@soulbatical/tetra-core 0.10.5 → 0.11.0

package/dist/shared/planner/routes.js

@@ -1,770 +0,0 @@
-/**
- * Planner Route Factories — standard scheduling endpoints
- *
- * Usage:
- * ```typescript
- * import { addPlannerRoutes, addPlannerPublicRoutes, addPlannerCalendarRoutes } from '@soulbatical/tetra-core';
- *
- * // Authenticated (behind auth middleware)
- * addPlannerRoutes(router, { config });
- *
- * // Public booking (no auth)
- * addPlannerPublicRoutes(publicRouter, { config, getSystemDB });
- *
- * // Google Calendar OAuth (behind auth middleware)
- * addPlannerCalendarRoutes(calendarRouter, { google: {...} });
- * ```
- */
-import { PlannerService } from './PlannerService.js';
-import { GoogleCalendarService } from './GoogleCalendarService.js';
-import { RFC7807ErrorResponse } from '../rfc7807ErrorResponse.js';
-import { createLogger } from '../../utils/logger.js';
-const logger = createLogger('planner:routes');
-const TIME_REGEX = /^\d{2}:\d{2}(:\d{2})?$/;
-const DATE_REGEX = /^\d{4}-\d{2}-\d{2}$/;
-// ─── Authenticated Planner Routes ───────────────────────────
-/**
- * Add authenticated planner routes to a router.
- *
- * Adds:
- * - GET    /availability                         — Get own availability
- * - PUT    /availability                         — Set own availability
- * - GET    /owners/:ownerId/availability          — Get an owner's availability
- * - GET    /owners/:ownerId/available-slots       — Get bookable slots for a date
- * - POST   /owners/:ownerId/book                  — Book a slot with an owner
- * - GET    /vacations                             — List own vacations
- * - POST   /vacations                             — Create vacation
- * - DELETE /vacations/:id                         — Delete vacation
- * - GET    /scheduler-settings                    — Get own scheduler settings
- * - PUT    /scheduler-settings                    — Update own scheduler settings
- * - GET    /appointments                          — List own appointments
- * - POST   /appointments                          — Create appointment
- * - PUT    /appointments/:id                      — Update appointment
- * - DELETE /appointments/:id                      — Cancel appointment
- * - POST   /appointments/:id/complete             — Complete appointment
- * - GET    /team-availability                     — Team availability for a date (admin)
- *
- * Returns the PlannerService instance for external use.
- */
-export function addPlannerRoutes(router, options) {
-    const service = new PlannerService(options.config);
-    // ── Availability ────────────────────────────────────────
-    // GET /availability — own
-    router.get('/availability', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            const slots = await service.getAvailability(db, user.id);
-            res.json({ success: true, data: slots });
-        }
-        catch (err) {
-            logger.error({ error: err }, 'Get availability error');
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // PUT /availability — set own
-    router.put('/availability', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id || !user?.organizationId)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const { slots } = req.body;
-            if (!Array.isArray(slots))
-                return RFC7807ErrorResponse.badRequest(res, 'slots must be an array');
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            const result = await service.setAvailability(db, user.id, user.organizationId, slots);
-            res.json({ success: true, data: result });
-        }
-        catch (err) {
-            logger.error({ error: err }, 'Set availability error');
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // GET /owners/:ownerId/availability
-    router.get('/owners/:ownerId/availability', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            const slots = await service.getAvailability(db, req.params.ownerId);
-            res.json({ success: true, data: slots });
-        }
-        catch (err) {
-            logger.error({ error: err }, 'Get owner availability error');
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // GET /owners/:ownerId/available-slots?date=YYYY-MM-DD
-    router.get('/owners/:ownerId/available-slots', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const date = req.query.date;
-            if (!date || !DATE_REGEX.test(date))
-                return RFC7807ErrorResponse.badRequest(res, 'date query parameter required (YYYY-MM-DD)');
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            const result = await service.getAvailableSlots(db, req.params.ownerId, date);
-            res.json({ success: true, data: result });
-        }
-        catch (err) {
-            logger.error({ error: err }, 'Get available slots error');
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // POST /owners/:ownerId/book
-    router.post('/owners/:ownerId/book', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id || !user?.organizationId)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const { parentId, date, startTime, endTime, title } = req.body;
-            if (!date || !startTime || !endTime)
-                return RFC7807ErrorResponse.badRequest(res, 'date, startTime, and endTime are required');
-            const startISO = `${date}T${startTime.length === 5 ? startTime + ':00' : startTime}Z`;
-            const endISO = `${date}T${endTime.length === 5 ? endTime + ':00' : endTime}Z`;
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            const appointment = await service.createAppointment(db, user.id, user.organizationId, {
-                title: title || 'Session',
-                parentId,
-                startTime: startISO,
-                endTime: endISO,
-            });
-            res.status(201).json({ success: true, data: appointment });
-        }
-        catch (err) {
-            logger.error({ error: err }, 'Book slot error');
-            if (err.message.includes('conflict') || err.message.includes('outside')) {
-                RFC7807ErrorResponse.conflict(res, err.message);
-            }
-            else {
-                RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-            }
-        }
-    });
-    // ── Vacations ───────────────────────────────────────────
-    router.get('/vacations', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            const vacations = await service.getVacations(db, user.id);
-            res.json({ success: true, data: vacations });
-        }
-        catch (err) {
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    router.post('/vacations', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id || !user?.organizationId)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const { startDate, endDate, description } = req.body;
-            if (!startDate || !endDate)
-                return RFC7807ErrorResponse.badRequest(res, 'startDate and endDate are required');
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            const vacation = await service.createVacation(db, user.id, user.organizationId, startDate, endDate, description);
-            res.status(201).json({ success: true, data: vacation });
-        }
-        catch (err) {
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    router.delete('/vacations/:id', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            await service.deleteVacation(db, req.params.id);
-            res.json({ success: true });
-        }
-        catch (err) {
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // ── Scheduler Settings ──────────────────────────────────
-    router.get('/scheduler-settings', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            const settings = await service.getSettings(db, user.id);
-            res.json({ success: true, data: settings });
-        }
-        catch (err) {
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    router.put('/scheduler-settings', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id || !user?.organizationId)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            const result = await service.updateSettings(db, user.id, user.organizationId, req.body);
-            res.json({ success: true, data: result });
-        }
-        catch (err) {
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // ── Appointments ────────────────────────────────────────
-    router.get('/appointments', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            const appointments = await service.listAppointments(db, user.id, {
-                status: req.query.status,
-            });
-            res.json({ success: true, data: appointments });
-        }
-        catch (err) {
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    router.post('/appointments', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id || !user?.organizationId)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const { title, parentId, description, startTime, endTime, location, type, attendeeIds } = req.body;
-            if (!title || !startTime || !endTime)
-                return RFC7807ErrorResponse.badRequest(res, 'title, startTime, and endTime are required');
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            const appointment = await service.createAppointment(db, user.id, user.organizationId, {
-                title, parentId, description, startTime, endTime, location, type, attendeeIds,
-            });
-            res.status(201).json({ success: true, data: appointment });
-        }
-        catch (err) {
-            if (err.message.includes('Invalid'))
-                RFC7807ErrorResponse.badRequest(res, err.message);
-            else
-                RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    router.put('/appointments/:id', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            const appointment = await service.updateAppointment(db, req.params.id, req.body);
-            res.json({ success: true, data: appointment });
-        }
-        catch (err) {
-            if (err.message === 'Appointment not found')
-                RFC7807ErrorResponse.notFound(res, 'Appointment');
-            else
-                RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    router.delete('/appointments/:id', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id || !user?.organizationId)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            const appointment = await service.cancelAppointment(db, req.params.id, user.organizationId);
-            res.json({ success: true, data: appointment });
-        }
-        catch (err) {
-            if (err.message === 'Appointment not found')
-                RFC7807ErrorResponse.notFound(res, 'Appointment');
-            else
-                RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    router.post('/appointments/:id/complete', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id || !user?.organizationId)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            const appointment = await service.completeAppointment(db, req.params.id, user.organizationId);
-            res.json({ success: true, data: appointment });
-        }
-        catch (err) {
-            if (err.message === 'Appointment not found')
-                RFC7807ErrorResponse.notFound(res, 'Appointment');
-            else
-                RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // ── Team Availability ───────────────────────────────────
-    router.get('/team-availability', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id || !user?.organizationId)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const date = req.query.date;
-            if (!date || !DATE_REGEX.test(date))
-                return RFC7807ErrorResponse.badRequest(res, 'date query parameter required (YYYY-MM-DD)');
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            const result = await service.getTeamAvailability(db, user.organizationId, date);
-            res.json({ success: true, data: result });
-        }
-        catch (err) {
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // ── Computed Availability (Phase 2) ───────────────────────
-    // GET /computed-availability/:ownerId?dateFrom=YYYY-MM-DD&dateTo=YYYY-MM-DD
-    router.get('/computed-availability/:ownerId', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const dateFrom = req.query.dateFrom;
-            const dateTo = req.query.dateTo;
-            if (!dateFrom || !dateTo || !DATE_REGEX.test(dateFrom) || !DATE_REGEX.test(dateTo)) {
-                return RFC7807ErrorResponse.badRequest(res, 'dateFrom and dateTo (YYYY-MM-DD) are required');
-            }
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            const result = await service.getComputedAvailability(db, req.params.ownerId, dateFrom, dateTo);
-            res.json({ success: true, data: result });
-        }
-        catch (err) {
-            logger.error({ error: err }, 'Computed availability error');
-            if (err.message?.includes('YYYY-MM-DD') || err.message?.includes('on or before')) {
-                return RFC7807ErrorResponse.badRequest(res, err.message);
-            }
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // ── Slot Reservations (Phase 3) ───────────────────────────
-    // POST /reserve-slot { ownerId, slotStart, slotEnd, ttlSeconds? }
-    router.post('/reserve-slot', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id || !user?.organizationId)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const { ownerId, slotStart, slotEnd, ttlSeconds } = req.body;
-            if (!ownerId || !slotStart || !slotEnd) {
-                return RFC7807ErrorResponse.badRequest(res, 'ownerId, slotStart and slotEnd are required');
-            }
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            const reservation = await service.reserveSlot(db, ownerId, user.organizationId, slotStart, slotEnd, ttlSeconds || 300);
-            res.status(201).json({ success: true, data: reservation });
-        }
-        catch (err) {
-            if (err.message?.includes('already reserved') || err.message?.includes('Slot')) {
-                return RFC7807ErrorResponse.conflict(res, err.message);
-            }
-            logger.error({ error: err }, 'Reserve slot error');
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // DELETE /reserve-slot/:id
-    router.delete('/reserve-slot/:id', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            await service.releaseSlot(db, req.params.id);
-            res.json({ success: true });
-        }
-        catch (err) {
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // ── Coach Auto-Assignment (Phase 3) ───────────────────────
-    // GET /coach-assignment-config — list coaches with config + active counts
-    router.get('/coach-assignment-config', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id || !user?.organizationId)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            const result = await service.getCoachAssignmentConfig(db, user.organizationId);
-            res.json({ success: true, data: result });
-        }
-        catch (err) {
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // PUT /coach-assignment-config/:coachId
-    router.put('/coach-assignment-config/:coachId', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id || !user?.organizationId)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            // Use systemDB to bypass RLS — admin-only endpoint, org_id is enforced at code level
-            const { systemDB } = await import('../../core/systemDb.js');
-            const db = await systemDB('planner:update-coach-assignment-config');
-            await service.updateCoachAssignmentConfig(db, user.organizationId, req.params.coachId, req.body);
-            res.json({ success: true });
-        }
-        catch (err) {
-            logger.error({ error: err }, 'Update coach assignment config error');
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // POST /auto-assign-coach
-    router.post('/auto-assign-coach', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id || !user?.organizationId)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            // systemDB needed because findBestCoach writes last_assigned_at
-            const { systemDB } = await import('../../core/systemDb.js');
-            const db = await systemDB('planner:auto-assign-coach');
-            const result = await service.findBestCoach(db, user.organizationId);
-            res.json({ success: true, data: result });
-        }
-        catch (err) {
-            if (err.message?.includes('No available') || err.message?.includes('maximum')) {
-                return RFC7807ErrorResponse.conflict(res, err.message);
-            }
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // GET /team-appointments — all org appointments (for team planner view)
-    router.get('/team-appointments', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id || !user?.organizationId)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const { adminDB } = await import('../../core/adminDb.js');
-            const db = await adminDB(req);
-            const appointments = await service.listTeamAppointments(db, user.organizationId, {
-                status: req.query.status,
-                dateFrom: req.query.dateFrom,
-                dateTo: req.query.dateTo,
-            });
-            res.json({ success: true, data: appointments });
-        }
-        catch (err) {
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    return service;
-}
-// ─── Public Planner Routes (no auth) ────────────────────────
-/**
- * Add public booking routes (Calendly-style, no authentication).
- *
- * Adds:
- * - GET  /scheduler/:ownerId         — Scheduler page data
- * - GET  /scheduler/:ownerId/slots   — Available slots for a date
- * - POST /scheduler/:ownerId/book    — Book a slot
- */
-export function addPlannerPublicRoutes(router, options) {
-    const service = new PlannerService(options.config);
-    const getDB = async () => {
-        if (options.getSystemDB)
-            return options.getSystemDB();
-        const { systemDB } = await import('../../core/systemDb.js');
-        return systemDB('planner:public');
-    };
-    // GET /scheduler/:ownerId
-    router.get('/scheduler/:ownerId', async (req, res) => {
-        try {
-            const db = await getDB();
-            const data = await service.getPublicSchedulerData(db, req.params.ownerId);
-            if (!data)
-                return RFC7807ErrorResponse.notFound(res, 'Owner');
-            res.json({ success: true, data });
-        }
-        catch (err) {
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // GET /scheduler/:ownerId/slots?date=YYYY-MM-DD
-    router.get('/scheduler/:ownerId/slots', async (req, res) => {
-        try {
-            const date = req.query.date;
-            if (!date || !DATE_REGEX.test(date))
-                return RFC7807ErrorResponse.badRequest(res, 'date required (YYYY-MM-DD)');
-            const db = await getDB();
-            const result = await service.getAvailableSlots(db, req.params.ownerId, date);
-            res.json({ success: true, data: result });
-        }
-        catch (err) {
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // POST /scheduler/:ownerId/book
-    router.post('/scheduler/:ownerId/book', async (req, res) => {
-        try {
-            const db = await getDB();
-            const appointment = await service.publicBook(db, req.params.ownerId, req.body);
-            res.status(201).json({ success: true, data: appointment });
-        }
-        catch (err) {
-            if (err.message.includes('outside') || err.message.includes('no longer') || err.message.includes('vacation')) {
-                RFC7807ErrorResponse.conflict(res, err.message);
-            }
-            else if (err.message.includes('required') || err.message.includes('Invalid')) {
-                RFC7807ErrorResponse.badRequest(res, err.message);
-            }
-            else {
-                RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-            }
-        }
-    });
-    return service;
-}
-// ─── Google Calendar Routes ─────────────────────────────────
-/**
- * Add Google Calendar OAuth routes.
- *
- * Adds:
- * - GET  /auth-url             — Generate OAuth URL
- * - GET  /callback             — Handle OAuth callback
- * - GET  /status               — Connection status
- * - GET  /calendars            — List available calendars
- * - PUT  /calendar-id          — Select single calendar (legacy)
- * - GET  /selected-calendars   — List calendars with multi-select state
- * - PUT  /selected-calendars   — Multi-select calendars for conflict checking
- * - POST /disconnect           — Remove connection
- */
-export function addPlannerCalendarRoutes(router, config) {
-    const calService = new GoogleCalendarService(config);
-    // GET /auth-url
-    router.get('/auth-url', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const url = await calService.getAuthUrl(user.id);
-            res.json({ success: true, data: { url } });
-        }
-        catch (err) {
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // GET /callback
-    router.get('/callback', async (req, res) => {
-        try {
-            const code = req.query.code;
-            const stateRaw = req.query.state;
-            if (!code || !stateRaw)
-                return RFC7807ErrorResponse.badRequest(res, 'Missing code or state');
-            let state;
-            try {
-                state = JSON.parse(Buffer.from(stateRaw, 'base64').toString());
-            }
-            catch {
-                return RFC7807ErrorResponse.badRequest(res, 'Invalid state');
-            }
-            // Look up org for user
-            const { systemDB } = await import('../../core/systemDb.js');
-            const db = await systemDB('planner:calendar-callback');
-            const { data: userData } = await db
-                .from('users_public')
-                .select('active_organization_id')
-                .eq('id', state.userId)
-                .single();
-            if (!userData)
-                return RFC7807ErrorResponse.notFound(res, 'User');
-            await calService.handleCallback(code, state.userId, userData.active_organization_id);
-            // Redirect to frontend settings
-            const frontendUrl = process.env.FRONTEND_URL || '';
-            res.redirect(`${frontendUrl}/settings?calendar=connected`);
-        }
-        catch (err) {
-            logger.error({ error: err }, 'Calendar callback error');
-            const frontendUrl = process.env.FRONTEND_URL || '';
-            res.redirect(`${frontendUrl}/settings?calendar=error&reason=exchange_failed`);
-        }
-    });
-    // GET /status
-    router.get('/status', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const connected = await calService.isConnected(user.id);
-            res.json({ success: true, data: { connected } });
-        }
-        catch (err) {
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // GET /calendars
-    router.get('/calendars', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const calendars = await calService.listCalendars(user.id);
-            res.json({ success: true, data: calendars || [] });
-        }
-        catch (err) {
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // PUT /calendar-id
-    router.put('/calendar-id', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const { calendarId } = req.body;
-            if (!calendarId)
-                return RFC7807ErrorResponse.badRequest(res, 'calendarId is required');
-            const success = await calService.selectCalendar(user.id, calendarId);
-            if (!success)
-                return RFC7807ErrorResponse.internalError(res, 'Failed to select calendar');
-            res.json({ success: true });
-        }
-        catch (err) {
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // GET /selected-calendars — List calendars with multi-select state
-    router.get('/selected-calendars', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const calendars = await calService.listCalendars(user.id);
-            if (!calendars)
-                return res.json({ success: true, data: [] });
-            // Map to the format the frontend expects
-            res.json({
-                success: true,
-                data: calendars.map((cal) => ({
-                    id: cal.id,
-                    externalCalendarId: cal.id,
-                    calendarName: cal.name,
-                    calendarColor: cal.color,
-                    isPrimary: cal.isPrimary,
-                    isSelected: cal.isSelected,
-                })),
-            });
-        }
-        catch (err) {
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // PUT /selected-calendars — Multi-select calendars for conflict checking
-    router.put('/selected-calendars', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const { calendars } = req.body;
-            if (!Array.isArray(calendars)) {
-                return RFC7807ErrorResponse.badRequest(res, 'calendars must be an array');
-            }
-            const selectedIds = calendars
-                .filter((c) => c.isSelected)
-                .map((c) => c.externalCalendarId || c.id);
-            if (selectedIds.length === 0) {
-                return RFC7807ErrorResponse.badRequest(res, 'At least one calendar must be selected');
-            }
-            const success = await calService.selectCalendars(user.id, selectedIds);
-            if (!success)
-                return RFC7807ErrorResponse.internalError(res, 'Failed to save selection');
-            res.json({ success: true });
-        }
-        catch (err) {
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // POST /disconnect
-    router.post('/disconnect', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            await calService.disconnect(user.id);
-            res.json({ success: true });
-        }
-        catch (err) {
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // GET /busy-slots?dateFrom=YYYY-MM-DD&dateTo=YYYY-MM-DD
-    // Returns busy slots from ALL selected calendars (Phase 1).
-    router.get('/busy-slots', async (req, res) => {
-        try {
-            const user = req.user;
-            if (!user?.id)
-                return RFC7807ErrorResponse.unauthorized(res, 'Authentication required');
-            const dateFrom = req.query.dateFrom;
-            const dateTo = req.query.dateTo;
-            if (!dateFrom || !dateTo || !DATE_REGEX.test(dateFrom) || !DATE_REGEX.test(dateTo)) {
-                return RFC7807ErrorResponse.badRequest(res, 'dateFrom and dateTo (YYYY-MM-DD) are required');
-            }
-            const slots = await calService.getBusySlots(user.id, dateFrom, dateTo);
-            res.json({ success: true, data: slots });
-        }
-        catch (err) {
-            logger.error({ error: err }, 'Get busy slots error');
-            RFC7807ErrorResponse.internalError(res, err.message || 'Failed');
-        }
-    });
-    // POST /webhook — Google Calendar push notification receiver (Phase 4)
-    // Google sends a POST with X-Goog-* headers when any event changes.
-    // We don't trust the body — we look up the channel and refetch.
-    router.post('/webhook', async (req, res) => {
-        try {
-            const channelId = req.headers['x-goog-channel-id'];
-            const resourceId = req.headers['x-goog-resource-id'];
-            const resourceState = req.headers['x-goog-resource-state'];
-            if (!channelId || !resourceId) {
-                return res.status(400).json({ success: false, error: 'Missing channel headers' });
-            }
-            logger.info({ channelId, resourceId, resourceState }, 'Calendar webhook received');
-            // Acknowledge fast — actual cache refresh happens async via cron or queue
-            const { systemDB } = await import('../../core/systemDb.js');
-            const db = await systemDB('planner:webhook');
-            // Mark cache stale by deleting synced_at marker for this user/calendar
-            // (a follow-up cron job will refetch)
-            const { data: channel } = await db
-                .from('planner_calendar_channels')
-                .select('user_id, external_calendar_id')
-                .eq('channel_id', channelId)
-                .single();
-            if (channel) {
-                // Touch the cache so the next read knows to refresh
-                await db
-                    .from('planner_calendar_cache')
-                    .update({ synced_at: new Date(0).toISOString() })
-                    .eq('user_id', channel.user_id)
-                    .eq('external_calendar_id', channel.external_calendar_id);
-            }
-            res.status(200).end();
-        }
-        catch (err) {
-            logger.error({ error: err }, 'Calendar webhook error');
-            // Always 200 to Google to avoid retries
-            res.status(200).end();
-        }
-    });
-    return calService;
-}
-//# sourceMappingURL=routes.js.map