domma-cms 0.102.0 → 0.103.0

package/plugins/booking/tests/admin-diary.test.js

@@ -0,0 +1,73 @@
+/**
+ * The Diary's geometry (admin/lib/diary-layout.js).
+ */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {datesFor, gridHours, layoutColumn, minuteAt, placeOf, weekStart, dayLabel} from '../admin/lib/diary-layout.js';
+
+test('weeks start on Monday', () => {
+    assert.equal(weekStart('2031-07-15'), '2031-07-14');
+    assert.equal(weekStart('2031-07-20'), '2031-07-14', 'Sunday belongs to the week before');
+    assert.deepEqual(datesFor('day', '2031-07-15'), ['2031-07-15']);
+    assert.equal(datesFor('week', '2031-07-15').length, 7);
+    assert.equal(dayLabel('2031-07-15'), 'Tue 15/07');
+});
+
+test('grid hours: opening hours, widened by bookings, at least 8 hours', () => {
+    const bk = {hours: {tue: [{from: '09:30', to: '12:00'}]}};
+    assert.deepEqual(gridHours([bk], ['2031-07-15']), {from: 540, to: 1020});
+    assert.deepEqual(gridHours([bk], ['2031-07-15'], [{startMin: 1140, endMin: 1200}]), {from: 540, to: 1200});
+    assert.deepEqual(gridHours([], ['2031-07-15']), {from: 480, to: 1080});
+    assert.deepEqual(gridHours([{hours: {tue: [{from: '18:00', to: '23:30'}]}}], ['2031-07-15']), {from: 960, to: 1440});
+});
+
+test('placing: London time, clipped at midnight', () => {
+    assert.deepEqual(placeOf({startAt: '2031-07-15T08:00:00Z', endAt: '2031-07-15T09:00:00Z'}, 'Europe/London'), {date: '2031-07-15', startMin: 540, endMin: 600});
+    assert.deepEqual(placeOf({startAt: '2031-07-15T22:30:00Z', endAt: '2031-07-16T00:30:00Z'}, 'Europe/London'), {date: '2031-07-15', startMin: 1410, endMin: 1440});
+});
+
+test('lanes: overlapping items side by side, separate clusters apart', () => {
+    const out = layoutColumn([
+        {id: 'a', startMin: 540, endMin: 600},
+        {id: 'b', startMin: 570, endMin: 630},
+        {id: 'c', startMin: 600, endMin: 660},
+        {id: 'd', startMin: 700, endMin: 760}
+    ]);
+    const by = Object.fromEntries(out.map(x => [x.id, [x.lane, x.lanes]]));
+    assert.deepEqual(by, {a: [0, 2], b: [1, 2], c: [0, 2], d: [0, 1]});
+});
+
+test('click to minute', () => {
+    assert.equal(minuteAt(95, {from: 480, pxPerMin: 1}), 570);
+    assert.equal(minuteAt(-5, {from: 480, pxPerMin: 1}), 480);
+});
+
+import {columnItems} from '../admin/lib/diary-layout.js';
+import {answerRows, placesLabel, sourceLabel, withNames} from '../admin/lib/details.js';
+
+test('diary columns: companions shown in every held column; a class is one item', () => {
+    const at = '2031-07-15T09:00:00.000Z';
+    const bs = [
+        {id: '1', serviceId: 'lesson', bookableId: 'tr', holds: ['tr', 'c1'], startAt: at, status: 'confirmed'},
+        {id: '2', serviceId: 'yoga', bookableId: 'tr2', startAt: at, status: 'confirmed'},
+        {id: '3', serviceId: 'yoga', bookableId: 'tr2', startAt: at, status: 'confirmed'},
+        {id: '4', serviceId: 'yoga', bookableId: 'tr2', startAt: at, status: 'cancelled'}
+    ];
+    assert.deepEqual(columnItems(bs, {bookableId: 'c1'}).map(i => [i.b.id, i.companion, i.session]), [['1', true, false]]);
+    assert.deepEqual(columnItems(bs, {bookableId: 'tr'}).map(i => [i.b.id, i.companion]), [['1', false]]);
+    const yoga = columnItems(bs, {bookableId: 'tr2'});
+    assert.deepEqual(yoga.map(i => [i.bookings.map(b => b.id), i.session]), [[['2', '3'], true], [['4'], false]]);
+    assert.equal(columnItems(bs).length, 3, 'week view: no companion copies, the class once, the cancelled one alone');
+});
+
+test('booking details: who, where from, answers, places', () => {
+    assert.equal(withNames({bookableName: 'Alex'}), 'Alex');
+    assert.equal(withNames({bookableName: 'Alex', alsoNames: ['Court 1']}), 'Alex and Court 1');
+    assert.equal(withNames({bookableName: 'Alex', alsoNames: ['Court 1', 'Balls']}), 'Alex, Court 1 and Balls');
+    assert.equal(sourceLabel('waitlist'), 'From the waiting list');
+    const svc = {ext: {'booking-pro': {questions: [{id: 'level', label: 'Level'}, {id: 'ok', label: 'Agreed'}]}}};
+    assert.deepEqual(answerRows({ok: true, level: 'Improver', gone: 3, empty: ''}, svc), [['Level', 'Improver'], ['Agreed', 'Yes'], ['gone', '3']]);
+    assert.deepEqual(answerRows(null), []);
+    assert.equal(placesLabel(1), '1 place left');
+    assert.equal(placesLabel(3), '3 places left');
+});

package/plugins/booking/tests/api.test.js

@@ -0,0 +1,356 @@
+/**
+ * Booking's API against the real collection service, inside the domma-cms
+ * checkout `make test` runs in. Its collections are made for the test and
+ * removed after; config/plugins.json is restored byte for byte.
+ */
+import {after, before, test} from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import Fastify from 'fastify';
+import booking from '../plugin.js';
+import {setMailer} from '../lib/mail.js';
+import {bookingRegistry} from '../lib/extensions.js';
+import {addDays, atWallClock, wallClock} from '../public/lib/time.js';
+
+const PLUGINS = path.resolve('config/plugins.json');
+const CONTACTS = path.resolve('content/collections/contacts-contacts/data.json');
+let savedContacts;
+const DIRS = ['booking-bookables', 'booking-services', 'booking-bookings'].map(c => path.resolve('content/collections', c));
+const TZ = 'Europe/London';
+let savedPlugins;
+let app;
+const sent = [];
+const notices = [];
+const related = {};
+
+before(async () => {
+    savedPlugins = await fs.readFile(PLUGINS, 'utf8').catch(() => null);
+    savedContacts = await fs.readFile(CONTACTS, 'utf8').catch(() => null);
+    for (const d of DIRS) await fs.rm(d, {recursive: true, force: true});
+    setMailer(async (msg) => { sent.push(msg); });
+    app = Fastify();
+    const authenticate = async (req) => { req.user = {id: 'u1', name: 'Sam', role: 'admin'}; };
+    await app.register(booking, {
+        prefix: '',
+        auth: {authenticate, requirePermission: () => async () => {}},
+        settings: {},
+        hooks: {
+            notify: (n) => notices.push(n), registerShortcode() {},
+            registerRelatedItems: (kind, p) => { related[kind] = p; return true; }
+        }
+    });
+});
+
+after(async () => {
+    setMailer(null);
+    await app?.close();
+    for (const d of DIRS) await fs.rm(d, {recursive: true, force: true});
+    if (savedPlugins === null) await fs.rm(PLUGINS, {force: true});
+    else await fs.writeFile(PLUGINS, savedPlugins);
+    if (savedContacts !== null) await fs.writeFile(CONTACTS, savedContacts);
+});
+
+const call = async (method, url, body) => {
+    const res = await app.inject({method, url, payload: body});
+    let json = null;
+    try { json = res.json(); } catch { /* not JSON */ }
+    return {status: res.statusCode, body: json};
+};
+
+/** A weekday a fortnight ahead, so notice rules never bite. */
+function aheadWeekday() {
+    let d = addDays(wallClock(Date.now(), TZ).date, 14);
+    while ([0, 6].includes(new Date(`${d}T12:00:00Z`).getUTCDay())) d = addDays(d, 1);
+    return d;
+}
+
+test('set up, book from the page, clash, move, cancel', async () => {
+    let r = await call('PUT', '/settings', {timeZone: TZ, reminderHours: 24, changeNoticeHours: 24});
+    assert.equal(r.status, 200, JSON.stringify(r.body));
+
+    r = await call('POST', '/bookables', {name: 'Alex', kind: 'person', email: 'alex@example.com'});
+    assert.equal(r.status, 201, JSON.stringify(r.body));
+    const alex = r.body;
+    r = await call('POST', '/bookables', {name: 'Room 1', kind: 'resource'});
+    const room = r.body;
+
+    r = await call('POST', '/services', {name: 'Consultation', duration: 60, bufferAfter: 15, step: 60, bookables: [alex.id]});
+    assert.equal(r.status, 201, JSON.stringify(r.body));
+    const svc = r.body;
+    r = await call('POST', '/services', {name: 'Consultation', duration: 30, bookables: [room.id], public: false});
+    assert.equal(r.body.slug, 'consultation-2', 'slugs stay unique');
+
+    r = await call('GET', '/public/services');
+    assert.deepEqual(r.body.services.map(s => s.name), ['Consultation'], 'hidden services are not on the page');
+
+    const day = aheadWeekday();
+    r = await call('GET', `/public/slots?service=${svc.id}&from=${day}&to=${day}`);
+    assert.equal(r.status, 200);
+    const slots = r.body.days[0].slots;
+    assert.deepEqual(slots.map(s => s.time), ['09:00', '10:00', '11:00', '12:00', '13:00', '14:00', '15:00', '16:00']);
+    assert.equal(slots[0].bookableIds, undefined, 'who is free is not sent to the page');
+
+    // A bot fills the honeypot: told it worked, nothing is booked.
+    r = await call('POST', '/public/book', {serviceId: svc.id, startAt: slots[0].start, customer: {name: 'Bot', email: 'b@b.co'}, website: 'x'});
+    assert.equal(r.status, 201);
+    assert.equal((await call('GET', '/bookings')).body.length, 0);
+
+    r = await call('POST', '/public/book', {serviceId: svc.id, startAt: slots[1].start, customer: {name: 'Jo Bloggs', email: 'JO@example.com', phone: '07700 900123'}});
+    assert.equal(r.status, 201, JSON.stringify(r.body));
+    const made = r.body.booking;
+    assert.equal(made.time, '10:00');
+    assert.match(r.body.manage, /^\/booking\/manage\/[\w-]+\?t=[\w-]+$/);
+    const token = r.body.manage.split('t=')[1];
+    assert.equal(made.email, 'jo@example.com');
+    assert.ok(made.canCancel && made.canMove);
+
+    // The same time again: gone. 09:00 goes too - its own 15 minutes after would run into 10:00 - and so does 11:00 (10:00's run to 11:15).
+    r = await call('POST', '/public/book', {serviceId: svc.id, startAt: slots[1].start, customer: {name: 'Kim', email: 'kim@example.com'}});
+    assert.equal(r.status, 409);
+    assert.equal(r.body.code, 'slot-taken');
+    r = await call('GET', `/public/slots?service=${svc.id}&from=${day}&to=${day}`);
+    assert.deepEqual(r.body.days[0].slots.map(s => s.time), ['12:00', '13:00', '14:00', '15:00', '16:00']);
+
+    // Not a time the page offers (off the hour's steps).
+    r = await call('POST', '/public/book', {serviceId: svc.id, startAt: atWallClock(day, '09:30', TZ).toISOString(), customer: {name: 'Kim', email: 'kim@example.com'}});
+    assert.equal(r.status, 409);
+
+    // Emails: the customer's confirmation with an .ics, and the owner's copy.
+    await new Promise(res => setTimeout(res, 50));
+    const toJo = sent.find(m => m.to === 'jo@example.com');
+    assert.match(toJo.subject, /^Booking confirmed: Consultation/);
+    assert.match(toJo.text, /Change or cancel: http.*\/booking\/manage\//);
+    assert.match(toJo.attachments[0].content, /DTSTART:\d{8}T\d{6}Z/);
+    assert.ok(sent.some(m => m.to === 'alex@example.com' && /New booking: Jo Bloggs/.test(m.subject)));
+    assert.ok(notices.some(n => n.source === 'bookings' && /New booking/.test(n.title)));
+
+    // The customer's own link.
+    r = await call('GET', `/public/booking/${made.id}?t=wrong`);
+    assert.equal(r.status, 404);
+    r = await call('GET', `/public/booking/${made.id}?t=${token}`);
+    assert.equal(r.body.serviceName, 'Consultation');
+    r = await call('GET', `/public/booking/${made.id}/ics?t=${token}`);
+    assert.equal(r.status, 200);
+
+    // They move it to 14:00.
+    r = await call('POST', `/public/booking/${made.id}/move`, {t: token, startAt: atWallClock(day, '14:00', TZ).toISOString()});
+    assert.equal(r.status, 200, JSON.stringify(r.body));
+    assert.equal(r.body.time, '14:00');
+    r = await call('GET', `/public/slots?service=${svc.id}&from=${day}&to=${day}`);
+    assert.ok(r.body.days[0].slots.some(s => s.time === '10:00'), 'the old time is free again');
+    assert.ok(!r.body.days[0].slots.some(s => s.time === '14:00'));
+
+    // Admin: a clash is refused unless forced.
+    r = await call('POST', '/bookings', {serviceId: svc.id, startAt: atWallClock(day, '14:30', TZ).toISOString(), customer: {name: 'Lee', email: 'lee@example.com'}});
+    assert.equal(r.status, 409);
+    r = await call('POST', '/bookings', {serviceId: svc.id, startAt: atWallClock(day, '14:30', TZ).toISOString(), customer: {name: 'Lee', email: 'lee@example.com'}, force: true, notify: false});
+    assert.equal(r.status, 201, JSON.stringify(r.body));
+    assert.equal(r.body.token, undefined, 'the admin never sees the customer\'s link token');
+    assert.equal(r.body.source, 'admin');
+
+    // They cancel.
+    r = await call('POST', `/public/booking/${made.id}/cancel`, {t: token});
+    assert.equal(r.status, 200);
+    assert.equal(r.body.status, 'cancelled');
+    assert.ok(!r.body.canCancel);
+    r = await call('POST', `/public/booking/${made.id}/cancel`, {t: token});
+    assert.equal(r.status, 403, 'only once');
+
+    // A person with bookings to come cannot be deleted; a service neither.
+    r = await call('DELETE', `/bookables/${alex.id}`);
+    assert.equal(r.status, 409);
+    r = await call('DELETE', `/services/${svc.id}`);
+    assert.equal(r.status, 409);
+
+    // Badge shape; the email menu action is registered with its permission.
+    r = await call('GET', '/count');
+    assert.equal(typeof r.body.count, 'number');
+    assert.equal(related.message.actions[0].permission.resource, 'booking');
+    assert.match(related.message.actions[0].url, /\{email\}/);
+});
+
+test('changing notice: inside the window the customer cannot change it', async () => {
+    const all = (await call('GET', '/bookings')).body;
+    const lee = all.find(b => b.name === 'Lee');
+    let r = await call('PUT', '/settings', {changeNoticeHours: 24 * 30});
+    assert.equal(r.status, 200);
+    // Lee's token is not in the admin's answer; the rule itself is checked via the public view of Jo's (cancelled) and a fresh one.
+    const svc = (await call('GET', '/services')).body.find(s => s.slug === 'consultation');
+    const day = aheadWeekday();
+    r = await call('POST', '/public/book', {serviceId: svc.id, startAt: atWallClock(day, '09:00', TZ).toISOString(), customer: {name: 'Ann', email: 'ann@example.com'}});
+    assert.equal(r.status, 201, JSON.stringify(r.body));
+    assert.equal(r.body.booking.canCancel, false, 'a fortnight away, 30 days notice needed');
+    const [id, t] = [r.body.booking.id, r.body.manage.split('t=')[1]];
+    r = await call('POST', `/public/booking/${id}/cancel`, {t});
+    assert.equal(r.status, 403);
+    assert.match(r.body.error, /720 hours/);
+    assert.ok(lee);
+    await call('PUT', '/settings', {changeNoticeHours: 24});
+});
+
+test('a switched-off person is never picked for "anyone"; the .ics escapes', async () => {
+    const svc = (await call('GET', '/services')).body.find(s => s.slug === 'consultation');
+    let r = await call('POST', '/bookables', {name: 'Off', kind: 'person', active: false});
+    const off = r.body;
+    await call('PUT', `/services/${svc.id}`, {bookables: [...svc.bookables, off.id]});
+    const day = addDays(aheadWeekday(), 1);
+    r = await call('POST', '/bookings', {serviceId: svc.id, startAt: atWallClock(day, '12:00', TZ).toISOString(), customer: {name: 'Any', email: 'any@example.com'}, notify: false});
+    assert.equal(r.status, 201, JSON.stringify(r.body));
+    assert.notEqual(r.body.bookableId, off.id);
+    r = await call('POST', '/bookings', {serviceId: svc.id, bookableId: off.id, startAt: atWallClock(day, '12:00', TZ).toISOString(), customer: {name: 'Named', email: 'n@example.com'}, notify: false});
+    assert.equal(r.body.bookableId, off.id, 'chosen by name, staff may still book them');
+    await call('PUT', `/services/${svc.id}`, {bookables: svc.bookables});
+    const {icsFor} = await import('../lib/mail.js');
+    assert.match(icsFor({id: 'x', startAt: '2031-01-01T09:00:00Z', endAt: '2031-01-01T10:00:00Z'}, {title: 'A; B, C'}), /SUMMARY:A\\; B\\, C/);
+});
+
+test('admin status changes, reminders, bad input', async () => {
+    const svc = (await call('GET', '/services')).body.find(s => s.slug === 'consultation');
+    let r = await call('POST', '/bookings', {serviceId: svc.id, startAt: 'nonsense', customer: {name: 'X', email: 'x@example.com'}});
+    assert.equal(r.status, 400);
+    r = await call('POST', '/bookings', {serviceId: svc.id, startAt: new Date().toISOString(), customer: {name: '', email: 'x'}});
+    assert.equal(r.status, 400);
+    assert.ok(r.body.errors.name && r.body.errors.email);
+
+    // 20 hours ahead, reminders 12 hours before: made outside the window, so one is due at 9 hours from now.
+    const start = new Date(Date.now() + 20 * 3600000);
+    start.setUTCMinutes(0, 0, 0);
+    r = await call('POST', '/bookings', {serviceId: svc.id, startAt: start.toISOString(), customer: {name: 'Rem', email: 'rem@example.com'}, force: true, notify: false});
+    assert.equal(r.status, 201);
+    const rem = r.body;
+    await call('PUT', '/settings', {reminderHours: 12});
+    const reg = bookingRegistry();
+    sent.length = 0;
+    assert.equal(await reg.services.sendReminders(Date.now()), 0, 'not yet');
+    assert.equal(await reg.services.sendReminders(Date.now() + 9 * 3600000), 1);
+    assert.equal(await reg.services.sendReminders(Date.now() + 10 * 3600000), 0, 'only once');
+    await new Promise(res => setTimeout(res, 50));
+    assert.ok(sent.some(m => m.to === 'rem@example.com' && /^Reminder: Consultation/.test(m.subject)));
+    // With a 24-hour window the same booking was made inside it: its confirmation did the job.
+    await call('PUT', `/bookings/${rem.id}/move`, {startAt: new Date(start.getTime() + 3600000).toISOString(), force: true, notify: false});
+    await call('PUT', '/settings', {reminderHours: 24});
+    assert.equal(await reg.services.sendReminders(Date.now() + 3600000), 0);
+
+    r = await call('PUT', `/bookings/${rem.id}`, {status: 'no-show'});
+    assert.equal(r.body.status, 'no-show');
+    r = await call('PUT', `/bookings/${rem.id}`, {status: 'teleported'});
+    assert.equal(r.status, 400);
+    r = await call('PUT', `/bookings/${rem.id}`, {status: 'cancelled', notify: false});
+    assert.equal(r.body.status, 'cancelled');
+    r = await call('PUT', `/bookings/${rem.id}/move`, {startAt: start.toISOString()});
+    assert.equal(r.status, 400, 'a cancelled booking is not moved');
+    r = await call('PUT', `/bookings/${rem.id}`, {status: 'confirmed'});
+    assert.equal(r.status, 400, 'nor brought back unchecked');
+    r = await call('DELETE', `/bookings/${rem.id}`);
+    assert.equal(r.status, 200);
+});
+
+test('a sender already in the caller\'s Contacts is found by email and booked as that contact', async () => {
+    const {isToolEnabled} = await import('../../../server/services/tools.js');
+    if (!isToolEnabled('contacts')) return;
+    const {createEntry, listEntries} = await import('../../../server/services/collections.js');
+    const mine = await createEntry('contacts-contacts', {name: 'Known Person', email: 'known@example.com', phone: '0123', userId: 'u1', groups: [], favourite: false,
+        emails: [{address: 'work@known.example.com'}]});
+    await createEntry('contacts-contacts', {name: 'Not Mine', email: 'theirs@example.com', userId: 'u2', groups: [], favourite: false});
+
+    let r = await call('GET', '/contact?email=KNOWN@example.com');
+    assert.equal(r.status, 200);
+    assert.equal(r.body.id, mine.id);
+    assert.equal(r.body.phone, '0123');
+    r = await call('GET', '/contact?email=work%40known.example.com');
+    assert.equal(r.body.id, mine.id, 'a second address (Contacts Pro) finds them too');
+    assert.equal((await call('GET', '/contact?email=theirs@example.com')).status, 404, 'another user\'s contact is not the caller\'s');
+    assert.equal((await call('GET', '/contact?email=nobody@example.com')).status, 404);
+
+    // No contactId sent (a typed address, or an older reader): the caller's contact is linked, none is made.
+    const count = async () => (await listEntries('contacts-contacts', {limit: 100000})).entries.length;
+    const before = await count();
+    const svc = (await call('GET', '/services')).body.find(s => s.slug === 'consultation');
+    const start = atWallClock(aheadWeekday(), '11:00', TZ).toISOString();
+    r = await call('POST', '/bookings', {serviceId: svc.id, startAt: start, customer: {name: 'Known', email: 'known@example.com'}, force: true, notify: false});
+    assert.equal(r.status, 201);
+    assert.equal(r.body.contactId, mine.id);
+    assert.equal(await count(), before);
+    await call('DELETE', `/bookings/${r.body.id}`);
+});
+
+test('online: a service an extension makes online gives a call - the customer and the host join, nobody else', async () => {
+    const reg = bookingRegistry();
+    reg.register('test-online', {rules: (s) => (s?.slug === 'video-chat' ? {online: true, recordingAllowed: true} : {})});
+    try {
+        let r = await call('POST', '/bookables', {name: 'Vic', kind: 'person', email: 'vic@example.com', hours: {mon: [{from: '00:00', to: '24:00'}], tue: [{from: '00:00', to: '24:00'}],
+            wed: [{from: '00:00', to: '24:00'}], thu: [{from: '00:00', to: '24:00'}], fri: [{from: '00:00', to: '24:00'}], sat: [{from: '00:00', to: '24:00'}], sun: [{from: '00:00', to: '24:00'}]}});
+        const vic = r.body;
+        r = await call('POST', '/services', {name: 'Video chat', duration: 30, minNoticeMinutes: 0, bookables: [vic.id]});
+        const svc = r.body;
+        r = await call('GET', '/public/services');
+        assert.equal(r.body.services.find(s => s.id === svc.id).online, true, 'the page says it is online');
+
+        // Starts in 5 minutes: the call is already open (10 minutes before).
+        const start = new Date(Math.ceil((Date.now() + 5 * 60000) / 60000) * 60000).toISOString();
+        sent.length = 0;
+        r = await call('POST', '/bookings', {serviceId: svc.id, startAt: start, customer: {name: 'Cal Customer', email: 'cal@example.com'}, force: true});
+        assert.equal(r.status, 201, JSON.stringify(r.body));
+        const b = r.body;
+        assert.equal(b.online, true);
+        assert.equal(b.recordingAllowed, true);
+        assert.equal(b.token, undefined);
+        assert.equal(b.hostKey, undefined, 'the raw host key never leaves the server');
+        assert.match(b.hostUrl, /^\/booking\/call\/[\w-]+\?b=.+&h=.+/);
+        const room = b.hostUrl.split('/call/')[1].split('?')[0];
+        const hostKey = new URL(`http://x${b.hostUrl}`).searchParams.get('h');
+
+        await new Promise(res => setTimeout(res, 50));
+        const toCustomer = sent.find(m => m.to === 'cal@example.com');
+        assert.ok(toCustomer, 'the customer is emailed');
+        const join = toCustomer.text.match(/Join the call: (\S+)/)?.[1] || '';
+        assert.match(join, new RegExp(`/booking/call/${room}\\?b=${b.id}&t=`));
+        const token = new URL(join).searchParams.get('t');
+        assert.doesNotMatch(toCustomer.text, /&h=/, 'the customer never gets the host link');
+
+        r = await call('GET', `/public/booking/${b.id}?t=${token}`);
+        assert.equal(r.body.online, true);
+        assert.match(r.body.callUrl, new RegExp(`/booking/call/${room}\\?b=`));
+
+        const joinAs = (cred, at = room) => call('POST', `/call/${at}/join`, {b: b.id, ...cred});
+        r = await joinAs({h: hostKey});
+        assert.equal(r.status, 200, JSON.stringify(r.body));
+        const hostIn = r.body;
+        assert.equal(r.body.host, true);
+        assert.equal(r.body.name, 'Vic');
+        r = await joinAs({t: token});
+        assert.equal(r.body.host, false);
+        assert.equal(r.body.name, 'Cal Customer');
+        assert.equal(r.body.state, 'waiting');
+        assert.equal((await joinAs({t: 'wrong'})).status, 404);
+        assert.equal((await joinAs({h: token})).status, 404, "the customer's token is not a host key");
+        assert.equal((await joinAs({t: token}, 'another-room-00000')).status, 404);
+
+        await call('PUT', `/bookings/${b.id}`, {status: 'cancelled', notify: false});
+        assert.equal((await joinAs({t: token})).status, 404, 'a cancelled booking has no call');
+        await new Promise(res => setTimeout(res, 100));
+        const polled = await app.inject({method: 'GET', url: `/call/${room}/poll?since=0`, headers: {'x-call-id': hostIn.id, 'x-call-secret': hostIn.secret}});
+        assert.equal(polled.statusCode, 410, 'the call already running ended with it');
+        await call('DELETE', `/bookings/${b.id}`);
+
+        // Booked from the page: the person booked is emailed the host link.
+        sent.length = 0;
+        const day = aheadWeekday();
+        const slot = (await call('GET', `/public/slots?service=${svc.id}&from=${day}&to=${day}`)).body.days[0].slots[4];
+        r = await call('POST', '/public/book', {serviceId: svc.id, startAt: slot.start, customer: {name: 'Web Customer', email: 'web@example.com'}});
+        assert.equal(r.status, 201, JSON.stringify(r.body));
+        assert.match(r.body.booking.callUrl, /\/booking\/call\//);
+        await new Promise(res => setTimeout(res, 50));
+        const toHost = sent.find(m => m.to === 'vic@example.com');
+        assert.match(toHost?.text || '', /Start the call: \S+&h=/, 'the person booked gets the host link');
+        assert.doesNotMatch(sent.find(m => m.to === 'web@example.com').text, /&h=/);
+        const early = await call('POST', `/call/${r.body.booking.callUrl.split('/call/')[1].split('?')[0]}/join`,
+            {b: r.body.booking.id, t: new URL(`http://x${r.body.booking.callUrl}`).searchParams.get('t')});
+        assert.equal(early.status, 425, 'not open days ahead');
+        assert.ok(early.body.opensAt);
+        await call('DELETE', `/bookings/${r.body.booking.id}`);
+    } finally {
+        reg.unregister('test-online');
+    }
+});

package/plugins/booking/tests/public.test.js

@@ -0,0 +1,71 @@
+/**
+ * The booking page: which address is which page, and the pure formatting it
+ * shares with the browser.
+ */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {esc, matchBookingPath} from '../plugin.public.js';
+import {dayLabel, dayParts, ddmmyyyy, icsUrl, lengthLabel, tokenFrom, weekMoves, weekOf, zoneNote} from '../public/lib/page-format.js';
+
+test('addresses under the booking page', () => {
+    const b = '/booking';
+    assert.deepEqual(matchBookingPath('/booking', b), {name: 'index', params: {}});
+    assert.deepEqual(matchBookingPath('/booking/', b), {name: 'slash', params: {}});
+    assert.deepEqual(matchBookingPath('/booking/hair-cut', b), {name: 'service', params: {slug: 'hair-cut'}});
+    assert.deepEqual(matchBookingPath('/booking/manage/abc123def', b), {name: 'manage', params: {id: 'abc123def'}});
+    assert.equal(matchBookingPath('/booking/manage', b), null, '"manage" alone is not a service');
+    assert.equal(matchBookingPath('/booking/manage/short', b), null);
+    assert.equal(matchBookingPath('/booking/a/b', b), null);
+    assert.equal(matchBookingPath('/booking/Hair_Cut', b), null);
+    assert.equal(matchBookingPath('/bookings', b), null, 'a neighbour address is not ours');
+    assert.equal(matchBookingPath('/booking/%E0%A4%A', b), null, 'bad encoding');
+    assert.deepEqual(matchBookingPath('/appointments/x', '/appointments'), {name: 'service', params: {slug: 'x'}});
+});
+
+test('formatting', () => {
+    assert.equal(ddmmyyyy('2031-07-15'), '15/07/2031');
+    assert.equal(dayLabel('2031-07-15'), 'Tuesday 15/07/2031');
+    assert.equal(dayLabel('2031-07-15', {short: true}), 'Tue 15/07/2031');
+    assert.equal(dayLabel('nope'), '');
+    assert.deepEqual(dayParts('2031-07-05'), {weekday: 'Sat', day: '5', month: '07'});
+    assert.equal(lengthLabel(45), '45 minutes');
+    assert.equal(lengthLabel(60), '1 hour');
+    assert.equal(lengthLabel(90), '1 hour 30 minutes');
+    assert.equal(lengthLabel(121), '2 hours 1 minute');
+    assert.equal(esc(`<a href="x">'`), '&lt;a href=&quot;x&quot;&gt;&#39;');
+});
+
+test('the week strip stays inside the bookable range', () => {
+    assert.deepEqual(weekOf('2031-12-29'), ['2031-12-29', '2031-12-30', '2031-12-31', '2032-01-01', '2032-01-02', '2032-01-03', '2032-01-04']);
+    const range = {first: '2031-07-03', last: '2031-07-20'};
+    assert.deepEqual(weekMoves('2031-07-03', range), {prev: '', next: '2031-07-10'});
+    assert.deepEqual(weekMoves('2031-07-10', range), {prev: '2031-07-03', next: '2031-07-17'});
+    assert.deepEqual(weekMoves('2031-07-17', range), {prev: '2031-07-10', next: ''});
+    assert.deepEqual(weekMoves('2031-07-06', range), {prev: '2031-07-03', next: '2031-07-13'}, 'back never goes before the first day');
+});
+
+test('zone note, tokens, calendar link', () => {
+    assert.equal(zoneNote('Europe/London', 'Europe/London'), '');
+    assert.equal(zoneNote('America/New_York', 'Europe/London'), 'Times are America/New York time.');
+    assert.equal(zoneNote('Europe/London', ''), '');
+    assert.equal(tokenFrom('/booking/manage/abc?t=Xy_-9'), 'Xy_-9');
+    assert.equal(tokenFrom('/booking/manage/abc'), '');
+    assert.equal(icsUrl('a b', 't&1'), '/api/plugins/booking/public/booking/a%20b/ics?t=t%261');
+});
+
+import {answersFor, placesText} from '../public/lib/page-format.js';
+
+test('places and the extra questions', () => {
+    assert.equal(placesText(3), '3 places left');
+    assert.equal(placesText(1), '1 place left');
+    assert.equal(placesText(0), 'Full');
+    const fields = [
+        {id: 'level', label: 'Level', kind: 'choice', required: true, options: ['A', 'B']},
+        {id: 'age', label: 'Age', kind: 'number'},
+        {id: 'ok', label: 'I agree', kind: 'yesno', required: true},
+        {id: 'more', label: 'More', kind: 'longtext'}
+    ];
+    assert.deepEqual(answersFor(fields, {level: 'B', age: '42', ok: true, more: '  '}), {answers: {level: 'B', age: 42, ok: true}, errors: {}});
+    assert.deepEqual(Object.keys(answersFor(fields, {age: 'x'}).errors).sort(), ['answers.age', 'answers.level', 'answers.ok']);
+    assert.deepEqual(answersFor([], {}), {answers: {}, errors: {}});
+});