@medalsocial/booking 0.0.0-placeholder.0 → 0.2.0

package/dist/core/portal/dto.mjs

@@ -0,0 +1,142 @@
+import { stylistDisplayName } from "../display-name.mjs";
+import { createPaths } from "../paths.mjs";
+//#region src/core/portal/dto.ts
+function stringOrNull(value) {
+	return typeof value === "string" && value !== "" ? value : null;
+}
+/** 1–12, or `null` for anything else — absent, `null`, or nonsense. */
+function monthOrNull(value) {
+	return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 12 ? value : null;
+}
+function yearOrNull(value) {
+	return typeof value === "number" && Number.isInteger(value) ? value : null;
+}
+/**
+* The person behind one `family` entry.
+*
+* By id where Medal sends one (SP10 puts `person_id` on every entry). Without
+* it — today's Medal — by name AND year among the active guardian-type
+* persons, and only when exactly ONE matches: that is the same pair Medal's
+* own `PATCH /me {family}` matches on, so an id found this way is the row that
+* patch would edit. Two same-named, same-year rows are nobody in particular.
+*/
+function personFor(member, persons) {
+	const id = stringOrNull(member.person_id);
+	if (id !== null) return persons.find((person) => person.person_id === id);
+	const twins = persons.filter((person) => person.active !== false && person.relation_type === "guardian" && person.name === member.name && person.birth_year === member.birth_year);
+	return twins.length === 1 ? twins[0] : void 0;
+}
+function toFamilyMemberDto(member, persons) {
+	const person = personFor(member, persons);
+	return {
+		personId: stringOrNull(member.person_id) ?? person?.person_id ?? null,
+		name: member.name,
+		birthYear: member.birth_year,
+		birthMonth: monthOrNull(member.birth_month) ?? monthOrNull(person?.birth_month),
+		notes: stringOrNull(person?.notes),
+		preferredResourceId: stringOrNull(person?.preferred_resource_id)
+	};
+}
+/** Whether the wire carries SP10's person fields at all; see `personDetails`. */
+function speaksPersonDetails(family, persons) {
+	return family.some((member) => "person_id" in member || "birth_month" in member) || persons.some((person) => "birth_month" in person || "preferred_resource_id" in person);
+}
+/**
+* Nulls stay nulls. The page decides what a missing surname or phone number
+* reads as, and a `''` here would make «not given» and «given as blank»
+* indistinguishable to the form that edits them.
+*/
+function toPortalProfileDto(profile) {
+	const family = profile.family;
+	const persons = Array.isArray(profile.persons) ? profile.persons : [];
+	return {
+		contactId: profile.contact_id,
+		email: profile.email,
+		firstName: profile.first_name,
+		lastName: profile.last_name,
+		phone: profile.phone,
+		family: family.map((member) => toFamilyMemberDto(member, persons)),
+		personDetails: speaksPersonDetails(family, persons),
+		marketingConsent: profile.marketing_consent,
+		labels: profile.labels,
+		...vippsLinkedFrom(profile)
+	};
+}
+/** `{ vippsLinked }` when the wire says, `{}` otherwise. TODO(sdk): typed once the SDK has it. */
+function vippsLinkedFrom(profile) {
+	const linked = profile.vipps_linked;
+	return typeof linked === "boolean" ? { vippsLinked: linked } : {};
+}
+function toPortalBookingDto(managePath, booking) {
+	return {
+		bookingId: booking.booking_id,
+		status: booking.status,
+		startTs: booking.start_ts,
+		endTs: booking.end_ts,
+		serviceId: booking.service_id,
+		serviceName: booking.service_name,
+		resourceId: booking.resource_id,
+		resourceName: booking.resource_name === null ? null : stylistDisplayName(booking.resource_name) || null,
+		bookedForName: booking.booked_for_name,
+		bookedForPersonId: stringOrNull(booking.booked_for_person_id),
+		bookedForBirthYear: yearOrNull(booking.booked_for_birth_year),
+		bookedForBirthMonth: monthOrNull(booking.booked_for_birth_month),
+		amountOre: booking.amount_ore,
+		notes: booking.notes,
+		managePath: booking.manage_token ? managePath(booking.manage_token) : null
+	};
+}
+/**
+* The haircuts worth offering again, most recent first, at most `max` of them.
+*
+* Distinct by (service, stylist, child): a family that books the same cut for
+* the same child with the same stylist every six weeks has ONE habit, not ten,
+* and ten identical cards would push the second child's cut off the list.
+* «Any stylist» (`resourceId: null`) is its own key — a parent who never
+* chose is offered the same non-choice, not the stylist they happened to get.
+*
+* Only `completed` rows: a cancelled or no-show booking is not a haircut that
+* happened, and a pending or confirmed one is upcoming, not history — offering
+* to book it again would be offering a duplicate. A row whose `serviceId` is
+* null has nothing to link to and is skipped rather than rendered as a card
+* that opens the wizard on step 1.
+*
+* Sorts a copy: the caller's `past` array is rendered in its own order.
+*/
+function rebookSuggestions(past, max = 4) {
+	const seen = /* @__PURE__ */ new Set();
+	const suggestions = [];
+	const newestFirst = [...past].sort((a, b) => b.startTs - a.startTs);
+	for (const booking of newestFirst) {
+		if (suggestions.length >= max) break;
+		if (booking.status !== "completed" || booking.serviceId === null) continue;
+		const key = JSON.stringify([
+			booking.serviceId,
+			booking.resourceId,
+			booking.bookedForName
+		]);
+		if (seen.has(key)) continue;
+		seen.add(key);
+		suggestions.push({
+			serviceId: booking.serviceId,
+			serviceName: booking.serviceName,
+			resourceId: booking.resourceId,
+			resourceName: booking.resourceName,
+			bookedForName: booking.bookedForName
+		});
+	}
+	return suggestions;
+}
+function createPortalDto(config) {
+	const { managePath } = createPaths(config);
+	return {
+		toPortalProfileDto,
+		toPortalBookingDto: (booking) => toPortalBookingDto(managePath, booking),
+		rebookSuggestions,
+		monthOrNull
+	};
+}
+//#endregion
+export { createPortalDto, monthOrNull, rebookSuggestions, toPortalProfileDto };
+
+//# sourceMappingURL=dto.mjs.map

package/dist/core/portal/dto.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"dto.mjs","names":[],"sources":["../../../src/core/portal/dto.ts"],"sourcesContent":["/**\n * Where the portal's wire shape becomes this site's — one definition per shape.\n *\n * The same split `lib/booking/dto.ts` makes for the wizard: `medal-portal.ts`\n * types the wire honestly and does nothing to it, and the pages under\n * `/min-side` read only the camelCase projections defined here. Two consumers\n * need the same answers — the overview page and the server actions that hand\n * a refreshed profile back to the browser — so the projection is a module and\n * not a private function in either.\n *\n * One projection here is a security decision, not a rename. A booking on the\n * wire carries its `manage_token`, which is a live bearer credential for that\n * one appointment: whoever holds it can move or cancel it, with no session and\n * no login. The DTO does not keep it. It keeps the PATH the token is spent at —\n * the same `/bestill/administrer/<token>` the confirmation e-mail links to —\n * built by the one function in the app that knows how to build it. A page that\n * renders a link has everything it needs; a serialiser that dumps the DTO into\n * a prop or a log has no field named «token» to leak, and the credential\n * travels exactly as far as an `href` and no further.\n *\n * Free of `server-only` on purpose: a client component may import a DTO type,\n * and `rebookSuggestions` is pure. The wire types come from `@medalsocial/sdk`\n * as `import type`, so nothing here pulls the SDK into a browser bundle.\n */\n\nimport type {\n  PortalBooking,\n  PortalBookingStatus,\n  PortalFamilyEntry,\n  PortalPerson,\n  PortalProfile,\n} from '@medalsocial/sdk';\nimport type { BookingConfig } from '../config';\nimport { stylistDisplayName } from '../display-name';\nimport { createPaths } from '../paths';\n\n/**\n * One child on the profile — a PERSON now, not a name (SP10).\n *\n * `personId` is what makes a child something this site can point at: the id\n * of the `contactPersons` row Medal keeps, stable across a rename through\n * `/me/persons/{id}`, and the key a past booking carries as\n * `booked_for_person_id`. It is `null` only against a Medal that sent neither\n * a `person_id` on the family entry nor one unambiguous person of that name\n * and year — the site then falls back to what it did before persons existed.\n *\n * `birthMonth`, `notes` («Notat til frisøren») and `preferredResourceId`\n * («Fast frisør») are SP10's portal-editable details; each is `null` when\n * unset AND when Medal predates them — see `personDetails` on the profile for\n * telling the two apart.\n */\nexport interface PortalFamilyMemberDto {\n  personId: string | null;\n  name: string;\n  birthYear: number;\n  birthMonth: number | null;\n  notes: string | null;\n  preferredResourceId: string | null;\n}\n\n/**\n * The bransjemal preset's words for who a booking is for — «Barn» for a\n * children's salon, «Familie» wherever the fallback still applies. `person` is the\n * singular a future per-row label would use; only `persons` is read today.\n */\nexport interface PortalLabels {\n  person: string;\n  persons: string;\n}\n\nexport interface PortalProfileDto {\n  contactId: string;\n  email: string;\n  firstName: string | null;\n  lastName: string | null;\n  phone: string | null;\n  family: PortalFamilyMemberDto[];\n  /**\n   * Whether this Medal speaks SP10 persons — birth month, notes and preferred\n   * stylist on each child, and the `/me/persons` endpoints that edit them.\n   * Read off the wire (the fields are present, `null` or not), so the editor\n   * offers the extra fields only where they can be saved. `false` also for a\n   * profile with no persons at all, where there is nothing to read it off;\n   * the person actions still try the endpoints and fall back on a 404.\n   */\n  personDetails: boolean;\n  marketingConsent: boolean;\n  labels?: PortalLabels;\n  /**\n   * Whether the parent's Vipps account is linked to this profile — present\n   * only when Medal says (`vipps_linked`, with the «Koble til Vipps» routes).\n   * ABSENT against a Medal that predates them, and then Min side → Profil\n   * draws no Vipps row: a button whose route does not exist is a dead end.\n   */\n  vippsLinked?: boolean;\n}\n\nexport interface PortalBookingDto {\n  bookingId: string;\n  status: PortalBookingStatus;\n  startTs: number;\n  endTs: number;\n  serviceId: string | null;\n  serviceName: string | null;\n  resourceId: string | null;\n  resourceName: string | null;\n  bookedForName: string | null;\n  /**\n   * Who the visit was for, by id — the `person_id` of one of the parent's\n   * children, or `null` for a visit for the parent themselves, one made before\n   * persons existed, or a Medal that does not send it yet (SP10). This is the\n   * key «Samme som sist» joins on; the name is only the fallback.\n   */\n  bookedForPersonId: string | null;\n  /** The birth year and month frozen onto the booking, when Medal sends them. */\n  bookedForBirthYear: number | null;\n  bookedForBirthMonth: number | null;\n  amountOre: number | null;\n  notes: string | null;\n  /**\n   * Where this booking is managed, or `null` when Medal issued no token for it\n   * — a cancelled or completed row, or one made over the counter. The token\n   * itself is deliberately not on this object; see the module comment.\n   */\n  managePath: string | null;\n}\n\n/*\n * The SP10 wire fields (`person_id` / `birth_month` on a family entry,\n * `birth_month` / `preferred_resource_id` on a person, `booked_for_*` on a\n * booking) are typed by the SDK since 1.12, but still READ defensively: a\n * Medal that predates SP10 omits every one of them, and `speaksPersonDetails`\n * keys on exactly that absence. The helpers below take `unknown` for that\n * reason, not because the types are missing.\n */\n\nfunction stringOrNull(value: unknown): string | null {\n  return typeof value === 'string' && value !== '' ? value : null;\n}\n\n/** 1–12, or `null` for anything else — absent, `null`, or nonsense. */\nexport function monthOrNull(value: unknown): number | null {\n  return typeof value === 'number' && Number.isInteger(value) && value >= 1 && value <= 12\n    ? value\n    : null;\n}\n\nfunction yearOrNull(value: unknown): number | null {\n  return typeof value === 'number' && Number.isInteger(value) ? value : null;\n}\n\n/**\n * The person behind one `family` entry.\n *\n * By id where Medal sends one (SP10 puts `person_id` on every entry). Without\n * it — today's Medal — by name AND year among the active guardian-type\n * persons, and only when exactly ONE matches: that is the same pair Medal's\n * own `PATCH /me {family}` matches on, so an id found this way is the row that\n * patch would edit. Two same-named, same-year rows are nobody in particular.\n */\nfunction personFor(member: PortalFamilyEntry, persons: PortalPerson[]): PortalPerson | undefined {\n  const id = stringOrNull(member.person_id);\n  if (id !== null) return persons.find((person) => person.person_id === id);\n  const twins = persons.filter(\n    (person) =>\n      person.active !== false &&\n      person.relation_type === 'guardian' &&\n      person.name === member.name &&\n      person.birth_year === member.birth_year\n  );\n  return twins.length === 1 ? twins[0] : undefined;\n}\n\nfunction toFamilyMemberDto(\n  member: PortalFamilyEntry,\n  persons: PortalPerson[]\n): PortalFamilyMemberDto {\n  const person = personFor(member, persons);\n  return {\n    personId: stringOrNull(member.person_id) ?? person?.person_id ?? null,\n    name: member.name,\n    birthYear: member.birth_year,\n    birthMonth: monthOrNull(member.birth_month) ?? monthOrNull(person?.birth_month),\n    notes: stringOrNull(person?.notes),\n    preferredResourceId: stringOrNull(person?.preferred_resource_id),\n  };\n}\n\n/** Whether the wire carries SP10's person fields at all; see `personDetails`. */\nfunction speaksPersonDetails(family: PortalFamilyEntry[], persons: PortalPerson[]): boolean {\n  return (\n    family.some((member) => 'person_id' in member || 'birth_month' in member) ||\n    persons.some((person) => 'birth_month' in person || 'preferred_resource_id' in person)\n  );\n}\n\n/**\n * Nulls stay nulls. The page decides what a missing surname or phone number\n * reads as, and a `''` here would make «not given» and «given as blank»\n * indistinguishable to the form that edits them.\n */\nexport function toPortalProfileDto(profile: PortalProfile): PortalProfileDto {\n  const family = profile.family;\n  // `persons` is SP11's; a Medal (or a fixture) without it is a family of names.\n  const persons = Array.isArray(profile.persons) ? profile.persons : [];\n  return {\n    contactId: profile.contact_id,\n    email: profile.email,\n    firstName: profile.first_name,\n    lastName: profile.last_name,\n    phone: profile.phone,\n    family: family.map((member) => toFamilyMemberDto(member, persons)),\n    personDetails: speaksPersonDetails(family, persons),\n    marketingConsent: profile.marketing_consent,\n    labels: profile.labels,\n    ...vippsLinkedFrom(profile),\n  };\n}\n\n/** `{ vippsLinked }` when the wire says, `{}` otherwise. TODO(sdk): typed once the SDK has it. */\nfunction vippsLinkedFrom(profile: PortalProfile): { vippsLinked?: boolean } {\n  const linked = (profile as PortalProfile & { vipps_linked?: unknown }).vipps_linked;\n  return typeof linked === 'boolean' ? { vippsLinked: linked } : {};\n}\n\nfunction toPortalBookingDto(\n  managePath: (token: string) => string,\n  booking: PortalBooking\n): PortalBookingDto {\n  return {\n    bookingId: booking.booking_id,\n    status: booking.status,\n    startTs: booking.start_ts,\n    endTs: booking.end_ts,\n    serviceId: booking.service_id,\n    serviceName: booking.service_name,\n    resourceId: booking.resource_id,\n    // Cleaned once here for every portal card (upcoming, history, rebook).\n    resourceName:\n      booking.resource_name === null ? null : stylistDisplayName(booking.resource_name) || null,\n    bookedForName: booking.booked_for_name,\n    bookedForPersonId: stringOrNull(booking.booked_for_person_id),\n    bookedForBirthYear: yearOrNull(booking.booked_for_birth_year),\n    bookedForBirthMonth: monthOrNull(booking.booked_for_birth_month),\n    amountOre: booking.amount_ore,\n    notes: booking.notes,\n    managePath: booking.manage_token ? managePath(booking.manage_token) : null,\n  };\n}\n\n/**\n * What a «Bestill igjen» card carries: enough to prefill the wizard's three\n * questions (`?service&stylist&who`) and the two names it shows on the card.\n * No ids the wizard cannot vouch for are trusted downstream — `applyPrefill`\n * ignores a service or stylist the catalogue no longer lists — so this does\n * not need to check them either.\n */\nexport interface RebookSuggestion {\n  serviceId: string;\n  serviceName: string | null;\n  resourceId: string | null;\n  resourceName: string | null;\n  bookedForName: string | null;\n}\n\n/**\n * The haircuts worth offering again, most recent first, at most `max` of them.\n *\n * Distinct by (service, stylist, child): a family that books the same cut for\n * the same child with the same stylist every six weeks has ONE habit, not ten,\n * and ten identical cards would push the second child's cut off the list.\n * «Any stylist» (`resourceId: null`) is its own key — a parent who never\n * chose is offered the same non-choice, not the stylist they happened to get.\n *\n * Only `completed` rows: a cancelled or no-show booking is not a haircut that\n * happened, and a pending or confirmed one is upcoming, not history — offering\n * to book it again would be offering a duplicate. A row whose `serviceId` is\n * null has nothing to link to and is skipped rather than rendered as a card\n * that opens the wizard on step 1.\n *\n * Sorts a copy: the caller's `past` array is rendered in its own order.\n */\nexport function rebookSuggestions(past: PortalBookingDto[], max = 4): RebookSuggestion[] {\n  const seen = new Set<string>();\n  const suggestions: RebookSuggestion[] = [];\n  const newestFirst = [...past].sort((a, b) => b.startTs - a.startTs);\n\n  for (const booking of newestFirst) {\n    if (suggestions.length >= max) break;\n    if (booking.status !== 'completed' || booking.serviceId === null) continue;\n\n    // JSON rather than a joined string: a child's name can contain whatever\n    // separator a `join` would pick, and `null` and `''` must stay distinct.\n    const key = JSON.stringify([booking.serviceId, booking.resourceId, booking.bookedForName]);\n    if (seen.has(key)) continue;\n    seen.add(key);\n\n    suggestions.push({\n      serviceId: booking.serviceId,\n      serviceName: booking.serviceName,\n      resourceId: booking.resourceId,\n      resourceName: booking.resourceName,\n      bookedForName: booking.bookedForName,\n    });\n  }\n\n  return suggestions;\n}\n\nexport interface PortalDto {\n  toPortalProfileDto: typeof toPortalProfileDto;\n  /** The booking, with its manage token turned into this site's manage PATH (`paths.manage`). */\n  toPortalBookingDto(booking: PortalBooking): PortalBookingDto;\n  rebookSuggestions: typeof rebookSuggestions;\n  monthOrNull: typeof monthOrNull;\n}\n\nexport function createPortalDto(config: Pick<BookingConfig, 'paths'>): PortalDto {\n  const { managePath } = createPaths(config);\n  return {\n    toPortalProfileDto,\n    toPortalBookingDto: (booking) => toPortalBookingDto(managePath, booking),\n    rebookSuggestions,\n    monthOrNull,\n  };\n}\n"],"mappings":";;;AAwIA,SAAS,aAAa,OAA+B;CACnD,OAAO,OAAO,UAAU,YAAY,UAAU,KAAK,QAAQ;AAC7D;;AAGA,SAAgB,YAAY,OAA+B;CACzD,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,KAAK,SAAS,KAAK,SAAS,KAClF,QACA;AACN;AAEA,SAAS,WAAW,OAA+B;CACjD,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,IAAI,QAAQ;AACxE;;;;;;;;;;AAWA,SAAS,UAAU,QAA2B,SAAmD;CAC/F,MAAM,KAAK,aAAa,OAAO,SAAS;CACxC,IAAI,OAAO,MAAM,OAAO,QAAQ,MAAM,WAAW,OAAO,cAAc,EAAE;CACxE,MAAM,QAAQ,QAAQ,QACnB,WACC,OAAO,WAAW,SAClB,OAAO,kBAAkB,cACzB,OAAO,SAAS,OAAO,QACvB,OAAO,eAAe,OAAO,UACjC;CACA,OAAO,MAAM,WAAW,IAAI,MAAM,KAAK,KAAA;AACzC;AAEA,SAAS,kBACP,QACA,SACuB;CACvB,MAAM,SAAS,UAAU,QAAQ,OAAO;CACxC,OAAO;EACL,UAAU,aAAa,OAAO,SAAS,KAAK,QAAQ,aAAa;EACjE,MAAM,OAAO;EACb,WAAW,OAAO;EAClB,YAAY,YAAY,OAAO,WAAW,KAAK,YAAY,QAAQ,WAAW;EAC9E,OAAO,aAAa,QAAQ,KAAK;EACjC,qBAAqB,aAAa,QAAQ,qBAAqB;CACjE;AACF;;AAGA,SAAS,oBAAoB,QAA6B,SAAkC;CAC1F,OACE,OAAO,MAAM,WAAW,eAAe,UAAU,iBAAiB,MAAM,KACxE,QAAQ,MAAM,WAAW,iBAAiB,UAAU,2BAA2B,MAAM;AAEzF;;;;;;AAOA,SAAgB,mBAAmB,SAA0C;CAC3E,MAAM,SAAS,QAAQ;CAEvB,MAAM,UAAU,MAAM,QAAQ,QAAQ,OAAO,IAAI,QAAQ,UAAU,CAAC;CACpE,OAAO;EACL,WAAW,QAAQ;EACnB,OAAO,QAAQ;EACf,WAAW,QAAQ;EACnB,UAAU,QAAQ;EAClB,OAAO,QAAQ;EACf,QAAQ,OAAO,KAAK,WAAW,kBAAkB,QAAQ,OAAO,CAAC;EACjE,eAAe,oBAAoB,QAAQ,OAAO;EAClD,kBAAkB,QAAQ;EAC1B,QAAQ,QAAQ;EAChB,GAAG,gBAAgB,OAAO;CAC5B;AACF;;AAGA,SAAS,gBAAgB,SAAmD;CAC1E,MAAM,SAAU,QAAuD;CACvE,OAAO,OAAO,WAAW,YAAY,EAAE,aAAa,OAAO,IAAI,CAAC;AAClE;AAEA,SAAS,mBACP,YACA,SACkB;CAClB,OAAO;EACL,WAAW,QAAQ;EACnB,QAAQ,QAAQ;EAChB,SAAS,QAAQ;EACjB,OAAO,QAAQ;EACf,WAAW,QAAQ;EACnB,aAAa,QAAQ;EACrB,YAAY,QAAQ;EAEpB,cACE,QAAQ,kBAAkB,OAAO,OAAO,mBAAmB,QAAQ,aAAa,KAAK;EACvF,eAAe,QAAQ;EACvB,mBAAmB,aAAa,QAAQ,oBAAoB;EAC5D,oBAAoB,WAAW,QAAQ,qBAAqB;EAC5D,qBAAqB,YAAY,QAAQ,sBAAsB;EAC/D,WAAW,QAAQ;EACnB,OAAO,QAAQ;EACf,YAAY,QAAQ,eAAe,WAAW,QAAQ,YAAY,IAAI;CACxE;AACF;;;;;;;;;;;;;;;;;;AAkCA,SAAgB,kBAAkB,MAA0B,MAAM,GAAuB;CACvF,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,cAAkC,CAAC;CACzC,MAAM,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,UAAU,EAAE,OAAO;CAElE,KAAK,MAAM,WAAW,aAAa;EACjC,IAAI,YAAY,UAAU,KAAK;EAC/B,IAAI,QAAQ,WAAW,eAAe,QAAQ,cAAc,MAAM;EAIlE,MAAM,MAAM,KAAK,UAAU;GAAC,QAAQ;GAAW,QAAQ;GAAY,QAAQ;EAAa,CAAC;EACzF,IAAI,KAAK,IAAI,GAAG,GAAG;EACnB,KAAK,IAAI,GAAG;EAEZ,YAAY,KAAK;GACf,WAAW,QAAQ;GACnB,aAAa,QAAQ;GACrB,YAAY,QAAQ;GACpB,cAAc,QAAQ;GACtB,eAAe,QAAQ;EACzB,CAAC;CACH;CAEA,OAAO;AACT;AAUA,SAAgB,gBAAgB,QAAiD;CAC/E,MAAM,EAAE,eAAe,YAAY,MAAM;CACzC,OAAO;EACL;EACA,qBAAqB,YAAY,mBAAmB,YAAY,OAAO;EACvE;EACA;CACF;AACF"}

package/dist/core/portal/family.d.mts

@@ -0,0 +1,39 @@
+import { PortalBookingDto } from "./dto.mjs";
+//#region src/core/portal/family.d.ts
+/**
+ * Which past (or upcoming) booking belongs to which child — BY ID (SP10).
+ *
+ * A booking carries `bookedForPersonId`, the id of the child it was made for,
+ * and a child on the profile carries the same id; that pair is the join, and
+ * it survives a rename, a nickname, and two siblings sharing a first name. It
+ * replaces what `child-summary.ts` did before persons existed — comparing the
+ * free text a parent typed on «Bekreft» with the free text on Min side.
+ *
+ * NAMES ARE THE FALLBACK, and only for a booking that carries no id: one made
+ * before persons existed, one for somebody typed by hand, or any booking from
+ * a Medal that does not send the id yet. For those the old rule stands —
+ * trimmed, case-folded, and a name two children share names nobody, because a
+ * missing «sist klipt» under-claims where a loose match would put a sister's
+ * haircut on the wrong child. A booking that DOES carry an id is never matched
+ * by name: its id is the answer, and a different child with the same name is a
+ * different child.
+ *
+ * Pure and free of `server-only`: the dashboard renders it on the server and
+ * the booking page does the same on the way to the wizard.
+ */
+export interface FamilyKey {
+  personId: string | null;
+  name: string;
+}
+/**
+ * For each child, the first booking in `bookings` that is theirs — so pass
+ * them in the order «first» should mean (newest first for a last visit,
+ * soonest first for the next one). `null` for a child with none.
+ */
+export declare function firstBookingFor(family: readonly FamilyKey[], bookings: readonly PortalBookingDto[]): Array<PortalBookingDto | null>;
+/** Completed bookings, newest first — the order a «last visit» is read in. */
+export declare function completedNewestFirst(past: readonly PortalBookingDto[]): PortalBookingDto[];
+/** Bookings still ahead, soonest first — the order a «next time» is read in. */
+export declare function upcomingSoonestFirst(upcoming: readonly PortalBookingDto[]): PortalBookingDto[];
+//#endregion
+//# sourceMappingURL=family.d.mts.map

package/dist/core/portal/family.mjs

@@ -0,0 +1,39 @@
+//#region src/core/portal/family.ts
+/** Trimmed and case-folded — the two sides were typed on different screens. */
+function nameKey(name) {
+	const trimmed = name?.trim().toLocaleLowerCase("nb-NO");
+	return trimmed ? trimmed : null;
+}
+/**
+* For each child, the first booking in `bookings` that is theirs — so pass
+* them in the order «first» should mean (newest first for a last visit,
+* soonest first for the next one). `null` for a child with none.
+*/
+function firstBookingFor(family, bookings) {
+	const seen = /* @__PURE__ */ new Map();
+	for (const member of family) {
+		const key = nameKey(member.name);
+		if (key !== null) seen.set(key, (seen.get(key) ?? 0) + 1);
+	}
+	return family.map((member) => {
+		const wanted = nameKey(member.name);
+		/* v8 ignore next -- every usable name was counted into `seen` above */
+		const nameUsable = wanted !== null && (seen.get(wanted) ?? 0) === 1;
+		return bookings.find((booking) => {
+			if (booking.bookedForPersonId !== null) return member.personId !== null && booking.bookedForPersonId === member.personId;
+			return nameUsable && nameKey(booking.bookedForName) === wanted;
+		}) ?? null;
+	});
+}
+/** Completed bookings, newest first — the order a «last visit» is read in. */
+function completedNewestFirst(past) {
+	return past.filter((booking) => booking.status === "completed").sort((a, b) => b.startTs - a.startTs);
+}
+/** Bookings still ahead, soonest first — the order a «next time» is read in. */
+function upcomingSoonestFirst(upcoming) {
+	return upcoming.filter((booking) => booking.status === "pending" || booking.status === "confirmed").sort((a, b) => a.startTs - b.startTs);
+}
+//#endregion
+export { completedNewestFirst, firstBookingFor, upcomingSoonestFirst };
+
+//# sourceMappingURL=family.mjs.map

package/dist/core/portal/family.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"family.mjs","names":[],"sources":["../../../src/core/portal/family.ts"],"sourcesContent":["import type { PortalBookingDto } from './dto';\n\n/**\n * Which past (or upcoming) booking belongs to which child — BY ID (SP10).\n *\n * A booking carries `bookedForPersonId`, the id of the child it was made for,\n * and a child on the profile carries the same id; that pair is the join, and\n * it survives a rename, a nickname, and two siblings sharing a first name. It\n * replaces what `child-summary.ts` did before persons existed — comparing the\n * free text a parent typed on «Bekreft» with the free text on Min side.\n *\n * NAMES ARE THE FALLBACK, and only for a booking that carries no id: one made\n * before persons existed, one for somebody typed by hand, or any booking from\n * a Medal that does not send the id yet. For those the old rule stands —\n * trimmed, case-folded, and a name two children share names nobody, because a\n * missing «sist klipt» under-claims where a loose match would put a sister's\n * haircut on the wrong child. A booking that DOES carry an id is never matched\n * by name: its id is the answer, and a different child with the same name is a\n * different child.\n *\n * Pure and free of `server-only`: the dashboard renders it on the server and\n * the booking page does the same on the way to the wizard.\n */\n\nexport interface FamilyKey {\n  personId: string | null;\n  name: string;\n}\n\n/** Trimmed and case-folded — the two sides were typed on different screens. */\nfunction nameKey(name: string | null): string | null {\n  const trimmed = name?.trim().toLocaleLowerCase('nb-NO');\n  return trimmed ? trimmed : null;\n}\n\n/**\n * For each child, the first booking in `bookings` that is theirs — so pass\n * them in the order «first» should mean (newest first for a last visit,\n * soonest first for the next one). `null` for a child with none.\n */\nexport function firstBookingFor(\n  family: readonly FamilyKey[],\n  bookings: readonly PortalBookingDto[]\n): Array<PortalBookingDto | null> {\n  // Names that appear twice in the family list name nobody in particular.\n  const seen = new Map<string, number>();\n  for (const member of family) {\n    const key = nameKey(member.name);\n    if (key !== null) seen.set(key, (seen.get(key) ?? 0) + 1);\n  }\n\n  return family.map((member) => {\n    const wanted = nameKey(member.name);\n    /* v8 ignore next -- every usable name was counted into `seen` above */\n    const nameUsable = wanted !== null && (seen.get(wanted) ?? 0) === 1;\n    const match = bookings.find((booking) => {\n      if (booking.bookedForPersonId !== null) {\n        return member.personId !== null && booking.bookedForPersonId === member.personId;\n      }\n      return nameUsable && nameKey(booking.bookedForName) === wanted;\n    });\n    return match ?? null;\n  });\n}\n\n/** Completed bookings, newest first — the order a «last visit» is read in. */\nexport function completedNewestFirst(past: readonly PortalBookingDto[]): PortalBookingDto[] {\n  return past\n    .filter((booking) => booking.status === 'completed')\n    .sort((a, b) => b.startTs - a.startTs);\n}\n\n/** Bookings still ahead, soonest first — the order a «next time» is read in. */\nexport function upcomingSoonestFirst(upcoming: readonly PortalBookingDto[]): PortalBookingDto[] {\n  return upcoming\n    .filter((booking) => booking.status === 'pending' || booking.status === 'confirmed')\n    .sort((a, b) => a.startTs - b.startTs);\n}\n"],"mappings":";;AA8BA,SAAS,QAAQ,MAAoC;CACnD,MAAM,UAAU,MAAM,KAAK,CAAC,CAAC,kBAAkB,OAAO;CACtD,OAAO,UAAU,UAAU;AAC7B;;;;;;AAOA,SAAgB,gBACd,QACA,UACgC;CAEhC,MAAM,uBAAO,IAAI,IAAoB;CACrC,KAAK,MAAM,UAAU,QAAQ;EAC3B,MAAM,MAAM,QAAQ,OAAO,IAAI;EAC/B,IAAI,QAAQ,MAAM,KAAK,IAAI,MAAM,KAAK,IAAI,GAAG,KAAK,KAAK,CAAC;CAC1D;CAEA,OAAO,OAAO,KAAK,WAAW;EAC5B,MAAM,SAAS,QAAQ,OAAO,IAAI;;EAElC,MAAM,aAAa,WAAW,SAAS,KAAK,IAAI,MAAM,KAAK,OAAO;EAOlE,OANc,SAAS,MAAM,YAAY;GACvC,IAAI,QAAQ,sBAAsB,MAChC,OAAO,OAAO,aAAa,QAAQ,QAAQ,sBAAsB,OAAO;GAE1E,OAAO,cAAc,QAAQ,QAAQ,aAAa,MAAM;EAC1D,CACW,KAAK;CAClB,CAAC;AACH;;AAGA,SAAgB,qBAAqB,MAAuD;CAC1F,OAAO,KACJ,QAAQ,YAAY,QAAQ,WAAW,WAAW,CAAC,CACnD,MAAM,GAAG,MAAM,EAAE,UAAU,EAAE,OAAO;AACzC;;AAGA,SAAgB,qBAAqB,UAA2D;CAC9F,OAAO,SACJ,QAAQ,YAAY,QAAQ,WAAW,aAAa,QAAQ,WAAW,WAAW,CAAC,CACnF,MAAM,GAAG,MAAM,EAAE,UAAU,EAAE,OAAO;AACzC"}

package/dist/core/portal/login-input.d.mts

@@ -0,0 +1,29 @@
+import { z } from "zod";
+//#region src/core/portal/login-input.d.ts
+/**
+ * The login's two inputs, validated the same way wherever they arrive — the
+ * `startLoginAction` server action and `POST /api/portal/login/verify`.
+ *
+ * A module of its own because a `'use server'` file may export only async
+ * functions, and the route handler needs the same schema the action uses: two
+ * spellings of «what is an e-mail address» would let an address a code was
+ * sent to be refused when the code comes back.
+ */
+/**
+ * Trimmed and lowercased BEFORE the format check, and piped rather than
+ * chained: `z.email()` validates the raw value, so a pasted address with a
+ * trailing space would be refused for a reason the parent cannot see.
+ * Lowercased because the code is looked up by address and «Kari@» and «kari@»
+ * are one inbox.
+ */
+export declare const emailField: z.ZodPipe<z.ZodString, z.ZodEmail>;
+/** Six digits, nothing else — Medal's own code shape. */
+export declare const codeField: z.ZodString;
+export declare const verifyLoginInput: z.ZodObject<{
+  email: z.ZodPipe<z.ZodString, z.ZodEmail>;
+  code: z.ZodString;
+}, z.core.$strip>;
+/** Why a code did not end in a session, in the words the login form keys its copy on. */
+export type VerifyLoginFailure = 'invalid' | 'throttled' | 'unreachable';
+//#endregion
+//# sourceMappingURL=login-input.d.mts.map

package/dist/core/portal/login-input.mjs

@@ -0,0 +1,29 @@
+import { z } from "zod";
+//#region src/core/portal/login-input.ts
+/**
+* The login's two inputs, validated the same way wherever they arrive — the
+* `startLoginAction` server action and `POST /api/portal/login/verify`.
+*
+* A module of its own because a `'use server'` file may export only async
+* functions, and the route handler needs the same schema the action uses: two
+* spellings of «what is an e-mail address» would let an address a code was
+* sent to be refused when the code comes back.
+*/
+/**
+* Trimmed and lowercased BEFORE the format check, and piped rather than
+* chained: `z.email()` validates the raw value, so a pasted address with a
+* trailing space would be refused for a reason the parent cannot see.
+* Lowercased because the code is looked up by address and «Kari@» and «kari@»
+* are one inbox.
+*/
+const emailField = z.string().trim().toLowerCase().pipe(z.email().max(254));
+/** Six digits, nothing else — Medal's own code shape. */
+const codeField = z.string().regex(/^\d{6}$/, "Koden er seks siffer.");
+const verifyLoginInput = z.object({
+	email: emailField,
+	code: codeField
+});
+//#endregion
+export { codeField, emailField, verifyLoginInput };
+
+//# sourceMappingURL=login-input.mjs.map

package/dist/core/portal/login-input.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-input.mjs","names":[],"sources":["../../../src/core/portal/login-input.ts"],"sourcesContent":["import { z } from 'zod';\n\n/**\n * The login's two inputs, validated the same way wherever they arrive — the\n * `startLoginAction` server action and `POST /api/portal/login/verify`.\n *\n * A module of its own because a `'use server'` file may export only async\n * functions, and the route handler needs the same schema the action uses: two\n * spellings of «what is an e-mail address» would let an address a code was\n * sent to be refused when the code comes back.\n */\n\n/**\n * Trimmed and lowercased BEFORE the format check, and piped rather than\n * chained: `z.email()` validates the raw value, so a pasted address with a\n * trailing space would be refused for a reason the parent cannot see.\n * Lowercased because the code is looked up by address and «Kari@» and «kari@»\n * are one inbox.\n */\nexport const emailField = z.string().trim().toLowerCase().pipe(z.email().max(254));\n\n/** Six digits, nothing else — Medal's own code shape. */\nexport const codeField = z.string().regex(/^\\d{6}$/, 'Koden er seks siffer.');\n\nexport const verifyLoginInput = z.object({ email: emailField, code: codeField });\n\n/** Why a code did not end in a session, in the words the login form keys its copy on. */\nexport type VerifyLoginFailure = 'invalid' | 'throttled' | 'unreachable';\n"],"mappings":";;;;;;;;;;;;;;;;;;AAmBA,MAAa,aAAa,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC;;AAGjF,MAAa,YAAY,EAAE,OAAO,CAAC,CAAC,MAAM,WAAW,uBAAuB;AAE5E,MAAa,mBAAmB,EAAE,OAAO;CAAE,OAAO;CAAY,MAAM;AAAU,CAAC"}

package/dist/core/portal/next-path.d.mts

@@ -0,0 +1,12 @@
+import { BookingConfig } from "../config.mjs";
+import { CookieSource } from "./cookies.mjs";
+//#region src/core/portal/next-path.d.ts
+export interface PortalNextPath {
+  readonly PORTAL_NEXT_COOKIE: string;
+  writePortalNextPath(path: string | null): Promise<void>;
+  takePortalNextPath(): Promise<string | null>;
+}
+/** The read-once «where this login ends» cookie (`portal.nextCookieName`). */
+export declare function createPortalNextPath(config: Pick<BookingConfig, 'portal'>, cookies: CookieSource): PortalNextPath;
+//#endregion
+//# sourceMappingURL=next-path.d.mts.map

package/dist/core/portal/next-path.mjs

@@ -0,0 +1,98 @@
+import { createReturnPath } from "./return-path.mjs";
+//#region src/core/portal/next-path.ts
+/**
+* Where to send the parent after a Vipps login that did not start on Min side.
+*
+* The e-mail login can carry its destination in the URL — the parent stays on
+* this site for the whole handshake, and `/min-side/logg-inn?return=…` is read
+* by the page that renders the form. The Vipps login cannot: the browser goes
+* to Medal, then to Vipps, then back to `/min-side/vipps`, and the only thing
+* this site controls along that path is the `return_url` it handed Medal at
+* the start. Two reasons not to put the destination in THAT:
+*
+* 1. Medal validates the `return_url` against the workspace's site and answers
+*    `400 INVALID_RETURN_URL` for one it does not recognise. A query string
+*    this site invents is a second thing that has to survive a check written
+*    on the other side of the integration — and the barnehage payment leg has
+*    already been bitten once by an engine that rewrote a `return_url`'s query
+*    (D31).
+* 2. It would put a redirect target in a URL a third party hands back to the
+*    browser, which is the shape an open redirect is usually built out of.
+*
+* So the destination never leaves this site: it goes into a short-lived
+* httpOnly cookie before the redirect to Vipps, and `/min-side/vipps` takes it
+* out again when the grant comes back. `sameSite: 'lax'` is what makes that
+* work — the return from Vipps is a top-level GET navigation, which is exactly
+* the case `lax` still sends a cookie on.
+*
+* VALIDATED ON BOTH SIDES. `safeReturnPath` runs before the value is written
+* AND after it is read, so a cookie edited in the jar between the two — this
+* one is httpOnly, but a cookie is not a promise — is a `null` rather than a
+* redirect of the holder's choosing.
+*/
+/**
+* Ten minutes: a Vipps login is a phone unlock and a confirmation, and a value
+* that outlived the attempt would send a parent who came back to the login on
+* their own into the middle of a flow they had left.
+*/
+const MAX_AGE_SECONDS = 600;
+/** The read-once «where this login ends» cookie (`portal.nextCookieName`). */
+function createPortalNextPath(config, cookies) {
+	const PORTAL_NEXT_COOKIE = config.portal.nextCookieName;
+	const safeReturnPath = createReturnPath(config);
+	/**
+	* Remember where this login should end, or forget any earlier answer.
+	*
+	* A `null` path CLEARS rather than leaves the previous value in place: a
+	* parent who starts a barnehage login, abandons it and then logs in normally
+	* from Min side must not be thrown into the kindergarten flow by a cookie the
+	* first attempt left behind.
+	*
+	* `secure` unconditionally, matching `PORTAL_SESSION_COOKIE` — see
+	* `lib/portal/session.ts` for why localhost still works in Chrome and Firefox.
+	*/
+	async function writePortalNextPath(path) {
+		const safe = path === null ? null : safeReturnPath(path);
+		const jar = await cookies();
+		if (safe === null) {
+			jar.delete({
+				name: PORTAL_NEXT_COOKIE,
+				path: "/"
+			});
+			return;
+		}
+		jar.set(PORTAL_NEXT_COOKIE, safe, {
+			httpOnly: true,
+			secure: true,
+			sameSite: "lax",
+			path: "/",
+			maxAge: MAX_AGE_SECONDS
+		});
+	}
+	/**
+	* The remembered destination, and it is gone afterwards.
+	*
+	* Read-once on purpose: the value describes ONE login attempt, and leaving it
+	* in the jar would redirect the next one too. The delete runs whether or not
+	* the value survived validation, so a malformed cookie is not re-read on every
+	* subsequent login either.
+	*/
+	async function takePortalNextPath() {
+		const jar = await cookies();
+		const raw = jar.get(PORTAL_NEXT_COOKIE)?.value;
+		jar.delete({
+			name: PORTAL_NEXT_COOKIE,
+			path: "/"
+		});
+		return safeReturnPath(raw);
+	}
+	return {
+		PORTAL_NEXT_COOKIE,
+		writePortalNextPath,
+		takePortalNextPath
+	};
+}
+//#endregion
+export { createPortalNextPath };
+
+//# sourceMappingURL=next-path.mjs.map

package/dist/core/portal/next-path.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-path.mjs","names":[],"sources":["../../../src/core/portal/next-path.ts"],"sourcesContent":["import type { BookingConfig } from '../config';\nimport type { CookieSource } from './cookies';\nimport { createReturnPath } from './return-path';\n\n/**\n * Where to send the parent after a Vipps login that did not start on Min side.\n *\n * The e-mail login can carry its destination in the URL — the parent stays on\n * this site for the whole handshake, and `/min-side/logg-inn?return=…` is read\n * by the page that renders the form. The Vipps login cannot: the browser goes\n * to Medal, then to Vipps, then back to `/min-side/vipps`, and the only thing\n * this site controls along that path is the `return_url` it handed Medal at\n * the start. Two reasons not to put the destination in THAT:\n *\n * 1. Medal validates the `return_url` against the workspace's site and answers\n *    `400 INVALID_RETURN_URL` for one it does not recognise. A query string\n *    this site invents is a second thing that has to survive a check written\n *    on the other side of the integration — and the barnehage payment leg has\n *    already been bitten once by an engine that rewrote a `return_url`'s query\n *    (D31).\n * 2. It would put a redirect target in a URL a third party hands back to the\n *    browser, which is the shape an open redirect is usually built out of.\n *\n * So the destination never leaves this site: it goes into a short-lived\n * httpOnly cookie before the redirect to Vipps, and `/min-side/vipps` takes it\n * out again when the grant comes back. `sameSite: 'lax'` is what makes that\n * work — the return from Vipps is a top-level GET navigation, which is exactly\n * the case `lax` still sends a cookie on.\n *\n * VALIDATED ON BOTH SIDES. `safeReturnPath` runs before the value is written\n * AND after it is read, so a cookie edited in the jar between the two — this\n * one is httpOnly, but a cookie is not a promise — is a `null` rather than a\n * redirect of the holder's choosing.\n */\n\n/**\n * Ten minutes: a Vipps login is a phone unlock and a confirmation, and a value\n * that outlived the attempt would send a parent who came back to the login on\n * their own into the middle of a flow they had left.\n */\nconst MAX_AGE_SECONDS = 10 * 60;\n\nexport interface PortalNextPath {\n  readonly PORTAL_NEXT_COOKIE: string;\n  writePortalNextPath(path: string | null): Promise<void>;\n  takePortalNextPath(): Promise<string | null>;\n}\n\n/** The read-once «where this login ends» cookie (`portal.nextCookieName`). */\nexport function createPortalNextPath(\n  config: Pick<BookingConfig, 'portal'>,\n  cookies: CookieSource\n): PortalNextPath {\n  const PORTAL_NEXT_COOKIE = config.portal.nextCookieName;\n  const safeReturnPath = createReturnPath(config);\n\n  /**\n   * Remember where this login should end, or forget any earlier answer.\n   *\n   * A `null` path CLEARS rather than leaves the previous value in place: a\n   * parent who starts a barnehage login, abandons it and then logs in normally\n   * from Min side must not be thrown into the kindergarten flow by a cookie the\n   * first attempt left behind.\n   *\n   * `secure` unconditionally, matching `PORTAL_SESSION_COOKIE` — see\n   * `lib/portal/session.ts` for why localhost still works in Chrome and Firefox.\n   */\n  async function writePortalNextPath(path: string | null): Promise<void> {\n    const safe = path === null ? null : safeReturnPath(path);\n    const jar = await cookies();\n    if (safe === null) {\n      jar.delete({ name: PORTAL_NEXT_COOKIE, path: '/' });\n      return;\n    }\n    jar.set(PORTAL_NEXT_COOKIE, safe, {\n      httpOnly: true,\n      secure: true,\n      sameSite: 'lax',\n      path: '/',\n      maxAge: MAX_AGE_SECONDS,\n    });\n  }\n\n  /**\n   * The remembered destination, and it is gone afterwards.\n   *\n   * Read-once on purpose: the value describes ONE login attempt, and leaving it\n   * in the jar would redirect the next one too. The delete runs whether or not\n   * the value survived validation, so a malformed cookie is not re-read on every\n   * subsequent login either.\n   */\n  async function takePortalNextPath(): Promise<string | null> {\n    const jar = await cookies();\n    const raw = jar.get(PORTAL_NEXT_COOKIE)?.value;\n    jar.delete({ name: PORTAL_NEXT_COOKIE, path: '/' });\n    return safeReturnPath(raw);\n  }\n\n  return { PORTAL_NEXT_COOKIE, writePortalNextPath, takePortalNextPath };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,MAAM,kBAAkB;;AASxB,SAAgB,qBACd,QACA,SACgB;CAChB,MAAM,qBAAqB,OAAO,OAAO;CACzC,MAAM,iBAAiB,iBAAiB,MAAM;;;;;;;;;;;;CAa9C,eAAe,oBAAoB,MAAoC;EACrE,MAAM,OAAO,SAAS,OAAO,OAAO,eAAe,IAAI;EACvD,MAAM,MAAM,MAAM,QAAQ;EAC1B,IAAI,SAAS,MAAM;GACjB,IAAI,OAAO;IAAE,MAAM;IAAoB,MAAM;GAAI,CAAC;GAClD;EACF;EACA,IAAI,IAAI,oBAAoB,MAAM;GAChC,UAAU;GACV,QAAQ;GACR,UAAU;GACV,MAAM;GACN,QAAQ;EACV,CAAC;CACH;;;;;;;;;CAUA,eAAe,qBAA6C;EAC1D,MAAM,MAAM,MAAM,QAAQ;EAC1B,MAAM,MAAM,IAAI,IAAI,kBAAkB,CAAC,EAAE;EACzC,IAAI,OAAO;GAAE,MAAM;GAAoB,MAAM;EAAI,CAAC;EAClD,OAAO,eAAe,GAAG;CAC3B;CAEA,OAAO;EAAE;EAAoB;EAAqB;CAAmB;AACvE"}

package/dist/core/portal/return-path.d.mts

@@ -0,0 +1,7 @@
+import { BookingConfig } from "../config.mjs";
+//#region src/core/portal/return-path.d.ts
+export type ReturnPathGuard = (value: unknown) => string | null;
+/** `safeReturnPath` for this site's `portal.returnPaths`. */
+export declare function createReturnPath(config: Pick<BookingConfig, 'portal'>): ReturnPathGuard;
+//#endregion
+//# sourceMappingURL=return-path.d.mts.map

package/dist/core/portal/return-path.mjs

@@ -0,0 +1,49 @@
+//#region src/core/portal/return-path.ts
+/**
+* Longer than any address this site builds (a kindergarten slug plus one
+* query flag) and short enough that a crafted value cannot be used to push a
+* kilobyte through a `Set-Cookie`.
+*/
+const MAX_LENGTH = 512;
+/**
+* A base that cannot be reached and cannot be confused with a real origin.
+* `URL` needs one to resolve a relative reference; anything that resolves to a
+* DIFFERENT origin than this was not relative, whatever it looked like.
+*/
+const RELATIVE_BASE = "https://return-path.invalid";
+/**
+* The path `value` names, or `null`.
+*
+* The answer is rebuilt from the parsed URL rather than handed back as it
+* arrived — pathname and query only — so a caller receives a normalised value
+* with no fragment and no room for a second reading of the same bytes.
+*/
+function safeReturnPath(allowed, value) {
+	if (typeof value !== "string") return null;
+	if (value.length === 0 || value.length > MAX_LENGTH) return null;
+	if (value.includes("\\")) return null;
+	for (const char of value) {
+		/* v8 ignore next -- a character of a string always has a code point */
+		const code = char.codePointAt(0) ?? 0;
+		if (code <= 32 || code === 127) return null;
+	}
+	if (!value.startsWith("/") || value.startsWith("//")) return null;
+	let url;
+	try {
+		url = new URL(value, RELATIVE_BASE);
+	} catch {
+		return null;
+	}
+	if (url.origin !== RELATIVE_BASE) return null;
+	if (!(allowed.prefixes.some((prefix) => url.pathname.startsWith(prefix)) || allowed.exact.some((path) => url.pathname === path))) return null;
+	return `${url.pathname}${url.search}`;
+}
+/** `safeReturnPath` for this site's `portal.returnPaths`. */
+function createReturnPath(config) {
+	const allowed = config.portal.returnPaths;
+	return (value) => safeReturnPath(allowed, value);
+}
+//#endregion
+export { createReturnPath };
+
+//# sourceMappingURL=return-path.mjs.map

package/dist/core/portal/return-path.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"return-path.mjs","names":[],"sources":["../../../src/core/portal/return-path.ts"],"sourcesContent":["/**\n * Where a login is allowed to send a parent afterwards.\n *\n * Two places on this site now start a Min side login on behalf of a page that\n * is NOT Min side — a sign-up flow's «fetch from Vipps» and its «log in\n * with e-mail» — and both have to name where the parent should land when the\n * login is done. That destination arrives from somewhere a visitor can write:\n * a query string on `/min-side/logg-inn`, or a form field posted to the Vipps\n * start action. Anything that arrives that way and is later handed to a\n * `redirect()` is an open redirect unless something narrows it first, and this\n * module is that something.\n *\n * The rule is deliberately not «is this the same origin»: a value is refused\n * unless it is a ROOT-RELATIVE PATH, so there is no origin to compare and no\n * parser disagreement to exploit. The three shapes that historically get\n * through a hand-rolled `startsWith('/')` check are all refused explicitly:\n *\n * - `//evil.example` — a protocol-relative URL. It starts with `/`, and a\n *   browser sends it to `evil.example`.\n * - `/\\evil.example` and `\\\\evil.example` — the same trick with backslashes,\n *   which Chrome and Safari normalise to `//`.\n * - `https://evil.example/barnehage/x` — an absolute URL that happens to\n *   contain an allowed path.\n *\n * On top of that the path must be one this site is willing to send a\n * freshly-logged-in parent to. That list is short on purpose: the login exists\n * to hand a parent back to a flow they were already standing in, not to be a\n * general-purpose navigation primitive. `/min-side` needs no entry — it is the\n * default when there is no return path at all.\n *\n * Pure, and not `server-only`: the login page validates a query parameter with\n * it on the server, and the tests exercise it directly.\n */\n\nimport type { BookingConfig } from '../config';\n\n/*\n * The paths a login may return a parent to come from\n * `config.portal.returnPaths`: `prefixes` match on the pathname (a flow whose\n * pages all live below one path), `exact` match the pathname alone and no\n * descendants.\n *\n * The booking page is the default `exact` entry: its login sheet offers Vipps\n * mid-flow and needs the parent back on the page they left (`?resume=1`\n * rebuilds the half-built booking out of the draft store). It is an exact\n * match rather than a prefix because the manage page lives underneath it:\n * that page is reached with a one-time credential in the path, and it has no\n * business being a destination a login can be pointed at.\n *\n * The query string is not part of the comparison — `safeReturnPath` rebuilds\n * the answer from `pathname` and `search`, so `?resume=1` survives while the\n * decision is made on the path alone. The portal itself needs no entry — it is\n * the default when there is no return path at all.\n */\n\n/**\n * Longer than any address this site builds (a kindergarten slug plus one\n * query flag) and short enough that a crafted value cannot be used to push a\n * kilobyte through a `Set-Cookie`.\n */\nconst MAX_LENGTH = 512;\n\n/**\n * A base that cannot be reached and cannot be confused with a real origin.\n * `URL` needs one to resolve a relative reference; anything that resolves to a\n * DIFFERENT origin than this was not relative, whatever it looked like.\n */\nconst RELATIVE_BASE = 'https://return-path.invalid';\n\n/**\n * The path `value` names, or `null`.\n *\n * The answer is rebuilt from the parsed URL rather than handed back as it\n * arrived — pathname and query only — so a caller receives a normalised value\n * with no fragment and no room for a second reading of the same bytes.\n */\nfunction safeReturnPath(\n  allowed: { exact: readonly string[]; prefixes: readonly string[] },\n  value: unknown\n): string | null {\n  if (typeof value !== 'string') return null;\n  if (value.length === 0 || value.length > MAX_LENGTH) return null;\n\n  // Before any parsing: a path this site issues contains no backslash, no\n  // whitespace and no control character, and every known normalisation trick\n  // needs one of the three. Character by character rather than by regex — a\n  // regex that spells out the control range is itself a lint error, and this\n  // says the same thing without one.\n  if (value.includes('\\\\')) return null;\n  for (const char of value) {\n    /* v8 ignore next -- a character of a string always has a code point */\n    const code = char.codePointAt(0) ?? 0;\n    if (code <= 0x20 || code === 0x7f) return null;\n  }\n\n  // One leading slash, never two — `//host` is protocol-relative.\n  if (!value.startsWith('/') || value.startsWith('//')) return null;\n\n  // Defensive from here: the checks above leave only single-slash paths with no\n  // backslash or whitespace, which neither throw nor leave the base origin. The\n  // two guards stay as the second line of defence they were written as.\n  let url: URL;\n  try {\n    url = new URL(value, RELATIVE_BASE);\n    /* v8 ignore start */\n  } catch {\n    return null;\n  }\n  // An absolute URL resolves to its own origin and is refused here even when\n  // its path would have been allowed.\n  if (url.origin !== RELATIVE_BASE) return null;\n  /* v8 ignore stop */\n\n  const ok =\n    allowed.prefixes.some((prefix) => url.pathname.startsWith(prefix)) ||\n    allowed.exact.some((path) => url.pathname === path);\n  if (!ok) return null;\n\n  return `${url.pathname}${url.search}`;\n}\n\nexport type ReturnPathGuard = (value: unknown) => string | null;\n\n/** `safeReturnPath` for this site's `portal.returnPaths`. */\nexport function createReturnPath(config: Pick<BookingConfig, 'portal'>): ReturnPathGuard {\n  const allowed = config.portal.returnPaths;\n  return (value) => safeReturnPath(allowed, value);\n}\n"],"mappings":";;;;;;AA4DA,MAAM,aAAa;;;;;;AAOnB,MAAM,gBAAgB;;;;;;;;AAStB,SAAS,eACP,SACA,OACe;CACf,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,IAAI,MAAM,WAAW,KAAK,MAAM,SAAS,YAAY,OAAO;CAO5D,IAAI,MAAM,SAAS,IAAI,GAAG,OAAO;CACjC,KAAK,MAAM,QAAQ,OAAO;;EAExB,MAAM,OAAO,KAAK,YAAY,CAAC,KAAK;EACpC,IAAI,QAAQ,MAAQ,SAAS,KAAM,OAAO;CAC5C;CAGA,IAAI,CAAC,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,GAAG,OAAO;CAK7D,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,OAAO,aAAa;CAEpC,QAAQ;EACN,OAAO;CACT;CAGA,IAAI,IAAI,WAAW,eAAe,OAAO;CAMzC,IAAI,EAFF,QAAQ,SAAS,MAAM,WAAW,IAAI,SAAS,WAAW,MAAM,CAAC,KACjE,QAAQ,MAAM,MAAM,SAAS,IAAI,aAAa,IAAI,IAC3C,OAAO;CAEhB,OAAO,GAAG,IAAI,WAAW,IAAI;AAC/B;;AAKA,SAAgB,iBAAiB,QAAwD;CACvF,MAAM,UAAU,OAAO,OAAO;CAC9B,QAAQ,UAAU,eAAe,SAAS,KAAK;AACjD"}

package/dist/core/portal/session-cookie.d.mts

@@ -0,0 +1,27 @@
+import { BookingConfig } from "../config.mjs";
+//#region src/core/portal/session-cookie.d.ts
+/**
+ * Whether a value is the shape of a Medal-issued portal session token.
+ *
+ * Shared by the cookie reader, the cookie writer, and middleware so the three
+ * cannot disagree — a token the writer accepted but the reader (or the
+ * bounce) refused would log the parent in and then out again on the next
+ * request, with nothing on screen to say why.
+ *
+ * `unknown` rather than `string`, because the value on the way in is whatever
+ * a JSON body or a cookie header contained, and narrowing it is this
+ * function's whole job.
+ */
+export declare function isPortalSessionToken(value: unknown): value is string;
+export interface SessionCookie {
+  /** The session cookie's name (`portal.cookieName`). */
+  readonly PORTAL_SESSION_COOKIE: string;
+  /** Exact dashboard URL the middleware bounce matches (`paths.portal`). */
+  readonly PORTAL_DASHBOARD_PATH: string | null;
+  /** Where a logged-out dashboard visit is sent (`paths.portalLogin`). */
+  readonly PORTAL_LOGIN_PATH: string;
+  isPortalSessionToken: typeof isPortalSessionToken;
+}
+export declare function createSessionCookie(config: Pick<BookingConfig, 'portal' | 'paths'>): SessionCookie;
+//#endregion
+//# sourceMappingURL=session-cookie.d.mts.map

package/dist/core/portal/session-cookie.mjs

@@ -0,0 +1,30 @@
+//#region src/core/portal/session-cookie.ts
+/** 32 bytes, base64url, no padding: `ceil(32 × 8 / 6)` = 43 characters. */
+const PORTAL_SESSION_TOKEN = /^[A-Za-z0-9_-]{43}$/;
+/**
+* Whether a value is the shape of a Medal-issued portal session token.
+*
+* Shared by the cookie reader, the cookie writer, and middleware so the three
+* cannot disagree — a token the writer accepted but the reader (or the
+* bounce) refused would log the parent in and then out again on the next
+* request, with nothing on screen to say why.
+*
+* `unknown` rather than `string`, because the value on the way in is whatever
+* a JSON body or a cookie header contained, and narrowing it is this
+* function's whole job.
+*/
+function isPortalSessionToken(value) {
+	return typeof value === "string" && PORTAL_SESSION_TOKEN.test(value);
+}
+function createSessionCookie(config) {
+	return {
+		PORTAL_SESSION_COOKIE: config.portal.cookieName,
+		PORTAL_DASHBOARD_PATH: config.paths.portal,
+		PORTAL_LOGIN_PATH: config.paths.portalLogin,
+		isPortalSessionToken
+	};
+}
+//#endregion
+export { createSessionCookie, isPortalSessionToken };
+
+//# sourceMappingURL=session-cookie.mjs.map

package/dist/core/portal/session-cookie.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-cookie.mjs","names":[],"sources":["../../../src/core/portal/session-cookie.ts"],"sourcesContent":["/**\n * The portal session cookie's *shape* — name and token alphabet — with no\n * Next.js `cookies()` import, so Edge middleware can share the check the\n * server reader uses without pulling `server-only` into the Worker.\n *\n * The token is a 43-character base64url string: 32 random bytes, encoded\n * without padding, which is what Medal's issuer produces and the one shape\n * this site accepts. The alphabet is `A–Z a–z 0–9 - _` — a `+`, `/` or `=`\n * is standard base64 and is refused, because a value that came from a\n * different encoder did not come from Medal.\n */\n\nimport type { BookingConfig } from '../config';\n\n/** 32 bytes, base64url, no padding: `ceil(32 × 8 / 6)` = 43 characters. */\nconst PORTAL_SESSION_TOKEN = /^[A-Za-z0-9_-]{43}$/;\n\n/**\n * Whether a value is the shape of a Medal-issued portal session token.\n *\n * Shared by the cookie reader, the cookie writer, and middleware so the three\n * cannot disagree — a token the writer accepted but the reader (or the\n * bounce) refused would log the parent in and then out again on the next\n * request, with nothing on screen to say why.\n *\n * `unknown` rather than `string`, because the value on the way in is whatever\n * a JSON body or a cookie header contained, and narrowing it is this\n * function's whole job.\n */\nexport function isPortalSessionToken(value: unknown): value is string {\n  return typeof value === 'string' && PORTAL_SESSION_TOKEN.test(value);\n}\n\nexport interface SessionCookie {\n  /** The session cookie's name (`portal.cookieName`). */\n  readonly PORTAL_SESSION_COOKIE: string;\n  /** Exact dashboard URL the middleware bounce matches (`paths.portal`). */\n  readonly PORTAL_DASHBOARD_PATH: string | null;\n  /** Where a logged-out dashboard visit is sent (`paths.portalLogin`). */\n  readonly PORTAL_LOGIN_PATH: string;\n  isPortalSessionToken: typeof isPortalSessionToken;\n}\n\nexport function createSessionCookie(\n  config: Pick<BookingConfig, 'portal' | 'paths'>\n): SessionCookie {\n  return {\n    PORTAL_SESSION_COOKIE: config.portal.cookieName,\n    PORTAL_DASHBOARD_PATH: config.paths.portal,\n    PORTAL_LOGIN_PATH: config.paths.portalLogin,\n    isPortalSessionToken,\n  };\n}\n"],"mappings":";;AAeA,MAAM,uBAAuB;;;;;;;;;;;;;AAc7B,SAAgB,qBAAqB,OAAiC;CACpE,OAAO,OAAO,UAAU,YAAY,qBAAqB,KAAK,KAAK;AACrE;AAYA,SAAgB,oBACd,QACe;CACf,OAAO;EACL,uBAAuB,OAAO,OAAO;EACrC,uBAAuB,OAAO,MAAM;EACpC,mBAAmB,OAAO,MAAM;EAChC;CACF;AACF"}