domma-cms 0.102.1 → 0.104.0

package/plugins/booking/plugin.js

@@ -0,0 +1,806 @@
+/**
+ * Booking - the API (mounted at /api/plugins/booking).
+ *
+ * Admin (the `booking` permission; read to look, manage to change):
+ *   GET  /bootstrap               settings, services, people & rooms, users, what else is here
+ *   GET  /count                   sidebar badge: bookings still to come today
+ *   GET  /bookings?from=&to=      bookings starting in a range (ISO instants)
+ *   GET  /bookings/:id · POST /bookings · PUT /bookings/:id · PUT /bookings/:id/move · DELETE /bookings/:id
+ *   GET  /slots?service=&from=&to=&with=&ignore=   free times (dates in the business zone)
+ *   GET/POST /services · PUT/DELETE /services/:id
+ *   GET/POST /bookables · PUT/DELETE /bookables/:id
+ *   GET  /settings · PUT /settings
+ *   GET  /contact/:id             a contact of the caller's, to fill a new booking
+ *   GET  /contact?email=          the caller's contact with that email (an email's "Book…")
+ *
+ * Customers (no sign-in), under /public:
+ *   GET  /public/services         what can be booked
+ *   GET  /public/slots            free times for a service
+ *   POST /public/book             make a booking (honeypot, rate limited)
+ *   GET  /public/booking/:id?t=   the customer's own booking (token-gated)
+ *   POST /public/booking/:id/cancel · POST /public/booking/:id/move   (token in the body)
+ *   GET  /public/booking/:id/ics?t=
+ *
+ * The booking page itself is plugin.public.js.
+ */
+
+import {getConfig} from '../../server/config.js';
+import {getPluginStates} from '../../server/services/plugins.js';
+import {getPermissionsFor} from '../../server/services/roles.js';
+import {getEffectiveRoles} from '../../server/services/userRoles.js';
+import {listUsers} from '../../server/services/users.js';
+import {isToolEnabled} from '../../server/services/tools.js';
+import {cleanBookable, cleanCustomer, cleanService, whenLabel} from './public/lib/clean.js';
+import {bookingRange, HOLDING, slotsFor} from './public/lib/slots.js';
+import {addDays, atWallClock, isDate, wallClock} from './public/lib/time.js';
+import {bookingRegistry} from './lib/extensions.js';
+import {hostPath, joinPath, sessionOf, whoIsCalling} from './lib/call.js';
+import {compose, icsFor, mailReady, send, siteAddress, siteTitle} from './lib/mail.js';
+import {
+    BOOKABLES, BOOKINGS, NAME, SERVICES, SlotTaken, allBookables, allBookings, allServices, calendarBusy, changeBooking,
+    cleanSettings, contactByEmail, customerMayChange, ensureCollections, getBookable, getBooking, getService, linkContact, liveSettings,
+    ownContact, placeBooking, publicBooking, refreshShelf, removeBooking, removeThing, saveSettings, saveThing,
+    settingsNow, shelfNow, tokenOk, uniqueSlug
+} from './lib/store.js';
+
+/**
+ * The origin staff last used the admin on - for emails sent with no request
+ * (reminders) when `site.baseUrl` is not set. Only signed-in requests set it:
+ * a customer's Host header is theirs to choose, and must not decide where
+ * everyone else's reminder links point.
+ */
+let lastOrigin = '';
+
+function siteBase(request) {
+    let base = '';
+    try { base = String(getConfig('site')?.baseUrl || ''); } catch { /* no site config */ }
+    if (/^https?:\/\/[^/\s]+/i.test(base)) return base.replace(/\/+$/, '');
+    if (!request) return lastOrigin;
+    const origin = `${request.protocol}://${request.host || request.headers.host || request.hostname}`;
+    if (request.user) lastOrigin = origin;
+    return origin;
+}
+
+const manageUrl = (s, b, base) => `${base}${s.bookingPath}/manage/${b.id}?t=${b.token}`;
+const fail = (reply, status, error, extra = {}) => reply.code(status).send({error, ...extra});
+const uidOf = (request) => request.user?.id ?? request.user?.sub ?? '';
+const contactsOn = () => { try { return isToolEnabled('contacts'); } catch { return false; } };
+
+/** Extension data sent by the admin: {owner: {...}} objects only. */
+const extOf = (v) => (v && typeof v === 'object' && !Array.isArray(v)
+    ? Object.fromEntries(Object.entries(v).filter(([k, x]) => /^[a-z0-9-]{1,64}$/.test(k) && x && typeof x === 'object' && !Array.isArray(x)))
+    : {});
+
+/** Extra booking-form questions as the page may see them. */
+const publicFields = (list) => list.map(f => ({
+    id: String(f.id).slice(0, 64), label: String(f.label).slice(0, 200), kind: String(f.kind || 'text'), required: f.required === true,
+    help: String(f.help || '').slice(0, 300), options: Array.isArray(f.options) ? f.options.map(o => String(o).slice(0, 100)).slice(0, 50) : []
+}));
+
+/**
+ * What the admin sees of a booking: everything but the customer's link token.
+ * An online booking carries the host's call address instead of the raw key.
+ */
+const adminBooking = (b) => {
+    if (!b) return b;
+    const {token, hostKey, ...rest} = b;
+    return b.online === true && hostKey ? {...rest, hostUrl: hostPath(settingsNow(), b)} : rest;
+};
+
+/** A service as the booking page sees it. */
+function publicService(svc, bookables) {
+    const mine = bookables.filter(b => b.active !== false && svc.bookables.includes(b.id));
+    return {
+        id: svc.id, slug: svc.slug, name: svc.name, description: svc.description, duration: svc.duration, colour: svc.colour,
+        chooseBookable: svc.chooseBookable !== false && mine.length > 1,
+        bookables: mine.map(b => ({id: b.id, name: b.name, kind: b.kind, description: b.description}))
+    };
+}
+
+/**
+ * The booking page, anywhere:
+ *   [booking /]                         the whole flow, every service
+ *   [booking service="hair-cut" /]      straight to one service
+ *   [booking service="hair-cut" with="<bookable id>" /]
+ * Self-closing: a bare [booking] is left as text. The page's script
+ * (public/booking.js, on every page via inject/body.html - the sanitiser strips
+ * a shortcode's own <script>) mounts on [data-booking] and adds its stylesheet.
+ */
+function registerShortcodes(hooks) {
+    if (typeof hooks.registerShortcode !== 'function') return;
+    const esc = (s) => String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+    hooks.registerShortcode('booking', (attrStr, _body, ctx) => {
+        const a = ctx.parseShortcodeAttrs(attrStr || '');
+        const s = settingsNow();
+        const svc = a.service ? shelfNow().services.find(x => x.slug === String(a.service) && x.active !== false && x.public !== false) : null;
+        if (a.service && !svc) return '<p class="bk-muted">That service cannot be booked just now.</p>';
+        const cfg = {base: s.bookingPath, service: svc?.id || '', with: String(a.with || '').slice(0, 64), embedded: true};
+        return `<div class="bk-app" data-booking='${esc(JSON.stringify(cfg))}'><p class="bk-muted">Loading the booking form… If it does not appear, <a href="${esc(s.bookingPath)}">book here</a>.</p></div>`;
+    });
+}
+
+export const ASSET_V = '1.4.0';
+
+export default async function booking(fastify, options) {
+    const {authenticate, requirePermission} = options.auth;
+    const hooks = options.hooks || {};
+    const can = (action) => ({preHandler: [authenticate, requirePermission('booking', action)]});
+    const registry = bookingRegistry();
+    const log = fastify.log || console;
+
+    await ensureCollections(log);
+    await refreshShelf();
+    registerShortcodes(hooks);
+
+    // The online call's rooms (set once the engine is mounted, at the end). A booking cancelled or moved away
+    // ends the call it was in, unless someone else is still booked into that session (a class).
+    let calls = null;
+    async function endCall(old) {
+        if (!calls || old?.online !== true) return;
+        const room = sessionOf(old);
+        const others = (await allBookings()).some(x => x.id !== old.id && x.online === true && HOLDING.has(x.status) && sessionOf(x) === room);
+        if (!others) calls.closeRoom(room);
+    }
+
+    const mayBook = (user, action = 'read') => {
+        // Core's related items and the Calendar pass every role the viewer has in `roles`.
+        const roles = Array.isArray(user?.roles) ? user.roles : getEffectiveRoles(user || {});
+        return roles.some(r => getPermissionsFor('booking', action).includes(r));
+    };
+
+    // ---- Telling people -------------------------------------------------------------
+
+    if (typeof hooks.registerNotificationSource === 'function') {
+        try {
+            hooks.registerNotificationSource({id: 'bookings', label: 'Bookings', severity: 'info', defaultOn: true,
+                description: 'A booking made, moved or cancelled from the booking page.'});
+        } catch { /* older engine */ }
+    }
+
+    function notice(b, what) {
+        const s = settingsNow();
+        const when = whenLabel(wallClock(b.startAt, s.timeZone));
+        const titles = {made: 'New booking', moved: 'Booking moved', cancelled: 'Booking cancelled'};
+        try {
+            hooks.notify?.({
+                title: `${titles[what]}: ${b.serviceName}, ${when}`,
+                body: `${b.name} (${b.email})${b.bookableName ? ` with ${b.bookableName}` : ''}`.slice(0, 300),
+                severity: what === 'cancelled' ? 'warning' : 'info',
+                link: `#/plugins/booking/bookings/${b.id}`,
+                source: 'bookings',
+                dedupeKey: `booking-${what}:${b.id}:${b.startAt}`
+            });
+        } catch { /* a notice never breaks a booking */ }
+    }
+
+    /** Where the owner's copy goes: the person booked, else the setting, else the site. */
+    async function ownerAddress(b) {
+        const bk = await getBookable(b.bookableId).catch(() => null);
+        return bk?.email || settingsNow().notifyAddress || siteAddress();
+    }
+
+    function detailsOf(b, s) {
+        return [
+            ['What', b.serviceName],
+            ['Where', b.online === true ? 'Online - a video call in your browser' : ''],
+            ['When', `${whenLabel(wallClock(b.startAt, s.timeZone))} (${b.duration || Math.round((Date.parse(b.endAt) - Date.parse(b.startAt)) / 60000)} minutes)`],
+            ['With', [b.bookableName, ...(b.alsoNames || [])].filter(Boolean).join(', ')],
+            ['Name', b.name],
+            ['Email', b.email],
+            ['Phone', b.phone],
+            ['Notes', b.notes]
+        ];
+    }
+
+    /**
+     * Email the customer (and the owner) about a booking. Never awaited by a
+     * request, never throws. `what`: made | moved | cancelled | reminder.
+     */
+    async function tell(b, what, {request = null, toCustomer = true, toOwner = true} = {}) {
+        try {
+            const s = await liveSettings();
+            const base = siteBase(request);
+            const title = siteTitle();
+            const link = base && b.token ? manageUrl(s, b, base) : '';
+            const may = customerMayChange(b, s) && (s.allowCancel || s.allowMove);
+            const host = (() => { try { return new URL(base).host; } catch { return 'booking'; } })();
+            const join = b.online === true && base ? `${base}${joinPath(s, b)}` : '';
+            const ics = icsFor(b, {host, title: `${b.serviceName} - ${title}`, location: join ? `Online: ${join}` : '',
+                description: [b.bookableName ? `With ${b.bookableName}` : '', join ? `Join the call: ${join}` : ''].filter(Boolean).join('\n'),
+                cancel: what === 'cancelled', sequence: (b.history || []).length});
+            const attachments = [{filename: what === 'cancelled' ? 'cancelled.ics' : 'booking.ics', content: ics,
+                contentType: `text/calendar; charset=utf-8; method=${what === 'cancelled' ? 'CANCEL' : 'REQUEST'}`}];
+            const heads = {
+                made: [`Booking confirmed: ${b.serviceName}`, `Thank you, ${b.name}. Your booking is confirmed.`],
+                moved: [`Booking moved: ${b.serviceName}`, `Your booking has moved. Here are the new details.`],
+                cancelled: [`Booking cancelled: ${b.serviceName}`, `Your booking has been cancelled.`],
+                reminder: [`Reminder: ${b.serviceName}`, `A reminder of your booking.`]
+            };
+            const [subject, line] = heads[what];
+            if (toCustomer && (what !== 'made' || s.sendConfirmation)) {
+                const after = [];
+                if (what !== 'cancelled' && s.confirmationNote) after.push(s.confirmationNote);
+                // Online: the call is the one link that matters; changing it is offered underneath.
+                const online = what !== 'cancelled' && join;
+                if (online && may) after.unshift(`To change or cancel: ${link}`);
+                const msg = compose({subject, lines: online ? [line, 'This is an online appointment. Use the button below at the time - the call opens 10 minutes before the start. You need a camera and microphone, or you can join with just one.'] : [line],
+                    details: detailsOf(b, s),
+                    link: online ? join : what !== 'cancelled' && may ? link : '', linkText: online ? 'Join the call' : 'Change or cancel', after});
+                send({to: b.email, replyTo: await ownerAddress(b), ...msg, attachments: what === 'reminder' ? [] : attachments}, {log});
+            }
+            if (toOwner && what !== 'reminder') {
+                const to = await ownerAddress(b);
+                const admin = base ? `${base}/admin/#/plugins/booking/bookings/${b.id}` : '';
+                const hostLink = b.online === true && b.hostKey && base && what !== 'cancelled' ? `${base}${hostPath(s, b)}` : '';
+                const msg = compose({subject: `${{made: 'New booking', moved: 'Booking moved', cancelled: 'Booking cancelled'}[what]}: ${b.name}, ${whenLabel(wallClock(b.startAt, s.timeZone))}`,
+                    lines: hostLink ? ['An online appointment. You are the host: start the call from the button below, and let them in when they arrive.'] : [],
+                    details: detailsOf(b, s), link: hostLink || admin, linkText: hostLink ? 'Start the call' : 'Open in Booking',
+                    after: hostLink && admin ? [`Open in Booking: ${admin}`] : []});
+                // The host's calendar entry opens the call as host, never as the customer.
+                const ownerAttachments = hostLink ? [{...attachments[0], content: icsFor(b, {host, title: `${b.serviceName} - ${title}`,
+                    location: `Online: ${hostLink}`, description: `With ${b.name}\nStart the call: ${hostLink}`, cancel: what === 'cancelled',
+                    sequence: (b.history || []).length})}] : attachments;
+                if (to && to !== b.email) send({to, replyTo: b.email, ...msg, attachments: ownerAttachments}, {log});
+            }
+        } catch (err) {
+            log.error?.(`[booking] could not prepare an email: ${err?.message || err}`);
+        }
+    }
+
+    // ---- Reminders ------------------------------------------------------------------
+
+    /** Send the reminders that are due. Exported through the registry for tests and Pro. */
+    async function sendReminders(now = Date.now()) {
+        const s = await liveSettings();
+        if (!s.reminderHours) return 0;
+        const due = (await allBookings()).filter(b => b.status === 'confirmed' && !b.reminderSentAt
+            && Date.parse(b.startAt) > now && Date.parse(b.startAt) - now <= s.reminderHours * 3600000
+            // A booking made inside the reminder window already had its confirmation.
+            && Date.parse(b.createdAt || b.history?.[0]?.at || 0) < Date.parse(b.startAt) - s.reminderHours * 3600000);
+        for (const b of due) {
+            await changeBooking(b.id, {reminderSentAt: new Date(now).toISOString()});
+            tell(b, 'reminder', {toOwner: false});
+        }
+        return due.length;
+    }
+    const timer = setInterval(() => { sendReminders().catch(err => log.warn?.(`[booking] reminders: ${err?.message || err}`)); }, 5 * 60000);
+    timer.unref?.();
+    fastify.addHook('onClose', async () => clearInterval(timer));
+
+    // ---- What extensions may use ------------------------------------------------------
+
+    registry.services = {
+        name: NAME, liveSettings, allBookings, allServices, allBookables, getBooking, getService, getBookable,
+        changeBooking, sendReminders,
+        /** The site's address: `site.baseUrl`, else the request's origin (a signed-in one), else the last admin's. */
+        siteBase: (request = null) => siteBase(request),
+        /** A booking as the admin may see it (no customer token; an online one's host key as `hostUrl`). */
+        adminBooking,
+        /** The contact `id` when it is `userId`'s own (Contacts on), else null. */
+        ownContact: async (id, userId) => (contactsOn() && id && userId ? ownContact(String(id), String(userId)).catch(() => null) : null),
+        manageUrl: (b) => liveSettings().then(s => manageUrl(s, b, siteBase(null))),
+        /** Make a booking the whole way (contacts, emails, notices, events) - a waiting list's place, a series. Throws SlotTaken. */
+        book: (p) => bookForExtension(p),
+        /** Cancel one, telling the customer when `notify`. */
+        cancel: async (id, {notify = true, reason = '', by = ''} = {}) => {
+            const res = await changeBooking(id, {status: 'cancelled', reason}, by);
+            if (!res) return null;
+            if (res.from !== 'cancelled') {
+                if (notify) tell(res.booking, 'cancelled', {toOwner: false});
+                registry.emit('cancelled', res.booking, res.from);
+                endCall(res.booking).catch(() => {});
+            }
+            return res.booking;
+        },
+        /**
+         * "Call now" (1.4): open an online booking's call now, even when it is booked for later - for everyone
+         * booked into that session (a class shares one call). The customer's own link then works at once.
+         * Throws with `code`: 'none' | 'not-online' | 'cancelled'.
+         */
+        openCall: async (id, {by = ''} = {}) => {
+            const b = await getBooking(String(id || ''));
+            const refuse = (code, message) => Object.assign(new Error(message), {code});
+            if (!b) throw refuse('none', 'No such booking.');
+            if (b.online !== true || !b.hostKey) throw refuse('not-online', 'That booking is not an online one, so it has no call.');
+            if (!HOLDING.has(b.status) || b.status === 'cancelled') throw refuse('cancelled', 'That booking is cancelled, so it has no call.');
+            const now = new Date().toISOString();
+            const room = sessionOf(b);
+            const session = (await allBookings()).filter(x => x.online === true && HOLDING.has(x.status) && sessionOf(x) === room);
+            for (const x of session) await changeBooking(x.id, {callOpenedAt: now}, by);
+            return getBooking(b.id);
+        },
+        /** An online booking's call addresses, whole: the customer's (`joinUrl`) and the host's (`hostUrl`). */
+        callLinks: (b, request = null) => {
+            if (b?.online !== true) return {joinUrl: '', hostUrl: ''};
+            const s = settingsNow();
+            const base = siteBase(request);
+            return {joinUrl: b.token ? `${base}${joinPath(s, b)}` : '', hostUrl: b.hostKey ? `${base}${hostPath(s, b)}` : ''};
+        },
+        SlotTaken,
+        // Booking's own helpers, so an extension never imports Booking's files.
+        mail: {send: (msg) => send(msg, {log}), compose, mailReady},
+        time: {wallClock, atWallClock, whenLabel, addDays},
+        timeZone: () => settingsNow().timeZone
+    };
+
+    /**
+     * `contactId` (1.4): the caller's own contact (`userId` = the caller) to book as - checked, dropped when it is
+     * not theirs. `request`: the admin request it came from, for the links in the emails.
+     */
+    async function bookForExtension({serviceId, bookableId = '', startAt, customer: raw = {}, source = 'extension', ext = {}, force = false, notify = true, by = '',
+        contactId: askedContact = '', userId = '', request = null}) {
+        const s = await liveSettings();
+        const {service, candidates, rules} = await candidatesFor(String(serviceId || ''), String(bookableId || ''), {includeInactive: true});
+        if (!service || !candidates.length) throw new Error('That service cannot be booked.');
+        const {data: customer, errors} = cleanCustomer(raw, {askPhone: true});
+        if (Object.keys(errors).length) throw new Error(Object.values(errors)[0]);
+        const contactId = askedContact && userId && await ownContact(String(askedContact), String(userId)).catch(() => null) ? String(askedContact) : '';
+        const b = await placeBooking({service, candidates, rules, startAt: new Date(startAt).toISOString(), tz: s.timeZone, force,
+            fields: {...customer, source, by: by || customer.name, ext: extOf(ext), ...(contactId ? {contactId} : {}), ...(userId ? {createdBy: String(userId)} : {})}});
+        if (!contactId && s.addToContacts) {
+            const bk = candidates.find(c => c.id === b.bookableId);
+            const id = await linkContact(customer, bk?.userId || s.contactsOwnerId, contactsOn()).catch(() => '');
+            if (id) Object.assign(b, (await changeBooking(b.id, {contactId: id})).booking);
+        }
+        if (request) siteBase(request);
+        if (notify) tell(b, 'made', {request, toOwner: source !== 'admin'});
+        registry.emit('made', b);
+        return b;
+    }
+
+    // ---- Links to other Tools -------------------------------------------------------
+
+    const bookingsOfContact = async (contactId) => (await allBookings()).filter(b => b.contactId === contactId);
+    hooks.registerRelatedItems?.('contact', {
+        id: 'booking', label: 'Bookings', icon: 'clipboard-check',
+        actions: [{label: 'Book {name}…', icon: 'calendar', url: '#/plugins/booking/new?contact={id}', permission: {resource: 'booking', action: 'manage'}}],
+        async list({id, user}) {
+            if (!mayBook(user)) return [];
+            const now = new Date().toISOString();
+            const rows = (await bookingsOfContact(id)).map(b => ({
+                id: b.id, title: `${b.serviceName}${b.bookableName ? ` with ${b.bookableName}` : ''}`, startAt: b.startAt,
+                past: b.startAt < now, meta: b.status === 'confirmed' ? '' : b.status, url: `#/plugins/booking/bookings/${b.id}`
+            }));
+            return [...rows.filter(r => !r.past).sort((a, b) => a.startAt.localeCompare(b.startAt)),
+                ...rows.filter(r => r.past).sort((a, b) => b.startAt.localeCompare(a.startAt)).slice(0, 5)];
+        }
+    });
+    // Core 0.103+: "Book Sam…" on an email's menu. An older core refuses the kind and nothing shows.
+    hooks.registerRelatedItems?.('message', {
+        id: 'booking', label: 'Booking', icon: 'calendar',
+        actions: [{label: 'Book {name}…', icon: 'calendar', url: '#/plugins/booking/new?email={email}&name={name}', permission: {resource: 'booking', action: 'manage'}}]
+    });
+
+    hooks.registerCalendarSource?.({
+        id: 'bookings', label: 'Bookings', icon: 'clipboard-check', tone: 'primary',
+        async list({from, to, user}) {
+            if (!mayBook(user)) return [];
+            return (await allBookings())
+                .filter(b => HOLDING.has(b.status) && b.startAt < to && b.endAt > from)
+                .map(b => ({id: b.id, title: `${b.serviceName}: ${b.name}`, startAt: b.startAt, endAt: b.endAt,
+                    meta: b.bookableName, url: `#/plugins/booking/bookings/${b.id}`}));
+        }
+    });
+
+    // ---- Admin: bootstrap, badge ----------------------------------------------------
+
+    async function bootstrap() {
+        const [s, services, bookables] = await Promise.all([liveSettings(), allServices(), allBookables()]);
+        let users = [];
+        try { users = (await listUsers()).filter(u => u.isActive !== false).map(u => ({id: u.id, name: u.name || u.email, email: u.email})); } catch { /* none */ }
+        return {
+            settings: s, services, bookables, users,
+            mailReady: mailReady(),
+            contacts: contactsOn(),
+            calendar: Boolean(getPluginStates().calendar?.enabled),
+            tabs: registry.tabs(),
+            sections: registry.admin(),
+            actions: typeof registry.actions === 'function' ? registry.actions() : [],
+            now: new Date().toISOString(),
+            today: wallClock(Date.now(), s.timeZone).date
+        };
+    }
+
+    fastify.get('/bootstrap', can('read'), async (request) => { siteBase(request); return bootstrap(); });
+
+    fastify.get('/count', can('read'), async () => {
+        const s = await liveSettings();
+        const now = Date.now();
+        const today = wallClock(now, s.timeZone).date;
+        const left = (await allBookings())
+            .filter(b => b.status === 'confirmed' && Date.parse(b.endAt) > now && wallClock(b.startAt, s.timeZone).date === today)
+            .sort((a, b) => a.startAt.localeCompare(b.startAt));
+        return {
+            count: left.length,
+            label: left.length === 1 ? '1 booking still to come today' : `${left.length} bookings still to come today`,
+            details: left.slice(0, 8).map(b => `${wallClock(b.startAt, s.timeZone).time} ${b.serviceName}: ${b.name}`).join('\n')
+        };
+    });
+
+    // ---- Admin: bookings ------------------------------------------------------------
+
+    fastify.get('/bookings', can('read'), async (request) => {
+        const from = String(request.query?.from || '');
+        const to = String(request.query?.to || '');
+        const contact = String(request.query?.contact || '');
+        let list = await allBookings();
+        if (from) list = list.filter(b => b.endAt > from);
+        if (to) list = list.filter(b => b.startAt < to);
+        if (contact) list = list.filter(b => b.contactId === contact);
+        return list.sort((a, b) => a.startAt.localeCompare(b.startAt)).map(adminBooking);
+    });
+
+    fastify.get('/bookings/:id', can('read'), async (request, reply) => {
+        const b = await getBooking(request.params.id);
+        return b ? adminBooking(b) : fail(reply, 404, 'No such booking.');
+    });
+
+    /** Service + the bookables that may take a booking of it (`with` narrows to one). */
+    async function candidatesFor(serviceId, withId, {includeInactive = false} = {}) {
+        const service = await getService(serviceId);
+        if (!service || (!includeInactive && service.active === false)) return {service: null, candidates: [], rules: registry.rules({}, [])};
+        // A switched-off person or room is only ever booked by name (staff choosing them), never as "anyone".
+        const every = await allBookables();
+        const bookables = every.filter(b => service.bookables.includes(b.id)
+            && (b.active !== false || (includeInactive && withId && b.id === withId)));
+        const candidates = withId ? bookables.filter(b => b.id === withId) : bookables;
+        return {service, candidates, rules: registry.rules(service, every)};
+    }
+
+    fastify.post('/bookings', can('manage'), async (request, reply) => {
+        const body = request.body || {};
+        const s = await liveSettings();
+        const {service, candidates, rules} = await candidatesFor(String(body.serviceId || ''), String(body.bookableId || ''), {includeInactive: true});
+        if (!service) return fail(reply, 400, 'Pick a service.');
+        if (!candidates.length) return fail(reply, 400, 'Nobody provides that service. Add a person or room to it first.');
+        const startAt = new Date(String(body.startAt || ''));
+        if (Number.isNaN(startAt.getTime())) return fail(reply, 400, 'Pick a date and time.');
+        const {data: customer, errors} = cleanCustomer(body.customer || {}, {askPhone: true});
+        if (Object.keys(errors).length) return fail(reply, 400, Object.values(errors)[0], {errors});
+
+        let contactId = String(body.contactId || '');
+        if (contactId && !(await ownContact(contactId, uidOf(request)))) contactId = '';
+        try {
+            // Staff may leave extension questions unanswered; what they did answer is cleaned the same way.
+            const answers = registry.answers(service, body.answers || {}).data;
+            const b = await placeBooking({
+                service, candidates, rules, startAt: startAt.toISOString(), tz: s.timeZone, force: body.force === true,
+                fields: {...customer, staffNote: String(body.staffNote || '').slice(0, 4000), source: 'admin', createdBy: uidOf(request), contactId, by: request.user?.name || '',
+                    ext: {...extOf(body.ext), ...(Object.keys(answers).length ? {answers} : {})}}
+            });
+            if (!contactId && s.addToContacts) {
+                const owner = candidates.find(c => c.id === b.bookableId)?.userId || uidOf(request);
+                const id = await linkContact(customer, owner, contactsOn()).catch(() => '');
+                if (id) Object.assign(b, (await changeBooking(b.id, {contactId: id})).booking);
+            }
+            siteBase(request);
+            if (body.notify !== false) tell(b, 'made', {request, toOwner: false});
+            registry.emit('made', b);
+            return reply.code(201).send(adminBooking(b));
+        } catch (err) {
+            if (err instanceof SlotTaken) return fail(reply, 409, 'That time clashes with another booking or busy time. Pick another, or book it anyway.', {code: 'slot-taken'});
+            throw err;
+        }
+    });
+
+    fastify.put('/bookings/:id/move', can('manage'), async (request, reply) => {
+        const body = request.body || {};
+        const s = await liveSettings();
+        const current = await getBooking(request.params.id);
+        if (!current) return fail(reply, 404, 'No such booking.');
+        if (!HOLDING.has(current.status) || current.status === 'cancelled') return fail(reply, 400, 'A cancelled booking cannot be moved.');
+        const {service, candidates, rules} = await candidatesFor(current.serviceId, String(body.bookableId || ''), {includeInactive: true});
+        if (!service) return fail(reply, 400, 'Its service no longer exists.');
+        const startAt = new Date(String(body.startAt || ''));
+        if (Number.isNaN(startAt.getTime())) return fail(reply, 400, 'Pick a date and time.');
+        try {
+            const b = await placeBooking({service, candidates, rules, startAt: startAt.toISOString(), tz: s.timeZone, moveId: current.id,
+                force: body.force === true, fields: {by: request.user?.name || ''}});
+            siteBase(request);
+            if (body.notify !== false) tell(b, 'moved', {request, toOwner: false});
+            registry.emit('moved', b, current);
+            endCall(current).catch(() => {});
+            return adminBooking(b);
+        } catch (err) {
+            if (err instanceof SlotTaken) return fail(reply, 409, 'That time clashes with another booking or busy time. Pick another, or move it anyway.', {code: 'slot-taken'});
+            throw err;
+        }
+    });
+
+    fastify.put('/bookings/:id', can('manage'), async (request, reply) => {
+        const body = request.body || {};
+        const patch = {};
+        if (body.status !== undefined) patch.status = String(body.status);
+        if (body.staffNote !== undefined) patch.staffNote = body.staffNote;
+        if (body.reason !== undefined) patch.reason = body.reason;
+        if (body.customer) {
+            const {data, errors} = cleanCustomer({...(await getBooking(request.params.id) || {}), ...body.customer}, {askPhone: true});
+            if (Object.keys(errors).length) return fail(reply, 400, Object.values(errors)[0], {errors});
+            patch.customer = data;
+        }
+        let res;
+        try { res = await changeBooking(request.params.id, patch, request.user?.name || ''); }
+        catch (err) { return fail(reply, 400, err.message); }
+        if (!res) return fail(reply, 404, 'No such booking.');
+        const {booking: b, from} = res;
+        if (b.status !== from) {
+            siteBase(request);
+            if (b.status === 'cancelled' && body.notify !== false) tell(b, 'cancelled', {request, toOwner: false});
+            registry.emit(b.status === 'cancelled' ? 'cancelled' : 'status', b, from);
+            if (b.status === 'cancelled') endCall(b).catch(() => {});
+        }
+        return adminBooking(b);
+    });
+
+    fastify.delete('/bookings/:id', can('manage'), async (request, reply) => {
+        const b = await getBooking(request.params.id);
+        if (!b) return fail(reply, 404, 'No such booking.');
+        await removeBooking(b.id);
+        return {ok: true};
+    });
+
+    // ---- Free times -------------------------------------------------------------------
+
+    /** Free times, for the admin (inactive services too) or the page (active, public ones). */
+    async function freeTimes({serviceId, withId, from, to, ignoreId = '', admin = false, includeFull = false}) {
+        const s = await liveSettings();
+        const {service, candidates, rules} = await candidatesFor(serviceId, withId, {includeInactive: admin});
+        if (!service || (!admin && service.public === false)) return null;
+        const now = Date.now();
+        // Staff may book at short notice or far ahead; the page keeps the service's rules.
+        const timing = admin ? {...service, minNoticeMinutes: 0, maxAdvanceDays: 0} : service;
+        const range = admin ? {first: from, last: to} : bookingRange(service, now, s.timeZone);
+        const first = isDate(from) && from > range.first ? from : range.first;
+        const lastWanted = isDate(to) ? to : addDays(first, 6);
+        const last = lastWanted < range.last ? lastWanted : range.last;
+        if (!isDate(first) || !isDate(last) || last < first) return {service, days: [], range, rules};
+        const span = {from: atWallClock(first, 0, s.timeZone).toISOString(), to: atWallClock(addDays(last, 1), 0, s.timeZone).toISOString()};
+        const everyone = [...candidates, ...rules.companions.flat()];
+        const busy = s.calendarBusy ? await calendarBusy(everyone, span, s.timeZone).catch(() => ({})) : {};
+        const days = slotsFor({service: timing, bookables: candidates, bookings: await allBookings(), busy, rules, includeFull: includeFull && rules.waitlist,
+            from: first, to: addDays(first, 41) < last ? addDays(first, 41) : last, now, tz: s.timeZone, closures: s.closures, ignoreId});
+        return {service, days, range, rules};
+    }
+
+    fastify.get('/slots', can('read'), async (request, reply) => {
+        const q = request.query || {};
+        const today = wallClock(Date.now(), settingsNow().timeZone).date;
+        const r = await freeTimes({serviceId: String(q.service || ''), withId: String(q.with || ''), from: String(q.from || today),
+            to: String(q.to || ''), ignoreId: String(q.ignore || ''), admin: true});
+        return r ? {days: r.days} : fail(reply, 404, 'No such service.');
+    });
+
+    // ---- Admin: services and people & rooms ---------------------------------------------
+
+    fastify.get('/services', can('read'), async () => allServices());
+    fastify.post('/services', can('manage'), async (request, reply) => {
+        const {data, errors} = cleanService(request.body || {});
+        if (Object.keys(errors).length) return fail(reply, 400, Object.values(errors)[0], {errors});
+        data.slug = uniqueSlug(data.slug, await allServices());
+        return reply.code(201).send(await saveThing(SERVICES, '', data));
+    });
+    fastify.put('/services/:id', can('manage'), async (request, reply) => {
+        const current = await getService(request.params.id);
+        if (!current) return fail(reply, 404, 'No such service.');
+        const {id, createdAt, updatedAt, ...stored} = current;
+        const {data, errors} = cleanService(request.body || {}, stored);
+        if (Object.keys(errors).length) return fail(reply, 400, Object.values(errors)[0], {errors});
+        data.slug = uniqueSlug(data.slug, await allServices(), id);
+        return saveThing(SERVICES, id, data);
+    });
+    fastify.delete('/services/:id', can('manage'), async (request, reply) => {
+        const current = await getService(request.params.id);
+        if (!current) return fail(reply, 404, 'No such service.');
+        const now = new Date().toISOString();
+        const ahead = (await allBookings()).filter(b => b.serviceId === current.id && b.status === 'confirmed' && b.startAt > now).length;
+        if (ahead) return fail(reply, 409, `${ahead} booking${ahead === 1 ? ' is' : 's are'} still to come for this service. Cancel or move ${ahead === 1 ? 'it' : 'them'} first, or switch the service off instead.`);
+        await removeThing(SERVICES, current.id);
+        return {ok: true};
+    });
+
+    fastify.get('/bookables', can('read'), async () => allBookables());
+    fastify.post('/bookables', can('manage'), async (request, reply) => {
+        const {data, errors} = cleanBookable(request.body || {});
+        if (Object.keys(errors).length) return fail(reply, 400, Object.values(errors)[0], {errors});
+        return reply.code(201).send(await saveThing(BOOKABLES, '', data));
+    });
+    fastify.put('/bookables/:id', can('manage'), async (request, reply) => {
+        const current = await getBookable(request.params.id);
+        if (!current) return fail(reply, 404, 'No such person or room.');
+        const {id, createdAt, updatedAt, ...stored} = current;
+        const {data, errors} = cleanBookable(request.body || {}, stored);
+        if (Object.keys(errors).length) return fail(reply, 400, Object.values(errors)[0], {errors});
+        return saveThing(BOOKABLES, id, data);
+    });
+    fastify.delete('/bookables/:id', can('manage'), async (request, reply) => {
+        const current = await getBookable(request.params.id);
+        if (!current) return fail(reply, 404, 'No such person or room.');
+        const now = new Date().toISOString();
+        const ahead = (await allBookings()).filter(b => b.bookableId === current.id && b.status === 'confirmed' && b.startAt > now).length;
+        if (ahead) return fail(reply, 409, `${ahead} booking${ahead === 1 ? ' is' : 's are'} still to come with ${current.name}. Move or cancel ${ahead === 1 ? 'it' : 'them'} first, or switch ${current.name} off instead.`);
+        await removeThing(BOOKABLES, current.id);
+        // Take it off every service that listed it.
+        for (const svc of await allServices()) {
+            if (!svc.bookables.includes(current.id)) continue;
+            const {id, createdAt, updatedAt, ...stored} = svc;
+            await saveThing(SERVICES, id, {...stored, bookables: svc.bookables.filter(x => x !== current.id)});
+        }
+        return {ok: true};
+    });
+
+    // ---- Admin: settings, contacts ----------------------------------------------------
+
+    fastify.get('/settings', can('read'), async () => ({settings: await liveSettings(), mailReady: mailReady()}));
+    fastify.put('/settings', can('manage'), async (request, reply) => {
+        const {settings, errors} = cleanSettings(request.body || {}, await liveSettings());
+        if (Object.keys(errors).length) return fail(reply, 400, Object.values(errors)[0], {errors});
+        saveSettings(settings);
+        return {settings: await liveSettings(), mailReady: mailReady()};
+    });
+
+    fastify.get('/contact', can('read'), async (request, reply) => {
+        if (!contactsOn()) return fail(reply, 404, 'Contacts is switched off.');
+        const c = await contactByEmail(request.query?.email, uidOf(request));
+        return c || fail(reply, 404, 'No such contact.');
+    });
+
+    fastify.get('/contact/:id', can('read'), async (request, reply) => {
+        if (!contactsOn()) return fail(reply, 404, 'Contacts is switched off.');
+        const c = await ownContact(request.params.id, uidOf(request));
+        return c || fail(reply, 404, 'No such contact.');
+    });
+
+    // ---- Customers --------------------------------------------------------------------
+
+    fastify.get('/public/services', async () => {
+        const {services, bookables} = await refreshShelf();
+        const s = await liveSettings();
+        return {
+            title: s.pageTitle, intro: s.intro, timeZone: s.timeZone, askPhone: s.askPhone, phoneRequired: s.phoneRequired,
+            termsUrl: s.termsUrl, today: wallClock(Date.now(), s.timeZone).date,
+            services: services.filter(x => x.active !== false && x.public !== false).map(x => publicService(x, bookables)).filter(x => x.bookables.length)
+                .map(x => {
+                    const svc = services.find(y => y.id === x.id);
+                    const r = registry.rules(svc, bookables);
+                    return {...x, capacity: r.capacity, online: r.online === true, waitlist: r.waitlist && Boolean(registry.waitlistUrl()), fields: publicFields(registry.form(svc))};
+                }),
+            waitlistUrl: registry.waitlistUrl()
+        };
+    });
+
+    fastify.get('/public/slots', {config: {rateLimit: {max: 120, timeWindow: '1 minute'}}}, async (request, reply) => {
+        const q = request.query || {};
+        const r = await freeTimes({serviceId: String(q.service || ''), withId: String(q.with || ''), from: String(q.from || ''), to: String(q.to || ''),
+            ignoreId: String(q.ignore || '').slice(0, 64), includeFull: !q.ignore && Boolean(registry.waitlistUrl())});
+        if (!r) return fail(reply, 404, 'That service cannot be booked.');
+        // Who is free is ours to know; the page only needs whether someone is (and, for a class, how many places).
+        const classy = r.rules?.capacity > 1;
+        return {range: r.range, days: r.days.map(d => ({date: d.date, slots: d.slots.map(({start, end, time, left, full}) =>
+            ({start, end, time, ...(classy ? {left} : {}), ...(full ? {full: true} : {})}))}))};
+    });
+
+    fastify.post('/public/book', {config: {rateLimit: {max: 10, timeWindow: '10 minutes'}}}, async (request, reply) => {
+        const body = request.body || {};
+        // The honeypot: a field people never see. A bot that fills it is told it worked.
+        if (body.website) return reply.code(201).send({ok: true});
+        const s = await liveSettings();
+        const {service, candidates} = await candidatesFor(String(body.serviceId || ''), String(body.bookableId || ''));
+        if (!service || service.public === false || !candidates.length) return fail(reply, 400, 'That service cannot be booked.');
+        const {data: customer, errors: customerErrors} = cleanCustomer(body.customer || body, {askPhone: s.askPhone, phoneRequired: s.phoneRequired});
+        const {data: answers, errors: answerErrors} = registry.answers(service, body.answers || {});
+        const errors = {...customerErrors, ...Object.fromEntries(Object.entries(answerErrors).map(([k, v]) => [`answers.${k}`, v]))};
+        if (Object.keys(errors).length) return fail(reply, 400, Object.values(errors)[0], {errors});
+        // The time must be one the page would offer: in the service's range, on its steps, in opening hours.
+        const startAt = new Date(String(body.startAt || ''));
+        if (Number.isNaN(startAt.getTime())) return fail(reply, 400, 'Pick a time.');
+        const day = wallClock(startAt, s.timeZone).date;
+        const r = await freeTimes({serviceId: service.id, withId: String(body.bookableId || ''), from: day, to: day}).catch(() => null);
+        const offered = r?.days?.[0]?.slots?.find(x => x.start === startAt.toISOString() && !x.full);
+        if (!offered) return fail(reply, 409, 'That time is no longer free. Please pick another.', {code: 'slot-taken'});
+        const refused = await registry.check({service, customer, startAt: offered.start, source: 'public', bookings: await allBookings(), settings: s});
+        if (refused) return fail(reply, 409, refused, {code: 'refused'});
+        try {
+            const b = await placeBooking({
+                service, rules: r.rules, candidates: candidates.filter(c => offered.bookableIds.includes(c.id)), startAt: offered.start, tz: s.timeZone,
+                fields: {...customer, source: 'public', by: customer.name, ext: Object.keys(answers).length ? {answers} : {}}
+            });
+            if (s.addToContacts) {
+                const bk = candidates.find(c => c.id === b.bookableId);
+                const id = await linkContact(customer, bk?.userId || s.contactsOwnerId, contactsOn()).catch(() => '');
+                if (id) Object.assign(b, (await changeBooking(b.id, {contactId: id})).booking);
+            }
+            siteBase(request);
+            tell(b, 'made', {request});
+            notice(b, 'made');
+            registry.emit('made', b);
+            return reply.code(201).send({ok: true, booking: publicBooking(b, s), manage: `${s.bookingPath}/manage/${b.id}?t=${b.token}`});
+        } catch (err) {
+            if (err instanceof SlotTaken) return fail(reply, 409, err.message, {code: 'slot-taken'});
+            throw err;
+        }
+    });
+
+    /** The customer's booking, when the token is right; null otherwise (a 404 either way). */
+    async function customersBooking(id, t) {
+        const b = await getBooking(String(id));
+        return b && tokenOk(b, String(t || '')) ? b : null;
+    }
+
+    fastify.get('/public/booking/:id', async (request, reply) => {
+        const b = await customersBooking(request.params.id, request.query?.t);
+        if (!b) return fail(reply, 404, 'No such booking.');
+        return publicBooking(b, await liveSettings());
+    });
+
+    fastify.get('/public/booking/:id/ics', async (request, reply) => {
+        const b = await customersBooking(request.params.id, request.query?.t);
+        if (!b) return fail(reply, 404, 'No such booking.');
+        const host = (() => { try { return new URL(siteBase(request)).host; } catch { return 'booking'; } })();
+        const ics = icsFor(b, {host, title: `${b.serviceName} - ${siteTitle()}`, cancel: b.status === 'cancelled', sequence: (b.history || []).length});
+        return reply.type('text/calendar; charset=utf-8').header('Content-Disposition', 'attachment; filename="booking.ics"').send(ics);
+    });
+
+    fastify.post('/public/booking/:id/cancel', {config: {rateLimit: {max: 10, timeWindow: '10 minutes'}}}, async (request, reply) => {
+        const s = await liveSettings();
+        const b = await customersBooking(request.params.id, request.body?.t);
+        if (!b) return fail(reply, 404, 'No such booking.');
+        if (!s.allowCancel || !customerMayChange(b, s)) return fail(reply, 403, s.changeNoticeHours
+            ? `Bookings can be cancelled here up to ${s.changeNoticeHours} hours before. Please contact us instead.`
+            : 'This booking cannot be cancelled here. Please contact us instead.');
+        const {booking: done} = await changeBooking(b.id, {status: 'cancelled', reason: String(request.body?.reason || '').slice(0, 300)}, b.name);
+        siteBase(request);
+        tell(done, 'cancelled', {request});
+        notice(done, 'cancelled');
+        registry.emit('cancelled', done, 'confirmed');
+        endCall(done).catch(() => {});
+        return publicBooking(done, s);
+    });
+
+    fastify.post('/public/booking/:id/move', {config: {rateLimit: {max: 10, timeWindow: '10 minutes'}}}, async (request, reply) => {
+        const s = await liveSettings();
+        const b = await customersBooking(request.params.id, request.body?.t);
+        if (!b) return fail(reply, 404, 'No such booking.');
+        if (!s.allowMove || !customerMayChange(b, s)) return fail(reply, 403, s.changeNoticeHours
+            ? `Bookings can be moved here up to ${s.changeNoticeHours} hours before. Please contact us instead.`
+            : 'This booking cannot be moved here. Please contact us instead.');
+        const startAt = new Date(String(request.body?.startAt || ''));
+        if (Number.isNaN(startAt.getTime())) return fail(reply, 400, 'Pick a new time.');
+        // The same person or room: a customer moves their time, not who they see.
+        const r = await freeTimes({serviceId: b.serviceId, withId: b.bookableId, from: wallClock(startAt, s.timeZone).date, to: wallClock(startAt, s.timeZone).date, ignoreId: b.id});
+        const offered = r?.days?.[0]?.slots?.find(x => x.start === startAt.toISOString() && !x.full);
+        if (!offered) return fail(reply, 409, 'That time is no longer free. Please pick another.', {code: 'slot-taken'});
+        const {service, candidates, rules} = await candidatesFor(b.serviceId, b.bookableId);
+        try {
+            const moved = await placeBooking({service, candidates, rules, startAt: offered.start, tz: s.timeZone, moveId: b.id, fields: {by: b.name}});
+            siteBase(request);
+            tell(moved, 'moved', {request});
+            notice(moved, 'moved');
+            registry.emit('moved', moved, b);
+            endCall(b).catch(() => {});
+            return publicBooking(moved, s);
+        } catch (err) {
+            if (err instanceof SlotTaken) return fail(reply, 409, err.message, {code: 'slot-taken'});
+            throw err;
+        }
+    });
+
+    // ---- Online bookings: the call ------------------------------------------------------
+    // The engine is core's (_lib/call); an older core without it simply has no calls.
+    try {
+        const {mountCallRoutes} = await import('../_lib/call/routes.js');
+        calls = mountCallRoutes(fastify, {prefix: '/call', ns: 'booking', resolve: async (request, room, body) => {
+            const b = await getBooking(String(body?.b || '')).catch(() => null);
+            // A class opened early ("Call now") is open for everyone in the session - someone who booked in
+            // after the click too: take the session's latest opening when this booking has none of its own.
+            if (b && b.online === true && !b.callOpenedAt) {
+                const room0 = sessionOf(b);
+                const opened = (await allBookings()).filter(x => x.id !== b.id && x.online === true && x.callOpenedAt && sessionOf(x) === room0)
+                    .map(x => x.callOpenedAt).sort().at(-1);
+                if (opened) b.callOpenedAt = opened;
+            }
+            return whoIsCalling(b, room, {t: body?.t, h: body?.h});
+        }});
+    } catch (err) {
+        log.warn?.(`[booking] online calls unavailable on this CMS: ${err?.message || err}`);
+    }
+}