payload-reserve 1.3.2 → 1.5.0

package/dist/endpoints/cancelBooking.js

@@ -1,15 +1,9 @@
+import { isPrivilegedUser } from '../utilities/userRoles.js';
 export function createCancelBookingEndpoint(config) {
     return {
         handler: async (req)=>{
-            if (!req.user) {
-                return Response.json({
-                    message: 'Unauthorized'
-                }, {
-                    status: 401
-                });
-            }
             const body = await req.json?.();
-            const { reason, reservationId } = body ?? {};
+            const { reason, reservationId, token } = body ?? {};
             if (!reservationId) {
                 return Response.json({
                     message: 'reservationId is required'
@@ -17,25 +11,37 @@ export function createCancelBookingEndpoint(config) {
                     status: 400
                 });
             }
-            // Fetch the reservation to check ownership
+            // Fetch the reservation to check ownership / token.
             // eslint-disable-next-line @typescript-eslint/no-explicit-any
             const existing = await req.payload.findByID({
                 id: reservationId,
                 collection: config.slugs.reservations,
                 depth: 0,
+                overrideAccess: true,
                 req
             });
-            // Check ownership: customer must match req.user
-            const customerId = typeof existing.customer === 'object' ? existing.customer?.id : existing.customer;
-            const isOwner = customerId === req.user.id;
-            // Admin = user from non-customer collection
-            const isAdmin = req.user.collection !== config.slugs.customers;
-            if (!isOwner && !isAdmin) {
-                return Response.json({
-                    message: 'Forbidden'
-                }, {
-                    status: 403
-                });
+            if (req.user) {
+                // Authenticated path: owner (customer === req.user) or admin/staff.
+                const customerId = typeof existing.customer === 'object' ? existing.customer?.id : existing.customer;
+                const isOwner = customerId === req.user.id;
+                // Staff/admin detection (role-aware for single-collection deployments)
+                const isAdmin = isPrivilegedUser(req.user, config);
+                if (!isOwner && !isAdmin) {
+                    return Response.json({
+                        message: 'Forbidden'
+                    }, {
+                        status: 403
+                    });
+                }
+            } else {
+                // Guest path: match the cancellation token.
+                if (!token || !existing.cancellationToken || token !== existing.cancellationToken) {
+                    return Response.json({
+                        message: 'Forbidden'
+                    }, {
+                        status: 403
+                    });
+                }
             }
             // eslint-disable-next-line @typescript-eslint/no-explicit-any
             const reservation = await req.payload.update({
@@ -45,9 +51,16 @@ export function createCancelBookingEndpoint(config) {
                     cancellationReason: reason,
                     status: 'cancelled'
                 },
+                // Authorization (owner / admin / matching token) is already enforced above.
+                // overrideAccess lets the write proceed for anonymous guest cancellations,
+                // and avoids a spurious 500 when resourceOwnerMode restricts update access.
+                overrideAccess: true,
                 req
             });
-            return Response.json(reservation);
+            // Strip the cancellation token from the response, consistent with the book
+            // endpoint — it must never be echoed back over HTTP.
+            const { cancellationToken: _cancellationToken, ...safeReservation } = reservation;
+            return Response.json(safeReservation);
         },
         method: 'post',
         path: '/reserve/cancel'

package/dist/endpoints/cancelBooking.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/endpoints/cancelBooking.ts"],"sourcesContent":["import type { Endpoint } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../types.js'\n\nexport function createCancelBookingEndpoint(config: ResolvedReservationPluginConfig): Endpoint {\n  return {\n    handler: async (req) => {\n      if (!req.user) {\n        return Response.json({ message: 'Unauthorized' }, { status: 401 })\n      }\n\n      const body = await req.json?.()\n      const { reason, reservationId } = (body ?? {}) as {\n        reason?: string\n        reservationId?: string\n      }\n\n      if (!reservationId) {\n        return Response.json({ message: 'reservationId is required' }, { status: 400 })\n      }\n\n      // Fetch the reservation to check ownership\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      const existing = await (req.payload.findByID as any)({\n        id: reservationId,\n        collection: config.slugs.reservations,\n        depth: 0,\n        req,\n      })\n\n      // Check ownership: customer must match req.user\n      const customerId =\n        typeof existing.customer === 'object' ? existing.customer?.id : existing.customer\n      const isOwner = customerId === req.user.id\n      // Admin = user from non-customer collection\n      const isAdmin = req.user.collection !== config.slugs.customers\n\n      if (!isOwner && !isAdmin) {\n        return Response.json({ message: 'Forbidden' }, { status: 403 })\n      }\n\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      const reservation = await (req.payload.update as any)({\n        id: reservationId,\n        collection: config.slugs.reservations,\n        data: {\n          cancellationReason: reason,\n          status: 'cancelled',\n        },\n        req,\n      })\n\n      return Response.json(reservation)\n    },\n    method: 'post',\n    path: '/reserve/cancel',\n  }\n}\n"],"names":["createCancelBookingEndpoint","config","handler","req","user","Response","json","message","status","body","reason","reservationId","existing","payload","findByID","id","collection","slugs","reservations","depth","customerId","customer","isOwner","isAdmin","customers","reservation","update","data","cancellationReason","method","path"],"mappings":"AAIA,OAAO,SAASA,4BAA4BC,MAAuC;IACjF,OAAO;QACLC,SAAS,OAAOC;YACd,IAAI,CAACA,IAAIC,IAAI,EAAE;gBACb,OAAOC,SAASC,IAAI,CAAC;oBAAEC,SAAS;gBAAe,GAAG;oBAAEC,QAAQ;gBAAI;YAClE;YAEA,MAAMC,OAAO,MAAMN,IAAIG,IAAI;YAC3B,MAAM,EAAEI,MAAM,EAAEC,aAAa,EAAE,GAAIF,QAAQ,CAAC;YAK5C,IAAI,CAACE,eAAe;gBAClB,OAAON,SAASC,IAAI,CAAC;oBAAEC,SAAS;gBAA4B,GAAG;oBAAEC,QAAQ;gBAAI;YAC/E;YAEA,2CAA2C;YAC3C,8DAA8D;YAC9D,MAAMI,WAAW,MAAM,AAACT,IAAIU,OAAO,CAACC,QAAQ,CAAS;gBACnDC,IAAIJ;gBACJK,YAAYf,OAAOgB,KAAK,CAACC,YAAY;gBACrCC,OAAO;gBACPhB;YACF;YAEA,gDAAgD;YAChD,MAAMiB,aACJ,OAAOR,SAASS,QAAQ,KAAK,WAAWT,SAASS,QAAQ,EAAEN,KAAKH,SAASS,QAAQ;YACnF,MAAMC,UAAUF,eAAejB,IAAIC,IAAI,CAACW,EAAE;YAC1C,4CAA4C;YAC5C,MAAMQ,UAAUpB,IAAIC,IAAI,CAACY,UAAU,KAAKf,OAAOgB,KAAK,CAACO,SAAS;YAE9D,IAAI,CAACF,WAAW,CAACC,SAAS;gBACxB,OAAOlB,SAASC,IAAI,CAAC;oBAAEC,SAAS;gBAAY,GAAG;oBAAEC,QAAQ;gBAAI;YAC/D;YAEA,8DAA8D;YAC9D,MAAMiB,cAAc,MAAM,AAACtB,IAAIU,OAAO,CAACa,MAAM,CAAS;gBACpDX,IAAIJ;gBACJK,YAAYf,OAAOgB,KAAK,CAACC,YAAY;gBACrCS,MAAM;oBACJC,oBAAoBlB;oBACpBF,QAAQ;gBACV;gBACAL;YACF;YAEA,OAAOE,SAASC,IAAI,CAACmB;QACvB;QACAI,QAAQ;QACRC,MAAM;IACR;AACF"}
+{"version":3,"sources":["../../src/endpoints/cancelBooking.ts"],"sourcesContent":["import type { Endpoint } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../types.js'\n\nimport { isPrivilegedUser } from '../utilities/userRoles.js'\n\nexport function createCancelBookingEndpoint(config: ResolvedReservationPluginConfig): Endpoint {\n  return {\n    handler: async (req) => {\n      const body = await req.json?.()\n      const { reason, reservationId, token } = (body ?? {}) as {\n        reason?: string\n        reservationId?: string\n        token?: string\n      }\n\n      if (!reservationId) {\n        return Response.json({ message: 'reservationId is required' }, { status: 400 })\n      }\n\n      // Fetch the reservation to check ownership / token.\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      const existing = await (req.payload.findByID as any)({\n        id: reservationId,\n        collection: config.slugs.reservations,\n        depth: 0,\n        overrideAccess: true,\n        req,\n      })\n\n      if (req.user) {\n        // Authenticated path: owner (customer === req.user) or admin/staff.\n        const customerId =\n          typeof existing.customer === 'object' ? existing.customer?.id : existing.customer\n        const isOwner = customerId === req.user.id\n        // Staff/admin detection (role-aware for single-collection deployments)\n        const isAdmin = isPrivilegedUser(req.user, config)\n        if (!isOwner && !isAdmin) {\n          return Response.json({ message: 'Forbidden' }, { status: 403 })\n        }\n      } else {\n        // Guest path: match the cancellation token.\n        if (!token || !existing.cancellationToken || token !== existing.cancellationToken) {\n          return Response.json({ message: 'Forbidden' }, { status: 403 })\n        }\n      }\n\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      const reservation = await (req.payload.update as any)({\n        id: reservationId,\n        collection: config.slugs.reservations,\n        data: {\n          cancellationReason: reason,\n          status: 'cancelled',\n        },\n        // Authorization (owner / admin / matching token) is already enforced above.\n        // overrideAccess lets the write proceed for anonymous guest cancellations,\n        // and avoids a spurious 500 when resourceOwnerMode restricts update access.\n        overrideAccess: true,\n        req,\n      })\n\n      // Strip the cancellation token from the response, consistent with the book\n      // endpoint — it must never be echoed back over HTTP.\n      const { cancellationToken: _cancellationToken, ...safeReservation } =\n        reservation as Record<string, unknown>\n\n      return Response.json(safeReservation)\n    },\n    method: 'post',\n    path: '/reserve/cancel',\n  }\n}\n"],"names":["isPrivilegedUser","createCancelBookingEndpoint","config","handler","req","body","json","reason","reservationId","token","Response","message","status","existing","payload","findByID","id","collection","slugs","reservations","depth","overrideAccess","user","customerId","customer","isOwner","isAdmin","cancellationToken","reservation","update","data","cancellationReason","_cancellationToken","safeReservation","method","path"],"mappings":"AAIA,SAASA,gBAAgB,QAAQ,4BAA2B;AAE5D,OAAO,SAASC,4BAA4BC,MAAuC;IACjF,OAAO;QACLC,SAAS,OAAOC;YACd,MAAMC,OAAO,MAAMD,IAAIE,IAAI;YAC3B,MAAM,EAAEC,MAAM,EAAEC,aAAa,EAAEC,KAAK,EAAE,GAAIJ,QAAQ,CAAC;YAMnD,IAAI,CAACG,eAAe;gBAClB,OAAOE,SAASJ,IAAI,CAAC;oBAAEK,SAAS;gBAA4B,GAAG;oBAAEC,QAAQ;gBAAI;YAC/E;YAEA,oDAAoD;YACpD,8DAA8D;YAC9D,MAAMC,WAAW,MAAM,AAACT,IAAIU,OAAO,CAACC,QAAQ,CAAS;gBACnDC,IAAIR;gBACJS,YAAYf,OAAOgB,KAAK,CAACC,YAAY;gBACrCC,OAAO;gBACPC,gBAAgB;gBAChBjB;YACF;YAEA,IAAIA,IAAIkB,IAAI,EAAE;gBACZ,oEAAoE;gBACpE,MAAMC,aACJ,OAAOV,SAASW,QAAQ,KAAK,WAAWX,SAASW,QAAQ,EAAER,KAAKH,SAASW,QAAQ;gBACnF,MAAMC,UAAUF,eAAenB,IAAIkB,IAAI,CAACN,EAAE;gBAC1C,uEAAuE;gBACvE,MAAMU,UAAU1B,iBAAiBI,IAAIkB,IAAI,EAAEpB;gBAC3C,IAAI,CAACuB,WAAW,CAACC,SAAS;oBACxB,OAAOhB,SAASJ,IAAI,CAAC;wBAAEK,SAAS;oBAAY,GAAG;wBAAEC,QAAQ;oBAAI;gBAC/D;YACF,OAAO;gBACL,4CAA4C;gBAC5C,IAAI,CAACH,SAAS,CAACI,SAASc,iBAAiB,IAAIlB,UAAUI,SAASc,iBAAiB,EAAE;oBACjF,OAAOjB,SAASJ,IAAI,CAAC;wBAAEK,SAAS;oBAAY,GAAG;wBAAEC,QAAQ;oBAAI;gBAC/D;YACF;YAEA,8DAA8D;YAC9D,MAAMgB,cAAc,MAAM,AAACxB,IAAIU,OAAO,CAACe,MAAM,CAAS;gBACpDb,IAAIR;gBACJS,YAAYf,OAAOgB,KAAK,CAACC,YAAY;gBACrCW,MAAM;oBACJC,oBAAoBxB;oBACpBK,QAAQ;gBACV;gBACA,4EAA4E;gBAC5E,2EAA2E;gBAC3E,4EAA4E;gBAC5ES,gBAAgB;gBAChBjB;YACF;YAEA,2EAA2E;YAC3E,qDAAqD;YACrD,MAAM,EAAEuB,mBAAmBK,kBAAkB,EAAE,GAAGC,iBAAiB,GACjEL;YAEF,OAAOlB,SAASJ,IAAI,CAAC2B;QACvB;QACAC,QAAQ;QACRC,MAAM;IACR;AACF"}

package/dist/endpoints/checkAvailability.js

@@ -1,4 +1,5 @@
 import { getAvailableSlots } from '../services/AvailabilityService.js';
+import { extractId, mergeResourceIds } from '../utilities/resolveRequiredResources.js';
 export function createCheckAvailabilityEndpoint(config) {
     return {
         handler: async (req)=>{
@@ -22,6 +23,20 @@ export function createCheckAvailabilityEndpoint(config) {
                 });
             }
             const guestCount = Math.max(Number(url.searchParams.get('guestCount') ?? '1'), 1);
+            // Resolve required resource set: caller resource(s) ∪ service.requiredResources
+            const explicit = url.searchParams.get('resources');
+            const callerIds = explicit ? explicit.split(',').map((s)=>s.trim()).filter(Boolean) : [
+                resource
+            ];
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const svcDoc = await req.payload.findByID({
+                id: service,
+                collection: config.slugs.services,
+                depth: 0,
+                req
+            });
+            const requiredIds = (svcDoc?.requiredResources ?? []).map((r)=>extractId(r)).filter((r)=>r !== undefined);
+            const resourceIds = mergeResourceIds(callerIds, requiredIds);
             const slots = await getAvailableSlots({
                 blockingStatuses: config.statusMachine.blockingStatuses,
                 date: parsedDate,
@@ -29,7 +44,7 @@ export function createCheckAvailabilityEndpoint(config) {
                 payload: req.payload,
                 req,
                 reservationSlug: config.slugs.reservations,
-                resourceId: resource,
+                resourceIds,
                 resourceSlug: config.slugs.resources,
                 scheduleSlug: config.slugs.schedules,
                 serviceId: service,

package/dist/endpoints/checkAvailability.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/endpoints/checkAvailability.ts"],"sourcesContent":["import type { Endpoint } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../types.js'\n\nimport { getAvailableSlots } from '../services/AvailabilityService.js'\n\nexport function createCheckAvailabilityEndpoint(\n  config: ResolvedReservationPluginConfig,\n): Endpoint {\n  return {\n    handler: async (req) => {\n      const url = new URL(req.url!)\n      const date = url.searchParams.get('date')\n      const resource = url.searchParams.get('resource')\n      const service = url.searchParams.get('service')\n\n      if (!date || !resource || !service) {\n        return Response.json(\n          { message: 'Missing required query params: resource, date, service' },\n          { status: 400 },\n        )\n      }\n\n      const parsedDate = new Date(date)\n      if (isNaN(parsedDate.getTime())) {\n        return Response.json(\n          { error: 'Invalid date format. Expected YYYY-MM-DD' },\n          { status: 400 },\n        )\n      }\n\n      const guestCount = Math.max(Number(url.searchParams.get('guestCount') ?? '1'), 1)\n\n      const slots = await getAvailableSlots({\n        blockingStatuses: config.statusMachine.blockingStatuses,\n        date: parsedDate,\n        guestCount,\n        payload: req.payload,\n        req,\n        reservationSlug: config.slugs.reservations,\n        resourceId: resource,\n        resourceSlug: config.slugs.resources,\n        scheduleSlug: config.slugs.schedules,\n        serviceId: service,\n        serviceSlug: config.slugs.services,\n      })\n\n      return Response.json({ slots })\n    },\n    method: 'get',\n    path: '/reserve/availability',\n  }\n}\n"],"names":["getAvailableSlots","createCheckAvailabilityEndpoint","config","handler","req","url","URL","date","searchParams","get","resource","service","Response","json","message","status","parsedDate","Date","isNaN","getTime","error","guestCount","Math","max","Number","slots","blockingStatuses","statusMachine","payload","reservationSlug","slugs","reservations","resourceId","resourceSlug","resources","scheduleSlug","schedules","serviceId","serviceSlug","services","method","path"],"mappings":"AAIA,SAASA,iBAAiB,QAAQ,qCAAoC;AAEtE,OAAO,SAASC,gCACdC,MAAuC;IAEvC,OAAO;QACLC,SAAS,OAAOC;YACd,MAAMC,MAAM,IAAIC,IAAIF,IAAIC,GAAG;YAC3B,MAAME,OAAOF,IAAIG,YAAY,CAACC,GAAG,CAAC;YAClC,MAAMC,WAAWL,IAAIG,YAAY,CAACC,GAAG,CAAC;YACtC,MAAME,UAAUN,IAAIG,YAAY,CAACC,GAAG,CAAC;YAErC,IAAI,CAACF,QAAQ,CAACG,YAAY,CAACC,SAAS;gBAClC,OAAOC,SAASC,IAAI,CAClB;oBAAEC,SAAS;gBAAyD,GACpE;oBAAEC,QAAQ;gBAAI;YAElB;YAEA,MAAMC,aAAa,IAAIC,KAAKV;YAC5B,IAAIW,MAAMF,WAAWG,OAAO,KAAK;gBAC/B,OAAOP,SAASC,IAAI,CAClB;oBAAEO,OAAO;gBAA2C,GACpD;oBAAEL,QAAQ;gBAAI;YAElB;YAEA,MAAMM,aAAaC,KAAKC,GAAG,CAACC,OAAOnB,IAAIG,YAAY,CAACC,GAAG,CAAC,iBAAiB,MAAM;YAE/E,MAAMgB,QAAQ,MAAMzB,kBAAkB;gBACpC0B,kBAAkBxB,OAAOyB,aAAa,CAACD,gBAAgB;gBACvDnB,MAAMS;gBACNK;gBACAO,SAASxB,IAAIwB,OAAO;gBACpBxB;gBACAyB,iBAAiB3B,OAAO4B,KAAK,CAACC,YAAY;gBAC1CC,YAAYtB;gBACZuB,cAAc/B,OAAO4B,KAAK,CAACI,SAAS;gBACpCC,cAAcjC,OAAO4B,KAAK,CAACM,SAAS;gBACpCC,WAAW1B;gBACX2B,aAAapC,OAAO4B,KAAK,CAACS,QAAQ;YACpC;YAEA,OAAO3B,SAASC,IAAI,CAAC;gBAAEY;YAAM;QAC/B;QACAe,QAAQ;QACRC,MAAM;IACR;AACF"}
+{"version":3,"sources":["../../src/endpoints/checkAvailability.ts"],"sourcesContent":["import type { Endpoint } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../types.js'\n\nimport { getAvailableSlots } from '../services/AvailabilityService.js'\nimport { extractId, mergeResourceIds } from '../utilities/resolveRequiredResources.js'\n\nexport function createCheckAvailabilityEndpoint(\n  config: ResolvedReservationPluginConfig,\n): Endpoint {\n  return {\n    handler: async (req) => {\n      const url = new URL(req.url!)\n      const date = url.searchParams.get('date')\n      const resource = url.searchParams.get('resource')\n      const service = url.searchParams.get('service')\n\n      if (!date || !resource || !service) {\n        return Response.json(\n          { message: 'Missing required query params: resource, date, service' },\n          { status: 400 },\n        )\n      }\n\n      const parsedDate = new Date(date)\n      if (isNaN(parsedDate.getTime())) {\n        return Response.json(\n          { error: 'Invalid date format. Expected YYYY-MM-DD' },\n          { status: 400 },\n        )\n      }\n\n      const guestCount = Math.max(Number(url.searchParams.get('guestCount') ?? '1'), 1)\n\n      // Resolve required resource set: caller resource(s) ∪ service.requiredResources\n      const explicit = url.searchParams.get('resources')\n      const callerIds = explicit ? explicit.split(',').map((s) => s.trim()).filter(Boolean) : [resource]\n\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      const svcDoc = await (req.payload.findByID as any)({\n        id: service,\n        collection: config.slugs.services,\n        depth: 0,\n        req,\n      })\n      const requiredIds = ((svcDoc?.requiredResources as unknown[]) ?? [])\n        .map((r) => extractId(r))\n        .filter((r): r is number | string => r !== undefined)\n      const resourceIds = mergeResourceIds(callerIds, requiredIds)\n\n      const slots = await getAvailableSlots({\n        blockingStatuses: config.statusMachine.blockingStatuses,\n        date: parsedDate,\n        guestCount,\n        payload: req.payload,\n        req,\n        reservationSlug: config.slugs.reservations,\n        resourceIds,\n        resourceSlug: config.slugs.resources,\n        scheduleSlug: config.slugs.schedules,\n        serviceId: service,\n        serviceSlug: config.slugs.services,\n      })\n\n      return Response.json({ slots })\n    },\n    method: 'get',\n    path: '/reserve/availability',\n  }\n}\n"],"names":["getAvailableSlots","extractId","mergeResourceIds","createCheckAvailabilityEndpoint","config","handler","req","url","URL","date","searchParams","get","resource","service","Response","json","message","status","parsedDate","Date","isNaN","getTime","error","guestCount","Math","max","Number","explicit","callerIds","split","map","s","trim","filter","Boolean","svcDoc","payload","findByID","id","collection","slugs","services","depth","requiredIds","requiredResources","r","undefined","resourceIds","slots","blockingStatuses","statusMachine","reservationSlug","reservations","resourceSlug","resources","scheduleSlug","schedules","serviceId","serviceSlug","method","path"],"mappings":"AAIA,SAASA,iBAAiB,QAAQ,qCAAoC;AACtE,SAASC,SAAS,EAAEC,gBAAgB,QAAQ,2CAA0C;AAEtF,OAAO,SAASC,gCACdC,MAAuC;IAEvC,OAAO;QACLC,SAAS,OAAOC;YACd,MAAMC,MAAM,IAAIC,IAAIF,IAAIC,GAAG;YAC3B,MAAME,OAAOF,IAAIG,YAAY,CAACC,GAAG,CAAC;YAClC,MAAMC,WAAWL,IAAIG,YAAY,CAACC,GAAG,CAAC;YACtC,MAAME,UAAUN,IAAIG,YAAY,CAACC,GAAG,CAAC;YAErC,IAAI,CAACF,QAAQ,CAACG,YAAY,CAACC,SAAS;gBAClC,OAAOC,SAASC,IAAI,CAClB;oBAAEC,SAAS;gBAAyD,GACpE;oBAAEC,QAAQ;gBAAI;YAElB;YAEA,MAAMC,aAAa,IAAIC,KAAKV;YAC5B,IAAIW,MAAMF,WAAWG,OAAO,KAAK;gBAC/B,OAAOP,SAASC,IAAI,CAClB;oBAAEO,OAAO;gBAA2C,GACpD;oBAAEL,QAAQ;gBAAI;YAElB;YAEA,MAAMM,aAAaC,KAAKC,GAAG,CAACC,OAAOnB,IAAIG,YAAY,CAACC,GAAG,CAAC,iBAAiB,MAAM;YAE/E,gFAAgF;YAChF,MAAMgB,WAAWpB,IAAIG,YAAY,CAACC,GAAG,CAAC;YACtC,MAAMiB,YAAYD,WAAWA,SAASE,KAAK,CAAC,KAAKC,GAAG,CAAC,CAACC,IAAMA,EAAEC,IAAI,IAAIC,MAAM,CAACC,WAAW;gBAACtB;aAAS;YAElG,8DAA8D;YAC9D,MAAMuB,SAAS,MAAM,AAAC7B,IAAI8B,OAAO,CAACC,QAAQ,CAAS;gBACjDC,IAAIzB;gBACJ0B,YAAYnC,OAAOoC,KAAK,CAACC,QAAQ;gBACjCC,OAAO;gBACPpC;YACF;YACA,MAAMqC,cAAc,AAAC,CAAA,AAACR,QAAQS,qBAAmC,EAAE,AAAD,EAC/Dd,GAAG,CAAC,CAACe,IAAM5C,UAAU4C,IACrBZ,MAAM,CAAC,CAACY,IAA4BA,MAAMC;YAC7C,MAAMC,cAAc7C,iBAAiB0B,WAAWe;YAEhD,MAAMK,QAAQ,MAAMhD,kBAAkB;gBACpCiD,kBAAkB7C,OAAO8C,aAAa,CAACD,gBAAgB;gBACvDxC,MAAMS;gBACNK;gBACAa,SAAS9B,IAAI8B,OAAO;gBACpB9B;gBACA6C,iBAAiB/C,OAAOoC,KAAK,CAACY,YAAY;gBAC1CL;gBACAM,cAAcjD,OAAOoC,KAAK,CAACc,SAAS;gBACpCC,cAAcnD,OAAOoC,KAAK,CAACgB,SAAS;gBACpCC,WAAW5C;gBACX6C,aAAatD,OAAOoC,KAAK,CAACC,QAAQ;YACpC;YAEA,OAAO3B,SAASC,IAAI,CAAC;gBAAEiC;YAAM;QAC/B;QACAW,QAAQ;QACRC,MAAM;IACR;AACF"}

package/dist/endpoints/createBooking.js

@@ -20,7 +20,10 @@ export function createBookingEndpoint(config) {
                 data: bookingData,
                 req
             });
-            return Response.json(reservation, {
+            // Never expose the cancellation token in the HTTP response — it is delivered
+            // to the guest by the host project via the afterBookingCreate hook.
+            const { cancellationToken: _cancellationToken, ...safeReservation } = reservation;
+            return Response.json(safeReservation, {
                 status: 201
             });
         },

package/dist/endpoints/createBooking.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/endpoints/createBooking.ts"],"sourcesContent":["import type { Endpoint } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../types.js'\n\nexport function createBookingEndpoint(config: ResolvedReservationPluginConfig): Endpoint {\n  return {\n    handler: async (req) => {\n      const data = (await req.json?.()) as Record<string, unknown>\n\n      // Call beforeBookingCreate plugin hooks before creating the reservation\n      let bookingData = data\n      if (config.hooks?.beforeBookingCreate) {\n        for (const hook of config.hooks.beforeBookingCreate) {\n          bookingData = (await hook({ data: bookingData, req })) ?? bookingData\n        }\n      }\n\n      // Create via Payload Local API — collection hooks handle conflict detection,\n      // endTime calculation, and status transitions\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      const reservation = await (req.payload.create as any)({\n        collection: config.slugs.reservations,\n        data: bookingData,\n        req,\n      })\n\n      return Response.json(reservation, { status: 201 })\n    },\n    method: 'post',\n    path: '/reserve/book',\n  }\n}\n"],"names":["createBookingEndpoint","config","handler","req","data","json","bookingData","hooks","beforeBookingCreate","hook","reservation","payload","create","collection","slugs","reservations","Response","status","method","path"],"mappings":"AAIA,OAAO,SAASA,sBAAsBC,MAAuC;IAC3E,OAAO;QACLC,SAAS,OAAOC;YACd,MAAMC,OAAQ,MAAMD,IAAIE,IAAI;YAE5B,wEAAwE;YACxE,IAAIC,cAAcF;YAClB,IAAIH,OAAOM,KAAK,EAAEC,qBAAqB;gBACrC,KAAK,MAAMC,QAAQR,OAAOM,KAAK,CAACC,mBAAmB,CAAE;oBACnDF,cAAc,AAAC,MAAMG,KAAK;wBAAEL,MAAME;wBAAaH;oBAAI,MAAOG;gBAC5D;YACF;YAEA,6EAA6E;YAC7E,8CAA8C;YAC9C,8DAA8D;YAC9D,MAAMI,cAAc,MAAM,AAACP,IAAIQ,OAAO,CAACC,MAAM,CAAS;gBACpDC,YAAYZ,OAAOa,KAAK,CAACC,YAAY;gBACrCX,MAAME;gBACNH;YACF;YAEA,OAAOa,SAASX,IAAI,CAACK,aAAa;gBAAEO,QAAQ;YAAI;QAClD;QACAC,QAAQ;QACRC,MAAM;IACR;AACF"}
+{"version":3,"sources":["../../src/endpoints/createBooking.ts"],"sourcesContent":["import type { Endpoint } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../types.js'\n\nexport function createBookingEndpoint(config: ResolvedReservationPluginConfig): Endpoint {\n  return {\n    handler: async (req) => {\n      const data = (await req.json?.()) as Record<string, unknown>\n\n      // Call beforeBookingCreate plugin hooks before creating the reservation\n      let bookingData = data\n      if (config.hooks?.beforeBookingCreate) {\n        for (const hook of config.hooks.beforeBookingCreate) {\n          bookingData = (await hook({ data: bookingData, req })) ?? bookingData\n        }\n      }\n\n      // Create via Payload Local API — collection hooks handle conflict detection,\n      // endTime calculation, and status transitions\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      const reservation = await (req.payload.create as any)({\n        collection: config.slugs.reservations,\n        data: bookingData,\n        req,\n      })\n\n      // Never expose the cancellation token in the HTTP response — it is delivered\n      // to the guest by the host project via the afterBookingCreate hook.\n      const { cancellationToken: _cancellationToken, ...safeReservation } =\n        reservation as Record<string, unknown>\n\n      return Response.json(safeReservation, { status: 201 })\n    },\n    method: 'post',\n    path: '/reserve/book',\n  }\n}\n"],"names":["createBookingEndpoint","config","handler","req","data","json","bookingData","hooks","beforeBookingCreate","hook","reservation","payload","create","collection","slugs","reservations","cancellationToken","_cancellationToken","safeReservation","Response","status","method","path"],"mappings":"AAIA,OAAO,SAASA,sBAAsBC,MAAuC;IAC3E,OAAO;QACLC,SAAS,OAAOC;YACd,MAAMC,OAAQ,MAAMD,IAAIE,IAAI;YAE5B,wEAAwE;YACxE,IAAIC,cAAcF;YAClB,IAAIH,OAAOM,KAAK,EAAEC,qBAAqB;gBACrC,KAAK,MAAMC,QAAQR,OAAOM,KAAK,CAACC,mBAAmB,CAAE;oBACnDF,cAAc,AAAC,MAAMG,KAAK;wBAAEL,MAAME;wBAAaH;oBAAI,MAAOG;gBAC5D;YACF;YAEA,6EAA6E;YAC7E,8CAA8C;YAC9C,8DAA8D;YAC9D,MAAMI,cAAc,MAAM,AAACP,IAAIQ,OAAO,CAACC,MAAM,CAAS;gBACpDC,YAAYZ,OAAOa,KAAK,CAACC,YAAY;gBACrCX,MAAME;gBACNH;YACF;YAEA,6EAA6E;YAC7E,oEAAoE;YACpE,MAAM,EAAEa,mBAAmBC,kBAAkB,EAAE,GAAGC,iBAAiB,GACjER;YAEF,OAAOS,SAASd,IAAI,CAACa,iBAAiB;gBAAEE,QAAQ;YAAI;QACtD;QACAC,QAAQ;QACRC,MAAM;IACR;AACF"}

package/dist/endpoints/customerSearch.js

@@ -1,3 +1,4 @@
+import { isPrivilegedUser, privilegedRoles } from '../utilities/userRoles.js';
 /**
  * Inspect a collection's field list and return the set of top-level named
  * fields as a plain Set<string>. Unnamed fields (rows, groups without a name,
@@ -21,8 +22,9 @@ export function createCustomerSearchEndpoint(config) {
                     status: 401
                 });
             }
-            // Only allow staff/admin users (non-customer collection) to search customers
-            if (req.user.collection === config.slugs.customers) {
+            // Only staff/admin may search customers. Role-aware so it works when staff
+            // and customers share one auth collection (userCollection set).
+            if (!isPrivilegedUser(req.user, config)) {
                 return Response.json({
                     message: 'Forbidden'
                 }, {
@@ -40,7 +42,7 @@ export function createCustomerSearchEndpoint(config) {
             const hasFirstName = availableFields.has('firstName');
             const hasLastName = availableFields.has('lastName');
             const hasPhone = availableFields.has('phone');
-            let where = {};
+            const andClauses = [];
             if (search) {
                 const orClauses = [];
                 if (hasName) {
@@ -77,10 +79,27 @@ export function createCustomerSearchEndpoint(config) {
                         }
                     });
                 }
-                where = {
+                andClauses.push({
                     or: orClauses
-                };
+                });
+            }
+            // Single-collection mode: staff/admin live in the same collection as
+            // customers, so exclude privileged roles — the dropdown should list only
+            // actual customers, not bookable-looking staff.
+            if (config.userCollection) {
+                const roleField = config.staffProvisioning?.roleField ?? 'role';
+                const priv = privilegedRoles(config);
+                if (priv.length > 0) {
+                    andClauses.push({
+                        [roleField]: {
+                            not_in: priv
+                        }
+                    });
+                }
             }
+            const where = andClauses.length === 0 ? {} : andClauses.length === 1 ? andClauses[0] : {
+                and: andClauses
+            };
             // eslint-disable-next-line @typescript-eslint/no-explicit-any
             const result = await req.payload.find({
                 collection: config.slugs.customers,

package/dist/endpoints/customerSearch.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/endpoints/customerSearch.ts"],"sourcesContent":["import type { CollectionSlug, Endpoint, Field, Where } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../types.js'\n\n/**\n * Inspect a collection's field list and return the set of top-level named\n * fields as a plain Set<string>. Unnamed fields (rows, groups without a name,\n * etc.) are skipped.\n */\nfunction getNamedFields(fields: Field[]): Set<string> {\n  const names = new Set<string>()\n  for (const field of fields) {\n    if ('name' in field) {\n      names.add(field.name)\n    }\n  }\n  return names\n}\n\nexport function createCustomerSearchEndpoint(\n  config: ResolvedReservationPluginConfig,\n): Endpoint {\n  return {\n    handler: async (req) => {\n      if (!req.user) {\n        return Response.json({ message: 'Unauthorized' }, { status: 401 })\n      }\n\n      // Only allow staff/admin users (non-customer collection) to search customers\n      if (req.user.collection === config.slugs.customers) {\n        return Response.json({ message: 'Forbidden' }, { status: 403 })\n      }\n\n      const url = new URL(req.url!)\n      const search = url.searchParams.get('search') ?? ''\n      const limit = Math.min(Number(url.searchParams.get('limit') ?? '10'), 50)\n      const page = Math.max(Number(url.searchParams.get('page') ?? '1'), 1)\n\n      // Detect which fields exist on the target collection at runtime\n      const collectionConfig = req.payload.collections[config.slugs.customers as unknown as CollectionSlug]?.config\n      const availableFields: Set<string> = collectionConfig\n        ? getNamedFields(collectionConfig.fields)\n        : new Set()\n\n      const hasName = availableFields.has('name')\n      const hasFirstName = availableFields.has('firstName')\n      const hasLastName = availableFields.has('lastName')\n      const hasPhone = availableFields.has('phone')\n\n      let where: Where = {}\n\n      if (search) {\n        const orClauses: Where[] = []\n\n        if (hasName) {\n          orClauses.push({ name: { contains: search } })\n        }\n        if (hasFirstName) {\n          orClauses.push({ firstName: { contains: search } })\n        }\n        if (hasLastName) {\n          orClauses.push({ lastName: { contains: search } })\n        }\n        // email is always present on auth collections\n        orClauses.push({ email: { contains: search } })\n        if (hasPhone) {\n          orClauses.push({ phone: { contains: search } })\n        }\n\n        where = { or: orClauses }\n      }\n\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      const result = await (req.payload.find as any)({\n        collection: config.slugs.customers,\n        limit,\n        page,\n        where,\n      })\n\n      return Response.json({\n        docs: (result.docs as Record<string, unknown>[]).map((doc) => {\n          const entry: Record<string, unknown> = {\n            id: doc['id'],\n            email: doc['email'] ?? '',\n          }\n\n          if (hasName) {\n            entry['name'] = doc['name'] ?? ''\n          }\n          if (hasFirstName) {\n            entry['firstName'] = doc['firstName'] ?? ''\n          }\n          if (hasLastName) {\n            entry['lastName'] = doc['lastName'] ?? ''\n          }\n          if (hasPhone) {\n            entry['phone'] = doc['phone'] ?? ''\n          }\n\n          return entry\n        }),\n        hasNextPage: result.hasNextPage,\n        totalDocs: result.totalDocs,\n      })\n    },\n    method: 'get',\n    path: '/reservation-customer-search',\n  }\n}\n"],"names":["getNamedFields","fields","names","Set","field","add","name","createCustomerSearchEndpoint","config","handler","req","user","Response","json","message","status","collection","slugs","customers","url","URL","search","searchParams","get","limit","Math","min","Number","page","max","collectionConfig","payload","collections","availableFields","hasName","has","hasFirstName","hasLastName","hasPhone","where","orClauses","push","contains","firstName","lastName","email","phone","or","result","find","docs","map","doc","entry","id","hasNextPage","totalDocs","method","path"],"mappings":"AAIA;;;;CAIC,GACD,SAASA,eAAeC,MAAe;IACrC,MAAMC,QAAQ,IAAIC;IAClB,KAAK,MAAMC,SAASH,OAAQ;QAC1B,IAAI,UAAUG,OAAO;YACnBF,MAAMG,GAAG,CAACD,MAAME,IAAI;QACtB;IACF;IACA,OAAOJ;AACT;AAEA,OAAO,SAASK,6BACdC,MAAuC;IAEvC,OAAO;QACLC,SAAS,OAAOC;YACd,IAAI,CAACA,IAAIC,IAAI,EAAE;gBACb,OAAOC,SAASC,IAAI,CAAC;oBAAEC,SAAS;gBAAe,GAAG;oBAAEC,QAAQ;gBAAI;YAClE;YAEA,6EAA6E;YAC7E,IAAIL,IAAIC,IAAI,CAACK,UAAU,KAAKR,OAAOS,KAAK,CAACC,SAAS,EAAE;gBAClD,OAAON,SAASC,IAAI,CAAC;oBAAEC,SAAS;gBAAY,GAAG;oBAAEC,QAAQ;gBAAI;YAC/D;YAEA,MAAMI,MAAM,IAAIC,IAAIV,IAAIS,GAAG;YAC3B,MAAME,SAASF,IAAIG,YAAY,CAACC,GAAG,CAAC,aAAa;YACjD,MAAMC,QAAQC,KAAKC,GAAG,CAACC,OAAOR,IAAIG,YAAY,CAACC,GAAG,CAAC,YAAY,OAAO;YACtE,MAAMK,OAAOH,KAAKI,GAAG,CAACF,OAAOR,IAAIG,YAAY,CAACC,GAAG,CAAC,WAAW,MAAM;YAEnE,gEAAgE;YAChE,MAAMO,mBAAmBpB,IAAIqB,OAAO,CAACC,WAAW,CAACxB,OAAOS,KAAK,CAACC,SAAS,CAA8B,EAAEV;YACvG,MAAMyB,kBAA+BH,mBACjC9B,eAAe8B,iBAAiB7B,MAAM,IACtC,IAAIE;YAER,MAAM+B,UAAUD,gBAAgBE,GAAG,CAAC;YACpC,MAAMC,eAAeH,gBAAgBE,GAAG,CAAC;YACzC,MAAME,cAAcJ,gBAAgBE,GAAG,CAAC;YACxC,MAAMG,WAAWL,gBAAgBE,GAAG,CAAC;YAErC,IAAII,QAAe,CAAC;YAEpB,IAAIlB,QAAQ;gBACV,MAAMmB,YAAqB,EAAE;gBAE7B,IAAIN,SAAS;oBACXM,UAAUC,IAAI,CAAC;wBAAEnC,MAAM;4BAAEoC,UAAUrB;wBAAO;oBAAE;gBAC9C;gBACA,IAAIe,cAAc;oBAChBI,UAAUC,IAAI,CAAC;wBAAEE,WAAW;4BAAED,UAAUrB;wBAAO;oBAAE;gBACnD;gBACA,IAAIgB,aAAa;oBACfG,UAAUC,IAAI,CAAC;wBAAEG,UAAU;4BAAEF,UAAUrB;wBAAO;oBAAE;gBAClD;gBACA,8CAA8C;gBAC9CmB,UAAUC,IAAI,CAAC;oBAAEI,OAAO;wBAAEH,UAAUrB;oBAAO;gBAAE;gBAC7C,IAAIiB,UAAU;oBACZE,UAAUC,IAAI,CAAC;wBAAEK,OAAO;4BAAEJ,UAAUrB;wBAAO;oBAAE;gBAC/C;gBAEAkB,QAAQ;oBAAEQ,IAAIP;gBAAU;YAC1B;YAEA,8DAA8D;YAC9D,MAAMQ,SAAS,MAAM,AAACtC,IAAIqB,OAAO,CAACkB,IAAI,CAAS;gBAC7CjC,YAAYR,OAAOS,KAAK,CAACC,SAAS;gBAClCM;gBACAI;gBACAW;YACF;YAEA,OAAO3B,SAASC,IAAI,CAAC;gBACnBqC,MAAM,AAACF,OAAOE,IAAI,CAA+BC,GAAG,CAAC,CAACC;oBACpD,MAAMC,QAAiC;wBACrCC,IAAIF,GAAG,CAAC,KAAK;wBACbP,OAAOO,GAAG,CAAC,QAAQ,IAAI;oBACzB;oBAEA,IAAIlB,SAAS;wBACXmB,KAAK,CAAC,OAAO,GAAGD,GAAG,CAAC,OAAO,IAAI;oBACjC;oBACA,IAAIhB,cAAc;wBAChBiB,KAAK,CAAC,YAAY,GAAGD,GAAG,CAAC,YAAY,IAAI;oBAC3C;oBACA,IAAIf,aAAa;wBACfgB,KAAK,CAAC,WAAW,GAAGD,GAAG,CAAC,WAAW,IAAI;oBACzC;oBACA,IAAId,UAAU;wBACZe,KAAK,CAAC,QAAQ,GAAGD,GAAG,CAAC,QAAQ,IAAI;oBACnC;oBAEA,OAAOC;gBACT;gBACAE,aAAaP,OAAOO,WAAW;gBAC/BC,WAAWR,OAAOQ,SAAS;YAC7B;QACF;QACAC,QAAQ;QACRC,MAAM;IACR;AACF"}
+{"version":3,"sources":["../../src/endpoints/customerSearch.ts"],"sourcesContent":["import type { CollectionSlug, Endpoint, Field, Where } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../types.js'\n\nimport { isPrivilegedUser, privilegedRoles } from '../utilities/userRoles.js'\n\n/**\n * Inspect a collection's field list and return the set of top-level named\n * fields as a plain Set<string>. Unnamed fields (rows, groups without a name,\n * etc.) are skipped.\n */\nfunction getNamedFields(fields: Field[]): Set<string> {\n  const names = new Set<string>()\n  for (const field of fields) {\n    if ('name' in field) {\n      names.add(field.name)\n    }\n  }\n  return names\n}\n\nexport function createCustomerSearchEndpoint(\n  config: ResolvedReservationPluginConfig,\n): Endpoint {\n  return {\n    handler: async (req) => {\n      if (!req.user) {\n        return Response.json({ message: 'Unauthorized' }, { status: 401 })\n      }\n\n      // Only staff/admin may search customers. Role-aware so it works when staff\n      // and customers share one auth collection (userCollection set).\n      if (!isPrivilegedUser(req.user, config)) {\n        return Response.json({ message: 'Forbidden' }, { status: 403 })\n      }\n\n      const url = new URL(req.url!)\n      const search = url.searchParams.get('search') ?? ''\n      const limit = Math.min(Number(url.searchParams.get('limit') ?? '10'), 50)\n      const page = Math.max(Number(url.searchParams.get('page') ?? '1'), 1)\n\n      // Detect which fields exist on the target collection at runtime\n      const collectionConfig = req.payload.collections[config.slugs.customers as unknown as CollectionSlug]?.config\n      const availableFields: Set<string> = collectionConfig\n        ? getNamedFields(collectionConfig.fields)\n        : new Set()\n\n      const hasName = availableFields.has('name')\n      const hasFirstName = availableFields.has('firstName')\n      const hasLastName = availableFields.has('lastName')\n      const hasPhone = availableFields.has('phone')\n\n      const andClauses: Where[] = []\n\n      if (search) {\n        const orClauses: Where[] = []\n\n        if (hasName) {\n          orClauses.push({ name: { contains: search } })\n        }\n        if (hasFirstName) {\n          orClauses.push({ firstName: { contains: search } })\n        }\n        if (hasLastName) {\n          orClauses.push({ lastName: { contains: search } })\n        }\n        // email is always present on auth collections\n        orClauses.push({ email: { contains: search } })\n        if (hasPhone) {\n          orClauses.push({ phone: { contains: search } })\n        }\n\n        andClauses.push({ or: orClauses })\n      }\n\n      // Single-collection mode: staff/admin live in the same collection as\n      // customers, so exclude privileged roles — the dropdown should list only\n      // actual customers, not bookable-looking staff.\n      if (config.userCollection) {\n        const roleField = config.staffProvisioning?.roleField ?? 'role'\n        const priv = privilegedRoles(config)\n        if (priv.length > 0) {\n          andClauses.push({ [roleField]: { not_in: priv } })\n        }\n      }\n\n      const where: Where =\n        andClauses.length === 0\n          ? {}\n          : andClauses.length === 1\n            ? andClauses[0]\n            : { and: andClauses }\n\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      const result = await (req.payload.find as any)({\n        collection: config.slugs.customers,\n        limit,\n        page,\n        where,\n      })\n\n      return Response.json({\n        docs: (result.docs as Record<string, unknown>[]).map((doc) => {\n          const entry: Record<string, unknown> = {\n            id: doc['id'],\n            email: doc['email'] ?? '',\n          }\n\n          if (hasName) {\n            entry['name'] = doc['name'] ?? ''\n          }\n          if (hasFirstName) {\n            entry['firstName'] = doc['firstName'] ?? ''\n          }\n          if (hasLastName) {\n            entry['lastName'] = doc['lastName'] ?? ''\n          }\n          if (hasPhone) {\n            entry['phone'] = doc['phone'] ?? ''\n          }\n\n          return entry\n        }),\n        hasNextPage: result.hasNextPage,\n        totalDocs: result.totalDocs,\n      })\n    },\n    method: 'get',\n    path: '/reservation-customer-search',\n  }\n}\n"],"names":["isPrivilegedUser","privilegedRoles","getNamedFields","fields","names","Set","field","add","name","createCustomerSearchEndpoint","config","handler","req","user","Response","json","message","status","url","URL","search","searchParams","get","limit","Math","min","Number","page","max","collectionConfig","payload","collections","slugs","customers","availableFields","hasName","has","hasFirstName","hasLastName","hasPhone","andClauses","orClauses","push","contains","firstName","lastName","email","phone","or","userCollection","roleField","staffProvisioning","priv","length","not_in","where","and","result","find","collection","docs","map","doc","entry","id","hasNextPage","totalDocs","method","path"],"mappings":"AAIA,SAASA,gBAAgB,EAAEC,eAAe,QAAQ,4BAA2B;AAE7E;;;;CAIC,GACD,SAASC,eAAeC,MAAe;IACrC,MAAMC,QAAQ,IAAIC;IAClB,KAAK,MAAMC,SAASH,OAAQ;QAC1B,IAAI,UAAUG,OAAO;YACnBF,MAAMG,GAAG,CAACD,MAAME,IAAI;QACtB;IACF;IACA,OAAOJ;AACT;AAEA,OAAO,SAASK,6BACdC,MAAuC;IAEvC,OAAO;QACLC,SAAS,OAAOC;YACd,IAAI,CAACA,IAAIC,IAAI,EAAE;gBACb,OAAOC,SAASC,IAAI,CAAC;oBAAEC,SAAS;gBAAe,GAAG;oBAAEC,QAAQ;gBAAI;YAClE;YAEA,2EAA2E;YAC3E,gEAAgE;YAChE,IAAI,CAACjB,iBAAiBY,IAAIC,IAAI,EAAEH,SAAS;gBACvC,OAAOI,SAASC,IAAI,CAAC;oBAAEC,SAAS;gBAAY,GAAG;oBAAEC,QAAQ;gBAAI;YAC/D;YAEA,MAAMC,MAAM,IAAIC,IAAIP,IAAIM,GAAG;YAC3B,MAAME,SAASF,IAAIG,YAAY,CAACC,GAAG,CAAC,aAAa;YACjD,MAAMC,QAAQC,KAAKC,GAAG,CAACC,OAAOR,IAAIG,YAAY,CAACC,GAAG,CAAC,YAAY,OAAO;YACtE,MAAMK,OAAOH,KAAKI,GAAG,CAACF,OAAOR,IAAIG,YAAY,CAACC,GAAG,CAAC,WAAW,MAAM;YAEnE,gEAAgE;YAChE,MAAMO,mBAAmBjB,IAAIkB,OAAO,CAACC,WAAW,CAACrB,OAAOsB,KAAK,CAACC,SAAS,CAA8B,EAAEvB;YACvG,MAAMwB,kBAA+BL,mBACjC3B,eAAe2B,iBAAiB1B,MAAM,IACtC,IAAIE;YAER,MAAM8B,UAAUD,gBAAgBE,GAAG,CAAC;YACpC,MAAMC,eAAeH,gBAAgBE,GAAG,CAAC;YACzC,MAAME,cAAcJ,gBAAgBE,GAAG,CAAC;YACxC,MAAMG,WAAWL,gBAAgBE,GAAG,CAAC;YAErC,MAAMI,aAAsB,EAAE;YAE9B,IAAIpB,QAAQ;gBACV,MAAMqB,YAAqB,EAAE;gBAE7B,IAAIN,SAAS;oBACXM,UAAUC,IAAI,CAAC;wBAAElC,MAAM;4BAAEmC,UAAUvB;wBAAO;oBAAE;gBAC9C;gBACA,IAAIiB,cAAc;oBAChBI,UAAUC,IAAI,CAAC;wBAAEE,WAAW;4BAAED,UAAUvB;wBAAO;oBAAE;gBACnD;gBACA,IAAIkB,aAAa;oBACfG,UAAUC,IAAI,CAAC;wBAAEG,UAAU;4BAAEF,UAAUvB;wBAAO;oBAAE;gBAClD;gBACA,8CAA8C;gBAC9CqB,UAAUC,IAAI,CAAC;oBAAEI,OAAO;wBAAEH,UAAUvB;oBAAO;gBAAE;gBAC7C,IAAImB,UAAU;oBACZE,UAAUC,IAAI,CAAC;wBAAEK,OAAO;4BAAEJ,UAAUvB;wBAAO;oBAAE;gBAC/C;gBAEAoB,WAAWE,IAAI,CAAC;oBAAEM,IAAIP;gBAAU;YAClC;YAEA,qEAAqE;YACrE,yEAAyE;YACzE,gDAAgD;YAChD,IAAI/B,OAAOuC,cAAc,EAAE;gBACzB,MAAMC,YAAYxC,OAAOyC,iBAAiB,EAAED,aAAa;gBACzD,MAAME,OAAOnD,gBAAgBS;gBAC7B,IAAI0C,KAAKC,MAAM,GAAG,GAAG;oBACnBb,WAAWE,IAAI,CAAC;wBAAE,CAACQ,UAAU,EAAE;4BAAEI,QAAQF;wBAAK;oBAAE;gBAClD;YACF;YAEA,MAAMG,QACJf,WAAWa,MAAM,KAAK,IAClB,CAAC,IACDb,WAAWa,MAAM,KAAK,IACpBb,UAAU,CAAC,EAAE,GACb;gBAAEgB,KAAKhB;YAAW;YAE1B,8DAA8D;YAC9D,MAAMiB,SAAS,MAAM,AAAC7C,IAAIkB,OAAO,CAAC4B,IAAI,CAAS;gBAC7CC,YAAYjD,OAAOsB,KAAK,CAACC,SAAS;gBAClCV;gBACAI;gBACA4B;YACF;YAEA,OAAOzC,SAASC,IAAI,CAAC;gBACnB6C,MAAM,AAACH,OAAOG,IAAI,CAA+BC,GAAG,CAAC,CAACC;oBACpD,MAAMC,QAAiC;wBACrCC,IAAIF,GAAG,CAAC,KAAK;wBACbhB,OAAOgB,GAAG,CAAC,QAAQ,IAAI;oBACzB;oBAEA,IAAI3B,SAAS;wBACX4B,KAAK,CAAC,OAAO,GAAGD,GAAG,CAAC,OAAO,IAAI;oBACjC;oBACA,IAAIzB,cAAc;wBAChB0B,KAAK,CAAC,YAAY,GAAGD,GAAG,CAAC,YAAY,IAAI;oBAC3C;oBACA,IAAIxB,aAAa;wBACfyB,KAAK,CAAC,WAAW,GAAGD,GAAG,CAAC,WAAW,IAAI;oBACzC;oBACA,IAAIvB,UAAU;wBACZwB,KAAK,CAAC,QAAQ,GAAGD,GAAG,CAAC,QAAQ,IAAI;oBACnC;oBAEA,OAAOC;gBACT;gBACAE,aAAaR,OAAOQ,WAAW;gBAC/BC,WAAWT,OAAOS,SAAS;YAC7B;QACF;QACAC,QAAQ;QACRC,MAAM;IACR;AACF"}

package/dist/endpoints/getSlots.js

@@ -1,4 +1,5 @@
 import { getAvailableSlots } from '../services/AvailabilityService.js';
+import { extractId, mergeResourceIds } from '../utilities/resolveRequiredResources.js';
 export function createGetSlotsEndpoint(config) {
     return {
         handler: async (req)=>{
@@ -22,6 +23,20 @@ export function createGetSlotsEndpoint(config) {
                 });
             }
             const guestCount = Math.max(Number(url.searchParams.get('guestCount') ?? '1'), 1);
+            // Resolve required resource set: caller resource(s) ∪ service.requiredResources
+            const explicit = url.searchParams.get('resources');
+            const callerIds = explicit ? explicit.split(',').map((s)=>s.trim()).filter(Boolean) : [
+                resource
+            ];
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const svcDoc = await req.payload.findByID({
+                id: service,
+                collection: config.slugs.services,
+                depth: 0,
+                req
+            });
+            const requiredIds = (svcDoc?.requiredResources ?? []).map((r)=>extractId(r)).filter((r)=>r !== undefined);
+            const resourceIds = mergeResourceIds(callerIds, requiredIds);
             const slots = await getAvailableSlots({
                 blockingStatuses: config.statusMachine.blockingStatuses,
                 date: parsedDate,
@@ -29,7 +44,7 @@ export function createGetSlotsEndpoint(config) {
                 payload: req.payload,
                 req,
                 reservationSlug: config.slugs.reservations,
-                resourceId: resource,
+                resourceIds,
                 resourceSlug: config.slugs.resources,
                 scheduleSlug: config.slugs.schedules,
                 serviceId: service,

package/dist/endpoints/getSlots.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/endpoints/getSlots.ts"],"sourcesContent":["import type { Endpoint } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../types.js'\n\nimport { getAvailableSlots } from '../services/AvailabilityService.js'\n\nexport function createGetSlotsEndpoint(config: ResolvedReservationPluginConfig): Endpoint {\n  return {\n    handler: async (req) => {\n      const url = new URL(req.url!)\n      const date = url.searchParams.get('date')\n      const resource = url.searchParams.get('resource')\n      const service = url.searchParams.get('service')\n\n      if (!date || !resource || !service) {\n        return Response.json(\n          { error: 'Missing required query params: resource, date, service' },\n          { status: 400 },\n        )\n      }\n\n      const parsedDate = new Date(date)\n      if (isNaN(parsedDate.getTime())) {\n        return Response.json(\n          { error: 'Invalid date format. Expected YYYY-MM-DD' },\n          { status: 400 },\n        )\n      }\n\n      const guestCount = Math.max(Number(url.searchParams.get('guestCount') ?? '1'), 1)\n\n      const slots = await getAvailableSlots({\n        blockingStatuses: config.statusMachine.blockingStatuses,\n        date: parsedDate,\n        guestCount,\n        payload: req.payload,\n        req,\n        reservationSlug: config.slugs.reservations,\n        resourceId: resource,\n        resourceSlug: config.slugs.resources,\n        scheduleSlug: config.slugs.schedules,\n        serviceId: service,\n        serviceSlug: config.slugs.services,\n      })\n\n      return Response.json({\n        date,\n        guestCount,\n        slots: slots.map((s) => ({ end: s.end.toISOString(), start: s.start.toISOString() })),\n      })\n    },\n    method: 'get',\n    path: '/reserve/slots',\n  }\n}\n"],"names":["getAvailableSlots","createGetSlotsEndpoint","config","handler","req","url","URL","date","searchParams","get","resource","service","Response","json","error","status","parsedDate","Date","isNaN","getTime","guestCount","Math","max","Number","slots","blockingStatuses","statusMachine","payload","reservationSlug","slugs","reservations","resourceId","resourceSlug","resources","scheduleSlug","schedules","serviceId","serviceSlug","services","map","s","end","toISOString","start","method","path"],"mappings":"AAIA,SAASA,iBAAiB,QAAQ,qCAAoC;AAEtE,OAAO,SAASC,uBAAuBC,MAAuC;IAC5E,OAAO;QACLC,SAAS,OAAOC;YACd,MAAMC,MAAM,IAAIC,IAAIF,IAAIC,GAAG;YAC3B,MAAME,OAAOF,IAAIG,YAAY,CAACC,GAAG,CAAC;YAClC,MAAMC,WAAWL,IAAIG,YAAY,CAACC,GAAG,CAAC;YACtC,MAAME,UAAUN,IAAIG,YAAY,CAACC,GAAG,CAAC;YAErC,IAAI,CAACF,QAAQ,CAACG,YAAY,CAACC,SAAS;gBAClC,OAAOC,SAASC,IAAI,CAClB;oBAAEC,OAAO;gBAAyD,GAClE;oBAAEC,QAAQ;gBAAI;YAElB;YAEA,MAAMC,aAAa,IAAIC,KAAKV;YAC5B,IAAIW,MAAMF,WAAWG,OAAO,KAAK;gBAC/B,OAAOP,SAASC,IAAI,CAClB;oBAAEC,OAAO;gBAA2C,GACpD;oBAAEC,QAAQ;gBAAI;YAElB;YAEA,MAAMK,aAAaC,KAAKC,GAAG,CAACC,OAAOlB,IAAIG,YAAY,CAACC,GAAG,CAAC,iBAAiB,MAAM;YAE/E,MAAMe,QAAQ,MAAMxB,kBAAkB;gBACpCyB,kBAAkBvB,OAAOwB,aAAa,CAACD,gBAAgB;gBACvDlB,MAAMS;gBACNI;gBACAO,SAASvB,IAAIuB,OAAO;gBACpBvB;gBACAwB,iBAAiB1B,OAAO2B,KAAK,CAACC,YAAY;gBAC1CC,YAAYrB;gBACZsB,cAAc9B,OAAO2B,KAAK,CAACI,SAAS;gBACpCC,cAAchC,OAAO2B,KAAK,CAACM,SAAS;gBACpCC,WAAWzB;gBACX0B,aAAanC,OAAO2B,KAAK,CAACS,QAAQ;YACpC;YAEA,OAAO1B,SAASC,IAAI,CAAC;gBACnBN;gBACAa;gBACAI,OAAOA,MAAMe,GAAG,CAAC,CAACC,IAAO,CAAA;wBAAEC,KAAKD,EAAEC,GAAG,CAACC,WAAW;wBAAIC,OAAOH,EAAEG,KAAK,CAACD,WAAW;oBAAG,CAAA;YACpF;QACF;QACAE,QAAQ;QACRC,MAAM;IACR;AACF"}
+{"version":3,"sources":["../../src/endpoints/getSlots.ts"],"sourcesContent":["import type { Endpoint } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../types.js'\n\nimport { getAvailableSlots } from '../services/AvailabilityService.js'\nimport { extractId, mergeResourceIds } from '../utilities/resolveRequiredResources.js'\n\nexport function createGetSlotsEndpoint(config: ResolvedReservationPluginConfig): Endpoint {\n  return {\n    handler: async (req) => {\n      const url = new URL(req.url!)\n      const date = url.searchParams.get('date')\n      const resource = url.searchParams.get('resource')\n      const service = url.searchParams.get('service')\n\n      if (!date || !resource || !service) {\n        return Response.json(\n          { error: 'Missing required query params: resource, date, service' },\n          { status: 400 },\n        )\n      }\n\n      const parsedDate = new Date(date)\n      if (isNaN(parsedDate.getTime())) {\n        return Response.json(\n          { error: 'Invalid date format. Expected YYYY-MM-DD' },\n          { status: 400 },\n        )\n      }\n\n      const guestCount = Math.max(Number(url.searchParams.get('guestCount') ?? '1'), 1)\n\n      // Resolve required resource set: caller resource(s) ∪ service.requiredResources\n      const explicit = url.searchParams.get('resources')\n      const callerIds = explicit ? explicit.split(',').map((s) => s.trim()).filter(Boolean) : [resource]\n\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      const svcDoc = await (req.payload.findByID as any)({\n        id: service,\n        collection: config.slugs.services,\n        depth: 0,\n        req,\n      })\n      const requiredIds = ((svcDoc?.requiredResources as unknown[]) ?? [])\n        .map((r) => extractId(r))\n        .filter((r): r is number | string => r !== undefined)\n      const resourceIds = mergeResourceIds(callerIds, requiredIds)\n\n      const slots = await getAvailableSlots({\n        blockingStatuses: config.statusMachine.blockingStatuses,\n        date: parsedDate,\n        guestCount,\n        payload: req.payload,\n        req,\n        reservationSlug: config.slugs.reservations,\n        resourceIds,\n        resourceSlug: config.slugs.resources,\n        scheduleSlug: config.slugs.schedules,\n        serviceId: service,\n        serviceSlug: config.slugs.services,\n      })\n\n      return Response.json({\n        date,\n        guestCount,\n        slots: slots.map((s) => ({ end: s.end.toISOString(), start: s.start.toISOString() })),\n      })\n    },\n    method: 'get',\n    path: '/reserve/slots',\n  }\n}\n"],"names":["getAvailableSlots","extractId","mergeResourceIds","createGetSlotsEndpoint","config","handler","req","url","URL","date","searchParams","get","resource","service","Response","json","error","status","parsedDate","Date","isNaN","getTime","guestCount","Math","max","Number","explicit","callerIds","split","map","s","trim","filter","Boolean","svcDoc","payload","findByID","id","collection","slugs","services","depth","requiredIds","requiredResources","r","undefined","resourceIds","slots","blockingStatuses","statusMachine","reservationSlug","reservations","resourceSlug","resources","scheduleSlug","schedules","serviceId","serviceSlug","end","toISOString","start","method","path"],"mappings":"AAIA,SAASA,iBAAiB,QAAQ,qCAAoC;AACtE,SAASC,SAAS,EAAEC,gBAAgB,QAAQ,2CAA0C;AAEtF,OAAO,SAASC,uBAAuBC,MAAuC;IAC5E,OAAO;QACLC,SAAS,OAAOC;YACd,MAAMC,MAAM,IAAIC,IAAIF,IAAIC,GAAG;YAC3B,MAAME,OAAOF,IAAIG,YAAY,CAACC,GAAG,CAAC;YAClC,MAAMC,WAAWL,IAAIG,YAAY,CAACC,GAAG,CAAC;YACtC,MAAME,UAAUN,IAAIG,YAAY,CAACC,GAAG,CAAC;YAErC,IAAI,CAACF,QAAQ,CAACG,YAAY,CAACC,SAAS;gBAClC,OAAOC,SAASC,IAAI,CAClB;oBAAEC,OAAO;gBAAyD,GAClE;oBAAEC,QAAQ;gBAAI;YAElB;YAEA,MAAMC,aAAa,IAAIC,KAAKV;YAC5B,IAAIW,MAAMF,WAAWG,OAAO,KAAK;gBAC/B,OAAOP,SAASC,IAAI,CAClB;oBAAEC,OAAO;gBAA2C,GACpD;oBAAEC,QAAQ;gBAAI;YAElB;YAEA,MAAMK,aAAaC,KAAKC,GAAG,CAACC,OAAOlB,IAAIG,YAAY,CAACC,GAAG,CAAC,iBAAiB,MAAM;YAE/E,gFAAgF;YAChF,MAAMe,WAAWnB,IAAIG,YAAY,CAACC,GAAG,CAAC;YACtC,MAAMgB,YAAYD,WAAWA,SAASE,KAAK,CAAC,KAAKC,GAAG,CAAC,CAACC,IAAMA,EAAEC,IAAI,IAAIC,MAAM,CAACC,WAAW;gBAACrB;aAAS;YAElG,8DAA8D;YAC9D,MAAMsB,SAAS,MAAM,AAAC5B,IAAI6B,OAAO,CAACC,QAAQ,CAAS;gBACjDC,IAAIxB;gBACJyB,YAAYlC,OAAOmC,KAAK,CAACC,QAAQ;gBACjCC,OAAO;gBACPnC;YACF;YACA,MAAMoC,cAAc,AAAC,CAAA,AAACR,QAAQS,qBAAmC,EAAE,AAAD,EAC/Dd,GAAG,CAAC,CAACe,IAAM3C,UAAU2C,IACrBZ,MAAM,CAAC,CAACY,IAA4BA,MAAMC;YAC7C,MAAMC,cAAc5C,iBAAiByB,WAAWe;YAEhD,MAAMK,QAAQ,MAAM/C,kBAAkB;gBACpCgD,kBAAkB5C,OAAO6C,aAAa,CAACD,gBAAgB;gBACvDvC,MAAMS;gBACNI;gBACAa,SAAS7B,IAAI6B,OAAO;gBACpB7B;gBACA4C,iBAAiB9C,OAAOmC,KAAK,CAACY,YAAY;gBAC1CL;gBACAM,cAAchD,OAAOmC,KAAK,CAACc,SAAS;gBACpCC,cAAclD,OAAOmC,KAAK,CAACgB,SAAS;gBACpCC,WAAW3C;gBACX4C,aAAarD,OAAOmC,KAAK,CAACC,QAAQ;YACpC;YAEA,OAAO1B,SAASC,IAAI,CAAC;gBACnBN;gBACAa;gBACAyB,OAAOA,MAAMlB,GAAG,CAAC,CAACC,IAAO,CAAA;wBAAE4B,KAAK5B,EAAE4B,GAAG,CAACC,WAAW;wBAAIC,OAAO9B,EAAE8B,KAAK,CAACD,WAAW;oBAAG,CAAA;YACpF;QACF;QACAE,QAAQ;QACRC,MAAM;IACR;AACF"}

package/dist/endpoints/resourceAvailability.d.ts

@@ -0,0 +1,43 @@
+import type { Endpoint, Payload } from 'payload';
+import type { ResolvedReservationPluginConfig } from '../types.js';
+type DayAvailability = {
+    date: string;
+    shiftWindows: Array<{
+        end: string;
+        start: string;
+    }>;
+    timeOff: Array<{
+        end: string;
+        reason?: string;
+        start: string;
+        type?: string;
+    }>;
+};
+type Busy = Array<{
+    end: string;
+    start: string;
+    units: number;
+}>;
+export type ResourceAvailability = {
+    busy: Busy;
+    capacityMode: 'per-guest' | 'per-reservation';
+    days: DayAvailability[];
+    quantity: number;
+    /** Capacity of resources this resource's services also require (e.g. a chair pool). */
+    requiredPools: Array<{
+        busy: Busy;
+        quantity: number;
+    }>;
+};
+export declare function buildResourceAvailability(params: {
+    blockingStatuses: string[];
+    end: Date;
+    payload: Payload;
+    reservationSlug: string;
+    resourceId: number | string;
+    resourceSlug: string;
+    scheduleSlug: string;
+    start: Date;
+}): Promise<ResourceAvailability>;
+export declare function createResourceAvailabilityEndpoint(config: ResolvedReservationPluginConfig): Endpoint;
+export {};

package/dist/endpoints/resourceAvailability.js

@@ -0,0 +1,214 @@
+import { resolveScheduleForDate } from '../utilities/scheduleUtils.js';
+import { localDayKey } from '../utilities/slotUtils.js';
+/** Busy intervals (with capacity units) for one resource over [start, end). */ async function busyFor(args) {
+    const { blockingStatuses, capacityMode, end, payload, reservationSlug, resourceId, start } = args;
+    const where = {
+        and: [
+            {
+                status: {
+                    in: blockingStatuses
+                }
+            },
+            {
+                startTime: {
+                    less_than: end.toISOString()
+                }
+            },
+            {
+                endTime: {
+                    greater_than: start.toISOString()
+                }
+            },
+            {
+                or: [
+                    {
+                        resource: {
+                            equals: resourceId
+                        }
+                    },
+                    {
+                        'items.resource': {
+                            equals: resourceId
+                        }
+                    }
+                ]
+            }
+        ]
+    };
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const { docs } = await payload.find({
+        collection: reservationSlug,
+        depth: 0,
+        limit: 500,
+        where
+    });
+    return docs.filter((r)=>r.startTime && r.endTime).map((r)=>({
+            end: new Date(r.endTime).toISOString(),
+            start: new Date(r.startTime).toISOString(),
+            units: capacityMode === 'per-guest' ? r.guestCount ?? 1 : 1
+        }));
+}
+export async function buildResourceAvailability(params) {
+    const { blockingStatuses, end, payload, reservationSlug, resourceId, resourceSlug, scheduleSlug, start } = params;
+    // depth 1 so `services` are populated (their `requiredResources` come back as ids)
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const resource = await payload.findByID({
+        id: resourceId,
+        collection: resourceSlug,
+        depth: 1
+    });
+    const quantity = resource?.quantity ?? 1;
+    const capacityMode = resource?.capacityMode ?? 'per-reservation';
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const { docs: schedules } = await payload.find({
+        collection: scheduleSlug,
+        depth: 0,
+        limit: 100,
+        where: {
+            and: [
+                {
+                    active: {
+                        equals: true
+                    }
+                },
+                {
+                    resource: {
+                        equals: resourceId
+                    }
+                }
+            ]
+        }
+    });
+    const days = [];
+    for(let d = new Date(start); d < end; d = new Date(d.getTime() + 86_400_000)){
+        const date = localDayKey(d);
+        const shiftWindows = [];
+        const timeOff = [];
+        const localMidnight = new Date(d.getFullYear(), d.getMonth(), d.getDate());
+        for (const sched of schedules){
+            // resolveScheduleForDate accepts a Schedule-shaped object; cast through unknown
+            const ranges = resolveScheduleForDate(sched, localMidnight);
+            for (const r of ranges){
+                shiftWindows.push({
+                    end: r.end.toISOString(),
+                    start: r.start.toISOString()
+                });
+            }
+            const exceptions = sched.exceptions ?? [];
+            for (const exc of exceptions){
+                const excStart = localDayKey(new Date(exc.date));
+                const excEnd = exc.endDate ? localDayKey(new Date(exc.endDate)) : excStart;
+                if (date >= excStart && date <= excEnd) {
+                    const localStart = new Date(d.getFullYear(), d.getMonth(), d.getDate(), 0, 0, 0, 0);
+                    const localEnd = new Date(d.getFullYear(), d.getMonth(), d.getDate(), 23, 59, 59, 999);
+                    timeOff.push({
+                        type: exc.type,
+                        end: localEnd.toISOString(),
+                        reason: exc.reason,
+                        start: localStart.toISOString()
+                    });
+                }
+            }
+        }
+        days.push({
+            date,
+            shiftWindows,
+            timeOff
+        });
+    }
+    const busy = await busyFor({
+        blockingStatuses,
+        capacityMode,
+        end,
+        payload,
+        reservationSlug,
+        resourceId,
+        start
+    });
+    // Resources this resource's services ALSO require (e.g. a shared chair pool).
+    // A slot isn't truly bookable if any of these is at capacity, even when the
+    // resource itself is free — so the calendar reflects real availability.
+    const poolIds = new Set();
+    for (const svc of resource?.services ?? []){
+        const reqs = (typeof svc === 'object' ? svc.requiredResources : []) ?? [];
+        for (const rr of reqs){
+            const id = typeof rr === 'object' && rr !== null ? rr.id : rr;
+            if (id != null && String(id) !== String(resourceId)) {
+                poolIds.add(String(id));
+            }
+        }
+    }
+    const requiredPools = [];
+    for (const poolId of poolIds){
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const pool = await payload.findByID({
+            id: poolId,
+            collection: resourceSlug,
+            depth: 0
+        }).catch(()=>null);
+        if (!pool) {
+            continue;
+        }
+        const poolCapacityMode = pool.capacityMode ?? 'per-reservation';
+        requiredPools.push({
+            busy: await busyFor({
+                blockingStatuses,
+                capacityMode: poolCapacityMode,
+                end,
+                payload,
+                reservationSlug,
+                resourceId: poolId,
+                start
+            }),
+            quantity: pool.quantity ?? 1
+        });
+    }
+    return {
+        busy,
+        capacityMode,
+        days,
+        quantity,
+        requiredPools
+    };
+}
+export function createResourceAvailabilityEndpoint(config) {
+    return {
+        handler: async (req)=>{
+            const url = new URL(req.url);
+            const resource = url.searchParams.get('resource');
+            const start = url.searchParams.get('start');
+            const end = url.searchParams.get('end');
+            if (!resource || !start || !end) {
+                return Response.json({
+                    error: 'Missing required query params: resource, start, end'
+                }, {
+                    status: 400
+                });
+            }
+            const startDate = new Date(start);
+            const endDate = new Date(end);
+            if (isNaN(startDate.getTime()) || isNaN(endDate.getTime())) {
+                return Response.json({
+                    error: 'Invalid start/end date'
+                }, {
+                    status: 400
+                });
+            }
+            const result = await buildResourceAvailability({
+                blockingStatuses: config.statusMachine.blockingStatuses,
+                end: endDate,
+                payload: req.payload,
+                reservationSlug: config.slugs.reservations,
+                resourceId: resource,
+                resourceSlug: config.slugs.resources,
+                scheduleSlug: config.slugs.schedules,
+                start: startDate
+            });
+            return Response.json(result);
+        },
+        method: 'get',
+        path: '/reserve/resource-availability'
+    };
+}
+
+//# sourceMappingURL=resourceAvailability.js.map