@ossy/booking 1.16.0 → 1.16.1

package/README.md

@@ -1,39 +1,46 @@
 # @ossy/booking
 
-Booking feature package for the Ossy platform. Lets consultants define services, set weekly availability, and accept client bookings with optional Stripe payment.
+Booking feature package for the Ossy platform. Lets consultants define services, set weekly availability, and accept client bookings.
 
 ## Pages
 
 | Page | Path | Audience |
 |------|------|----------|
-| `booking-page` | `/book/:workspaceId` | Public (clients) |
-| `services` | `/services` | Consultant (authenticated) |
-| `bookings` | `/bookings` | Consultant (authenticated) |
-| `availability` | `/availability` | Consultant (authenticated) |
+| `public-booking` | `/book/:consultantSlug` · `/boka/:consultantSlug` | Public (clients) |
+| `services` | `/services` · `/tjanster` | Consultant (authenticated) |
+| `bookings` | `/bookings` · `/bokningar` | Consultant (authenticated) |
+| `availability-setup` | `/availability` · `/tillganglighet` | Consultant (authenticated) |
+| `booking-detail` | `/bookings/:bookingId` · `/bokningar/:bookingId` | Consultant (authenticated) |
+
+## Public booking flow
+
+1. Client opens `public-booking` (no auth; `metadata.public: true`)
+2. Picks a service → calendar slot → contact details
+3. `booking/create` stores a pending booking and sends notification emails
+
+## Service actions
+
+| Action | Access |
+|--------|--------|
+| `booking/get-services` | public |
+| `booking/create-service` | workspace |
+| `booking/update-service` | workspace |
+| `booking/delete-service` | workspace |
 
 ## Resource templates
 
-Three resource schemas are registered under the `@ossy/booking` category:
+- `@ossy/booking/service` — what a consultant sells (`/@ossy/booking/services/`)
+- `@ossy/booking/booking` — an appointment (`/@ossy/booking/bookings/`)
+- `@ossy/booking/availability` — weekly availability config (`/@ossy/booking/availability/`)
 
-- `@ossy/booking/service` — what a consultant sells
-- `@ossy/booking/booking` — a confirmed appointment
-- `@ossy/booking/availability` — recurring weekly availability window
+Import locations from `@ossy/booking` (`services`, `bookings`, `availability`).
 
 ## Resource view slots
 
-Register custom UI for resource types via `*.component.jsx` with `metadata.id` matching the slot key (see `@ossy/design-system` [SLOTS.md](../design-system/docs/SLOTS.md)):
-
 | Component | Slot key |
 |-----------|----------|
 | `service-detail.component.jsx` | `resource:booking/service/detail` |
 | `service-card-slot.component.jsx` | `resource:booking/service/card` |
 | `booking-card.component.jsx` | `resource:booking/booking/card` |
 
-Dedicated pages (`services.page.jsx`, `booking-detail.page.jsx`, etc.) continue to work alongside generic `@ossy/resources` slot hosts.
-
-## What still needs implementation
-
-- **Slot generation** — derive available time slots from `availability` records minus existing `booking` records
-- **Stripe integration** — create a PaymentIntent on booking submit, webhook to flip `paymentStatus`
-- **Confirmation emails** — `booking.send-confirmation-email` task
-- **Public workspace resolution** — resolve `workspaceId` param on the public booking page without auth
+See [SPEC.md](./SPEC.md) for the full product specification.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ossy/booking",
   "description": "Booking feature package — services, availability, and appointment management for Ossy consultants",
-  "version": "1.16.0",
+  "version": "1.16.1",
   "type": "module",
   "main": "./src/index.js",
   "module": "./src/index.js",
@@ -14,11 +14,11 @@
     "src": "./src"
   },
   "dependencies": {
-    "@ossy/email": "^1.6.0",
-    "@ossy/event-store": "^1.8.0",
-    "@ossy/observability": "^1.8.0",
-    "@ossy/platform": "^1.39.0",
-    "@ossy/resources": "^1.12.0"
+    "@ossy/email": "^1.6.1",
+    "@ossy/event-store": "^1.8.1",
+    "@ossy/observability": "^1.8.1",
+    "@ossy/platform": "^1.39.1",
+    "@ossy/resources": "^1.12.1"
   },
   "peerDependencies": {
     "@ossy/design-system": ">=1.0.0",
@@ -34,5 +34,5 @@
     "/src",
     "README.md"
   ],
-  "gitHead": "d9d31182be64a448d575da432af2830d909ad4b9"
+  "gitHead": "c0ba5d90749690634e4dc2705178ff8d89dd3070"
 }

package/src/availability-setup.page.jsx

@@ -9,6 +9,11 @@ import {
   Alert,
   useLocale,
 } from '@ossy/design-system'
+import { useRouter } from '@ossy/router-react'
+import { useSdk } from '@ossy/sdk-react'
+import { metadata as SaveAvailability } from './save-availability.action.js'
+import { metadata as GetAvailability } from './get-availability.action.js'
+import { invokeErrorMessage } from './invoke-error-message.js'
 
 export const metadata = {
   id: 'booking/availability-setup',
@@ -87,6 +92,8 @@ function DayRow ({ label, day, onToggle, onTimeChange, t }) {
 
 export default function AvailabilitySetupPage ({ workspaceId }) {
   const { t } = useLocale()
+  const sdk = useSdk()
+  const router = useRouter()
   const dayDefs = useMemo(() => [
     { dayOfWeek: 1, key: 'booking.availabilitySetup.day.monday' },
     { dayOfWeek: 2, key: 'booking.availabilitySetup.day.tuesday' },
@@ -107,11 +114,15 @@ export default function AvailabilitySetupPage ({ workspaceId }) {
   const [error, setError] = useState(null)
   const [copied, setCopied] = useState(false)
 
-  const bookingUrl = `https://ossy.se/boka/${workspaceId ?? ''}`
+  const bookingPath = workspaceId
+    ? router.getHref({ id: 'public-booking', params: { consultantSlug: workspaceId } })
+    : ''
+  const bookingUrl = typeof window !== 'undefined' && bookingPath
+    ? `${window.location.origin}${bookingPath}`
+    : bookingPath
 
   useEffect(() => {
-    fetch('/actions/booking/get-availability')
-      .then(r => (r.ok ? r.json() : null))
+    sdk.invoke(GetAvailability, {})
       .then(data => {
         if (data) {
           setDayState(buildDayState(data.weeklyWindows ?? []))
@@ -127,7 +138,7 @@ export default function AvailabilitySetupPage ({ workspaceId }) {
       })
       .catch(() => {})
       .finally(() => setLoading(false))
-  }, [])
+  }, [sdk])
 
   const toggleDay = (dayOfWeek) => {
     setDayState(prev => prev.map(d => d.dayOfWeek === dayOfWeek
@@ -161,20 +172,10 @@ export default function AvailabilitySetupPage ({ workspaceId }) {
     }))
 
     try {
-      const res = await fetch('/actions/booking/save-availability', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ weeklyWindows, sessionDurations, bufferMinutes, timezone }),
-      })
-
-      if (!res.ok) {
-        const data = await res.json().catch(() => ({}))
-        throw new Error(data?.message ?? t('booking.availabilitySetup.errorSave', { status: res.status }))
-      }
-
+      await sdk.invoke(SaveAvailability, { weeklyWindows, sessionDurations, bufferMinutes, timezone })
       setSaved(true)
     } catch (err) {
-      setError(err.message)
+      setError(await invokeErrorMessage(err, t('booking.availabilitySetup.errorSave', { status: '' })))
     } finally {
       setSaving(false)
     }
@@ -268,7 +269,7 @@ export default function AvailabilitySetupPage ({ workspaceId }) {
 
       {error && <Alert variant="danger">{error}</Alert>}
 
-      <Button variant="primary" disabled={saving} onClick={handleSave}>
+      <Button data-action={SaveAvailability.id} variant="primary" disabled={saving} onClick={handleSave}>
         {saving ? t('booking.availabilitySetup.saving') : t('booking.availabilitySetup.save')}
       </Button>
 

package/src/booking-card.component.jsx

@@ -1,5 +1,8 @@
 import React, { useState } from 'react'
 import { View, Title, Text, Button, Badge, Alert, useLocale } from '@ossy/design-system'
+import { metadata as ConfirmBooking } from './confirm-booking.action.js'
+import { metadata as DeclineBooking } from './decline-booking.action.js'
+import { metadata as CancelBooking } from './cancel-booking.action.js'
 
 export const metadata = { id: 'resource:booking/booking/card' }
 
@@ -102,6 +105,7 @@ export function BookingCard ({ booking, resource, onConfirm, onDecline, onCancel
         <View layout="row" gap="s" style={{ flexWrap: 'wrap' }}>
           {isPending && onConfirm && (
             <Button
+              data-action={ConfirmBooking.id}
               variant="primary"
               disabled={loadingAction === 'confirm'}
               onClick={() => handle(onConfirm, 'confirm')}
@@ -111,6 +115,7 @@ export function BookingCard ({ booking, resource, onConfirm, onDecline, onCancel
           )}
           {isPending && onDecline && (
             <Button
+              data-action={DeclineBooking.id}
               variant="danger"
               disabled={loadingAction === 'decline'}
               onClick={() => handle(onDecline, 'decline')}
@@ -120,6 +125,7 @@ export function BookingCard ({ booking, resource, onConfirm, onDecline, onCancel
           )}
           {isConfirmed && onCancel && (
             <Button
+              data-action={CancelBooking.id}
               variant="danger"
               disabled={loadingAction === 'cancel'}
               onClick={() => handle(onCancel, 'cancel')}

package/src/booking-detail.page.jsx

@@ -1,6 +1,12 @@
 import React, { useState, useEffect, useCallback, useMemo } from 'react'
 import { useRouter } from '@ossy/router-react'
 import { View, Title, Text, Button, Badge, Alert, Textarea, useLocale } from '@ossy/design-system'
+import { useSdk } from '@ossy/sdk-react'
+import { metadata as ConfirmBooking } from './confirm-booking.action.js'
+import { metadata as DeclineBooking } from './decline-booking.action.js'
+import { metadata as CancelBooking } from './cancel-booking.action.js'
+import { metadata as ListBookings } from './list-bookings.action.js'
+import { invokeErrorMessage } from './invoke-error-message.js'
 
 export const metadata = {
   id: 'booking/booking-detail',
@@ -36,34 +42,32 @@ function DetailRow ({ label, value }) {
   )
 }
 
-function ConfirmForm ({ booking, onSuccess, onError, t }) {
+function ConfirmForm ({ booking, onSuccess, onError, t, sdk }) {
   const [loading, setLoading] = useState(false)
   const handleConfirm = async () => {
     setLoading(true)
     try {
-      const res = await fetch('/actions/booking/confirm', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ bookingId: booking.id }) })
-      if (!res.ok) { const data = await res.json().catch(() => ({})); throw new Error(data?.message ?? t('booking.bookingDetail.errorConfirm')) }
+      await sdk.invoke(ConfirmBooking, { bookingId: booking.id })
       onSuccess()
-    } catch (err) { onError(err.message) } finally { setLoading(false) }
+    } catch (err) { onError(await invokeErrorMessage(err, t('booking.bookingDetail.errorConfirm'))) } finally { setLoading(false) }
   }
   return (
-    <Button variant="primary" disabled={loading} onClick={handleConfirm}>
+    <Button data-action={ConfirmBooking.id} variant="primary" disabled={loading} onClick={handleConfirm}>
       {loading ? t('booking.bookingDetail.confirming') : t('booking.bookingDetail.confirm')}
     </Button>
   )
 }
 
-function DeclineForm ({ booking, onSuccess, onError, t }) {
+function DeclineForm ({ booking, onSuccess, onError, t, sdk }) {
   const [reason, setReason] = useState('')
   const [loading, setLoading] = useState(false)
   const [expanded, setExpanded] = useState(false)
   const handleDecline = async () => {
     setLoading(true)
     try {
-      const res = await fetch('/actions/booking/decline', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ bookingId: booking.id, reason: reason.trim() || null }) })
-      if (!res.ok) { const data = await res.json().catch(() => ({})); throw new Error(data?.message ?? t('booking.bookingDetail.errorDecline')) }
+      await sdk.invoke(DeclineBooking, { bookingId: booking.id, reason: reason.trim() || null })
       onSuccess()
-    } catch (err) { onError(err.message) } finally { setLoading(false) }
+    } catch (err) { onError(await invokeErrorMessage(err, t('booking.bookingDetail.errorDecline'))) } finally { setLoading(false) }
   }
   if (!expanded) return <Button variant="danger" onClick={() => setExpanded(true)}>{t('booking.bookingDetail.decline')}</Button>
   return (
@@ -72,7 +76,7 @@ function DeclineForm ({ booking, onSuccess, onError, t }) {
         <Textarea value={reason} onChange={e => setReason(e.target.value)} rows={3} placeholder={t('booking.bookingDetail.declinePlaceholder')} />
         <Text variant="small" color="secondary">{t('booking.bookingDetail.declineReasonHint')}</Text>
         <View layout="row" gap="s">
-          <Button variant="danger" disabled={loading} onClick={handleDecline}>{loading ? t('booking.bookingDetail.declining') : t('booking.bookingDetail.declineConfirm')}</Button>
+          <Button data-action={DeclineBooking.id} variant="danger" disabled={loading} onClick={handleDecline}>{loading ? t('booking.bookingDetail.declining') : t('booking.bookingDetail.declineConfirm')}</Button>
           <Button variant="neutral" onClick={() => setExpanded(false)}>{t('booking.bookingDetail.cancelButton')}</Button>
         </View>
       </View>
@@ -80,16 +84,15 @@ function DeclineForm ({ booking, onSuccess, onError, t }) {
   )
 }
 
-function CancelForm ({ booking, onSuccess, onError, t }) {
+function CancelForm ({ booking, onSuccess, onError, t, sdk }) {
   const [loading, setLoading] = useState(false)
   const [expanded, setExpanded] = useState(false)
   const handleCancel = async () => {
     setLoading(true)
     try {
-      const res = await fetch('/actions/booking/cancel', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ bookingId: booking.id }) })
-      if (!res.ok) { const data = await res.json().catch(() => ({})); throw new Error(data?.message ?? t('booking.bookingDetail.errorCancel')) }
+      await sdk.invoke(CancelBooking, { bookingId: booking.id })
       onSuccess()
-    } catch (err) { onError(err.message) } finally { setLoading(false) }
+    } catch (err) { onError(await invokeErrorMessage(err, t('booking.bookingDetail.errorCancel'))) } finally { setLoading(false) }
   }
   if (!expanded) return <Button variant="danger" onClick={() => setExpanded(true)}>{t('booking.bookingDetail.cancelMeeting')}</Button>
   return (
@@ -97,7 +100,7 @@ function CancelForm ({ booking, onSuccess, onError, t }) {
       <View gap="s">
         <Text color="secondary">{t('booking.bookingDetail.cancelBody')}</Text>
         <View layout="row" gap="s">
-          <Button variant="danger" disabled={loading} onClick={handleCancel}>{loading ? t('booking.bookingDetail.cancelling') : t('booking.bookingDetail.cancelConfirm')}</Button>
+          <Button data-action={CancelBooking.id} variant="danger" disabled={loading} onClick={handleCancel}>{loading ? t('booking.bookingDetail.cancelling') : t('booking.bookingDetail.cancelConfirm')}</Button>
           <Button variant="neutral" onClick={() => setExpanded(false)}>{t('booking.bookingDetail.cancelButton')}</Button>
         </View>
       </View>
@@ -107,6 +110,7 @@ function CancelForm ({ booking, onSuccess, onError, t }) {
 
 export default function BookingDetailPage ({ bookingId: bookingIdProp }) {
   const { t, language } = useLocale()
+  const sdk = useSdk()
   const router = useRouter()
   const bookingId = bookingIdProp ?? router?.params?.bookingId
   const [booking, setBooking] = useState(null)
@@ -124,18 +128,19 @@ export default function BookingDetailPage ({ bookingId: bookingIdProp }) {
     if (!bookingId) return
     setLoading(true); setError(null)
     try {
-      const res = await fetch('/actions/booking/list', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({}) })
-      if (!res.ok) { const data = await res.json().catch(() => ({})); throw new Error(data?.message ?? t('booking.bookingDetail.errorStatus', { status: res.status })) }
-      const all = await res.json()
+      const all = await sdk.invoke(ListBookings, {})
       const found = all.find(b => b.id === bookingId)
       if (!found) throw new Error(t('booking.bookingDetail.notFound'))
       setBooking(found)
     } catch (err) { setError(err.message) } finally { setLoading(false) }
-  }, [bookingId, t])
+  }, [bookingId, sdk, t])
 
   useEffect(() => { loadBooking() }, [loadBooking])
 
-  const goBack = () => { if (window.history.length > 1) window.history.back(); else window.location.href = '/bokningar' }
+  const goBack = () => {
+    if (window.history.length > 1) window.history.back()
+    else window.location.href = router.getHref('booking/bookings')
+  }
 
   return (
     <View gap="m" surface="primary" style={{ padding: 'var(--space-m) var(--space-l)', height: '100%', overflowY: 'auto' }}>
@@ -173,12 +178,12 @@ export default function BookingDetailPage ({ bookingId: bookingIdProp }) {
               {actionError && <Alert variant="danger">{actionError}</Alert>}
               {booking.status === 'pending' && (
                 <View gap="s">
-                  <ConfirmForm booking={booking} onSuccess={() => { setActionError(null); loadBooking() }} onError={setActionError} t={t} />
-                  <DeclineForm booking={booking} onSuccess={() => { setActionError(null); loadBooking() }} onError={setActionError} t={t} />
+                  <ConfirmForm booking={booking} sdk={sdk} onSuccess={() => { setActionError(null); loadBooking() }} onError={setActionError} t={t} />
+                  <DeclineForm booking={booking} sdk={sdk} onSuccess={() => { setActionError(null); loadBooking() }} onError={setActionError} t={t} />
                 </View>
               )}
               {booking.status === 'confirmed' && (
-                <CancelForm booking={booking} onSuccess={() => { setActionError(null); loadBooking() }} onError={setActionError} t={t} />
+                <CancelForm booking={booking} sdk={sdk} onSuccess={() => { setActionError(null); loadBooking() }} onError={setActionError} t={t} />
               )}
             </View>
           )}

package/src/booking-resources.js

@@ -0,0 +1,10 @@
+import { ResourcesQueries } from '@ossy/resources/server'
+
+/**
+ * List booking resources by type (and optional workspace).
+ */
+export function getBookingResources ({ type, belongsTo }) {
+  const query = { type }
+  if (belongsTo) query.belongsTo = belongsTo
+  return ResourcesQueries.GetResources(query)
+}

package/src/bookings.page.jsx

@@ -1,7 +1,14 @@
 import React, { useState, useEffect, useCallback, useMemo } from 'react'
+import { useRouter } from '@ossy/router-react'
 import { View, Title, Text, Tabs, Alert, useLocale } from '@ossy/design-system'
+import { useSdk } from '@ossy/sdk-react'
 import { Definition } from './Definition.js'
 import { BookingCard } from './booking-card.component.jsx'
+import { metadata as ConfirmBooking } from './confirm-booking.action.js'
+import { metadata as DeclineBooking } from './decline-booking.action.js'
+import { metadata as CancelBooking } from './cancel-booking.action.js'
+import { metadata as ListBookings } from './list-bookings.action.js'
+import { invokeErrorMessage } from './invoke-error-message.js'
 
 export const metadata = {
   id: 'booking/bookings',
@@ -13,6 +20,8 @@ export const metadata = {
 
 export default function BookingsPage () {
   const { t } = useLocale()
+  const sdk = useSdk()
+  const router = useRouter()
   const [activeTab, setActiveTab] = useState('pending')
   const [bookings, setBookings] = useState([])
   const [loading, setLoading] = useState(true)
@@ -43,23 +52,14 @@ export default function BookingsPage () {
     setLoading(true)
     setError(null)
     try {
-      const res = await fetch('/actions/booking/list', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({}),
-      })
-      if (!res.ok) {
-        const data = await res.json().catch(() => ({}))
-        throw new Error(data?.message ?? t('booking.bookings.errorStatus', { status: res.status }))
-      }
-      const data = await res.json()
+      const data = await sdk.invoke(ListBookings, {})
       setBookings(data)
     } catch (err) {
       setError(err.message)
     } finally {
       setLoading(false)
     }
-  }, [t])
+  }, [sdk, t])
 
   useEffect(() => {
     loadBookings()
@@ -70,46 +70,34 @@ export default function BookingsPage () {
   const visible = activeTab === 'pending' ? pending : activeTab === 'confirmed' ? confirmed : bookings
 
   const handleConfirm = async (booking) => {
-    const res = await fetch('/actions/booking/confirm', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ bookingId: booking.id }),
-    })
-    if (!res.ok) {
-      const data = await res.json().catch(() => ({}))
-      throw new Error(data?.message ?? t('booking.bookings.errorConfirm'))
+    try {
+      await sdk.invoke(ConfirmBooking, { bookingId: booking.id })
+      await loadBookings()
+    } catch (err) {
+      throw new Error(await invokeErrorMessage(err, t('booking.bookings.errorConfirm')))
     }
-    await loadBookings()
   }
 
   const handleDecline = async (booking) => {
-    const res = await fetch('/actions/booking/decline', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ bookingId: booking.id }),
-    })
-    if (!res.ok) {
-      const data = await res.json().catch(() => ({}))
-      throw new Error(data?.message ?? t('booking.bookings.errorDecline'))
+    try {
+      await sdk.invoke(DeclineBooking, { bookingId: booking.id })
+      await loadBookings()
+    } catch (err) {
+      throw new Error(await invokeErrorMessage(err, t('booking.bookings.errorDecline')))
     }
-    await loadBookings()
   }
 
   const handleCancel = async (booking) => {
-    const res = await fetch('/actions/booking/cancel', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ bookingId: booking.id }),
-    })
-    if (!res.ok) {
-      const data = await res.json().catch(() => ({}))
-      throw new Error(data?.message ?? t('booking.bookings.errorCancel'))
+    try {
+      await sdk.invoke(CancelBooking, { bookingId: booking.id })
+      await loadBookings()
+    } catch (err) {
+      throw new Error(await invokeErrorMessage(err, t('booking.bookings.errorCancel')))
     }
-    await loadBookings()
   }
 
   const handleView = (booking) => {
-    window.location.href = `/bokningar/${booking.id}`
+    window.location.href = router.getHref({ id: 'booking/booking-detail', params: { bookingId: booking.id } })
   }
 
   const empty = EMPTY_MESSAGES[activeTab] ?? EMPTY_MESSAGES.all

package/src/cancel-booking.action.js

@@ -1,61 +1 @@
-import { Aggregate } from '@ossy/event-store'
-import { Resource, ResourcesEvents } from '@ossy/resources'
-import BookingCancellationEmail from './booking-cancellation.email.jsx'
-
-export const id = 'booking/cancel'
-export const access = 'authenticated'
-
-export async function run({ payload, req, log, integrations }) {
-  const bookingId = payload?.bookingId ?? req?.params?.bookingId
-  const workspaceId = payload?.workspaceId ?? req?.workspaceId
-
-  if (!bookingId) throw Object.assign(new Error('bookingId is required'), { status: 400 })
-
-  log?.info(`[booking/cancel] Cancelling booking ${bookingId}`)
-
-  const booking = await Aggregate.Of(Resource, bookingId).then(Aggregate.View())
-  if (!booking?.id) throw Object.assign(new Error('Booking not found'), { status: 404 })
-
-  if (booking.belongsTo !== workspaceId) {
-    throw Object.assign(new Error('You do not have permission to cancel this booking'), { status: 403 })
-  }
-
-  if (booking.content?.status === 'cancelled') {
-    throw Object.assign(new Error('Booking is already cancelled'), { status: 409 })
-  }
-
-  const updated = await Aggregate.Of(Resource, bookingId)
-    .then(Aggregate.Add(
-      ResourcesEvents.ContentUpdated({
-        createdBy: req?.userId ?? 'system',
-        content: { ...booking.content, status: 'cancelled' },
-      }),
-    ))
-    .then(Aggregate.Save())
-
-  log?.info(`[booking/cancel] Booking ${bookingId} cancelled`)
-
-  // Send cancellation email to client
-  const emailClient = integrations?.get?.('email')
-  if (emailClient && booking.content?.clientEmail) {
-    try {
-      await emailClient.sendTemplate(
-        BookingCancellationEmail,
-        {
-          clientName: booking.content.clientName,
-          startAt: booking.content.startsAt,
-          duration: booking.content.duration,
-        },
-        {
-          to: booking.content.clientEmail,
-          from: 'noreply@ossy.se',
-          subject: 'Din bokning har avbokats',
-        },
-      )
-    } catch (err) {
-      log?.error('[booking/cancel] Failed to send cancellation email', err)
-    }
-  }
-
-  return { id: bookingId, status: 'cancelled' }
-}
+export const metadata = { id: 'booking/cancel', access: 'authenticated' }

package/src/cancel-booking.task.js

@@ -0,0 +1,60 @@
+import { Aggregate } from '@ossy/event-store'
+import { Resource, ResourcesEvents } from '@ossy/resources/server'
+import BookingCancellationEmail from './booking-cancellation.email.jsx'
+
+export const metadata = { id: 'booking/cancel' }
+
+export async function run({ payload, req, log, integrations }) {
+  const bookingId = payload?.bookingId ?? req?.params?.bookingId
+  const workspaceId = payload?.workspaceId ?? req?.workspaceId
+
+  if (!bookingId) throw Object.assign(new Error('bookingId is required'), { status: 400 })
+
+  log?.info(`[booking/cancel] Cancelling booking ${bookingId}`)
+
+  const booking = await Aggregate.Of(Resource, bookingId).then(Aggregate.View())
+  if (!booking?.id) throw Object.assign(new Error('Booking not found'), { status: 404 })
+
+  if (booking.belongsTo !== workspaceId) {
+    throw Object.assign(new Error('You do not have permission to cancel this booking'), { status: 403 })
+  }
+
+  if (booking.content?.status === 'cancelled') {
+    throw Object.assign(new Error('Booking is already cancelled'), { status: 409 })
+  }
+
+  const updated = await Aggregate.Of(Resource, bookingId)
+    .then(Aggregate.Add(
+      ResourcesEvents.ContentUpdated({
+        createdBy: req?.userId ?? 'system',
+        content: { ...booking.content, status: 'cancelled' },
+      }),
+    ))
+    .then(Aggregate.Save())
+
+  log?.info(`[booking/cancel] Booking ${bookingId} cancelled`)
+
+  // Send cancellation email to client
+  const emailClient = integrations?.get?.('email')
+  if (emailClient && booking.content?.clientEmail) {
+    try {
+      await emailClient.sendTemplate(
+        BookingCancellationEmail,
+        {
+          clientName: booking.content.clientName,
+          startAt: booking.content.startsAt,
+          duration: booking.content.duration,
+        },
+        {
+          to: booking.content.clientEmail,
+          from: 'noreply@ossy.se',
+          subject: 'Din bokning har avbokats',
+        },
+      )
+    } catch (err) {
+      log?.error('[booking/cancel] Failed to send cancellation email', err)
+    }
+  }
+
+  return { id: bookingId, status: 'cancelled' }
+}