@acms-subir/core 0.3.9 → 0.3.11

package/src/lib/editor/auth.ts

@@ -1,3 +1,6 @@
+import { AUTH } from '../auth/config';
+import { validateMobileBinding, authEnvironment, ClerkUnavailableError } from '../auth/request';
+import type { ClerkBinding } from '../auth/store';
 import { Role } from '../schema';
 import { createHmac } from 'node:crypto';
 import { env } from '../env';
@@ -129,10 +132,12 @@ export function checkConsentTicket(ticket: string, session: string, p: Authorize
 }
 
 /** approve: a one-time code bound to the user, app, return address and challenge */
-export async function issueCode(repo: ContentRepository, user: { id: string; sessionVersion: number }, p: AuthorizeParams, deviceName: string, now = Date.now()): Promise<string> {
+export async function issueCode(repo: ContentRepository, user: { id: string; sessionVersion: number }, p: AuthorizeParams, deviceName: string, now = Date.now(), binding?: ClerkBinding): Promise<string> {
+  if (AUTH.provider === 'clerk' && !binding) throw new ApiError(401, 'Clerk sign-in is required.');
   const code = randomToken(CODE_PREFIX);
   await repo.editor.createCode({ hash: await sha256Hex(code), userId: user.id, clientId: p.clientId, redirectUri: p.redirectUri,
-    challenge: p.codeChallenge, deviceName: cleanDeviceName(deviceName) || 'Phone', sessionVersion: user.sessionVersion, expiresAt: now + EDITOR.codeMs }, now);
+    challenge: p.codeChallenge, authProvider: AUTH.provider, deviceName: cleanDeviceName(deviceName) || 'Phone', sessionVersion: user.sessionVersion, expiresAt: now + EDITOR.codeMs }, now);
+  if (binding) await repo.auth.bindMobile('code', await sha256Hex(code), binding);
   return code;
 }
 
@@ -164,13 +169,28 @@ function tokenResponse(t: { access: string; refresh: string }, user: { id: strin
     user: { id: user.id, name: user.name, email: user.email, role: Role.parse(user.role) }, device };
 }
 
-export async function tokenGrant(repo: ContentRepository, form: Record<string, string>, now = Date.now()): Promise<TokenResponse> {
+async function mobileBindingActive(...args: Parameters<typeof validateMobileBinding>) {
+  try { return await validateMobileBinding(...args); }
+  catch (error) {
+    if (error instanceof ClerkUnavailableError) throw new ApiError(503, error.message);
+    throw error;
+  }
+}
+
+export async function tokenGrant(repo: ContentRepository, form: Record<string, string>, now = Date.now(), locals?: unknown): Promise<TokenResponse> {
   const grant = form.grant_type;
   if (grant === 'authorization_code') {
     const { code = '', code_verifier: verifier = '', redirect_uri: redirectUri = '', client_id: clientId = '' } = form;
     if (!code || !verifier || !redirectUri || !clientId) throw new OAuthError(400, 'invalid_request', 'code, code_verifier, redirect_uri and client_id are required.');
     if (!wellFormed(code, CODE_PREFIX)) throw invalidGrant('The sign-in code is invalid or expired.');
-    const spent = await repo.editor.consumeCode(await sha256Hex(code), now);
+    const hash = await sha256Hex(code);
+    // Provider outages must not burn a usable one-time credential. The later
+    // atomic consume still enforces single use and detects concurrent replays.
+    if (AUTH.provider === 'clerk') {
+      const candidate = await repo.editor.getCode(hash);
+      if (!candidate || candidate.authProvider !== AUTH.provider || !await mobileBindingActive(repo, 'code', hash, candidate.userId, locals)) throw invalidGrant('The original sign-in is no longer active. Sign in again.');
+    }
+    const spent = await repo.editor.consumeCode(hash, now);
     if (!spent) throw invalidGrant('The sign-in code is invalid or expired.');
     const c = spent.code;
     if (spent.reused) {
@@ -182,11 +202,14 @@ export async function tokenGrant(repo: ContentRepository, form: Record<string, s
     // every check runs; the code is already burned whatever the outcome
     const checks = [safeEqual(clientId, c.clientId), safeEqual(redirectUri, c.redirectUri), VERIFIER.test(verifier) && safeEqual(await s256(verifier), c.challenge), allowedRedirect(c.redirectUri)];
     if (checks.includes(false)) throw invalidGrant('The sign-in code doesn’t match this app, return address or verifier.');
+    if (c.authProvider !== AUTH.provider) throw invalidGrant('The original sign-in is no longer active. Sign in again.');
     const user = await liveUser(repo, c.userId, c.sessionVersion);
     if (!user) throw invalidGrant('This account changed since sign-in. Sign in again.');
     const device = { id: crypto.randomUUID(), name: c.deviceName };
     const t = await pair(now);
-    await repo.editor.createDevice({ id: device.id, userId: user.id, name: device.name, clientId: c.clientId, sessionVersion: c.sessionVersion }, t.hashed, now);
+    await repo.editor.createDevice({ id: device.id, userId: user.id, name: device.name, clientId: c.clientId, sessionVersion: c.sessionVersion, authProvider: c.authProvider }, t.hashed, now);
+    const binding = AUTH.provider === 'clerk' ? await repo.auth.mobile('code', c.hash) : null;
+    if (binding) await repo.auth.bindMobile('device', device.id, binding);
     await repo.editor.bindCode(c.hash, device.id);
     await repo.editor.prune(now).catch(() => {});
     return tokenResponse(t.plain, user, device);
@@ -196,6 +219,11 @@ export async function tokenGrant(repo: ContentRepository, form: Record<string, s
     if (!token) throw new OAuthError(400, 'invalid_request', 'refresh_token is required.');
     if (!wellFormed(token, REFRESH_PREFIX)) throw invalidGrant('The refresh token is invalid or expired.');
     const hash = await sha256Hex(token);
+    if (AUTH.provider === 'clerk') {
+      const deviceId = await repo.editor.deviceForToken(hash);
+      const candidate = deviceId ? await repo.editor.getDevice(deviceId) : null;
+      if (!candidate || candidate.revokedAt !== null || candidate.authProvider !== AUTH.provider || !await mobileBindingActive(repo, 'device', candidate.id, candidate.userId, locals)) throw invalidGrant('The original sign-in is no longer active. Sign in again.');
+    }
     const spent = await repo.editor.spendRefresh(hash, now);
     if (!spent) throw invalidGrant('The refresh token is invalid or expired.');
     // A rotated token presented again is theft, except for a short grace: the
@@ -209,6 +237,7 @@ export async function tokenGrant(repo: ContentRepository, form: Record<string, s
     const device = await repo.editor.getDevice(spent.deviceId);
     if (!device || device.revokedAt !== null) throw invalidGrant('This device was signed out. Sign in again.');
     if (form.client_id && !safeEqual(form.client_id, device.clientId)) throw invalidGrant('The refresh token belongs to another app.');
+    if (device.authProvider !== AUTH.provider) throw invalidGrant('The original sign-in is no longer active. Sign in again.');
     const user = await liveUser(repo, device.userId, device.sessionVersion);
     if (!user) {
       await repo.editor.revokeDevice(device.id, 'account changed', now);
@@ -254,6 +283,7 @@ export async function authenticateDevice(request: Request, repo: ContentReposito
     await repo.editor.revokeDevice(access.device.id, 'password changed', now);
     throw new ApiError(401, 'This account changed. Sign in again.');
   }
+  if (access.device.authProvider !== AUTH.provider || (AUTH.provider === 'clerk' && !await mobileBindingActive(repo, 'device', access.device.id, access.user.id, authEnvironment(request), !['GET','HEAD'].includes(request.method)))) throw new ApiError(401, 'The original sign-in is no longer active. Sign in again.');
   await repo.editor.touch(access.device.id, now);
   const { user, device } = access;
   return {

package/src/lib/editor/http.ts

@@ -25,6 +25,7 @@ export function editorRoute(handler: (c: EditorContext) => Promise<unknown>, opt
       let who: EditorPrincipal;
       try { who = await authenticateDevice(context.request, repo, now); }
       catch (error) {
+        if (error instanceof ApiError && error.status === 503) throw error;
         // failed bearer attempts are throttled per client address
         if (!await repo.email.rateLimit(`editor:fail:${await sha256Hex(address(context))}`, 30, 60_000)) throw new ApiError(429, 'Too many requests. Try again in a minute.');
         throw error;
@@ -37,7 +38,9 @@ export function editorRoute(handler: (c: EditorContext) => Promise<unknown>, opt
     } catch (error) {
       // expected failures carry a status (ApiError, BookingError) or zod issues; only surprises are logged (never request data)
       if (typeof (error as { status?: unknown })?.status !== 'number' && !(error instanceof Error && 'issues' in error)) console.error('acms editor api: request failed:', error instanceof Error ? error.message : error);
-      return failure(error);
+      const result = failure(error);
+      if (result.status === 503) result.headers.set('Retry-After', '10');
+      return result;
     }
   };
 }

package/src/lib/editor/me.ts

@@ -5,6 +5,7 @@ import { I18N, extraLocales, localeName } from '../i18n';
 import { translationEngine } from '../translate';
 import { siteOrigin } from '../seo';
 import type { EditorPrincipal } from './auth';
+import { canManageSchedule, isAdmin } from './roles';
 
 /** who is signed in on this device, and what this site lets them do */
 export async function me(repo: ContentRepository, who: EditorPrincipal, url: URL, locals: unknown) {
@@ -25,6 +26,9 @@ export async function me(repo: ContentRepository, who: EditorPrincipal, url: URL
       documents: { edit: true, publish: true },
       sections: { editContent: true, editLocked: owner, publishSection: true, changeLayout: false },
       bookings: bookingsEnabled(),
+      schedule: { view: CALENDAR.enabled, manage: CALENDAR.enabled && canManageSchedule(who, settings), ignoreRules: bookingsEnabled() && isAdmin(who) },
+      forms: { list: true, readResponses: isAdmin(who) },
+      links: { edit: true, editHtml: isAdmin(who) },
     },
   };
 }

package/src/lib/editor/openapi.ts

@@ -4,6 +4,8 @@ import { ActionInput, CreateInput, EventFields, PageFields, PostFields, listQuer
 import { SectionPatch, SectionsQuery, RevisionInput } from './sections';
 import { AiDocInput, AiSectionInput, ReviewDocInput, ReviewSectionInput, SetDocInput, SetSectionInput } from './translations';
 import { BookingActionInput, InboxQuery } from './bookings';
+import { BlockInput, CalendarBody, CalendarPatch, LinkInput, LinkPatch, RescheduleInput, ResourceInput, ResourcePatch, ScheduleQuery, StaffBookingInput } from './schedule';
+import { LinksPut, ResponsesQuery } from './site-data';
 import { pageQuery } from '../mobile/http';
 
 // OpenAPI for editor apps: device sign-in (/api/v1/auth/*) and the bearer-only
@@ -106,7 +108,53 @@ export function editorPaths(jsonSchema: Json) {
         description: 'Images up to 30 MB, documents up to 25 MB; optional variant_<width> WebP fields (max 8). Compress images on the device first.' }),
       options: preflight,
     },
-    [`${P}/bookings`]: { get: op(`${P}/bookings`, 'Bookings inbox (pending first); requires bookings', 'EditorBookingList', { query: InboxQuery }), options: preflight },
+    [`${P}/bookings`]: {
+      get: op(`${P}/bookings`, 'Bookings inbox (pending first); requires bookings', 'EditorBookingList', { query: InboxQuery }),
+      post: op(`${P}/bookings`, 'Book on someone’s behalf (the guest gets the usual emails); requires bookings', 'EditorBooking', { body: StaffBookingInput, write: true, status: 201,
+        description: 'Normal availability rules apply. ignoreRules (administrators and owners) books outside hours and notice, never over another booking.' }),
+      options: preflight,
+    },
+    [`${P}/bookings/{id}/reschedule`]: {
+      post: op(`${P}/bookings/{id}/reschedule`, 'Move a booking (the guest is emailed); ignoreRules for administrators and owners', 'EditorBooking', { body: RescheduleInput, write: true }),
+      options: preflight,
+    },
+    [`${P}/schedule`]: { get: op(`${P}/schedule`, 'Bookings, blocked time, events and subscribed calendars for up to 63 days; requires calendar', 'EditorSchedule', { query: ScheduleQuery.innerType() }), options: preflight },
+    [`${P}/resources`]: {
+      get: op(`${P}/resources`, 'Rooms and services with hours and booking types; requires bookings', 'EditorResourceList'),
+      post: op(`${P}/resources`, 'Add a room or service (schedule role)', 'EditorResource', { body: ResourceInput, write: true, status: 201 }),
+      options: preflight,
+    },
+    [`${P}/resources/{id}`]: {
+      get: op(`${P}/resources/{id}`, 'One room or service', 'EditorResource'),
+      patch: op(`${P}/resources/{id}`, 'Edit a room or service: details, weekly hours, date overrides (schedule role)', 'EditorResource', { body: ResourcePatch, write: true }),
+      delete: op(`${P}/resources/{id}`, 'Delete a room or service (schedule role)', 'EditorDeleted', { write: true }),
+      options: preflight,
+    },
+    [`${P}/resources/{id}/links`]: { post: op(`${P}/resources/{id}/links`, 'Add a booking type (schedule role)', 'EditorBookingLink', { body: LinkInput, write: true, status: 201 }), options: preflight },
+    [`${P}/resources/{id}/links/{linkId}`]: {
+      patch: op(`${P}/resources/{id}/links/{linkId}`, 'Edit a booking type (schedule role)', 'EditorBookingLink', { body: LinkPatch, write: true }),
+      delete: op(`${P}/resources/{id}/links/{linkId}`, 'Delete a booking type (schedule role)', 'EditorDeleted', { write: true }),
+      options: preflight,
+    },
+    [`${P}/resources/{id}/blocks`]: { post: op(`${P}/resources/{id}/blocks`, 'Block time on a room (no booking can land on it)', 'EditorBlock', { body: BlockInput.innerType(), write: true, status: 201 }), options: preflight },
+    [`${P}/resources/{id}/blocks/{blockId}`]: { delete: op(`${P}/resources/{id}/blocks/{blockId}`, 'Remove blocked time', 'EditorDeleted', { write: true }), options: preflight },
+    [`${P}/calendars`]: {
+      get: op(`${P}/calendars`, 'Every calendar, private ones included; requires calendar', 'EditorCalendarList'),
+      post: op(`${P}/calendars`, 'Add a calendar or subscribe to a feed (schedule role)', 'EditorCalendar', { body: CalendarBody, write: true, status: 201 }),
+      options: preflight,
+    },
+    [`${P}/calendars/{id}`]: {
+      patch: op(`${P}/calendars/{id}`, 'Rename, recolor, change visibility or feed (schedule role)', 'EditorCalendar', { body: CalendarPatch, write: true }),
+      delete: op(`${P}/calendars/{id}`, 'Delete a calendar (schedule role)', 'EditorDeleted', { write: true }),
+      options: preflight,
+    },
+    [`${P}/forms`]: { get: op(`${P}/forms`, 'Forms with response counts', 'EditorFormList'), options: preflight },
+    [`${P}/forms/{id}/responses`]: { get: op(`${P}/forms/{id}/responses`, 'Form responses, newest first (administrators and owners)', 'EditorFormResponses', { query: ResponsesQuery }), options: preflight },
+    [`${P}/links`]: {
+      get: op(`${P}/links`, 'The links page: profile and every block (hidden ones included)', 'EditorLinksPage'),
+      put: op(`${P}/links`, 'Replace the links page (profile + blocks in order) at the revision from GET; 409 when someone changed it since (nothing is saved). HTML blocks need an administrator or owner', 'EditorLinksPage', { body: LinksPut, write: true }),
+      options: preflight,
+    },
     ...Object.fromEntries((['approve', 'decline', 'cancel'] as const).map((action) => [`${P}/bookings/{id}/${action}`, {
       post: op(`${P}/bookings/{id}/${action}`, `${action[0].toUpperCase()}${action.slice(1)} a booking (the guest is emailed)`, 'EditorBooking', { body: BookingActionInput, write: true }),
       options: preflight,

package/src/lib/editor/roles.ts

@@ -0,0 +1,20 @@
+import type { Settings } from '../schema';
+import { ApiError } from '../api';
+import type { EditorPrincipal } from './auth';
+
+// Role checks for editor apps. The role is read live on every request
+// (authenticateDevice), so a demotion takes effect on the next call.
+
+const ADMIN = new Set(['administrator', 'owner']);
+export const isAdmin = (who: EditorPrincipal) => ADMIN.has(who.user.role);
+
+/** form responses, raw HTML link blocks, overriding booking rules */
+export function requireAdmin(who: EditorPrincipal, what = 'do this') {
+  if (!isAdmin(who)) throw new ApiError(403, `Only administrators and owners can ${what}.`);
+}
+
+/** rooms, booking types, hours and calendars (Admin → Mobile app decides who) */
+export const canManageSchedule = (who: EditorPrincipal, settings: Settings) => settings.mobileAccess.scheduleRoles === 'staff' || isAdmin(who);
+export function requireScheduleRole(who: EditorPrincipal, settings: Settings) {
+  if (!canManageSchedule(who, settings)) throw new ApiError(403, 'Only administrators and owners can change rooms, booking types, hours and calendars.');
+}

package/src/lib/editor/schedule.ts

@@ -0,0 +1,340 @@
+import { z } from 'zod';
+import type { ContentRepository } from '../repo/types';
+import type { Booking, BookingLink, Resource, Settings } from '../schema';
+import { ApiError } from '../api';
+import { ApprovalMode, ApprovalRules, BookingMode, DateOverride, QUESTION_TYPES, TimeRange, WeeklyHours, slugify } from '../schema';
+import { CALENDAR, bookingsEnabled } from '../calendar/config';
+import { collectViewEvents } from '../calendar/data';
+import { isValidTimeZone, safeColor } from '../calendar/events';
+import { describeRepeat } from '../calendar/rrule';
+import { zonedToUtc } from '../calendar/ics';
+import { normalizeCalendarSrc } from '../calendar/src';
+import { saveCalendar } from '../calendar/admin';
+import { availabilityContext, bookingJson, createBlock, createResourceBooking, rescheduleBooking } from '../booking/service';
+import { isBookable } from '../booking/availability';
+import { siteOrigin } from '../seo';
+import { waitUntilFrom } from '../webhooks';
+import { isoDay } from '../mobile/http';
+import type { EditorContext } from './http';
+import { requireBookings } from './bookings';
+import { requireAdmin, requireScheduleRole, canManageSchedule } from './roles';
+
+// The schedule from editor apps: one-request week/month view, booking on
+// someone's behalf, moving bookings, blocked time, and setup (rooms, booking
+// types, hours, calendars). Setup writes need the schedule role (Admin →
+// Mobile app; administrators + owners by default). Every write goes through
+// the same services as the web admin and lands in the audit log.
+
+const DAY = 86_400_000;
+const iso = (n: number) => new Date(n).toISOString();
+const flow = (c: EditorContext, settings: Settings) => ({ origin: siteOrigin(settings, c.context.url), locals: c.context.locals, waitUntil: waitUntilFrom(c.context.locals) });
+function requireCalendarModule() { if (!CALENDAR.enabled) throw new ApiError(404, 'The calendar is turned off on this site.'); }
+
+// ---- schedule view -----------------------------------------------------------
+
+export const ScheduleQuery = z.object({ from: isoDay, to: isoDay, resource: z.string().max(200).optional() }).strict()
+  .refine((q) => q.to >= q.from && Date.parse(q.to) - Date.parse(q.from) <= 62 * DAY, 'Use a range of 1 to 63 days.');
+
+export async function schedule(c: EditorContext, q: z.infer<typeof ScheduleQuery>) {
+  requireCalendarModule();
+  const settings = await c.repo.getSettings();
+  const tz = settings.timezone || 'UTC';
+  const at = (d: string) => zonedToUtc(+d.slice(0, 4), +d.slice(5, 7), +d.slice(8, 10), 0, 0, 0, tz);
+  // site-local midnights: from the start of `from` to the end of `to`
+  const startMs = at(q.from), endMs = at(new Date(Date.parse(q.to) + DAY).toISOString().slice(0, 10));
+  const win = { displayTz: tz, now: Date.now(), windowStartMs: startMs, windowEndMs: endMs };
+  const resources = bookingsEnabled() ? await c.repo.listResources() : [];
+  const resource = q.resource ? resources.find((r) => r.id === q.resource || r.slug === q.resource) : null;
+  if (q.resource && !resource) throw new ApiError(404, 'Room or service not found.');
+  const [{ events, calendars, errors }, bookings] = await Promise.all([
+    collectViewEvents(c.repo, settings, win, { audience: 'admin', includeFeeds: true, includeBookings: false }),
+    bookingsEnabled() ? c.repo.listBookings({ from: startMs, to: win.windowEndMs, resourceId: resource?.id, statuses: ['pending', 'confirmed'], kinds: ['booking', 'block'] }) : Promise.resolve([] as Booking[]),
+  ]);
+  const calById = new Map(calendars.map((cal) => [cal.id, cal]));
+  const items = [
+    ...events.filter((v) => !resource || v.event?.roomHold.resourceIds.includes(resource.id)).map((v) => {
+      const e = v.event;
+      const cal = e ? e.calendarIds.map((id) => calById.get(id)).find(Boolean) : calendars.find((x) => x.name === v.calendarName && x.kind === 'feed');
+      return {
+        kind: e ? 'event' as const : 'feed' as const, id: e?.id ?? '', title: v.title,
+        start: iso(v.start), end: iso(v.end), allDay: v.allDay, status: e ? e.status : 'feed',
+        calendarId: cal?.id ?? '', color: v.color ?? (cal ? safeColor(cal.color) : '#8a8378'),
+        location: v.location, cancelled: Boolean(v.cancelled), repeat: e?.rrule ? describeRepeat(e.rrule, e.start) : '',
+        resourceIds: e?.roomHold.resourceIds ?? [],
+      };
+    }),
+    ...bookings.map((b) => ({
+      kind: b.kind as 'booking' | 'block', id: b.id, title: b.kind === 'block' ? b.notes || 'Blocked' : b.name,
+      start: iso(b.start), end: iso(b.end), allDay: false, status: b.status, resourceId: b.resourceId, linkId: b.linkId || null,
+      name: b.name, email: b.email, phone: b.phone, notes: b.notes,
+    })),
+  ].sort((a, b) => a.start.localeCompare(b.start));
+  return {
+    timezone: tz, from: q.from, to: q.to,
+    resources: resources.map((r) => ({ id: r.id, slug: r.slug, name: r.name, kind: r.kind })),
+    calendars: calendars.map((cal) => ({ id: cal.id, name: cal.name, color: safeColor(cal.color), kind: cal.kind, visibility: cal.visibility })),
+    items, errors,
+  };
+}
+
+// ---- bookings: on someone's behalf, moving ----------------------------------
+
+async function resourceAndLink(repo: ContentRepository, resourceRef: string, linkRef: string) {
+  const resource = await repo.getResource(resourceRef) ?? await repo.getResourceBySlug(resourceRef);
+  const link = resource ? (await repo.listBookingLinks(resource.id)).find((l) => l.id === linkRef || l.slug === linkRef) ?? null : null;
+  if (!resource || !link) throw new ApiError(404, 'Room or booking type not found.');
+  return { resource, link };
+}
+
+export const StaffBookingInput = z.object({
+  resource: z.string().min(1).max(200), link: z.string().min(1).max(200),
+  start: z.string().datetime({ offset: true }), minutes: z.number().int().min(1).max(44640).optional(),
+  name: z.string().trim().min(1).max(120), email: z.string().trim().email().max(200), phone: z.string().trim().max(40).default(''),
+  // question id → answer, as on the public form
+  answers: z.record(z.string().max(2000)).default({}),
+  status: z.enum(['confirmed', 'pending']).default('confirmed'),
+  // book outside hours/notice (never over another booking); administrators and owners only
+  ignoreRules: z.boolean().default(false),
+}).strict();
+
+export async function staffBook(c: EditorContext, body: z.infer<typeof StaffBookingInput>) {
+  requireBookings();
+  if (body.ignoreRules) requireAdmin(c.who, 'book outside the normal rules');
+  const settings = await c.repo.getSettings();
+  const { resource, link } = await resourceAndLink(c.repo, body.resource, body.link);
+  const start = Date.parse(body.start);
+  const minutes = body.minutes ?? (link.mode === 'day' ? 1440 : link.mode === 'range' ? link.lengths[0] ?? link.duration : link.duration);
+  const end = start + minutes * 60_000;
+  if (!body.ignoreRules && !isBookable(await availabilityContext(c.repo, resource, link, settings, Date.now()), start, end)) throw new ApiError(409, 'That time isn’t available. Pick another, or (as an administrator) book it outside the rules.');
+  // source 'admin' skips the rule check inside (done above) but never overlaps
+  const b = await createResourceBooking(c.repo, { resource, link, start, end, status: body.status, source: 'admin',
+    booker: { name: body.name, email: body.email, phone: body.phone, answers: body.answers } }, flow(c, settings));
+  return staffBookingView(b, resource, link);
+}
+
+export const RescheduleInput = z.object({
+  start: z.string().datetime({ offset: true }), minutes: z.number().int().min(1).max(44640).optional(),
+  ignoreRules: z.boolean().default(false),
+}).strict();
+export async function staffReschedule(c: EditorContext, id: string, body: z.infer<typeof RescheduleInput>) {
+  requireBookings();
+  if (body.ignoreRules) requireAdmin(c.who, 'move bookings outside the normal rules');
+  const b = await c.repo.getBooking(id);
+  if (!b || b.kind !== 'booking') throw new ApiError(404, 'Booking not found.');
+  const settings = await c.repo.getSettings();
+  const start = Date.parse(body.start);
+  const minutes = body.minutes ?? Math.round((b.end - b.start) / 60_000);
+  const next = await rescheduleBooking(c.repo, b, start, start + minutes * 60_000, { ...flow(c, settings), skipRules: body.ignoreRules });
+  const [resource, link] = await Promise.all([c.repo.getResource(next.resourceId), c.repo.getBookingLink(next.linkId)]);
+  return staffBookingView(next, resource, link);
+}
+
+function staffBookingView(b: Booking, resource: Resource | null, link: BookingLink | null) {
+  return { ...bookingJson(b), title: [resource?.name, link?.name].filter(Boolean).join(' · ') || 'Booking', notes: b.notes, updatedAt: iso(b.updatedAt) };
+}
+
+// ---- blocked time -------------------------------------------------------------
+
+export const BlockInput = z.object({
+  start: z.string().datetime({ offset: true }), end: z.string().datetime({ offset: true }), note: z.string().trim().max(500).default(''),
+}).strict().refine((b) => Date.parse(b.end) > Date.parse(b.start) && Date.parse(b.end) - Date.parse(b.start) <= 366 * DAY, 'The block must end after it starts (up to a year).');
+export async function addBlock(c: EditorContext, resourceId: string, body: z.infer<typeof BlockInput>) {
+  requireBookings();
+  const resource = await c.repo.getResource(resourceId);
+  if (!resource) throw new ApiError(404, 'Room or service not found.');
+  const b = await createBlock(c.repo, resource, Date.parse(body.start), Date.parse(body.end), body.note);
+  if (!b) throw new ApiError(409, 'That time overlaps a booking. Move or cancel it first.');
+  return { id: b.id, resourceId: resource.id, start: iso(b.start), end: iso(b.end), note: b.notes };
+}
+export async function removeBlock(c: EditorContext, resourceId: string, blockId: string) {
+  requireBookings();
+  const b = await c.repo.getBooking(blockId);
+  if (!b || b.kind !== 'block' || b.resourceId !== resourceId) throw new ApiError(404, 'Blocked time not found.');
+  await c.repo.deleteBooking(b.id);
+  return { id: b.id, deleted: true as const };
+}
+
+// ---- rooms and services -------------------------------------------------------
+
+// a real clock time; as in the booking engine an end of 00:00 means midnight (end of day)
+const clock = z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/, 'Use a 24-hour time like 09:30.');
+const hhmm = (s: string, end = false) => (end && s === '00:00' ? 1440 : Number(s.slice(0, 2)) * 60 + Number(s.slice(3, 5)));
+const Range = TimeRange.extend({ start: clock, end: clock }).refine((r) => hhmm(r.start) < hhmm(r.end, true), 'Each time range must end after it starts.');
+const Hours = WeeklyHours.extend(Object.fromEntries(['su', 'mo', 'tu', 'we', 'th', 'fr', 'sa'].map((d) => [d, z.array(Range).max(12).default([])])) as Record<'su', z.ZodDefault<z.ZodArray<typeof Range>>>);
+// endDate: leave out (or '') for a single day
+const Override = DateOverride.extend({
+  ranges: z.array(Range).max(12).default([]), label: z.string().max(120).default(''),
+}).refine((o) => !o.endDate || o.endDate >= o.date, 'An override must end on or after its first day.');
+const imageUrl = z.string().max(1000).refine((v) => !v || /^(https?:\/\/|\/)/.test(v), 'Use an http(s) or site path image.');
+
+export const ResourceInput = z.object({
+  name: z.string().trim().min(1).max(120), slug: z.string().max(120).optional(), kind: z.string().trim().max(40).optional(),
+  description: z.string().max(2000).optional(), photo: imageUrl.optional(), capacity: z.number().int().min(1).max(100000).nullable().optional(),
+  amenities: z.array(z.string().trim().min(1).max(80)).max(20).optional(),
+  timezone: z.string().max(64).refine((t) => !t || isValidTimeZone(t), 'Unknown timezone.').optional(),
+  hours: Hours.optional(), overrides: z.array(Override).max(200).optional(),
+  visibility: z.enum(['public', 'unlisted']).optional(), showOnCalendar: z.boolean().optional(), placeId: z.string().max(100).optional(),
+  // ICS / Google calendars whose events block this room (fetched like calendar feeds)
+  busyFeeds: z.array(z.string().max(2000)).max(10).optional(),
+  notifyEmails: z.array(z.string().trim().email().max(200)).max(10).optional(),
+}).strict();
+export const ResourcePatch = ResourceInput.partial();
+
+async function uniqueResourceSlug(repo: ContentRepository, wanted: string, id?: string) {
+  const base = slugify(wanted) || 'room';
+  for (let n = 1; ; n++) {
+    const slug = n === 1 ? base : `${base}-${n}`;
+    const hit = await repo.getResourceBySlug(slug);
+    if (!hit || hit.id === id) return slug;
+  }
+}
+async function resourceFields(repo: ContentRepository, body: z.infer<typeof ResourcePatch>) {
+  const out: Partial<Resource> = { ...body } as Partial<Resource>;
+  delete (out as { slug?: string }).slug;
+  if (body.busyFeeds) {
+    const feeds = body.busyFeeds.map((f) => normalizeCalendarSrc(f));
+    if (feeds.some((f) => !f)) throw new ApiError(400, 'Each busy calendar must be an ICS or Google Calendar link.');
+    out.busyFeeds = feeds as string[];
+  }
+  if (body.placeId) { if (!(await repo.listPlaces()).some((p) => p.id === body.placeId)) throw new ApiError(400, 'Unknown place.'); }
+  return out;
+}
+function resourceView(r: Resource, links: BookingLink[], canManage: boolean) {
+  // the staff feed token is a secret; it never leaves the web admin. Busy
+  // calendars are often private Google "secret address" links: setup only.
+  const { feedToken: _secret, ...rest } = r;
+  return { ...rest, busyFeeds: canManage ? r.busyFeeds : [], createdAt: iso(r.createdAt), updatedAt: iso(r.updatedAt), links: links.filter((l) => l.resourceId === r.id).map(linkView) };
+}
+const linkView = (l: BookingLink) => ({ ...l, createdAt: iso(l.createdAt), updatedAt: iso(l.updatedAt) });
+
+export async function listResourcesFor(c: EditorContext) {
+  requireBookings();
+  const [resources, links, settings] = await Promise.all([c.repo.listResources(), c.repo.listBookingLinks(), c.repo.getSettings()]);
+  const canEdit = canManageSchedule(c.who, settings);
+  return { canEdit, resources: resources.map((r) => resourceView(r, links, canEdit)) };
+}
+export async function getResourceFor(c: EditorContext, id: string) {
+  requireBookings();
+  const r = await c.repo.getResource(id);
+  if (!r) throw new ApiError(404, 'Room or service not found.');
+  return resourceView(r, await c.repo.listBookingLinks(r.id), canManageSchedule(c.who, await c.repo.getSettings()));
+}
+export async function createResourceFor(c: EditorContext, body: z.infer<typeof ResourceInput>) {
+  requireBookings();
+  requireScheduleRole(c.who, await c.repo.getSettings());
+  const r = await c.repo.createResource({ ...(await resourceFields(c.repo, body)), name: body.name, slug: await uniqueResourceSlug(c.repo, body.slug || body.name) });
+  return resourceView(r, [], true);
+}
+export async function updateResourceFor(c: EditorContext, id: string, body: z.infer<typeof ResourcePatch>) {
+  requireBookings();
+  requireScheduleRole(c.who, await c.repo.getSettings());
+  const cur = await c.repo.getResource(id);
+  if (!cur) throw new ApiError(404, 'Room or service not found.');
+  await c.repo.updateResource(id, { ...(await resourceFields(c.repo, body)), ...(body.slug !== undefined ? { slug: await uniqueResourceSlug(c.repo, body.slug || cur.name, id) } : {}) });
+  return getResourceFor(c, id);
+}
+export async function deleteResourceFor(c: EditorContext, id: string) {
+  requireBookings();
+  requireScheduleRole(c.who, await c.repo.getSettings());
+  if (!await c.repo.getResource(id)) throw new ApiError(404, 'Room or service not found.');
+  await c.repo.deleteResource(id);
+  return { id, deleted: true as const };
+}
+
+// ---- booking types (links) ----------------------------------------------------
+
+const Question = z.object({
+  id: z.string().regex(/^[a-zA-Z0-9_-]{1,40}$/), label: z.string().trim().min(1).max(200), type: z.enum(QUESTION_TYPES).default('text'),
+  required: z.boolean().default(false), options: z.array(z.string().trim().min(1).max(200)).max(50).default([]), help: z.string().max(300).default(''),
+}).strict();
+export const LinkInput = z.object({
+  name: z.string().trim().min(1).max(120), slug: z.string().max(120).optional(), description: z.string().max(2000).optional(),
+  mode: BookingMode.optional(), duration: z.number().int().min(5).max(1440).optional(), lengths: z.array(z.number().int().min(5).max(1440)).max(12).optional(),
+  minDays: z.number().int().min(1).max(60).optional(), maxDays: z.number().int().min(1).max(60).optional(), step: z.number().int().min(5).max(240).optional(),
+  bufferBefore: z.number().int().min(0).max(480).optional(), bufferAfter: z.number().int().min(0).max(480).optional(),
+  minNotice: z.number().int().min(0).max(86_400).optional(), maxAdvance: z.number().int().min(1).max(730).optional(), perDayCap: z.number().int().min(0).max(100).optional(),
+  hours: Hours.nullable().optional(), approval: z.union([ApprovalMode, z.literal('default')]).optional(), approvalRules: ApprovalRules.optional(),
+  visibility: z.enum(['public', 'unlisted']).optional(), askPhone: z.boolean().optional(), questions: z.array(Question).max(20).optional(),
+  confirmMessage: z.string().max(1000).optional(), redirectUrl: z.string().max(1000).refine((v) => !v || /^https?:\/\//.test(v), 'Use an http(s) URL.').optional(),
+  active: z.boolean().optional(),
+  changeCutoff: z.number().int().min(0).max(8760).optional(),
+}).strict();
+export const LinkPatch = LinkInput.partial();
+
+async function uniqueLinkSlug(repo: ContentRepository, resourceId: string, wanted: string, id?: string) {
+  const base = slugify(wanted) || 'booking';
+  for (let n = 1; ; n++) {
+    const slug = n === 1 ? base : `${base}-${n}`;
+    const hit = await repo.getBookingLinkBySlug(resourceId, slug);
+    if (!hit || hit.id === id) return slug;
+  }
+}
+async function linkOf(repo: ContentRepository, resourceId: string, linkId: string) {
+  const l = await repo.getBookingLink(linkId);
+  if (!l || l.resourceId !== resourceId) throw new ApiError(404, 'Booking type not found.');
+  return l;
+}
+export async function createLinkFor(c: EditorContext, resourceId: string, body: z.infer<typeof LinkInput>) {
+  requireBookings();
+  requireScheduleRole(c.who, await c.repo.getSettings());
+  if (!await c.repo.getResource(resourceId)) throw new ApiError(404, 'Room or service not found.');
+  const { slug, ...rest } = body;
+  const created = await c.repo.createBookingLink({ resourceId, name: body.name, slug: await uniqueLinkSlug(c.repo, resourceId, slug || body.name) });
+  if (Object.keys(rest).length > 1) await c.repo.updateBookingLink(created.id, rest);
+  return linkView((await c.repo.getBookingLink(created.id))!);
+}
+export async function updateLinkFor(c: EditorContext, resourceId: string, linkId: string, body: z.infer<typeof LinkPatch>) {
+  requireBookings();
+  requireScheduleRole(c.who, await c.repo.getSettings());
+  const cur = await linkOf(c.repo, resourceId, linkId);
+  const { slug, ...rest } = body;
+  await c.repo.updateBookingLink(cur.id, { ...rest, ...(slug !== undefined ? { slug: await uniqueLinkSlug(c.repo, resourceId, slug || cur.name, cur.id) } : {}) });
+  return linkView((await c.repo.getBookingLink(cur.id))!);
+}
+export async function deleteLinkFor(c: EditorContext, resourceId: string, linkId: string) {
+  requireBookings();
+  requireScheduleRole(c.who, await c.repo.getSettings());
+  const cur = await linkOf(c.repo, resourceId, linkId);
+  await c.repo.deleteBookingLink(cur.id);
+  return { id: cur.id, deleted: true as const };
+}
+
+// ---- calendars ----------------------------------------------------------------
+
+export const CalendarBody = z.object({
+  name: z.string().trim().min(1).max(120), slug: z.string().max(120).optional(), color: z.string().max(20).optional(),
+  description: z.string().max(1000).optional(), kind: z.enum(['native', 'feed']).optional(), feedUrl: z.string().max(2000).optional(),
+  visibility: z.enum(['public', 'unlisted', 'private']).optional(),
+}).strict();
+export const CalendarPatch = CalendarBody.omit({ kind: true }).partial();
+const calendarView = (cal: Awaited<ReturnType<ContentRepository['listCalendars']>>[number], canManage = true) => {
+  // the private feed token stays in the web admin; a subscribed feed's URL can be a secret link (setup only)
+  const { feedToken: _secret, ...rest } = cal;
+  return { ...rest, feedUrl: canManage ? cal.feedUrl : '', createdAt: iso(cal.createdAt), updatedAt: iso(cal.updatedAt) };
+};
+export async function listCalendarsFor(c: EditorContext) {
+  requireCalendarModule();
+  const [list, settings] = await Promise.all([c.repo.listCalendars(), c.repo.getSettings()]);
+  const canEdit = canManageSchedule(c.who, settings);
+  return { canEdit, calendars: list.map((cal) => calendarView(cal, canEdit)) };
+}
+export async function createCalendarFor(c: EditorContext, body: z.infer<typeof CalendarBody>) {
+  requireCalendarModule();
+  requireScheduleRole(c.who, await c.repo.getSettings());
+  return calendarView(await saveCalendar(c.repo, undefined, body));
+}
+export async function updateCalendarFor(c: EditorContext, id: string, body: z.infer<typeof CalendarPatch>) {
+  requireCalendarModule();
+  requireScheduleRole(c.who, await c.repo.getSettings());
+  const cur = await c.repo.getCalendar(id);
+  if (!cur) throw new ApiError(404, 'Calendar not found.');
+  return calendarView(await saveCalendar(c.repo, id, { ...body, name: body.name ?? cur.name, slug: body.slug ?? cur.slug }));
+}
+export async function deleteCalendarFor(c: EditorContext, id: string) {
+  requireCalendarModule();
+  requireScheduleRole(c.who, await c.repo.getSettings());
+  if (!await c.repo.getCalendar(id)) throw new ApiError(404, 'Calendar not found.');
+  await c.repo.deleteCalendar(id);
+  return { id, deleted: true as const };
+}
+

package/src/lib/editor/schemas.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { FormDefinition } from '../forms/schema';
-import { Booking } from '../schema';
+import { Booking, BookingLink, Calendar, LinkKind, Resource } from '../schema';
 
 // Response shapes of the editor-app API (OpenAPI components, client types).
 const str = z.string(), bool = z.boolean(), num = z.number(), date = str.datetime();
@@ -25,6 +25,10 @@ export const EditorMe = z.object({
     documents: z.object({ edit: bool, publish: bool }),
     sections: z.object({ editContent: bool, editLocked: bool, publishSection: bool, changeLayout: bool }),
     bookings: bool,
+    // rooms, booking types, hours and calendars; book or move outside the rules
+    schedule: z.object({ view: bool, manage: bool, ignoreRules: bool }),
+    forms: z.object({ list: bool, readResponses: bool }),
+    links: z.object({ edit: bool, editHtml: bool }),
   }),
 });
 
@@ -84,6 +88,37 @@ export const EditorBooking = Booking.pick({ id: true, kind: true, status: true,
   .extend({ start: date, end: date, resourceId: str.nullable(), linkId: str.nullable(), eventId: str.nullable(), createdAt: date, updatedAt: date, title: str });
 export const EditorBookingList = z.object({ pending: num.int(), items: z.array(EditorBooking), pagination: Pagination });
 
+// ---- schedule, setup, forms, links page ----
+export const EditorSchedule = z.object({
+  timezone: str, from: str, to: str,
+  resources: z.array(z.object({ id: str, slug: str, name: str, kind: str })),
+  calendars: z.array(z.object({ id: str, name: str, color: str, kind: z.enum(['native', 'feed']), visibility: z.enum(['public', 'unlisted', 'private']) })),
+  items: z.array(z.union([
+    z.object({ kind: z.enum(['event', 'feed']), id: str, title: str, start: date, end: date, allDay: bool, status: str, calendarId: str, color: str, location: str, cancelled: bool, repeat: str, resourceIds: z.array(str) }),
+    z.object({ kind: z.enum(['booking', 'block']), id: str, title: str, start: date, end: date, allDay: bool, status: z.enum(['pending', 'confirmed']), resourceId: str, linkId: str.nullable(), name: str, email: str, phone: str, notes: str }),
+  ])),
+  errors: z.array(str),
+});
+export const EditorBookingLink = BookingLink.extend({ createdAt: date, updatedAt: date });
+export const EditorResource = Resource.omit({ feedToken: true }).extend({ createdAt: date, updatedAt: date, links: z.array(EditorBookingLink) });
+export const EditorResourceList = z.object({ canEdit: bool, resources: z.array(EditorResource) });
+export const EditorBlock = z.object({ id: str, resourceId: str, start: date, end: date, note: str });
+export const EditorCalendar = Calendar.omit({ feedToken: true }).extend({ createdAt: date, updatedAt: date });
+export const EditorCalendarList = z.object({ canEdit: bool, calendars: z.array(EditorCalendar) });
+export const EditorDeleted = z.object({ id: str, deleted: z.literal(true) });
+export const EditorFormList = z.object({ canReadResponses: bool, forms: z.array(z.object({
+  id: str, name: str, title: str, purpose: z.enum(['event', 'general']), status: z.enum(['draft', 'published', 'archived']), hasDraft: bool,
+  responses: num.int(), lastResponseAt: date.nullable(), updatedAt: date.nullable(),
+})) });
+export const EditorFormResponses = z.object({
+  form: z.object({ id: str, name: str }),
+  items: z.array(z.object({ id: str, createdAt: date, answers: z.array(z.object({ label: str, value: str })) })),
+  pagination: Pagination,
+});
+export const EditorLinksPage = z.object({ revision: num.int(), name: str, bio: str, avatar: str, canEditHtml: bool, items: z.array(z.object({
+  id: str, kind: LinkKind, label: str, url: str, icon: str, html: str, meta: z.record(z.unknown()), clicks: num.int(),
+})) });
+
 /** documented request body for POST /api/v1/auth/token (form-encoded or JSON) */
 export const EditorTokenRequest = z.discriminatedUnion('grant_type', [
   z.object({ grant_type: z.literal('authorization_code'), code: str, code_verifier: str, redirect_uri: str, client_id: str }).strict(),