domma-cms 0.106.0 → 0.107.0

package/plugins/booking/plugin.js

@@ -32,13 +32,13 @@ import {getConfig} from '../../server/config.js';
 import {getPluginStates} from '../../server/services/plugins.js';
 import {getPermissionsFor} from '../../server/services/roles.js';
 import {getEffectiveRoles} from '../../server/services/userRoles.js';
-import {listUsers} from '../../server/services/users.js';
+import {getUserById, listUsers} from '../../server/services/users.js';
 import {isToolEnabled} from '../../server/services/tools.js';
 import {cleanBookable, cleanCustomer, cleanService, whenLabel} from './public/lib/clean.js';
 import {bookingRange, HOLDING, slotsFor} from './public/lib/slots.js';
 import {addDays, atWallClock, isDate, wallClock} from './public/lib/time.js';
 import {bookingRegistry} from './lib/extensions.js';
-import {hostPath, joinPath, sessionOf, whoIsCalling} from './lib/call.js';
+import {callWindow, hostPath, invitePath, joinPath, sessionOf, whoIsCalling} from './lib/call.js';
 import {compose, icsFor, mailReady, send, siteAddress, siteTitle} from './lib/mail.js';
 import {
     BOOKABLES, BOOKINGS, NAME, SERVICES, SlotTaken, allBookables, allBookings, allServices, calendarBusy, changeBooking,
@@ -87,7 +87,7 @@ const publicFields = (list) => list.map(f => ({
  */
 const adminBooking = (b) => {
     if (!b) return b;
-    const {token, hostKey, ...rest} = b;
+    const {token, hostKey, callExtraKey, ...rest} = b;
     return b.online === true && hostKey ? {...rest, hostUrl: hostPath(settingsNow(), b)} : rest;
 };
 
@@ -123,7 +123,7 @@ function registerShortcodes(hooks) {
     });
 }
 
-export const ASSET_V = '1.5.0';
+export const ASSET_V = '1.6.0';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 
@@ -826,7 +826,57 @@ export default async function booking(fastify, options) {
             chatStore = createChatStore(path.join(dataDir, 'call-chat.json'));
             whoOf = (await import('../_lib/call/rooms.js')).whoOf || null;
         } catch { chatStore = null; }
-        calls = mountCallRoutes(fastify, {prefix: '/call', ns: 'booking', ...(chatStore ? {chat: chatStore} : {}), resolve: async (request, room, body) => {
+        // Add people (1.6; a core with services/callInvites.js): the host searches their contacts and the team, and
+        // each person gets their own `&g=` pass under the session's callExtraKey (never the customer's token or the
+        // host key). They knock like the customer. Without that core the button stays hidden.
+        let invites = null;
+        try { invites = await import('../../server/services/callInvites.js'); } catch { invites = null; }
+        /** The host's booking of this session (their identity is `<booking>:host`), or null. */
+        const hostBooking = async (room, identity) => {
+            const id = String(identity || '').endsWith(':host') ? String(identity).slice(0, -5) : '';
+            const b = id ? await getBooking(id).catch(() => null) : null;
+            return b && b.online === true && HOLDING.has(b.status) && sessionOf(b) === room ? b : null;
+        };
+        /** The session's extra key: the one a booking of it already has, else a new one - on every booking of it. */
+        const extraKeyOf = async (b, room) => {
+            const session = (await allBookings()).filter(x => x.online === true && HOLDING.has(x.status) && sessionOf(x) === room);
+            const key = session.map(x => x.callExtraKey).find(Boolean) || (await import('../_lib/call/invite.js')).newInviteKey();
+            for (const x of session) if (!x.callExtraKey) await changeBooking(x.id, {callExtraKey: key}, 'call');
+            // Two sends at once: the first key written stays (changeBooking never replaces one) - use what is stored.
+            return (await getBooking(b.id).catch(() => null))?.callExtraKey || key;
+        };
+        /**
+         * The host's user on the site: the person's linked, active account - else '' (the host link then may be held
+         * by someone from outside - it is emailed to the person's address and sits in the .ics - so they get no team
+         * directory, no contacts and nothing sent in the site's name: Copy link only).
+         */
+        const hostUserOf = async (b) => {
+            const bk = b?.bookableId ? await getBookable(b.bookableId).catch(() => null) : null;
+            const u = bk?.userId ? await getUserById(bk.userId).catch(() => null) : null;
+            return u && u.disabled !== true && u.active !== false && u.isActive !== false ? u.id : '';
+        };
+        const invite = invites ? {
+            search: async (room, q, {identity}) => {
+                const b = await hostBooking(room, identity);
+                const owner = b ? await hostUserOf(b) : '';
+                return owner ? invites.searchInvitees({hostUserId: owner, q}) : [];
+            },
+            send: async (room, people, {identity, name, via, request}) => {
+                const b = await hostBooking(room, identity);
+                if (!b) return {error: 'This booking has no call now.'};
+                const owner = await hostUserOf(b);
+                if (!owner && people.length) return {error: 'Copy the link and pass it on yourself.'};
+                const key = await extraKeyOf(b, room);
+                const s = await liveSettings();
+                const base = invites.inviteOrigin ? invites.inviteOrigin(request) : siteBase(request);
+                const newLink = () => `${base}${invitePath(s, b, key)}`;
+                const targets = await invites.resolveInvitees(people, {hostUserId: owner});
+                const results = await invites.deliverInvites(targets, {linkFor: newLink, hostName: name || b.bookableName || 'Your host',
+                    hostUserId: owner, title: b.serviceName, via, key: `booking:${room}`, expiresAt: callWindow(b).closesAt, log});
+                return {link: newLink(), results};
+            }
+        } : null;
+        calls = mountCallRoutes(fastify, {prefix: '/call', ns: 'booking', ...(chatStore ? {chat: chatStore} : {}), ...(invite ? {invite} : {}), resolve: async (request, room, body) => {
             const b = await getBooking(String(body?.b || '')).catch(() => null);
             // A class opened early ("Call now") is open for everyone in the session - someone who booked in
             // after the click too: take the session's latest opening when this booking has none of its own.
@@ -836,7 +886,10 @@ export default async function booking(fastify, options) {
                     .map(x => x.callOpenedAt).sort().at(-1);
                 if (opened) b.callOpenedAt = opened;
             }
-            return whoIsCalling(b, room, {t: body?.t, h: body?.h});
+            const who = whoIsCalling(b, room, {t: body?.t, h: body?.h, g: body?.g});
+            // Add people for a host with no account here: Copy link only (see hostUserOf).
+            if (who?.host && invite && !(await hostUserOf(b))) return {...who, inviteOptions: {search: false, typed: false, copyLink: true}};
+            return who;
         }});
     } catch (err) {
         log.warn?.(`[booking] online calls unavailable on this CMS: ${err?.message || err}`);

package/plugins/booking/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "booking",
   "displayName": "Booking",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "tier": "free",
   "description": "Let people book appointments with you or your team, and rooms or equipment, from a booking page on your site. Opening hours, days off and buffers; confirmation and reminder emails with a link to change or cancel; a diary in the admin. Book straight from a contact or an email.",
   "author": "Domma CMS",

package/plugins/booking/plugin.public.js

@@ -20,7 +20,7 @@ import {callWindow, whoIsCalling} from './lib/call.js';
 import {dayLabel, lengthLabel} from './public/lib/page-format.js';
 
 const TEMPLATE = path.join(fileURLToPath(new URL('.', import.meta.url)), 'templates', 'booking.html');
-export const ASSET_V = '1.3.1';
+export const ASSET_V = '1.6.0';
 
 /** Which page a path is, under the booking page's base. */
 export function matchBookingPath(pathname, base) {
@@ -128,7 +128,7 @@ export default async function bookingPublic(fastify) {
      */
     pages.call = async function call(request, reply, s, {room}) {
         const q = request.query || {};
-        const cred = {b: String(q.b || '').slice(0, 64), ...(q.h ? {h: String(q.h).slice(0, 128)} : {t: String(q.t || '').slice(0, 128)})};
+        const cred = {b: String(q.b || '').slice(0, 64), ...(q.h ? {h: String(q.h).slice(0, 128)} : q.g ? {g: String(q.g).slice(0, 128)} : {t: String(q.t || '').slice(0, 128)})};
         const b = await getBooking(cred.b).catch(() => null);
         const who = whoIsCalling(b, room, cred);
         const head = `<header class="bk-hero"><p class="bk-crumbs"><a href="${esc(s.bookingPath)}">${esc(s.pageTitle || 'Book')}</a></p>`;
@@ -136,11 +136,11 @@ export default async function bookingPublic(fastify) {
             return send(reply, request, s, {page: 'call', title: `Call - ${s.pageTitle || 'Book'}`, urlPath: `${s.bookingPath}/call/${room}`, noindex: true,
                 body: `${head}<h1>This call link is not valid</h1></header><p class="bk-note">The booking may have been cancelled or moved. Check the latest email we sent you.</p>`
                     // A reload of the bare address (the call screen took the link out of the address bar): back to it.
-                    + (cred.t || cred.h ? '' : RECOVER_CALL)});
+                    + (cred.t || cred.h || cred.g ? '' : RECOVER_CALL)});
         }
         const {closesAt} = callWindow(b);
         const cfg = {api: '/api/plugins/booking/call', room, cred, title: `${b.serviceName}${who.host ? `: ${b.name}` : b.bookableName ? ` with ${b.bookableName}` : ''}`,
-            askName: false, recordingAllowed: who.recordingAllowed, closesAt};
+            askName: who.invited === true, recordingAllowed: who.recordingAllowed, closesAt};
         return send(reply, request, s, {page: 'call', title: `${b.serviceName} - online`, urlPath: `${s.bookingPath}/call/${room}`, noindex: true,
             body: `<link rel="stylesheet" href="/plugins/_lib/public/call/call.css?v=${ASSET_V}">`
                 + `<div data-dm-call='${esc(JSON.stringify(cfg))}'><noscript><p class="bk-note">The call needs JavaScript switched on.</p></noscript></div>`

package/plugins/booking/tests/api.test.js

@@ -506,3 +506,117 @@ test('an early-opened call lasts two hours from the click, not all the way to a
     const soon = {...b, callOpenedAt: '2031-01-10T09:00:00.000Z'};
     assert.deepEqual(callWindow(soon, at('2031-01-10T09:05:00.000Z')), {opensAt: '2031-01-10T09:00:00.000Z', closesAt: '2031-01-10T12:00:00.000Z'}, 'joined up when they meet');
 });
+
+test('1.6 Add people: the host adds a team member and an address; each gets their own &g= pass (never the customer token or host key); they knock', async () => {
+    const reg = bookingRegistry();
+    reg.register('test-online', {rules: (s) => (s?.slug === 'team-call' ? {online: true} : {})});
+    const {createUser, deleteUser} = await import('../../../server/services/users.js');
+    await (await import('../../../server/services/roles.js')).load();
+    const {setInviteMailer, resetInviteLimits} = await import('../../../server/services/callInvites.js');
+    const {whoIsCalling} = await import('../lib/call.js');
+    const tag = Math.random().toString(36).slice(2, 7);
+    const tess = await createUser({name: `Tess Host ${tag}`, email: `tess-${tag}@example.test`, password: 'password123', role: 'user'});
+    const mate = await createUser({name: `Milo Mate ${tag}`, email: `milo-${tag}@example.test`, password: 'password123', role: 'user'});
+    const mails = [];
+    setInviteMailer(async (m) => { mails.push(m); });
+    resetInviteLimits();
+    try {
+        const all = Object.fromEntries(['mon', 'tue', 'wed', 'thu', 'fri', 'sat', 'sun'].map(d => [d, [{from: '00:00', to: '24:00'}]]));
+        let r = await call('POST', '/bookables', {name: 'Tess', kind: 'person', hours: all, userId: tess.id});
+        const bk = r.body;
+        assert.equal(bk.userId, tess.id, 'the person is a user of the site');
+        const svc = (await call('POST', '/services', {name: 'Team call', duration: 30, minNoticeMinutes: 0, bookables: [bk.id]})).body;
+        const start = new Date(Math.ceil((Date.now() + 5 * 60000) / 60000) * 60000).toISOString();
+        r = await call('POST', '/bookings', {serviceId: svc.id, startAt: start, customer: {name: 'Gus Guest', email: 'gus@example.com'}, force: true, notify: false});
+        assert.equal(r.status, 201, JSON.stringify(r.body));
+        const b = r.body;
+        const raw = await reg.services.getBooking(b.id);
+        const room = b.hostUrl.split('/call/')[1].split('?')[0];
+        const as = (p) => ({'x-call-id': p.id, 'x-call-secret': p.secret});
+        const post = (u, payload, headers = {}) => app.inject({method: 'POST', url: u, payload, headers});
+        const host = (await post(`/call/${room}/join`, {b: b.id, h: raw.hostKey})).json();
+        const guest = (await post(`/call/${room}/join`, {b: b.id, t: raw.token})).json();
+        assert.equal(host.canInvite, true);
+        assert.equal(guest.canInvite, false);
+
+        let s = await app.inject({method: 'GET', url: `/call/${room}/people?q=Milo`, headers: as(host)});
+        assert.equal(s.statusCode, 200);
+        assert.ok(s.json().people.some(p => p.kind === 'user' && p.id === mate.id));
+        assert.ok(!(await app.inject({method: 'GET', url: `/call/${room}/people?q=Tess`, headers: as(host)})).json().people.some(p => p.id === tess.id), 'not the host');
+        assert.equal((await app.inject({method: 'GET', url: `/call/${room}/people?q=Milo`, headers: as(guest)})).statusCode, 403, 'the customer cannot');
+
+        r = await post(`/call/${room}/invite`, {people: [{kind: 'user', id: mate.id}, {name: 'Ext Person', email: 'ext@example.com'}], via: {email: true}}, {...as(host), host: 'site.test'});
+        assert.equal(r.statusCode, 200, r.body);
+        assert.deepEqual(r.json().results.map(x => [x.name, x.emailed]), [[`Milo Mate ${tag}`, true], ['Ext Person', true]]);
+        const linkTo = (to) => new URL(mails.find(m => m.to === to).text.match(/https?:\/\/\S+/)[0]);
+        const milo = linkTo(mate.email);
+        const ext = linkTo('ext@example.com');
+        assert.equal(milo.pathname, `/booking/call/${room}`);
+        assert.equal(milo.searchParams.get('b'), b.id);
+        assert.ok(milo.searchParams.get('g') && !milo.searchParams.get('t') && !milo.searchParams.get('h'));
+        assert.notEqual(milo.searchParams.get('g'), ext.searchParams.get('g'));
+        for (const u of [milo, ext]) assert.ok(!u.href.includes(raw.token) && !u.href.includes(raw.hostKey), 'no token or host key reused');
+
+        const kept = await reg.services.getBooking(b.id);
+        assert.ok(kept.callExtraKey && kept.callExtraKey !== raw.token && kept.callExtraKey !== raw.hostKey);
+        assert.equal((await call('GET', `/bookings/${b.id}`)).body.callExtraKey, undefined, 'never shown in the admin');
+
+        // They knock with their own name; the customer keeps their place.
+        const m1 = (await post(`/call/${room}/join`, {b: b.id, g: milo.searchParams.get('g'), name: 'Milo'})).json();
+        const e1 = (await post(`/call/${room}/join`, {b: b.id, g: ext.searchParams.get('g'), name: 'Ext'})).json();
+        assert.equal(m1.state, 'waiting');
+        assert.equal(e1.state, 'waiting');
+        assert.equal(m1.canInvite, false);
+        assert.deepEqual((await app.inject({method: 'GET', url: `/call/${room}/poll?since=0`, headers: as(host)})).json().events
+            .filter(e => e.type === 'waiting').at(-1).waiting.map(w => w.name), ['Gus Guest', 'Milo', 'Ext']);
+        assert.equal((await post(`/call/${room}/join`, {b: b.id, g: 'abcdefgh.AAAAAAAAAAAAAAAAAAAAAAAA', name: 'X'})).statusCode, 404, 'forged');
+        const who = whoIsCalling(kept, room, {g: milo.searchParams.get('g')});
+        assert.equal(who.invited, true);
+        assert.equal(who.host, false);
+
+        // Copy link: a new pass each time.
+        const copy = (await post(`/call/${room}/invite`, {people: []}, {...as(host), host: 'site.test'})).json();
+        assert.match(copy.link, new RegExp(`/booking/call/${room}\\?b=${b.id}&g=`));
+        for (const p of [host, guest, m1, e1]) await post(`/call/${room}/leave`, {}, as(p));
+        await call('DELETE', `/bookings/${b.id}`);
+    } finally {
+        setInviteMailer(null);
+        reg.unregister('test-online');
+        for (const u of [tess, mate]) await deleteUser(u.id).catch(() => {});
+    }
+});
+
+test('1.6 Add people: a person with no account on the site (the host link may be anyone\'s) gets Copy link only - no directory, nothing sent', async () => {
+    const reg = bookingRegistry();
+    reg.register('test-online', {rules: (s) => (s?.slug === 'outside-call' ? {online: true} : {})});
+    const {setInviteMailer} = await import('../../../server/services/callInvites.js');
+    const mails = [];
+    setInviteMailer(async (m) => { mails.push(m); });
+    try {
+        const all = Object.fromEntries(['mon', 'tue', 'wed', 'thu', 'fri', 'sat', 'sun'].map(d => [d, [{from: '00:00', to: '24:00'}]]));
+        const olga = (await call('POST', '/bookables', {name: 'Olga Outside', kind: 'person', hours: all, email: 'olga@elsewhere.example'})).body;
+        const svc = (await call('POST', '/services', {name: 'Outside call', duration: 30, minNoticeMinutes: 0, bookables: [olga.id]})).body;
+        const start = new Date(Math.ceil((Date.now() + 5 * 60000) / 60000) * 60000).toISOString();
+        const b = (await call('POST', '/bookings', {serviceId: svc.id, startAt: start, customer: {name: 'Gus', email: 'gus2@example.com'}, force: true, notify: false})).body;
+        const raw = await reg.services.getBooking(b.id);
+        const room = b.hostUrl.split('/call/')[1].split('?')[0];
+        const post = (u, payload, headers = {}) => app.inject({method: 'POST', url: u, payload, headers});
+        const host = (await post(`/call/${room}/join`, {b: b.id, h: raw.hostKey})).json();
+        assert.equal(host.canInvite, true);
+        assert.deepEqual(host.inviteOptions, {search: false, typed: false, copyLink: true, external: true});
+        const as = {'x-call-id': host.id, 'x-call-secret': host.secret};
+        assert.deepEqual((await app.inject({method: 'GET', url: `/call/${room}/people?q=a`, headers: as})).json(), {people: []}, 'no team directory, no contacts');
+        for (const person of [{name: 'Spam', email: 'victim@example.com'}, {kind: 'user', id: 'someone'}, {kind: 'contact', id: 'c1'}]) {
+            assert.equal((await post(`/call/${room}/invite`, {people: [person], via: {email: true}}, as)).statusCode, 400);
+        }
+        assert.equal(mails.length, 0, 'nothing sent in the site\'s name');
+        const copy = (await post(`/call/${room}/invite`, {people: []}, as)).json();
+        assert.match(copy.link, new RegExp(`/booking/call/${room}\\?b=${b.id}&g=`), 'Copy link: their own pass');
+        const knock = (await post(`/call/${room}/join`, {b: b.id, g: new URL(copy.link).searchParams.get('g'), name: 'Friend'})).json();
+        assert.equal(knock.state, 'waiting');
+        await call('DELETE', `/bookings/${b.id}`);
+    } finally {
+        setInviteMailer(null);
+        reg.unregister('test-online');
+    }
+});

package/plugins/free-tier.lock.json

@@ -1,6 +1,6 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@ba58fcb",
+  "source": "dcms-marketplace@f582d78",
   "plugins": {
     "blog": {
       "version": "1.9.4",
@@ -73,9 +73,9 @@
       }
     },
     "booking": {
-      "version": "1.5.0",
+      "version": "1.6.0",
       "files": {
-        "CLAUDE.md": "258f342c1acdd1d7562a3409bc7c8622828308c243549255d2ac75832be6d84e",
+        "CLAUDE.md": "9bcab41375a2aaecbdd332766ceca5b18bf9dafa99d4c8315549e38033c1f5c5",
         "admin/css/index.css": "4f7731921c0c5038cb1566a6ab2d43ffc35bf9b161e58f87a0cff423e81b47fa",
         "admin/lib/details.js": "8b37536bfa9ccfcc5265cc957ba8266d3f5f777133e7c0946ae49540f1c80e3c",
         "admin/lib/diary-layout.js": "d818c79001fb9a9ecc15c96239ba961b0a1d98b9e8fce903eefb57d85adf2a73",
@@ -93,15 +93,15 @@
         "collections/booking-bookings.json": "fa0b15cc81b4a2114734a0bc8adc4b4d25049d16cf62549b83634cdbeb543b52",
         "collections/booking-services.json": "cecb500a9215a0eba894e6b4c9ae78f5fbeb209830d07d47050c56c75143f66a",
         "config.js": "5565fd627481cf809322257cc300a7cbb7ccbf6cae076b4cf8a7453fcf554bd3",
-        "docs/guide.md": "dd6a8250ac25914dc8ac6922167c92e815f69f464d61b424dfab42770af59626",
+        "docs/guide.md": "186e2419f44ff5b13dfbcea709dc8616f3817c260717839a9fa51834ab73f718",
         "inject/body.html": "ab55ce945eec2302eb0c836a4626cffa5e091d050c6a59c6f2af332b05570777",
-        "lib/call.js": "7dfa0ae60be87d8f7f26b4360d5c1144322abe66eb61b233ed812e35bb8e59bd",
+        "lib/call.js": "87c11b8531e1a6d247d52d4e03ea8e5aa06a1af49cbd7cbd0af97e2586237f7b",
         "lib/extensions.js": "8cec28ff8685daad8083b23f034f1c3bf82fd2322943dd19d46570ccdc311105",
         "lib/mail.js": "cad8f409df62d6e42f0f4024ec364bbe018a62b842fa3f7c38786fd4e7f92408",
-        "lib/store.js": "270161f907c68de39d32758931e86c290582524af4650e722c2c3be209acc875",
-        "plugin.js": "afe2c3dd15c69515828f513478bb40f2ea3788a8b67ace571c01198acd79dc3b",
-        "plugin.json": "be0576b42a5fa60c04da8131a5d20113c020eb8088db228892f0715e9b1808f8",
-        "plugin.public.js": "5f2dc4f01202b16ae804364a33c547509d1fa4026eadebac440730234aa266b5",
+        "lib/store.js": "7aa7967e4694e5a3b85378f60302e5a47394b1d90c7dd86e09578156f1c13e03",
+        "plugin.js": "90424e681de6c086dcc316c734ddb907c7572e452949ced4cc756205a4798f6e",
+        "plugin.json": "8f7a5b1ed1e0bbfb1e933906b2c63bff4fbfc62868244b2077b1090d87fc3cc0",
+        "plugin.public.js": "4d5b4e8ad6943182ee3b6c6e6f6762a2d3f676d8d7ee363fcb07bd47d3d6532e",
         "public/booking.css": "8b88989fdd04e50efc1688a2f32fe2e422299d7d13b81bb8fce0cc162fa99df6",
         "public/booking.js": "7dfc3d205696967013886567f67a867443c2e370bac29019d69911d695fdbade",
         "public/lib/clean.js": "d591be9ea8462705b7bc8806670027fdd4d6d4764777da08e91a010d27ec1651",
@@ -110,7 +110,7 @@
         "public/lib/time.js": "48e13a23e3d7a4916e2097e8f87c03a87d37b71c4ef037a5a16143c6a4185c41",
         "templates/booking.html": "a4995de46dfdab7e692b56f21347f29c76320cf3b0477889dc3c5d14e0b6dcd7",
         "tests/admin-diary.test.js": "4e34b447d62b41272ceec49bad9d491ae00dd04f4760d8a7a3046be1912f4abe",
-        "tests/api.test.js": "937a79e5af9af6b3f12b7ae15dabc470a91c7fe8ca03e3f7f261e4e641dfe3dc",
+        "tests/api.test.js": "43ae40477a43a03d21096038f317d745bc08cd51767c97548bf0601e99ebdd97",
         "tests/public.test.js": "0b7b626d60df5a3d73d7c0077b73f59b62a9fded98ce84a8d93cd32cd0333159",
         "tests/pure.test.js": "8ba0c8f76b4c9efcc422f39ff29509612544d81f760025a4b9a5594af14e7bcf"
       }

package/server/routes/api/calls.js

@@ -25,6 +25,9 @@
  * The call itself (no sign-in - the link is the credential):
  *   /api/calls/room/:id/{join,poll,signal,chat,answer,recording,leave}   (plugins/_lib/call/routes.js)
  *   join takes {t} (the guest) or {h} (the host); guests knock and the host lets them in.
+ *   "Add people" (the host, in the call): GET /api/calls/room/:id/people?q= - the host's readable contacts and the
+ *   team; POST /api/calls/room/:id/invite - each person gets their own Join link `?g=<pass>` (never the guest's
+ *   token), by email, notification and Messages as chosen (services/callInvites.js). They knock like any guest.
  */
 import {authenticate as defaultAuthenticate, requirePermission as defaultRequirePermission} from '../../middleware/auth.js';
 import {getEntry, listEntries} from '../../services/collections.js';
@@ -35,9 +38,10 @@ import {isToolEnabled} from '../../services/tools.js';
 import {mountCallRoutes} from '../../../plugins/_lib/call/routes.js';
 import {whoOf} from '../../../plugins/_lib/call/rooms.js';
 import {getBaseUrl} from '../public.js';
+import {deliverInvites, resolveInvitees, searchInvitees} from '../../services/callInvites.js';
 import {
     EMAIL_RE, callChat, callMailReady, callPaths, callsOfContact, chatCountOf, createCall, getCall, instantCallsEnabled, isOpen,
-    mayEmailAddress, mayStartCall, saveCallChat, sendCallEmail, whoIsCalling
+    invitePath, mayEmailAddress, mayStartCall, saveCallChat, sendCallEmail, whoIsCalling
 } from '../../services/instantCalls.js';
 
 const CONTACTS_SLUG = 'contacts-contacts';
@@ -147,8 +151,26 @@ export async function callsRoutes(fastify, opts = {}) {
     // The call engine: a room per call, guests knock, the host lets them in, open createdAt..expiresAt.
     mountCallRoutes(fastify, {
         prefix: '/room', ns: 'instant', ...(opts.rooms ? {rooms: opts.rooms} : {}),
-        resolve: async (request, room, body) => whoIsCalling(await getCall(String(room)), {t: body?.t, h: body?.h}),
+        resolve: async (request, room, body) => whoIsCalling(await getCall(String(room)), {t: body?.t, h: body?.h, g: body?.g}),
         // The chat is saved against the call record, so a call reopened (or after a restart) shows it again.
-        chat: {load: (room) => callChat(String(room)), save: (room, item) => saveCallChat(String(room), item)}
+        chat: {load: (room) => callChat(String(room)), save: (room, item) => saveCallChat(String(room), item)},
+        // Add people (the host): the host user's contacts and the team; each invitee gets their own `?g=` link.
+        invite: {
+            search: async (room, q) => {
+                const rec = await getCall(String(room));
+                if (!rec || !isOpen(rec)) return [];
+                return searchInvitees({hostUserId: rec.hostId, q});
+            },
+            send: async (room, people, {via, request}) => {
+                const rec = await getCall(String(room));
+                if (!rec || !isOpen(rec)) return {error: 'This call has ended.'};
+                const base = getBaseUrl(request);
+                const newLink = async () => `${base}${await invitePath(rec.id)}`;
+                const targets = await resolveInvitees(people, {hostUserId: rec.hostId});
+                const results = await deliverInvites(targets, {linkFor: newLink, hostName: rec.hostName, hostUserId: rec.hostId,
+                    title: `Video call: ${rec.hostName} and ${rec.name || 'a guest'}`, via, key: `instant:${rec.id}`, expiresAt: rec.expiresAt, log: request.log});
+                return {link: await newLink(), results};
+            }
+        }
     });
 }

package/server/routes/call-public.js

@@ -3,6 +3,7 @@
  *
  *   /_call/<id>?t=<guest token>   the person called
  *   /_call/<id>?h=<host key>      the host
+ *   /_call/<id>?g=<invite pass>   someone the host added ("Add people") - names themselves, knocks
  *
  * Under `/_call`, like `/_preview`. Answered from an onRequest hook, and ONLY
  * while instant calls are on: with no Pro Tool with calls the request goes on
@@ -53,14 +54,14 @@ export const recoverScript = '<script>(function(){try{if(location.search)return;
 
 export function callPage(rec, who, cred, now = Date.now()) {
     if (!rec || !who) {
-        const bare = !cred?.t && !cred?.h;
+        const bare = !cred?.t && !cred?.h && !cred?.g;
         return {status: 404, title: 'Call', body: '<h1>This call link is not valid</h1><p>Ask the person who sent it for a new one.</p>'
             + (bare ? recoverScript : '')};
     }
     if (!(Date.parse(rec.expiresAt) > now)) {
         return {status: 410, title: 'Call', body: '<h1>This call has ended</h1><p>Ask the person who sent the link for a new one.</p>'};
     }
-    const cfg = {api: ROOM_API, room: rec.id, cred, title: who.title, askName: !who.host && !rec.name, recordingAllowed: false, closesAt: rec.expiresAt};
+    const cfg = {api: ROOM_API, room: rec.id, cred, title: who.title, askName: !who.host && (!rec.name || who.invited === true), recordingAllowed: false, closesAt: rec.expiresAt};
     return {
         status: 200,
         title: who.title,
@@ -89,7 +90,7 @@ export async function callPublicRoutes(fastify, opts = {}) {
         reply.header('cache-control', 'no-store, private');
         reply.header('x-robots-tag', 'noindex, nofollow');
         const q = new URLSearchParams(search);
-        const cred = q.get('h') ? {h: q.get('h').slice(0, 128)} : {t: String(q.get('t') || '').slice(0, 128)};
+        const cred = q.get('h') ? {h: q.get('h').slice(0, 128)} : q.get('g') ? {g: q.get('g').slice(0, 128)} : {t: String(q.get('t') || '').slice(0, 128)};
         const rec = await getCall(id);
         const page = callPage(rec, whoIsCalling(rec, cred), cred);
         const html = await renderBlogPage(TEMPLATE, {body: page.body}, {