendars (Admin → Mobile app decides who) */
+export const canManageSchedule = (who: EditorPrincipal, settings: Settings) => settings.mobileAccess.scheduleRoles === 'staff' || isAdmin(who);
+export function requireScheduleRole(who: EditorPrincipal, settings: Settings) {
+  if (!canManageSchedule(who, settings)) throw new ApiError(403, 'Only administrators and owners can change rooms, booking types, hours and calendars.');
+}