@medalsocial/booking 0.0.0-placeholder.0 → 0.2.0

package/dist/next/routes/manage.mjs

@@ -0,0 +1,191 @@
+import { toManageDto } from "../manage-dto.mjs";
+import { MedalConfigError } from "../medal.mjs";
+import { readBoundedText } from "../request.mjs";
+import { bookingErrorResponse, digestOf, isSlotTaken } from "./shared.mjs";
+import { MedalApiError } from "@medalsocial/sdk";
+import { NextResponse } from "next/server";
+//#region src/next/routes/manage.ts
+function invalid(message) {
+	return bookingErrorResponse("invalidInput", 400, message);
+}
+/**
+* The `Idempotency-Key` for one move: the booking's token and the instant it is
+* being moved to, hashed together.
+*
+* A reschedule is an insert plus a cancel, so a second identical request would
+* otherwise find the booking already cancelled and answer 409 — a double tap on
+* «Bekreft endring» reporting failure for a move that succeeded. Deriving the
+* key from the two things that identify the move makes the retry a replay.
+*
+* The digest, never the token. Medal stores the request identity against the
+* key, so a plaintext token here would write a live credential into a table that
+* outlives the appointment — the same reason the engine hashes the token out of
+* its own idempotency identity and API log. Two visitors cannot collide either,
+* since the token is unique per booking; and a visitor who picks a different
+* hour derives a different key, which is correctly a second move rather than a
+* replay of the first.
+*/
+async function moveKey(token, startTs) {
+	return digestOf(`reschedule:${token}:${startTs}`);
+}
+/**
+* The `Idempotency-Key` for one cancellation — the booking's token, hashed.
+*
+* The same hazard the move key exists for, and it had been left off this half.
+* Cancelling twice is a `CONFLICT` from the engine, because the second call
+* finds a booking that is already cancelled — so a dropped RESPONSE (the write
+* landed, the answer did not) turns the visitor's perfectly reasonable retry
+* into «det gikk ikke» for an appointment that IS cancelled. A disabled button
+* only stops the concurrent double tap; it does nothing about the retry after
+* an ambiguous network result.
+*
+* No second component, unlike the move: a booking has exactly one cancellation,
+* so the token alone identifies it. Two attempts with different reasons are
+* still one cancellation, and the first reason is the one that sticks — which
+* is the right answer, since it is the one the visitor gave before anything
+* went wrong.
+*
+* The digest and never the token, for the reason `moveKey` gives.
+*/
+async function cancelKey(token) {
+	return digestOf(`cancel:${token}`);
+}
+/**
+* Every way a manage action can fail, in codes the page has a Norwegian
+* sentence for.
+*
+* `windowPassed` is the one that matters. The engine enforces both windows on
+* the write and raises `CONFLICT` with `CANCEL_WINDOW_PASSED` /
+* `RESCHEDULE_WINDOW_PASSED` in the message — the code alone cannot tell it from
+* a taken slot, exactly as the create route has to read `SLOT_TAKEN` out of the
+* message. It is reachable without anyone doing anything wrong: `can_cancel` was
+* true when the page rendered, and the visitor sat on it until it was not.
+*
+* The upstream's own message never travels. Medal writes for the integrator
+* holding the API key, and its 404 for this route would be the same sentence
+* whether the token was revoked, GDPR-erased, or belongs to another salon.
+*/
+function manageErrorResponse(rt, error, action) {
+	if (error instanceof MedalConfigError) {
+		rt.logger.error({
+			err: error,
+			action
+		}, "Booking API is not configured");
+		return bookingErrorResponse("unconfigured", 503);
+	}
+	if (error instanceof MedalApiError) {
+		if (error.status === 404) return bookingErrorResponse("notFound", 404);
+		if (error.code === "CONFLICT") {
+			if (error.message.includes("WINDOW_PASSED")) return bookingErrorResponse("windowPassed", 409);
+			if (isSlotTaken(error)) return bookingErrorResponse("slotTaken", 409);
+			return bookingErrorResponse("conflict", 409);
+		}
+		if (error.code === "VALIDATION_ERROR" || error.code === "INVALID_INPUT") return bookingErrorResponse("invalidInput", 400);
+	}
+	rt.logger.error({
+		err: error,
+		action
+	}, "Booking manage action failed");
+	return bookingErrorResponse("upstreamError", 502);
+}
+/**
+* The booking's service id, for expiring its cached slots after a write.
+*
+* Asked for ALONGSIDE the write rather than after it, so it adds no round trip
+* (after a move the old token resolves to the cancelled row, which still names
+* the service — but there is no reason to wait for that). Best effort: `null`
+* leaves the cache to its ~60 s bound, never fails the action.
+*/
+async function serviceIdOf(rt, token) {
+	try {
+		return (await rt.medal.getManage(token)).service_id ?? null;
+	} catch {
+		return null;
+	}
+}
+/** Expire the booking's slots — cached and in this colo's seeds — once the
+* write has landed. */
+async function expireAfterWrite(rt, serviceId) {
+	const id = await serviceId;
+	if (id === null) return;
+	rt.catalogue.expireSlots([id]);
+	await rt.seed.expireBookingSeeds([id]);
+}
+/**
+* The manage body's ceiling: an action, a reason chip and an instant fit in
+* a few hundred bytes. Read in bytes before anything parses it, as the portal
+* routes cap theirs.
+*/
+const MANAGE_MAX_BODY_BYTES = 4096;
+async function manageRoute(rt, request, token) {
+	if (!token) return invalid("token is required");
+	let parsed;
+	try {
+		const text = await readBoundedText(request, MANAGE_MAX_BODY_BYTES);
+		if (text === null) return invalid("body is too large");
+		parsed = JSON.parse(text);
+	} catch {
+		return invalid("body must be valid JSON");
+	}
+	if (typeof parsed !== "object" || parsed === null) return invalid("body must be a JSON object");
+	const body = parsed;
+	if (body.action === "cancel") try {
+		const reason = typeof body.reason === "string" ? body.reason.trim() : "";
+		const serviceId = serviceIdOf(rt, token);
+		await rt.medal.cancelManage(token, reason.length > 0 ? reason : void 0, await cancelKey(token));
+		await expireAfterWrite(rt, serviceId);
+		return NextResponse.json({ ok: true });
+	} catch (error) {
+		return manageErrorResponse(rt, error, "cancel");
+	}
+	if (body.action === "reschedule") {
+		const startTs = body.startTs;
+		if (!Number.isFinite(startTs)) return invalid("startTs must be a timestamp");
+		const serviceId = serviceIdOf(rt, token);
+		try {
+			const result = await rt.medal.rescheduleManage(token, startTs, await moveKey(token, startTs));
+			await expireAfterWrite(rt, serviceId);
+			return NextResponse.json({
+				ok: true,
+				...typeof result?.manage_token === "string" ? { manageToken: result.manage_token } : {}
+			});
+		} catch (error) {
+			if (isSlotTaken(error)) await expireAfterWrite(rt, serviceId);
+			return manageErrorResponse(rt, error, "reschedule");
+		}
+	}
+	return invalid("action must be \"cancel\" or \"reschedule\"");
+}
+/**
+* `GET <api>/manage/<token>` — the booking the token names, as the manage page
+* renders it, for a client that loads it itself. The same 404 for an unknown
+* token as for a revoked one; the token is never echoed or logged, and the
+* answer is never stored by anyone (`no-store`, `no-referrer`).
+*/
+async function manageSummaryRoute(rt, _request, token) {
+	const headers = {
+		"Cache-Control": "no-store",
+		"Referrer-Policy": "no-referrer"
+	};
+	if (!token) return invalid("token is required");
+	try {
+		const booking = toManageDto(await rt.medal.getManage(token));
+		if (booking === null) return NextResponse.json({ error: "notFound" }, {
+			status: 404,
+			headers
+		});
+		return NextResponse.json({ booking }, { headers });
+	} catch (error) {
+		if (error instanceof MedalApiError && error.status === 404) return NextResponse.json({ error: "notFound" }, {
+			status: 404,
+			headers
+		});
+		const response = manageErrorResponse(rt, error, "read");
+		for (const [name, value] of Object.entries(headers)) response.headers.set(name, value);
+		return response;
+	}
+}
+//#endregion
+export { manageRoute, manageSummaryRoute };
+
+//# sourceMappingURL=manage.mjs.map

package/dist/next/routes/manage.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"manage.mjs","names":[],"sources":["../../../src/next/routes/manage.ts"],"sourcesContent":["import { MedalApiError } from '@medalsocial/sdk';\nimport { NextResponse } from 'next/server';\nimport { toManageDto } from '../manage-dto';\nimport { MedalConfigError } from '../medal';\nimport { readBoundedText } from '../request';\nimport type { BookingRuntime } from '../runtime';\nimport { bookingErrorResponse, digestOf, isSlotTaken } from './shared';\n\n/**\n * The two things the manage page can DO: call off an appointment, or move it.\n *\n * One route rather than `…/cancel` and `…/reschedule`, because the token is the\n * expensive part of this URL and there is no reason to have it in two places.\n * The action is a field on the body.\n *\n * SECURITY — the path segment is a live bearer credential for one booking:\n * whoever holds it can cancel or move that appointment. Three rules follow, and\n * every one of them is a rule about *this file*:\n *\n * - The token is read from the path and from nowhere else. A query string would\n *   be the same credential in the one place that is logged by every proxy\n *   between here and the visitor, and would let a link with `?token=` be\n *   crafted for a page that never offered one.\n * - Nothing here logs it, echoes it, or puts it in a response body. The upstream\n *   client already redacts it out of its own error messages (`safePath`), and\n *   the responses below carry a code and never the input that produced it.\n * - An unknown token gets the same 404 shape as a revoked one, which is what the\n *   engine already answers with — the endpoint is not an oracle for whether a\n *   booking exists.\n */\n\n/**\n * What the browser may send. `startTs` is epoch milliseconds, the same unit the\n * availability route emits and the same one `pickSlot` stores, so nothing has to\n * reformat a time between choosing it and committing to it.\n */\ninterface ManageRequest {\n  action?: unknown;\n  reason?: unknown;\n  startTs?: unknown;\n}\n\nfunction invalid(message: string): NextResponse {\n  return bookingErrorResponse('invalidInput', 400, message);\n}\n\n/**\n * The `Idempotency-Key` for one move: the booking's token and the instant it is\n * being moved to, hashed together.\n *\n * A reschedule is an insert plus a cancel, so a second identical request would\n * otherwise find the booking already cancelled and answer 409 — a double tap on\n * «Bekreft endring» reporting failure for a move that succeeded. Deriving the\n * key from the two things that identify the move makes the retry a replay.\n *\n * The digest, never the token. Medal stores the request identity against the\n * key, so a plaintext token here would write a live credential into a table that\n * outlives the appointment — the same reason the engine hashes the token out of\n * its own idempotency identity and API log. Two visitors cannot collide either,\n * since the token is unique per booking; and a visitor who picks a different\n * hour derives a different key, which is correctly a second move rather than a\n * replay of the first.\n */\nasync function moveKey(token: string, startTs: number): Promise<string> {\n  return digestOf(`reschedule:${token}:${startTs}`);\n}\n\n/**\n * The `Idempotency-Key` for one cancellation — the booking's token, hashed.\n *\n * The same hazard the move key exists for, and it had been left off this half.\n * Cancelling twice is a `CONFLICT` from the engine, because the second call\n * finds a booking that is already cancelled — so a dropped RESPONSE (the write\n * landed, the answer did not) turns the visitor's perfectly reasonable retry\n * into «det gikk ikke» for an appointment that IS cancelled. A disabled button\n * only stops the concurrent double tap; it does nothing about the retry after\n * an ambiguous network result.\n *\n * No second component, unlike the move: a booking has exactly one cancellation,\n * so the token alone identifies it. Two attempts with different reasons are\n * still one cancellation, and the first reason is the one that sticks — which\n * is the right answer, since it is the one the visitor gave before anything\n * went wrong.\n *\n * The digest and never the token, for the reason `moveKey` gives.\n */\nasync function cancelKey(token: string): Promise<string> {\n  return digestOf(`cancel:${token}`);\n}\n\n/**\n * Every way a manage action can fail, in codes the page has a Norwegian\n * sentence for.\n *\n * `windowPassed` is the one that matters. The engine enforces both windows on\n * the write and raises `CONFLICT` with `CANCEL_WINDOW_PASSED` /\n * `RESCHEDULE_WINDOW_PASSED` in the message — the code alone cannot tell it from\n * a taken slot, exactly as the create route has to read `SLOT_TAKEN` out of the\n * message. It is reachable without anyone doing anything wrong: `can_cancel` was\n * true when the page rendered, and the visitor sat on it until it was not.\n *\n * The upstream's own message never travels. Medal writes for the integrator\n * holding the API key, and its 404 for this route would be the same sentence\n * whether the token was revoked, GDPR-erased, or belongs to another salon.\n */\nfunction manageErrorResponse(rt: BookingRuntime, error: unknown, action: string): NextResponse {\n  if (error instanceof MedalConfigError) {\n    rt.logger.error({ err: error, action }, 'Booking API is not configured');\n    return bookingErrorResponse('unconfigured', 503);\n  }\n\n  if (error instanceof MedalApiError) {\n    if (error.status === 404) {\n      return bookingErrorResponse('notFound', 404);\n    }\n    if (error.code === 'CONFLICT') {\n      if (error.message.includes('WINDOW_PASSED')) {\n        return bookingErrorResponse('windowPassed', 409);\n      }\n      if (isSlotTaken(error)) {\n        return bookingErrorResponse('slotTaken', 409);\n      }\n      return bookingErrorResponse('conflict', 409);\n    }\n    if (error.code === 'VALIDATION_ERROR' || error.code === 'INVALID_INPUT') {\n      return bookingErrorResponse('invalidInput', 400);\n    }\n  }\n\n  // `action` and not the token: which of the two failed is the whole reason to\n  // log a line here, and the token is the one thing that must never reach a log\n  // stream that outlives the booking.\n  rt.logger.error({ err: error, action }, 'Booking manage action failed');\n  return bookingErrorResponse('upstreamError', 502);\n}\n\n/**\n * The booking's service id, for expiring its cached slots after a write.\n *\n * Asked for ALONGSIDE the write rather than after it, so it adds no round trip\n * (after a move the old token resolves to the cancelled row, which still names\n * the service — but there is no reason to wait for that). Best effort: `null`\n * leaves the cache to its ~60 s bound, never fails the action.\n */\n// A visit's extra services are not expired here: the summary names only its\n// first one (the visit's own entry carries that tag too, so it does go); their\n// one-service entries turn over with their own ~60 s bound.\nasync function serviceIdOf(rt: BookingRuntime, token: string): Promise<string | null> {\n  try {\n    return (await rt.medal.getManage(token)).service_id ?? null;\n  } catch {\n    return null;\n  }\n}\n\n/** Expire the booking's slots — cached and in this colo's seeds — once the\n * write has landed. */\nasync function expireAfterWrite(\n  rt: BookingRuntime,\n  serviceId: Promise<string | null>\n): Promise<void> {\n  const id = await serviceId;\n  if (id === null) return;\n  rt.catalogue.expireSlots([id]);\n  await rt.seed.expireBookingSeeds([id]);\n}\n\n/**\n * The manage body's ceiling: an action, a reason chip and an instant fit in\n * a few hundred bytes. Read in bytes before anything parses it, as the portal\n * routes cap theirs.\n */\nconst MANAGE_MAX_BODY_BYTES = 4 * 1024;\n\nexport async function manageRoute(\n  rt: BookingRuntime,\n  request: Request,\n  token: string\n): Promise<Response> {\n  if (!token) {\n    // Unreachable through the router, which only matches a non-empty segment —\n    // but this is the one function in the app where an empty credential must\n    // never be forwarded as if it were one.\n    return invalid('token is required');\n  }\n\n  let parsed: unknown;\n  try {\n    const text = await readBoundedText(request, MANAGE_MAX_BODY_BYTES);\n    if (text === null) return invalid('body is too large');\n    parsed = JSON.parse(text);\n  } catch {\n    return invalid('body must be valid JSON');\n  }\n  if (typeof parsed !== 'object' || parsed === null) {\n    return invalid('body must be a JSON object');\n  }\n  const body = parsed as ManageRequest;\n\n  if (body.action === 'cancel') {\n    try {\n      // Trimmed to nothing means the visitor picked no chip, and the reason is\n      // optional to the engine — `''` is a value it would store as a reason\n      // that says nothing. Absent is the honest form of «they did not say».\n      const reason = typeof body.reason === 'string' ? body.reason.trim() : '';\n      const serviceId = serviceIdOf(rt, token);\n      await rt.medal.cancelManage(\n        token,\n        reason.length > 0 ? reason : undefined,\n        await cancelKey(token)\n      );\n      await expireAfterWrite(rt, serviceId);\n      return NextResponse.json({ ok: true });\n    } catch (error) {\n      return manageErrorResponse(rt, error, 'cancel');\n    }\n  }\n\n  if (body.action === 'reschedule') {\n    const startTs = body.startTs;\n    // `Number.isFinite` and not `Number(...)`, for the reason the create route\n    // gives: `Number(null)` is 0, and a cleared slot serialises as null — a\n    // lenient parse would ask the engine to move the appointment to 1970.\n    if (!Number.isFinite(startTs)) {\n      return invalid('startTs must be a timestamp');\n    }\n    const serviceId = serviceIdOf(rt, token);\n    try {\n      const result = await rt.medal.rescheduleManage(\n        token,\n        startTs as number,\n        await moveKey(token, startTs as number)\n      );\n      await expireAfterWrite(rt, serviceId);\n      // The NEW booking's token, relayed so the page can send the visitor to a\n      // manage link that still works: the token they arrived with now belongs\n      // to the cancelled row and from here on resolves to «avbestilt».\n      //\n      // Absent on an idempotent replay — the engine mints it exactly once — so\n      // the field is optional and the page has a path for not getting one.\n      return NextResponse.json({\n        ok: true,\n        ...(typeof result?.manage_token === 'string' ? { manageToken: result.manage_token } : {}),\n      });\n    } catch (error) {\n      // The move lost its slot: the cache offered one that was already gone.\n      if (isSlotTaken(error)) await expireAfterWrite(rt, serviceId);\n      return manageErrorResponse(rt, error, 'reschedule');\n    }\n  }\n\n  return invalid('action must be \"cancel\" or \"reschedule\"');\n}\n\n/**\n * `GET <api>/manage/<token>` — the booking the token names, as the manage page\n * renders it, for a client that loads it itself. The same 404 for an unknown\n * token as for a revoked one; the token is never echoed or logged, and the\n * answer is never stored by anyone (`no-store`, `no-referrer`).\n */\nexport async function manageSummaryRoute(\n  rt: BookingRuntime,\n  _request: Request,\n  token: string\n): Promise<Response> {\n  const headers = { 'Cache-Control': 'no-store', 'Referrer-Policy': 'no-referrer' };\n  if (!token) return invalid('token is required');\n  try {\n    const booking = toManageDto(await rt.medal.getManage(token));\n    if (booking === null) return NextResponse.json({ error: 'notFound' }, { status: 404, headers });\n    return NextResponse.json({ booking }, { headers });\n  } catch (error) {\n    if (error instanceof MedalApiError && error.status === 404) {\n      return NextResponse.json({ error: 'notFound' }, { status: 404, headers });\n    }\n    const response = manageErrorResponse(rt, error, 'read');\n    for (const [name, value] of Object.entries(headers)) response.headers.set(name, value);\n    return response;\n  }\n}\n"],"mappings":";;;;;;;AA0CA,SAAS,QAAQ,SAA+B;CAC9C,OAAO,qBAAqB,gBAAgB,KAAK,OAAO;AAC1D;;;;;;;;;;;;;;;;;;AAmBA,eAAe,QAAQ,OAAe,SAAkC;CACtE,OAAO,SAAS,cAAc,MAAM,GAAG,SAAS;AAClD;;;;;;;;;;;;;;;;;;;;AAqBA,eAAe,UAAU,OAAgC;CACvD,OAAO,SAAS,UAAU,OAAO;AACnC;;;;;;;;;;;;;;;;AAiBA,SAAS,oBAAoB,IAAoB,OAAgB,QAA8B;CAC7F,IAAI,iBAAiB,kBAAkB;EACrC,GAAG,OAAO,MAAM;GAAE,KAAK;GAAO;EAAO,GAAG,+BAA+B;EACvE,OAAO,qBAAqB,gBAAgB,GAAG;CACjD;CAEA,IAAI,iBAAiB,eAAe;EAClC,IAAI,MAAM,WAAW,KACnB,OAAO,qBAAqB,YAAY,GAAG;EAE7C,IAAI,MAAM,SAAS,YAAY;GAC7B,IAAI,MAAM,QAAQ,SAAS,eAAe,GACxC,OAAO,qBAAqB,gBAAgB,GAAG;GAEjD,IAAI,YAAY,KAAK,GACnB,OAAO,qBAAqB,aAAa,GAAG;GAE9C,OAAO,qBAAqB,YAAY,GAAG;EAC7C;EACA,IAAI,MAAM,SAAS,sBAAsB,MAAM,SAAS,iBACtD,OAAO,qBAAqB,gBAAgB,GAAG;CAEnD;CAKA,GAAG,OAAO,MAAM;EAAE,KAAK;EAAO;CAAO,GAAG,8BAA8B;CACtE,OAAO,qBAAqB,iBAAiB,GAAG;AAClD;;;;;;;;;AAaA,eAAe,YAAY,IAAoB,OAAuC;CACpF,IAAI;EACF,QAAQ,MAAM,GAAG,MAAM,UAAU,KAAK,EAAA,CAAG,cAAc;CACzD,QAAQ;EACN,OAAO;CACT;AACF;;;AAIA,eAAe,iBACb,IACA,WACe;CACf,MAAM,KAAK,MAAM;CACjB,IAAI,OAAO,MAAM;CACjB,GAAG,UAAU,YAAY,CAAC,EAAE,CAAC;CAC7B,MAAM,GAAG,KAAK,mBAAmB,CAAC,EAAE,CAAC;AACvC;;;;;;AAOA,MAAM,wBAAwB;AAE9B,eAAsB,YACpB,IACA,SACA,OACmB;CACnB,IAAI,CAAC,OAIH,OAAO,QAAQ,mBAAmB;CAGpC,IAAI;CACJ,IAAI;EACF,MAAM,OAAO,MAAM,gBAAgB,SAAS,qBAAqB;EACjE,IAAI,SAAS,MAAM,OAAO,QAAQ,mBAAmB;EACrD,SAAS,KAAK,MAAM,IAAI;CAC1B,QAAQ;EACN,OAAO,QAAQ,yBAAyB;CAC1C;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,MAC3C,OAAO,QAAQ,4BAA4B;CAE7C,MAAM,OAAO;CAEb,IAAI,KAAK,WAAW,UAClB,IAAI;EAIF,MAAM,SAAS,OAAO,KAAK,WAAW,WAAW,KAAK,OAAO,KAAK,IAAI;EACtE,MAAM,YAAY,YAAY,IAAI,KAAK;EACvC,MAAM,GAAG,MAAM,aACb,OACA,OAAO,SAAS,IAAI,SAAS,KAAA,GAC7B,MAAM,UAAU,KAAK,CACvB;EACA,MAAM,iBAAiB,IAAI,SAAS;EACpC,OAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;CACvC,SAAS,OAAO;EACd,OAAO,oBAAoB,IAAI,OAAO,QAAQ;CAChD;CAGF,IAAI,KAAK,WAAW,cAAc;EAChC,MAAM,UAAU,KAAK;EAIrB,IAAI,CAAC,OAAO,SAAS,OAAO,GAC1B,OAAO,QAAQ,6BAA6B;EAE9C,MAAM,YAAY,YAAY,IAAI,KAAK;EACvC,IAAI;GACF,MAAM,SAAS,MAAM,GAAG,MAAM,iBAC5B,OACA,SACA,MAAM,QAAQ,OAAO,OAAiB,CACxC;GACA,MAAM,iBAAiB,IAAI,SAAS;GAOpC,OAAO,aAAa,KAAK;IACvB,IAAI;IACJ,GAAI,OAAO,QAAQ,iBAAiB,WAAW,EAAE,aAAa,OAAO,aAAa,IAAI,CAAC;GACzF,CAAC;EACH,SAAS,OAAO;GAEd,IAAI,YAAY,KAAK,GAAG,MAAM,iBAAiB,IAAI,SAAS;GAC5D,OAAO,oBAAoB,IAAI,OAAO,YAAY;EACpD;CACF;CAEA,OAAO,QAAQ,6CAAyC;AAC1D;;;;;;;AAQA,eAAsB,mBACpB,IACA,UACA,OACmB;CACnB,MAAM,UAAU;EAAE,iBAAiB;EAAY,mBAAmB;CAAc;CAChF,IAAI,CAAC,OAAO,OAAO,QAAQ,mBAAmB;CAC9C,IAAI;EACF,MAAM,UAAU,YAAY,MAAM,GAAG,MAAM,UAAU,KAAK,CAAC;EAC3D,IAAI,YAAY,MAAM,OAAO,aAAa,KAAK,EAAE,OAAO,WAAW,GAAG;GAAE,QAAQ;GAAK;EAAQ,CAAC;EAC9F,OAAO,aAAa,KAAK,EAAE,QAAQ,GAAG,EAAE,QAAQ,CAAC;CACnD,SAAS,OAAO;EACd,IAAI,iBAAiB,iBAAiB,MAAM,WAAW,KACrD,OAAO,aAAa,KAAK,EAAE,OAAO,WAAW,GAAG;GAAE,QAAQ;GAAK;EAAQ,CAAC;EAE1E,MAAM,WAAW,oBAAoB,IAAI,OAAO,MAAM;EACtD,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,OAAO,GAAG,SAAS,QAAQ,IAAI,MAAM,KAAK;EACrF,OAAO;CACT;AACF"}

package/dist/next/routes/portal-routes.mjs

@@ -0,0 +1,312 @@
+import { verifyLoginInput } from "../../core/portal/login-input.mjs";
+import { toBookingFamilyMember } from "../portal/guardian.mjs";
+import { PortalSessionExpiredError, PortalThrottledError, PortalValidationError, PortalVippsConflictError } from "../portal/medal-portal.mjs";
+import { declaresNoOrigin, isCrossOriginRequest, readBoundedText } from "../request.mjs";
+import { z } from "zod";
+import { NextResponse } from "next/server";
+//#region src/next/routes/portal-routes.ts
+/**
+* The portal's route handlers: the e-mail code and Vipps-link code that mint
+* a session, «add a child» from the booking wizard, the hourly session touch,
+* the dead-session clear and the Vipps flash spend.
+*
+* ROUTE HANDLERS, NOT SERVER ACTIONS, and that is the whole reason they
+* exist: in Next 16 a server action that sets a cookie makes the client
+* re-fetch the route it was called from, which on the booking page would
+* re-render the whole force-dynamic wizard behind a login sheet whose point
+* was not to. A `fetch` to a route handler sets the cookie and triggers
+* nothing.
+*
+* THE SESSION TOKEN IS NEVER IN A RESPONSE: it goes from the seam straight
+* into `writePortalSession`, whose cookie is HttpOnly. The seam scrubs it (and
+* every other secret it holds) out of anything it throws.
+*
+* SAME-ORIGIN, STRICTLY, for everything that mints a session or writes to the
+* account: a page elsewhere must not be able to log a visitor in to an
+* account of its choosing (login CSRF), and a request that declares neither
+* `Origin` nor `Referer` is refused too — every browser sends `Origin` on a
+* `fetch` POST.
+*/
+function answer(status, body) {
+	return Response.json(body, {
+		status,
+		headers: { "Cache-Control": "no-store" }
+	});
+}
+function empty(status) {
+	return new Response(null, {
+		status,
+		headers: { "Cache-Control": "no-store" }
+	});
+}
+async function jsonFrom(request, maxBytes) {
+	const text = await readBoundedText(request, maxBytes);
+	try {
+		return text === null ? null : JSON.parse(text);
+	} catch {
+		return null;
+	}
+}
+/** An address, six digits and JSON punctuation fit in far less. */
+const LOGIN_MAX_BODY_BYTES = 2048;
+/**
+* `POST <portalApi>/login/verify` — exchange an e-mail code for the session
+* cookie. Body `{ email, code }`. Answers, all `no-store`:
+*
+* - 200 `{ ok: true, guardian }` — the cookie is written. `guardian` is the
+*   parent narrowed exactly as the booking page narrows them, or `null` when
+*   the profile read after a good code failed.
+* - 400 / 401 `{ ok: false, reason: 'invalid' }` — a malformed body, or a
+*   wrong or expired code.
+* - 429 `throttled` · 503 `unreachable` · 403 for another origin.
+*/
+async function loginVerifyRoute(rt, request) {
+	const reply = (status, body) => answer(status, body);
+	if (declaresNoOrigin(request) || isCrossOriginRequest(request)) return reply(403, {
+		ok: false,
+		reason: "forbidden"
+	});
+	const parsed = verifyLoginInput.safeParse(await jsonFrom(request, LOGIN_MAX_BODY_BYTES));
+	if (!parsed.success) return reply(400, {
+		ok: false,
+		reason: "invalid"
+	});
+	let session;
+	try {
+		session = await rt.portal.verifyLogin(parsed.data.email, parsed.data.code);
+	} catch (error) {
+		if (error instanceof PortalThrottledError) return reply(429, {
+			ok: false,
+			reason: "throttled"
+		});
+		rt.logger.error(error, "Portal login code could not be verified");
+		return reply(503, {
+			ok: false,
+			reason: "unreachable"
+		});
+	}
+	if (session === null) return reply(401, {
+		ok: false,
+		reason: "invalid"
+	});
+	await rt.session.writePortalSession(session.sessionToken, session.expiresAt);
+	return reply(200, {
+		ok: true,
+		guardian: await rt.guardianFromSession(session.sessionToken)
+	});
+}
+const PERSONS_MAX_BODY_BYTES = 2048;
+const personInput = z.object({
+	name: z.string().trim().min(1).max(60),
+	birthYear: z.number().int().refine((year) => year >= (/* @__PURE__ */ new Date()).getFullYear() - 18 && year <= (/* @__PURE__ */ new Date()).getFullYear()),
+	birthMonth: z.number().int().min(1).max(12).optional(),
+	notes: z.string().trim().max(500).optional()
+});
+/**
+* `POST <portalApi>/persons` — the wizard's «add a child» for a logged-in
+* parent: create the child in Medal, answer with them, narrowed exactly as the
+* booking page narrows the family (no stylist note, no contact id).
+*
+* Body `{ name, birthYear, birthMonth?, notes? }`. Answers, all `no-store`:
+* 201 `{ ok: true, child }` · 400 `invalid` (with the engine's `message`
+* where there is one) · 401 `session` · 429 `throttled` · 503 `unreachable`
+* · 403 for another origin.
+*/
+async function personsRoute(rt, request) {
+	const reply = (status, body) => answer(status, body);
+	if (declaresNoOrigin(request) || isCrossOriginRequest(request)) return reply(403, {
+		ok: false,
+		reason: "forbidden"
+	});
+	const session = await rt.session.readPortalSession();
+	if (session === null) return reply(401, {
+		ok: false,
+		reason: "session"
+	});
+	const parsed = personInput.safeParse(await jsonFrom(request, PERSONS_MAX_BODY_BYTES));
+	if (!parsed.success) return reply(400, {
+		ok: false,
+		reason: "invalid"
+	});
+	const { name, birthYear, birthMonth, notes } = parsed.data;
+	try {
+		return reply(201, {
+			ok: true,
+			child: createdChild(await rt.portal.createPerson(session, {
+				name,
+				birthYear,
+				...birthMonth === void 0 ? {} : { birthMonth },
+				...notes === void 0 || notes === "" ? {} : { notes }
+			}), parsed.data)
+		});
+	} catch (error) {
+		if (error instanceof PortalSessionExpiredError) return reply(401, {
+			ok: false,
+			reason: "session"
+		});
+		if (error instanceof PortalValidationError) return reply(400, {
+			ok: false,
+			reason: "invalid",
+			message: error.message
+		});
+		if (error instanceof PortalThrottledError) return reply(429, {
+			ok: false,
+			reason: "throttled"
+		});
+		rt.logger.error(error, "A child could not be added from the booking wizard");
+		return reply(503, {
+			ok: false,
+			reason: "unreachable"
+		});
+	}
+}
+/** The child just created, as the wizard sees them — by id, else by name and year. */
+function createdChild(result, wanted) {
+	const family = result.profile.family;
+	const created = (result.personId === null ? void 0 : family.find((member) => member.personId === result.personId)) ?? family.find((member) => member.name === wanted.name && member.birthYear === wanted.birthYear);
+	if (created) return toBookingFamilyMember(created);
+	return {
+		name: wanted.name,
+		birthYear: wanted.birthYear,
+		...wanted.birthMonth === void 0 ? {} : { birthMonth: wanted.birthMonth }
+	};
+}
+/**
+* `POST <portalApi>/session/touch` — keep the session cookie alive as long as
+* the session behind it. Medal slides a portal session every time it is used,
+* but the cookie was written once, at login; Server Components cannot set
+* cookies, so the portal calls this from the browser (once an hour at most).
+*
+* 204: Medal answered, the cookie is renewed. 401: no session, or one Medal no
+* longer honours — nothing is renewed or cleared here. 503: Medal could not be
+* asked. POST so no link, prefetch or crawler triggers it.
+*/
+async function sessionTouchRoute(rt) {
+	const session = await rt.session.readPortalSession();
+	if (session === null) return empty(401);
+	try {
+		await rt.portal.getMe(session);
+	} catch (error) {
+		if (error instanceof PortalSessionExpiredError) return empty(401);
+		rt.logger.warn({ err: error }, "Portal session touch could not reach Medal");
+		return empty(503);
+	}
+	await rt.session.renewPortalSession(session);
+	return empty(204);
+}
+function seeOther(path, request, headers = {}) {
+	const location = new URL(path, request.url);
+	return new NextResponse(null, {
+		status: 303,
+		headers: {
+			Location: location.toString(),
+			"Cache-Control": "no-store",
+			...headers
+		}
+	});
+}
+/**
+* `GET <portalApi>/session/expired` — drop a session cookie Medal has stopped
+* honouring, then send the parent to the login.
+*
+* A Server Component cannot clear a cookie, and the login page sends anyone
+* WITH a cookie back to the portal, so a revoked cookie would bounce the
+* parent between the two. The portal page redirects HERE instead.
+*
+* It clears ONLY a cookie Medal itself refuses: a predictable GET that always
+* logged the parent out would be a logout-CSRF. If Medal cannot be reached the
+* cookie is kept too, and the portal shows its own «unreachable» card.
+*/
+async function sessionExpiredRoute(rt, request) {
+	const login = rt.paths.portalLogin;
+	const session = await rt.session.readPortalSession();
+	if (session === null) return seeOther(login, request);
+	let dead;
+	try {
+		await rt.portal.getMe(session);
+		dead = false;
+	} catch (error) {
+		dead = error instanceof PortalSessionExpiredError;
+	}
+	if (!dead) return seeOther(rt.paths.portal ?? login, request);
+	await rt.session.clearPortalSession();
+	return seeOther(login, request);
+}
+/**
+* `DELETE <portalApi>/vipps/flash` — spend the «Vipps linked» flash once the
+* profile has shown it. Same-origin only; 204 whether or not there was one.
+*/
+async function vippsFlashRoute(rt, request) {
+	if (isCrossOriginRequest(request)) return empty(403);
+	await rt.flash.clearVippsLinkFlash();
+	return empty(204);
+}
+const LINK_MAX_BODY_BYTES = 1024;
+const linkInput = z.object({ code: z.string().regex(/^\d{6}$/) }).strict();
+/**
+* `POST <portalApi>/vipps/link/verify` — the e-mail code that confirms a
+* conflicted Vipps login, exchanged for the session cookie. The body is
+* `{ code }` and nothing else; the pending `link` and this browser's binding
+* come from their httpOnly cookies and go to Medal in the request body.
+*
+* 200 `{ ok: true, guardian }` (both Vipps cookies cleared) · 400 / 401
+* `invalid` (the cookies stay on a wrong code) · 409 `conflict` (the link is
+* spent, so the cookies go) · 429 · 503 · 403.
+*/
+async function vippsLinkVerifyRoute(rt, request) {
+	const reply = (status, body) => answer(status, body);
+	if (declaresNoOrigin(request) || isCrossOriginRequest(request)) return reply(403, {
+		ok: false,
+		reason: "forbidden"
+	});
+	const parsed = linkInput.safeParse(await jsonFrom(request, LINK_MAX_BODY_BYTES));
+	const code = parsed.success ? parsed.data.code : null;
+	if (code === null) return reply(400, {
+		ok: false,
+		reason: "invalid"
+	});
+	const pair = await rt.vippsLink.readVippsLinkPair();
+	if (pair === null) return reply(401, {
+		ok: false,
+		reason: "invalid"
+	});
+	let session;
+	try {
+		session = await rt.portal.verifyVippsLink({
+			link: pair.link,
+			code,
+			browserBinding: pair.binding
+		});
+	} catch (error) {
+		if (error instanceof PortalVippsConflictError) {
+			await rt.vippsLink.clearVippsLinkPair();
+			return reply(409, {
+				ok: false,
+				reason: "conflict"
+			});
+		}
+		if (error instanceof PortalThrottledError) return reply(429, {
+			ok: false,
+			reason: "throttled"
+		});
+		rt.logger.error(error, "A Vipps link code could not be verified");
+		return reply(503, {
+			ok: false,
+			reason: "unreachable"
+		});
+	}
+	if (session === null) return reply(401, {
+		ok: false,
+		reason: "invalid"
+	});
+	await rt.session.writePortalSession(session.sessionToken, session.expiresAt);
+	await rt.vippsLink.clearVippsLinkPair();
+	return reply(200, {
+		ok: true,
+		guardian: await rt.guardianFromSession(session.sessionToken)
+	});
+}
+//#endregion
+export { loginVerifyRoute, personsRoute, sessionExpiredRoute, sessionTouchRoute, vippsFlashRoute, vippsLinkVerifyRoute };
+
+//# sourceMappingURL=portal-routes.mjs.map

package/dist/next/routes/portal-routes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"portal-routes.mjs","names":[],"sources":["../../../src/next/routes/portal-routes.ts"],"sourcesContent":["/**\n * The portal's route handlers: the e-mail code and Vipps-link code that mint\n * a session, «add a child» from the booking wizard, the hourly session touch,\n * the dead-session clear and the Vipps flash spend.\n *\n * ROUTE HANDLERS, NOT SERVER ACTIONS, and that is the whole reason they\n * exist: in Next 16 a server action that sets a cookie makes the client\n * re-fetch the route it was called from, which on the booking page would\n * re-render the whole force-dynamic wizard behind a login sheet whose point\n * was not to. A `fetch` to a route handler sets the cookie and triggers\n * nothing.\n *\n * THE SESSION TOKEN IS NEVER IN A RESPONSE: it goes from the seam straight\n * into `writePortalSession`, whose cookie is HttpOnly. The seam scrubs it (and\n * every other secret it holds) out of anything it throws.\n *\n * SAME-ORIGIN, STRICTLY, for everything that mints a session or writes to the\n * account: a page elsewhere must not be able to log a visitor in to an\n * account of its choosing (login CSRF), and a request that declares neither\n * `Origin` nor `Referer` is refused too — every browser sends `Origin` on a\n * `fetch` POST.\n */\n\nimport { NextResponse } from 'next/server';\nimport { z } from 'zod';\nimport { type VerifyLoginFailure, verifyLoginInput } from '../../core/portal/login-input';\nimport type { BookingFamilyMember, BookingGuardian } from '../../core/types';\nimport { toBookingFamilyMember } from '../portal/guardian';\nimport {\n  type PortalPersonResult,\n  PortalSessionExpiredError,\n  PortalThrottledError,\n  PortalValidationError,\n  PortalVippsConflictError,\n} from '../portal/medal-portal';\nimport { declaresNoOrigin, isCrossOriginRequest, readBoundedText } from '../request';\nimport type { BookingRuntime } from '../runtime';\n\nfunction answer(status: number, body: unknown): Response {\n  return Response.json(body, { status, headers: { 'Cache-Control': 'no-store' } });\n}\n\nfunction empty(status: number): Response {\n  return new Response(null, { status, headers: { 'Cache-Control': 'no-store' } });\n}\n\nasync function jsonFrom(request: Request, maxBytes: number): Promise<unknown> {\n  const text = await readBoundedText(request, maxBytes);\n  try {\n    return text === null ? null : JSON.parse(text);\n  } catch {\n    return null;\n  }\n}\n\n/** An address, six digits and JSON punctuation fit in far less. */\nconst LOGIN_MAX_BODY_BYTES = 2 * 1024;\n\ntype VerifyAnswer =\n  | { ok: true; guardian: BookingGuardian | null }\n  | { ok: false; reason: VerifyLoginFailure | 'forbidden' };\n\n/**\n * `POST <portalApi>/login/verify` — exchange an e-mail code for the session\n * cookie. Body `{ email, code }`. Answers, all `no-store`:\n *\n * - 200 `{ ok: true, guardian }` — the cookie is written. `guardian` is the\n *   parent narrowed exactly as the booking page narrows them, or `null` when\n *   the profile read after a good code failed.\n * - 400 / 401 `{ ok: false, reason: 'invalid' }` — a malformed body, or a\n *   wrong or expired code.\n * - 429 `throttled` · 503 `unreachable` · 403 for another origin.\n */\nexport async function loginVerifyRoute(rt: BookingRuntime, request: Request): Promise<Response> {\n  const reply = (status: number, body: VerifyAnswer) => answer(status, body);\n  if (declaresNoOrigin(request) || isCrossOriginRequest(request)) {\n    return reply(403, { ok: false, reason: 'forbidden' });\n  }\n\n  const parsed = verifyLoginInput.safeParse(await jsonFrom(request, LOGIN_MAX_BODY_BYTES));\n  if (!parsed.success) return reply(400, { ok: false, reason: 'invalid' });\n\n  let session: Awaited<ReturnType<BookingRuntime['portal']['verifyLogin']>>;\n  try {\n    session = await rt.portal.verifyLogin(parsed.data.email, parsed.data.code);\n  } catch (error) {\n    if (error instanceof PortalThrottledError) {\n      return reply(429, { ok: false, reason: 'throttled' });\n    }\n    // The seam never puts the code or a token in an error it throws.\n    rt.logger.error(error, 'Portal login code could not be verified');\n    return reply(503, { ok: false, reason: 'unreachable' });\n  }\n  if (session === null) return reply(401, { ok: false, reason: 'invalid' });\n\n  await rt.session.writePortalSession(session.sessionToken, session.expiresAt);\n  return reply(200, { ok: true, guardian: await rt.guardianFromSession(session.sessionToken) });\n}\n\nconst PERSONS_MAX_BODY_BYTES = 2 * 1024;\n\nconst personInput = z.object({\n  name: z.string().trim().min(1).max(60),\n  birthYear: z\n    .number()\n    .int()\n    .refine((year) => year >= new Date().getFullYear() - 18 && year <= new Date().getFullYear()),\n  birthMonth: z.number().int().min(1).max(12).optional(),\n  notes: z.string().trim().max(500).optional(),\n});\n\ntype PersonsAnswer =\n  | { ok: true; child: BookingFamilyMember }\n  | {\n      ok: false;\n      reason: 'invalid' | 'session' | 'throttled' | 'unreachable' | 'forbidden';\n      message?: string;\n    };\n\n/**\n * `POST <portalApi>/persons` — the wizard's «add a child» for a logged-in\n * parent: create the child in Medal, answer with them, narrowed exactly as the\n * booking page narrows the family (no stylist note, no contact id).\n *\n * Body `{ name, birthYear, birthMonth?, notes? }`. Answers, all `no-store`:\n * 201 `{ ok: true, child }` · 400 `invalid` (with the engine's `message`\n * where there is one) · 401 `session` · 429 `throttled` · 503 `unreachable`\n * · 403 for another origin.\n */\nexport async function personsRoute(rt: BookingRuntime, request: Request): Promise<Response> {\n  const reply = (status: number, body: PersonsAnswer) => answer(status, body);\n  if (declaresNoOrigin(request) || isCrossOriginRequest(request)) {\n    return reply(403, { ok: false, reason: 'forbidden' });\n  }\n  const session = await rt.session.readPortalSession();\n  if (session === null) return reply(401, { ok: false, reason: 'session' });\n\n  const parsed = personInput.safeParse(await jsonFrom(request, PERSONS_MAX_BODY_BYTES));\n  if (!parsed.success) return reply(400, { ok: false, reason: 'invalid' });\n  const { name, birthYear, birthMonth, notes } = parsed.data;\n\n  try {\n    const result = await rt.portal.createPerson(session, {\n      name,\n      birthYear,\n      ...(birthMonth === undefined ? {} : { birthMonth }),\n      ...(notes === undefined || notes === '' ? {} : { notes }),\n    });\n    return reply(201, { ok: true, child: createdChild(result, parsed.data) });\n  } catch (error) {\n    if (error instanceof PortalSessionExpiredError) {\n      return reply(401, { ok: false, reason: 'session' });\n    }\n    if (error instanceof PortalValidationError) {\n      return reply(400, { ok: false, reason: 'invalid', message: error.message });\n    }\n    if (error instanceof PortalThrottledError) {\n      return reply(429, { ok: false, reason: 'throttled' });\n    }\n    rt.logger.error(error, 'A child could not be added from the booking wizard');\n    return reply(503, { ok: false, reason: 'unreachable' });\n  }\n}\n\n/** The child just created, as the wizard sees them — by id, else by name and year. */\nfunction createdChild(\n  result: PortalPersonResult,\n  wanted: { name: string; birthYear: number; birthMonth?: number }\n): BookingFamilyMember {\n  const family = result.profile.family;\n  const created =\n    (result.personId === null\n      ? undefined\n      : family.find((member) => member.personId === result.personId)) ??\n    family.find((member) => member.name === wanted.name && member.birthYear === wanted.birthYear);\n  if (created) return toBookingFamilyMember(created);\n  return {\n    name: wanted.name,\n    birthYear: wanted.birthYear,\n    ...(wanted.birthMonth === undefined ? {} : { birthMonth: wanted.birthMonth }),\n  };\n}\n\n/**\n * `POST <portalApi>/session/touch` — keep the session cookie alive as long as\n * the session behind it. Medal slides a portal session every time it is used,\n * but the cookie was written once, at login; Server Components cannot set\n * cookies, so the portal calls this from the browser (once an hour at most).\n *\n * 204: Medal answered, the cookie is renewed. 401: no session, or one Medal no\n * longer honours — nothing is renewed or cleared here. 503: Medal could not be\n * asked. POST so no link, prefetch or crawler triggers it.\n */\nexport async function sessionTouchRoute(rt: BookingRuntime): Promise<Response> {\n  const session = await rt.session.readPortalSession();\n  if (session === null) return empty(401);\n\n  try {\n    await rt.portal.getMe(session);\n  } catch (error) {\n    if (error instanceof PortalSessionExpiredError) return empty(401);\n    rt.logger.warn({ err: error }, 'Portal session touch could not reach Medal');\n    return empty(503);\n  }\n\n  await rt.session.renewPortalSession(session);\n  return empty(204);\n}\n\nfunction seeOther(path: string, request: Request, headers: Record<string, string> = {}): Response {\n  const location = new URL(path, request.url);\n  return new NextResponse(null, {\n    status: 303,\n    headers: { Location: location.toString(), 'Cache-Control': 'no-store', ...headers },\n  });\n}\n\n/**\n * `GET <portalApi>/session/expired` — drop a session cookie Medal has stopped\n * honouring, then send the parent to the login.\n *\n * A Server Component cannot clear a cookie, and the login page sends anyone\n * WITH a cookie back to the portal, so a revoked cookie would bounce the\n * parent between the two. The portal page redirects HERE instead.\n *\n * It clears ONLY a cookie Medal itself refuses: a predictable GET that always\n * logged the parent out would be a logout-CSRF. If Medal cannot be reached the\n * cookie is kept too, and the portal shows its own «unreachable» card.\n */\nexport async function sessionExpiredRoute(rt: BookingRuntime, request: Request): Promise<Response> {\n  const login = rt.paths.portalLogin;\n  const session = await rt.session.readPortalSession();\n  if (session === null) {\n    return seeOther(login, request);\n  }\n  let dead: boolean;\n  try {\n    await rt.portal.getMe(session);\n    dead = false;\n  } catch (error) {\n    dead = error instanceof PortalSessionExpiredError;\n  }\n  if (!dead) {\n    return seeOther(rt.paths.portal ?? login, request);\n  }\n  await rt.session.clearPortalSession();\n  return seeOther(login, request);\n}\n\n/**\n * `DELETE <portalApi>/vipps/flash` — spend the «Vipps linked» flash once the\n * profile has shown it. Same-origin only; 204 whether or not there was one.\n */\nexport async function vippsFlashRoute(rt: BookingRuntime, request: Request): Promise<Response> {\n  if (isCrossOriginRequest(request)) return empty(403);\n  await rt.flash.clearVippsLinkFlash();\n  return empty(204);\n}\n\nconst LINK_MAX_BODY_BYTES = 1024;\n\nconst linkInput = z.object({ code: z.string().regex(/^\\d{6}$/) }).strict();\n\ntype LinkAnswer =\n  | { ok: true; guardian: BookingGuardian | null }\n  | { ok: false; reason: 'invalid' | 'conflict' | 'throttled' | 'unreachable' | 'forbidden' };\n\n/**\n * `POST <portalApi>/vipps/link/verify` — the e-mail code that confirms a\n * conflicted Vipps login, exchanged for the session cookie. The body is\n * `{ code }` and nothing else; the pending `link` and this browser's binding\n * come from their httpOnly cookies and go to Medal in the request body.\n *\n * 200 `{ ok: true, guardian }` (both Vipps cookies cleared) · 400 / 401\n * `invalid` (the cookies stay on a wrong code) · 409 `conflict` (the link is\n * spent, so the cookies go) · 429 · 503 · 403.\n */\nexport async function vippsLinkVerifyRoute(\n  rt: BookingRuntime,\n  request: Request\n): Promise<Response> {\n  const reply = (status: number, body: LinkAnswer) => answer(status, body);\n  if (declaresNoOrigin(request) || isCrossOriginRequest(request)) {\n    return reply(403, { ok: false, reason: 'forbidden' });\n  }\n  const parsed = linkInput.safeParse(await jsonFrom(request, LINK_MAX_BODY_BYTES));\n  const code = parsed.success ? parsed.data.code : null;\n  if (code === null) return reply(400, { ok: false, reason: 'invalid' });\n  // No link or no binding in the jar — expired, or another browser — is the\n  // same «wrong or expired code» Medal would give, without asking Medal.\n  const pair = await rt.vippsLink.readVippsLinkPair();\n  if (pair === null) return reply(401, { ok: false, reason: 'invalid' });\n\n  let session: Awaited<ReturnType<BookingRuntime['portal']['verifyVippsLink']>>;\n  try {\n    session = await rt.portal.verifyVippsLink({\n      link: pair.link,\n      code,\n      browserBinding: pair.binding,\n    });\n  } catch (error) {\n    if (error instanceof PortalVippsConflictError) {\n      await rt.vippsLink.clearVippsLinkPair();\n      return reply(409, { ok: false, reason: 'conflict' });\n    }\n    if (error instanceof PortalThrottledError) {\n      return reply(429, { ok: false, reason: 'throttled' });\n    }\n    rt.logger.error(error, 'A Vipps link code could not be verified');\n    return reply(503, { ok: false, reason: 'unreachable' });\n  }\n  if (session === null) return reply(401, { ok: false, reason: 'invalid' });\n\n  await rt.session.writePortalSession(session.sessionToken, session.expiresAt);\n  await rt.vippsLink.clearVippsLinkPair();\n  return reply(200, { ok: true, guardian: await rt.guardianFromSession(session.sessionToken) });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,SAAS,OAAO,QAAgB,MAAyB;CACvD,OAAO,SAAS,KAAK,MAAM;EAAE;EAAQ,SAAS,EAAE,iBAAiB,WAAW;CAAE,CAAC;AACjF;AAEA,SAAS,MAAM,QAA0B;CACvC,OAAO,IAAI,SAAS,MAAM;EAAE;EAAQ,SAAS,EAAE,iBAAiB,WAAW;CAAE,CAAC;AAChF;AAEA,eAAe,SAAS,SAAkB,UAAoC;CAC5E,MAAM,OAAO,MAAM,gBAAgB,SAAS,QAAQ;CACpD,IAAI;EACF,OAAO,SAAS,OAAO,OAAO,KAAK,MAAM,IAAI;CAC/C,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,MAAM,uBAAuB;;;;;;;;;;;;AAiB7B,eAAsB,iBAAiB,IAAoB,SAAqC;CAC9F,MAAM,SAAS,QAAgB,SAAuB,OAAO,QAAQ,IAAI;CACzE,IAAI,iBAAiB,OAAO,KAAK,qBAAqB,OAAO,GAC3D,OAAO,MAAM,KAAK;EAAE,IAAI;EAAO,QAAQ;CAAY,CAAC;CAGtD,MAAM,SAAS,iBAAiB,UAAU,MAAM,SAAS,SAAS,oBAAoB,CAAC;CACvF,IAAI,CAAC,OAAO,SAAS,OAAO,MAAM,KAAK;EAAE,IAAI;EAAO,QAAQ;CAAU,CAAC;CAEvE,IAAI;CACJ,IAAI;EACF,UAAU,MAAM,GAAG,OAAO,YAAY,OAAO,KAAK,OAAO,OAAO,KAAK,IAAI;CAC3E,SAAS,OAAO;EACd,IAAI,iBAAiB,sBACnB,OAAO,MAAM,KAAK;GAAE,IAAI;GAAO,QAAQ;EAAY,CAAC;EAGtD,GAAG,OAAO,MAAM,OAAO,yCAAyC;EAChE,OAAO,MAAM,KAAK;GAAE,IAAI;GAAO,QAAQ;EAAc,CAAC;CACxD;CACA,IAAI,YAAY,MAAM,OAAO,MAAM,KAAK;EAAE,IAAI;EAAO,QAAQ;CAAU,CAAC;CAExE,MAAM,GAAG,QAAQ,mBAAmB,QAAQ,cAAc,QAAQ,SAAS;CAC3E,OAAO,MAAM,KAAK;EAAE,IAAI;EAAM,UAAU,MAAM,GAAG,oBAAoB,QAAQ,YAAY;CAAE,CAAC;AAC9F;AAEA,MAAM,yBAAyB;AAE/B,MAAM,cAAc,EAAE,OAAO;CAC3B,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;CACrC,WAAW,EACR,OAAO,CAAC,CACR,IAAI,CAAC,CACL,QAAQ,SAAS,yBAAQ,IAAI,KAAK,EAAA,CAAE,YAAY,IAAI,MAAM,yBAAQ,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC;CAC7F,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS;CACrD,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;AAC7C,CAAC;;;;;;;;;;;AAoBD,eAAsB,aAAa,IAAoB,SAAqC;CAC1F,MAAM,SAAS,QAAgB,SAAwB,OAAO,QAAQ,IAAI;CAC1E,IAAI,iBAAiB,OAAO,KAAK,qBAAqB,OAAO,GAC3D,OAAO,MAAM,KAAK;EAAE,IAAI;EAAO,QAAQ;CAAY,CAAC;CAEtD,MAAM,UAAU,MAAM,GAAG,QAAQ,kBAAkB;CACnD,IAAI,YAAY,MAAM,OAAO,MAAM,KAAK;EAAE,IAAI;EAAO,QAAQ;CAAU,CAAC;CAExE,MAAM,SAAS,YAAY,UAAU,MAAM,SAAS,SAAS,sBAAsB,CAAC;CACpF,IAAI,CAAC,OAAO,SAAS,OAAO,MAAM,KAAK;EAAE,IAAI;EAAO,QAAQ;CAAU,CAAC;CACvE,MAAM,EAAE,MAAM,WAAW,YAAY,UAAU,OAAO;CAEtD,IAAI;EAOF,OAAO,MAAM,KAAK;GAAE,IAAI;GAAM,OAAO,aAAa,MAN7B,GAAG,OAAO,aAAa,SAAS;IACnD;IACA;IACA,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;IACjD,GAAI,UAAU,KAAA,KAAa,UAAU,KAAK,CAAC,IAAI,EAAE,MAAM;GACzD,CAAC,GACyD,OAAO,IAAI;EAAE,CAAC;CAC1E,SAAS,OAAO;EACd,IAAI,iBAAiB,2BACnB,OAAO,MAAM,KAAK;GAAE,IAAI;GAAO,QAAQ;EAAU,CAAC;EAEpD,IAAI,iBAAiB,uBACnB,OAAO,MAAM,KAAK;GAAE,IAAI;GAAO,QAAQ;GAAW,SAAS,MAAM;EAAQ,CAAC;EAE5E,IAAI,iBAAiB,sBACnB,OAAO,MAAM,KAAK;GAAE,IAAI;GAAO,QAAQ;EAAY,CAAC;EAEtD,GAAG,OAAO,MAAM,OAAO,oDAAoD;EAC3E,OAAO,MAAM,KAAK;GAAE,IAAI;GAAO,QAAQ;EAAc,CAAC;CACxD;AACF;;AAGA,SAAS,aACP,QACA,QACqB;CACrB,MAAM,SAAS,OAAO,QAAQ;CAC9B,MAAM,WACH,OAAO,aAAa,OACjB,KAAA,IACA,OAAO,MAAM,WAAW,OAAO,aAAa,OAAO,QAAQ,MAC/D,OAAO,MAAM,WAAW,OAAO,SAAS,OAAO,QAAQ,OAAO,cAAc,OAAO,SAAS;CAC9F,IAAI,SAAS,OAAO,sBAAsB,OAAO;CACjD,OAAO;EACL,MAAM,OAAO;EACb,WAAW,OAAO;EAClB,GAAI,OAAO,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,OAAO,WAAW;CAC7E;AACF;;;;;;;;;;;AAYA,eAAsB,kBAAkB,IAAuC;CAC7E,MAAM,UAAU,MAAM,GAAG,QAAQ,kBAAkB;CACnD,IAAI,YAAY,MAAM,OAAO,MAAM,GAAG;CAEtC,IAAI;EACF,MAAM,GAAG,OAAO,MAAM,OAAO;CAC/B,SAAS,OAAO;EACd,IAAI,iBAAiB,2BAA2B,OAAO,MAAM,GAAG;EAChE,GAAG,OAAO,KAAK,EAAE,KAAK,MAAM,GAAG,4CAA4C;EAC3E,OAAO,MAAM,GAAG;CAClB;CAEA,MAAM,GAAG,QAAQ,mBAAmB,OAAO;CAC3C,OAAO,MAAM,GAAG;AAClB;AAEA,SAAS,SAAS,MAAc,SAAkB,UAAkC,CAAC,GAAa;CAChG,MAAM,WAAW,IAAI,IAAI,MAAM,QAAQ,GAAG;CAC1C,OAAO,IAAI,aAAa,MAAM;EAC5B,QAAQ;EACR,SAAS;GAAE,UAAU,SAAS,SAAS;GAAG,iBAAiB;GAAY,GAAG;EAAQ;CACpF,CAAC;AACH;;;;;;;;;;;;;AAcA,eAAsB,oBAAoB,IAAoB,SAAqC;CACjG,MAAM,QAAQ,GAAG,MAAM;CACvB,MAAM,UAAU,MAAM,GAAG,QAAQ,kBAAkB;CACnD,IAAI,YAAY,MACd,OAAO,SAAS,OAAO,OAAO;CAEhC,IAAI;CACJ,IAAI;EACF,MAAM,GAAG,OAAO,MAAM,OAAO;EAC7B,OAAO;CACT,SAAS,OAAO;EACd,OAAO,iBAAiB;CAC1B;CACA,IAAI,CAAC,MACH,OAAO,SAAS,GAAG,MAAM,UAAU,OAAO,OAAO;CAEnD,MAAM,GAAG,QAAQ,mBAAmB;CACpC,OAAO,SAAS,OAAO,OAAO;AAChC;;;;;AAMA,eAAsB,gBAAgB,IAAoB,SAAqC;CAC7F,IAAI,qBAAqB,OAAO,GAAG,OAAO,MAAM,GAAG;CACnD,MAAM,GAAG,MAAM,oBAAoB;CACnC,OAAO,MAAM,GAAG;AAClB;AAEA,MAAM,sBAAsB;AAE5B,MAAM,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO;;;;;;;;;;;AAgBzE,eAAsB,qBACpB,IACA,SACmB;CACnB,MAAM,SAAS,QAAgB,SAAqB,OAAO,QAAQ,IAAI;CACvE,IAAI,iBAAiB,OAAO,KAAK,qBAAqB,OAAO,GAC3D,OAAO,MAAM,KAAK;EAAE,IAAI;EAAO,QAAQ;CAAY,CAAC;CAEtD,MAAM,SAAS,UAAU,UAAU,MAAM,SAAS,SAAS,mBAAmB,CAAC;CAC/E,MAAM,OAAO,OAAO,UAAU,OAAO,KAAK,OAAO;CACjD,IAAI,SAAS,MAAM,OAAO,MAAM,KAAK;EAAE,IAAI;EAAO,QAAQ;CAAU,CAAC;CAGrE,MAAM,OAAO,MAAM,GAAG,UAAU,kBAAkB;CAClD,IAAI,SAAS,MAAM,OAAO,MAAM,KAAK;EAAE,IAAI;EAAO,QAAQ;CAAU,CAAC;CAErE,IAAI;CACJ,IAAI;EACF,UAAU,MAAM,GAAG,OAAO,gBAAgB;GACxC,MAAM,KAAK;GACX;GACA,gBAAgB,KAAK;EACvB,CAAC;CACH,SAAS,OAAO;EACd,IAAI,iBAAiB,0BAA0B;GAC7C,MAAM,GAAG,UAAU,mBAAmB;GACtC,OAAO,MAAM,KAAK;IAAE,IAAI;IAAO,QAAQ;GAAW,CAAC;EACrD;EACA,IAAI,iBAAiB,sBACnB,OAAO,MAAM,KAAK;GAAE,IAAI;GAAO,QAAQ;EAAY,CAAC;EAEtD,GAAG,OAAO,MAAM,OAAO,yCAAyC;EAChE,OAAO,MAAM,KAAK;GAAE,IAAI;GAAO,QAAQ;EAAc,CAAC;CACxD;CACA,IAAI,YAAY,MAAM,OAAO,MAAM,KAAK;EAAE,IAAI;EAAO,QAAQ;CAAU,CAAC;CAExE,MAAM,GAAG,QAAQ,mBAAmB,QAAQ,cAAc,QAAQ,SAAS;CAC3E,MAAM,GAAG,UAAU,mBAAmB;CACtC,OAAO,MAAM,KAAK;EAAE,IAAI;EAAM,UAAU,MAAM,GAAG,oBAAoB,QAAQ,YAAY;CAAE,CAAC;AAC9F"}