payload-reserve 1.5.0 → 2.0.0

package/dist/hooks/reservations/enforceCustomerOwnership.d.ts

@@ -0,0 +1,11 @@
+import type { CollectionBeforeChangeHook } from 'payload';
+import type { ResolvedReservationPluginConfig } from '../../types.js';
+/**
+ * Prevents a non-privileged authenticated user from creating a reservation on
+ * behalf of another customer (mass assignment). The `/api/reserve/book` endpoint
+ * already enforces this, but a logged-in customer could reach the same write
+ * through Payload's default collection REST API — this guard closes that route
+ * (review B3 parallel path). Staff/admin may still book for anyone (walk-ins);
+ * guest bookings (no `customer`) are untouched.
+ */
+export declare const enforceCustomerOwnership: (config: ResolvedReservationPluginConfig) => CollectionBeforeChangeHook;

package/dist/hooks/reservations/enforceCustomerOwnership.js

@@ -0,0 +1,30 @@
+import { extractId } from '../../utilities/resolveReservationItems.js';
+import { isPrivilegedUser } from '../../utilities/userRoles.js';
+/**
+ * Prevents a non-privileged authenticated user from creating a reservation on
+ * behalf of another customer (mass assignment). The `/api/reserve/book` endpoint
+ * already enforces this, but a logged-in customer could reach the same write
+ * through Payload's default collection REST API — this guard closes that route
+ * (review B3 parallel path). Staff/admin may still book for anyone (walk-ins);
+ * guest bookings (no `customer`) are untouched.
+ */ export const enforceCustomerOwnership = (config)=>({ context, data, operation, req })=>{
+        if (context?.skipReservationHooks) {
+            return data;
+        }
+        if (operation !== 'create' || !req.user) {
+            return data;
+        }
+        if (isPrivilegedUser(req.user, config)) {
+            return data;
+        }
+        const customer = data?.customer;
+        if (customer != null && customer !== '') {
+            const customerId = extractId(customer);
+            if (String(customerId) !== String(req.user.id)) {
+                data.customer = req.user.id;
+            }
+        }
+        return data;
+    };
+
+//# sourceMappingURL=enforceCustomerOwnership.js.map

package/dist/hooks/reservations/enforceCustomerOwnership.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/hooks/reservations/enforceCustomerOwnership.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nimport { extractId } from '../../utilities/resolveReservationItems.js'\nimport { isPrivilegedUser } from '../../utilities/userRoles.js'\n\n/**\n * Prevents a non-privileged authenticated user from creating a reservation on\n * behalf of another customer (mass assignment). The `/api/reserve/book` endpoint\n * already enforces this, but a logged-in customer could reach the same write\n * through Payload's default collection REST API — this guard closes that route\n * (review B3 parallel path). Staff/admin may still book for anyone (walk-ins);\n * guest bookings (no `customer`) are untouched.\n */\nexport const enforceCustomerOwnership =\n  (config: ResolvedReservationPluginConfig): CollectionBeforeChangeHook =>\n  ({ context, data, operation, req }) => {\n    if (context?.skipReservationHooks) {\n      return data\n    }\n    if (operation !== 'create' || !req.user) {\n      return data\n    }\n    if (isPrivilegedUser(req.user, config)) {\n      return data\n    }\n\n    const customer = data?.customer\n    if (customer != null && customer !== '') {\n      const customerId = extractId(customer)\n      if (String(customerId) !== String(req.user.id)) {\n        data.customer = req.user.id\n      }\n    }\n\n    return data\n  }\n"],"names":["extractId","isPrivilegedUser","enforceCustomerOwnership","config","context","data","operation","req","skipReservationHooks","user","customer","customerId","String","id"],"mappings":"AAIA,SAASA,SAAS,QAAQ,6CAA4C;AACtE,SAASC,gBAAgB,QAAQ,+BAA8B;AAE/D;;;;;;;CAOC,GACD,OAAO,MAAMC,2BACX,CAACC,SACD,CAAC,EAAEC,OAAO,EAAEC,IAAI,EAAEC,SAAS,EAAEC,GAAG,EAAE;QAChC,IAAIH,SAASI,sBAAsB;YACjC,OAAOH;QACT;QACA,IAAIC,cAAc,YAAY,CAACC,IAAIE,IAAI,EAAE;YACvC,OAAOJ;QACT;QACA,IAAIJ,iBAAiBM,IAAIE,IAAI,EAAEN,SAAS;YACtC,OAAOE;QACT;QAEA,MAAMK,WAAWL,MAAMK;QACvB,IAAIA,YAAY,QAAQA,aAAa,IAAI;YACvC,MAAMC,aAAaX,UAAUU;YAC7B,IAAIE,OAAOD,gBAAgBC,OAAOL,IAAIE,IAAI,CAACI,EAAE,GAAG;gBAC9CR,KAAKK,QAAQ,GAAGH,IAAIE,IAAI,CAACI,EAAE;YAC7B;QACF;QAEA,OAAOR;IACT,EAAC"}

package/dist/hooks/reservations/onStatusChange.js

@@ -1,8 +1,14 @@
-export const onStatusChange = (config)=>async ({ context, doc, previousDoc, req })=>{
+export const onStatusChange = (config)=>async ({ context, doc, operation, previousDoc, req })=>{
         if (context?.skipReservationHooks) {
             return doc;
         }
-        if (!previousDoc || previousDoc.status === doc.status) {
+        // On create Payload passes previousDoc: {} (not undefined) — there is no
+        // previous status, so status-change hooks must not fire (afterBookingCreate
+        // covers creation).
+        if (operation !== 'update') {
+            return doc;
+        }
+        if (!previousDoc?.status || previousDoc.status === doc.status) {
             return doc;
         }
         const prev = previousDoc.status;
@@ -24,7 +30,7 @@ export const onStatusChange = (config)=>async ({ context, doc, previousDoc, req
                 }
             }
         }
-        if (next === 'confirmed' && config.hooks?.afterBookingConfirm) {
+        if (next === config.statusMachine.confirmStatus && config.hooks?.afterBookingConfirm) {
             for (const hook of config.hooks.afterBookingConfirm){
                 try {
                     await hook({
@@ -39,7 +45,7 @@ export const onStatusChange = (config)=>async ({ context, doc, previousDoc, req
                 }
             }
         }
-        if (next === 'cancelled' && config.hooks?.afterBookingCancel) {
+        if (next === config.statusMachine.cancelStatus && config.hooks?.afterBookingCancel) {
             for (const hook of config.hooks.afterBookingCancel){
                 try {
                     await hook({

package/dist/hooks/reservations/onStatusChange.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/hooks/reservations/onStatusChange.ts"],"sourcesContent":["import type { CollectionAfterChangeHook } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nexport const onStatusChange =\n  (config: ResolvedReservationPluginConfig): CollectionAfterChangeHook =>\n  async ({ context, doc, previousDoc, req }) => {\n    if (context?.skipReservationHooks) {return doc}\n    if (!previousDoc || previousDoc.status === doc.status) {return doc}\n\n    const prev = previousDoc.status as string\n    const next = doc.status as string\n\n    if (config.hooks?.afterStatusChange) {\n      for (const hook of config.hooks.afterStatusChange) {\n        try {\n          await hook({ doc: doc as Record<string, unknown>, newStatus: next, previousStatus: prev, req })\n        } catch (err) {\n          req.payload.logger.error({ err, msg: `afterStatusChange hook failed for reservation ${doc.id}` })\n        }\n      }\n    }\n\n    if (next === 'confirmed' && config.hooks?.afterBookingConfirm) {\n      for (const hook of config.hooks.afterBookingConfirm) {\n        try {\n          await hook({ doc: doc as Record<string, unknown>, req })\n        } catch (err) {\n          req.payload.logger.error({ err, msg: `afterBookingConfirm hook failed for reservation ${doc.id}` })\n        }\n      }\n    }\n    if (next === 'cancelled' && config.hooks?.afterBookingCancel) {\n      for (const hook of config.hooks.afterBookingCancel) {\n        try {\n          await hook({ doc: doc as Record<string, unknown>, req })\n        } catch (err) {\n          req.payload.logger.error({ err, msg: `afterBookingCancel hook failed for reservation ${doc.id}` })\n        }\n      }\n    }\n\n    return doc\n  }\n"],"names":["onStatusChange","config","context","doc","previousDoc","req","skipReservationHooks","status","prev","next","hooks","afterStatusChange","hook","newStatus","previousStatus","err","payload","logger","error","msg","id","afterBookingConfirm","afterBookingCancel"],"mappings":"AAIA,OAAO,MAAMA,iBACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,GAAG,EAAEC,WAAW,EAAEC,GAAG,EAAE;QACvC,IAAIH,SAASI,sBAAsB;YAAC,OAAOH;QAAG;QAC9C,IAAI,CAACC,eAAeA,YAAYG,MAAM,KAAKJ,IAAII,MAAM,EAAE;YAAC,OAAOJ;QAAG;QAElE,MAAMK,OAAOJ,YAAYG,MAAM;QAC/B,MAAME,OAAON,IAAII,MAAM;QAEvB,IAAIN,OAAOS,KAAK,EAAEC,mBAAmB;YACnC,KAAK,MAAMC,QAAQX,OAAOS,KAAK,CAACC,iBAAiB,CAAE;gBACjD,IAAI;oBACF,MAAMC,KAAK;wBAAET,KAAKA;wBAAgCU,WAAWJ;wBAAMK,gBAAgBN;wBAAMH;oBAAI;gBAC/F,EAAE,OAAOU,KAAK;oBACZV,IAAIW,OAAO,CAACC,MAAM,CAACC,KAAK,CAAC;wBAAEH;wBAAKI,KAAK,CAAC,8CAA8C,EAAEhB,IAAIiB,EAAE,EAAE;oBAAC;gBACjG;YACF;QACF;QAEA,IAAIX,SAAS,eAAeR,OAAOS,KAAK,EAAEW,qBAAqB;YAC7D,KAAK,MAAMT,QAAQX,OAAOS,KAAK,CAACW,mBAAmB,CAAE;gBACnD,IAAI;oBACF,MAAMT,KAAK;wBAAET,KAAKA;wBAAgCE;oBAAI;gBACxD,EAAE,OAAOU,KAAK;oBACZV,IAAIW,OAAO,CAACC,MAAM,CAACC,KAAK,CAAC;wBAAEH;wBAAKI,KAAK,CAAC,gDAAgD,EAAEhB,IAAIiB,EAAE,EAAE;oBAAC;gBACnG;YACF;QACF;QACA,IAAIX,SAAS,eAAeR,OAAOS,KAAK,EAAEY,oBAAoB;YAC5D,KAAK,MAAMV,QAAQX,OAAOS,KAAK,CAACY,kBAAkB,CAAE;gBAClD,IAAI;oBACF,MAAMV,KAAK;wBAAET,KAAKA;wBAAgCE;oBAAI;gBACxD,EAAE,OAAOU,KAAK;oBACZV,IAAIW,OAAO,CAACC,MAAM,CAACC,KAAK,CAAC;wBAAEH;wBAAKI,KAAK,CAAC,+CAA+C,EAAEhB,IAAIiB,EAAE,EAAE;oBAAC;gBAClG;YACF;QACF;QAEA,OAAOjB;IACT,EAAC"}
+{"version":3,"sources":["../../../src/hooks/reservations/onStatusChange.ts"],"sourcesContent":["import type { CollectionAfterChangeHook } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nexport const onStatusChange =\n  (config: ResolvedReservationPluginConfig): CollectionAfterChangeHook =>\n  async ({ context, doc, operation, previousDoc, req }) => {\n    if (context?.skipReservationHooks) {return doc}\n    // On create Payload passes previousDoc: {} (not undefined) — there is no\n    // previous status, so status-change hooks must not fire (afterBookingCreate\n    // covers creation).\n    if (operation !== 'update') {return doc}\n    if (!previousDoc?.status || previousDoc.status === doc.status) {return doc}\n\n    const prev = previousDoc.status as string\n    const next = doc.status as string\n\n    if (config.hooks?.afterStatusChange) {\n      for (const hook of config.hooks.afterStatusChange) {\n        try {\n          await hook({ doc: doc as Record<string, unknown>, newStatus: next, previousStatus: prev, req })\n        } catch (err) {\n          req.payload.logger.error({ err, msg: `afterStatusChange hook failed for reservation ${doc.id}` })\n        }\n      }\n    }\n\n    if (next === config.statusMachine.confirmStatus && config.hooks?.afterBookingConfirm) {\n      for (const hook of config.hooks.afterBookingConfirm) {\n        try {\n          await hook({ doc: doc as Record<string, unknown>, req })\n        } catch (err) {\n          req.payload.logger.error({ err, msg: `afterBookingConfirm hook failed for reservation ${doc.id}` })\n        }\n      }\n    }\n    if (next === config.statusMachine.cancelStatus && config.hooks?.afterBookingCancel) {\n      for (const hook of config.hooks.afterBookingCancel) {\n        try {\n          await hook({ doc: doc as Record<string, unknown>, req })\n        } catch (err) {\n          req.payload.logger.error({ err, msg: `afterBookingCancel hook failed for reservation ${doc.id}` })\n        }\n      }\n    }\n\n    return doc\n  }\n"],"names":["onStatusChange","config","context","doc","operation","previousDoc","req","skipReservationHooks","status","prev","next","hooks","afterStatusChange","hook","newStatus","previousStatus","err","payload","logger","error","msg","id","statusMachine","confirmStatus","afterBookingConfirm","cancelStatus","afterBookingCancel"],"mappings":"AAIA,OAAO,MAAMA,iBACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,GAAG,EAAEC,SAAS,EAAEC,WAAW,EAAEC,GAAG,EAAE;QAClD,IAAIJ,SAASK,sBAAsB;YAAC,OAAOJ;QAAG;QAC9C,yEAAyE;QACzE,4EAA4E;QAC5E,oBAAoB;QACpB,IAAIC,cAAc,UAAU;YAAC,OAAOD;QAAG;QACvC,IAAI,CAACE,aAAaG,UAAUH,YAAYG,MAAM,KAAKL,IAAIK,MAAM,EAAE;YAAC,OAAOL;QAAG;QAE1E,MAAMM,OAAOJ,YAAYG,MAAM;QAC/B,MAAME,OAAOP,IAAIK,MAAM;QAEvB,IAAIP,OAAOU,KAAK,EAAEC,mBAAmB;YACnC,KAAK,MAAMC,QAAQZ,OAAOU,KAAK,CAACC,iBAAiB,CAAE;gBACjD,IAAI;oBACF,MAAMC,KAAK;wBAAEV,KAAKA;wBAAgCW,WAAWJ;wBAAMK,gBAAgBN;wBAAMH;oBAAI;gBAC/F,EAAE,OAAOU,KAAK;oBACZV,IAAIW,OAAO,CAACC,MAAM,CAACC,KAAK,CAAC;wBAAEH;wBAAKI,KAAK,CAAC,8CAA8C,EAAEjB,IAAIkB,EAAE,EAAE;oBAAC;gBACjG;YACF;QACF;QAEA,IAAIX,SAAST,OAAOqB,aAAa,CAACC,aAAa,IAAItB,OAAOU,KAAK,EAAEa,qBAAqB;YACpF,KAAK,MAAMX,QAAQZ,OAAOU,KAAK,CAACa,mBAAmB,CAAE;gBACnD,IAAI;oBACF,MAAMX,KAAK;wBAAEV,KAAKA;wBAAgCG;oBAAI;gBACxD,EAAE,OAAOU,KAAK;oBACZV,IAAIW,OAAO,CAACC,MAAM,CAACC,KAAK,CAAC;wBAAEH;wBAAKI,KAAK,CAAC,gDAAgD,EAAEjB,IAAIkB,EAAE,EAAE;oBAAC;gBACnG;YACF;QACF;QACA,IAAIX,SAAST,OAAOqB,aAAa,CAACG,YAAY,IAAIxB,OAAOU,KAAK,EAAEe,oBAAoB;YAClF,KAAK,MAAMb,QAAQZ,OAAOU,KAAK,CAACe,kBAAkB,CAAE;gBAClD,IAAI;oBACF,MAAMb,KAAK;wBAAEV,KAAKA;wBAAgCG;oBAAI;gBACxD,EAAE,OAAOU,KAAK;oBACZV,IAAIW,OAAO,CAACC,MAAM,CAACC,KAAK,CAAC;wBAAEH;wBAAKI,KAAK,CAAC,+CAA+C,EAAEjB,IAAIkB,EAAE,EAAE;oBAAC;gBAClG;YACF;QACF;QAEA,OAAOlB;IACT,EAAC"}

package/dist/hooks/reservations/validateCancellation.js

@@ -9,8 +9,9 @@ export const validateCancellation = (config)=>({ context, data, operation, origi
         }
         const newStatus = data?.status;
         const previousStatus = originalDoc?.status;
-        // Only check when transitioning to cancelled
-        if (newStatus !== 'cancelled' || previousStatus === 'cancelled') {
+        // Only check when transitioning to the cancel status
+        const cancelStatus = config.statusMachine.cancelStatus;
+        if (newStatus !== cancelStatus || previousStatus === cancelStatus) {
             return data;
         }
         const startTime = data?.startTime ?? originalDoc?.startTime;

package/dist/hooks/reservations/validateCancellation.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/hooks/reservations/validateCancellation.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload'\n\nimport { ValidationError } from 'payload'\n\nimport type { PluginT } from '../../translations/index.js'\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nimport { hoursUntil } from '../../utilities/slotUtils.js'\n\nexport const validateCancellation =\n  (config: ResolvedReservationPluginConfig): CollectionBeforeChangeHook =>\n  ({ context, data, operation, originalDoc, req }) => {\n    if (context?.skipReservationHooks) {return data}\n\n    if (operation !== 'update') {return data}\n\n    const newStatus = data?.status\n    const previousStatus = originalDoc?.status\n\n    // Only check when transitioning to cancelled\n    if (newStatus !== 'cancelled' || previousStatus === 'cancelled') {return data}\n\n    const startTime = data?.startTime ?? originalDoc?.startTime\n    if (!startTime) {return data}\n\n    const startDate = new Date(startTime)\n    const hours = hoursUntil(startDate)\n\n    if (hours > 0 && hours < config.cancellationNoticePeriod) {\n      throw new ValidationError({\n        errors: [\n          {\n            message: (req.t as PluginT)('reservation:errorCancellationNotice', {\n              hours: String(Math.round(hours)),\n              period: String(config.cancellationNoticePeriod),\n            }),\n            path: 'status',\n          },\n        ],\n      })\n    }\n\n    return data\n  }\n"],"names":["ValidationError","hoursUntil","validateCancellation","config","context","data","operation","originalDoc","req","skipReservationHooks","newStatus","status","previousStatus","startTime","startDate","Date","hours","cancellationNoticePeriod","errors","message","t","String","Math","round","period","path"],"mappings":"AAEA,SAASA,eAAe,QAAQ,UAAS;AAKzC,SAASC,UAAU,QAAQ,+BAA8B;AAEzD,OAAO,MAAMC,uBACX,CAACC,SACD,CAAC,EAAEC,OAAO,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,GAAG,EAAE;QAC7C,IAAIJ,SAASK,sBAAsB;YAAC,OAAOJ;QAAI;QAE/C,IAAIC,cAAc,UAAU;YAAC,OAAOD;QAAI;QAExC,MAAMK,YAAYL,MAAMM;QACxB,MAAMC,iBAAiBL,aAAaI;QAEpC,6CAA6C;QAC7C,IAAID,cAAc,eAAeE,mBAAmB,aAAa;YAAC,OAAOP;QAAI;QAE7E,MAAMQ,YAAYR,MAAMQ,aAAaN,aAAaM;QAClD,IAAI,CAACA,WAAW;YAAC,OAAOR;QAAI;QAE5B,MAAMS,YAAY,IAAIC,KAAKF;QAC3B,MAAMG,QAAQf,WAAWa;QAEzB,IAAIE,QAAQ,KAAKA,QAAQb,OAAOc,wBAAwB,EAAE;YACxD,MAAM,IAAIjB,gBAAgB;gBACxBkB,QAAQ;oBACN;wBACEC,SAAS,AAACX,IAAIY,CAAC,CAAa,uCAAuC;4BACjEJ,OAAOK,OAAOC,KAAKC,KAAK,CAACP;4BACzBQ,QAAQH,OAAOlB,OAAOc,wBAAwB;wBAChD;wBACAQ,MAAM;oBACR;iBACD;YACH;QACF;QAEA,OAAOpB;IACT,EAAC"}
+{"version":3,"sources":["../../../src/hooks/reservations/validateCancellation.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload'\n\nimport { ValidationError } from 'payload'\n\nimport type { PluginT } from '../../translations/index.js'\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nimport { hoursUntil } from '../../utilities/slotUtils.js'\n\nexport const validateCancellation =\n  (config: ResolvedReservationPluginConfig): CollectionBeforeChangeHook =>\n  ({ context, data, operation, originalDoc, req }) => {\n    if (context?.skipReservationHooks) {return data}\n\n    if (operation !== 'update') {return data}\n\n    const newStatus = data?.status\n    const previousStatus = originalDoc?.status\n\n    // Only check when transitioning to the cancel status\n    const cancelStatus = config.statusMachine.cancelStatus\n    if (newStatus !== cancelStatus || previousStatus === cancelStatus) {return data}\n\n    const startTime = data?.startTime ?? originalDoc?.startTime\n    if (!startTime) {return data}\n\n    const startDate = new Date(startTime)\n    const hours = hoursUntil(startDate)\n\n    if (hours > 0 && hours < config.cancellationNoticePeriod) {\n      throw new ValidationError({\n        errors: [\n          {\n            message: (req.t as PluginT)('reservation:errorCancellationNotice', {\n              hours: String(Math.round(hours)),\n              period: String(config.cancellationNoticePeriod),\n            }),\n            path: 'status',\n          },\n        ],\n      })\n    }\n\n    return data\n  }\n"],"names":["ValidationError","hoursUntil","validateCancellation","config","context","data","operation","originalDoc","req","skipReservationHooks","newStatus","status","previousStatus","cancelStatus","statusMachine","startTime","startDate","Date","hours","cancellationNoticePeriod","errors","message","t","String","Math","round","period","path"],"mappings":"AAEA,SAASA,eAAe,QAAQ,UAAS;AAKzC,SAASC,UAAU,QAAQ,+BAA8B;AAEzD,OAAO,MAAMC,uBACX,CAACC,SACD,CAAC,EAAEC,OAAO,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,GAAG,EAAE;QAC7C,IAAIJ,SAASK,sBAAsB;YAAC,OAAOJ;QAAI;QAE/C,IAAIC,cAAc,UAAU;YAAC,OAAOD;QAAI;QAExC,MAAMK,YAAYL,MAAMM;QACxB,MAAMC,iBAAiBL,aAAaI;QAEpC,qDAAqD;QACrD,MAAME,eAAeV,OAAOW,aAAa,CAACD,YAAY;QACtD,IAAIH,cAAcG,gBAAgBD,mBAAmBC,cAAc;YAAC,OAAOR;QAAI;QAE/E,MAAMU,YAAYV,MAAMU,aAAaR,aAAaQ;QAClD,IAAI,CAACA,WAAW;YAAC,OAAOV;QAAI;QAE5B,MAAMW,YAAY,IAAIC,KAAKF;QAC3B,MAAMG,QAAQjB,WAAWe;QAEzB,IAAIE,QAAQ,KAAKA,QAAQf,OAAOgB,wBAAwB,EAAE;YACxD,MAAM,IAAInB,gBAAgB;gBACxBoB,QAAQ;oBACN;wBACEC,SAAS,AAACb,IAAIc,CAAC,CAAa,uCAAuC;4BACjEJ,OAAOK,OAAOC,KAAKC,KAAK,CAACP;4BACzBQ,QAAQH,OAAOpB,OAAOgB,wBAAwB;wBAChD;wBACAQ,MAAM;oBACR;iBACD;YACH;QACF;QAEA,OAAOtB;IACT,EAAC"}

package/dist/hooks/reservations/validateConflicts.js

@@ -1,11 +1,25 @@
 import { ValidationError } from 'payload';
 import { checkAvailability } from '../../services/AvailabilityService.js';
-import { resolveReservationItems } from '../../utilities/resolveReservationItems.js';
+import { mergeReservationData, schedulingFieldsChanged } from '../../utilities/reservationChanges.js';
+import { extractId, resolveReservationItems } from '../../utilities/resolveReservationItems.js';
 export const validateConflicts = (config)=>async ({ context, data, operation, originalDoc, req })=>{
         if (context?.skipReservationHooks) {
             return data;
         }
-        const items = resolveReservationItems(data);
+        const isUpdate = operation === 'update';
+        // Skip when an update touches no scheduling-relevant field, so reservations
+        // booked under older buffers/schedules can still take benign edits.
+        if (isUpdate && !schedulingFieldsChanged({
+            blockingStatuses: config.statusMachine.blockingStatuses,
+            data: data,
+            originalDoc: originalDoc
+        })) {
+            return data;
+        }
+        // Validate the merged document — Payload usually backfills update patches
+        // from originalDoc before beforeChange, but the hook must not rely on it.
+        const source = isUpdate ? mergeReservationData(data, originalDoc) : data;
+        const items = resolveReservationItems(source);
         if (items.length === 0) {
             return data;
         }
@@ -15,7 +29,7 @@ export const validateConflicts = (config)=>async ({ context, data, operation, or
                 continue;
             }
             // Fetch buffer times from the item's own service (not just the primary)
-            const itemServiceId = item.service ?? (typeof data?.service === 'object' ? data.service.id : data?.service);
+            const itemServiceId = item.service ?? extractId(source.service);
             let bufferBefore = config.defaultBufferTime;
             let bufferAfter = config.defaultBufferTime;
             if (itemServiceId) {
@@ -34,18 +48,23 @@ export const validateConflicts = (config)=>async ({ context, data, operation, or
                 // Use defaults if service lookup fails
                 }
             }
+            // Other items of this same booking on the same resource count as occupancy
+            // so two items can't double-book one resource within one create (review A5).
+            const siblingItems = items.filter((other, j)=>j !== i && other.resource === item.resource);
             const result = await checkAvailability({
                 blockingStatuses: config.statusMachine.blockingStatuses,
                 bufferAfter,
                 bufferBefore,
                 endTime: new Date(item.endTime),
-                excludeReservationId: operation === 'update' ? originalDoc?.id : undefined,
+                excludeReservationId: isUpdate ? originalDoc?.id : undefined,
                 guestCount: item.guestCount,
                 payload: req.payload,
                 req,
                 reservationSlug: config.slugs.reservations,
                 resourceId: item.resource,
                 resourceSlug: config.slugs.resources,
+                servicesSlug: config.slugs.services,
+                siblingItems,
                 startTime: new Date(item.startTime)
             });
             if (!result.available) {

package/dist/hooks/reservations/validateConflicts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/hooks/reservations/validateConflicts.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload'\n\nimport { ValidationError } from 'payload'\n\nimport type { PluginT } from '../../translations/index.js'\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nimport { checkAvailability } from '../../services/AvailabilityService.js'\nimport { resolveReservationItems } from '../../utilities/resolveReservationItems.js'\n\nexport const validateConflicts =\n  (config: ResolvedReservationPluginConfig): CollectionBeforeChangeHook =>\n  async ({ context, data, operation, originalDoc, req }) => {\n    if (context?.skipReservationHooks) {return data}\n\n    const items = resolveReservationItems(data as Record<string, unknown>)\n\n    if (items.length === 0) {return data}\n\n    for (let i = 0; i < items.length; i++) {\n      const item = items[i]\n      if (!item.endTime) {continue}\n\n      // Fetch buffer times from the item's own service (not just the primary)\n      const itemServiceId = item.service\n        ?? (typeof data?.service === 'object' ? data.service.id : data?.service)\n      let bufferBefore = config.defaultBufferTime\n      let bufferAfter = config.defaultBufferTime\n\n      if (itemServiceId) {\n        try {\n          // eslint-disable-next-line @typescript-eslint/no-explicit-any\n          const service = await (req.payload.findByID as any)({\n            id: itemServiceId,\n            collection: config.slugs.services,\n            req,\n          })\n          if (service) {\n            bufferBefore = (service.bufferTimeBefore as number) ?? config.defaultBufferTime\n            bufferAfter = (service.bufferTimeAfter as number) ?? config.defaultBufferTime\n          }\n        } catch {\n          // Use defaults if service lookup fails\n        }\n      }\n\n      const result = await checkAvailability({\n        blockingStatuses: config.statusMachine.blockingStatuses,\n        bufferAfter,\n        bufferBefore,\n        endTime: new Date(item.endTime),\n        excludeReservationId: operation === 'update' ? originalDoc?.id : undefined,\n        guestCount: item.guestCount,\n        payload: req.payload,\n        req,\n        reservationSlug: config.slugs.reservations,\n        resourceId: item.resource,\n        resourceSlug: config.slugs.resources,\n        startTime: new Date(item.startTime),\n      })\n\n      if (!result.available) {\n        throw new ValidationError({\n          errors: [\n            {\n              message: result.reason ?? (req.t as PluginT)('reservation:errorConflict'),\n              path: items.length > 1 ? `items.${i}.startTime` : 'startTime',\n            },\n          ],\n        })\n      }\n    }\n\n    return data\n  }\n"],"names":["ValidationError","checkAvailability","resolveReservationItems","validateConflicts","config","context","data","operation","originalDoc","req","skipReservationHooks","items","length","i","item","endTime","itemServiceId","service","id","bufferBefore","defaultBufferTime","bufferAfter","payload","findByID","collection","slugs","services","bufferTimeBefore","bufferTimeAfter","result","blockingStatuses","statusMachine","Date","excludeReservationId","undefined","guestCount","reservationSlug","reservations","resourceId","resource","resourceSlug","resources","startTime","available","errors","message","reason","t","path"],"mappings":"AAEA,SAASA,eAAe,QAAQ,UAAS;AAKzC,SAASC,iBAAiB,QAAQ,wCAAuC;AACzE,SAASC,uBAAuB,QAAQ,6CAA4C;AAEpF,OAAO,MAAMC,oBACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,GAAG,EAAE;QACnD,IAAIJ,SAASK,sBAAsB;YAAC,OAAOJ;QAAI;QAE/C,MAAMK,QAAQT,wBAAwBI;QAEtC,IAAIK,MAAMC,MAAM,KAAK,GAAG;YAAC,OAAON;QAAI;QAEpC,IAAK,IAAIO,IAAI,GAAGA,IAAIF,MAAMC,MAAM,EAAEC,IAAK;YACrC,MAAMC,OAAOH,KAAK,CAACE,EAAE;YACrB,IAAI,CAACC,KAAKC,OAAO,EAAE;gBAAC;YAAQ;YAE5B,wEAAwE;YACxE,MAAMC,gBAAgBF,KAAKG,OAAO,IAC5B,CAAA,OAAOX,MAAMW,YAAY,WAAWX,KAAKW,OAAO,CAACC,EAAE,GAAGZ,MAAMW,OAAM;YACxE,IAAIE,eAAef,OAAOgB,iBAAiB;YAC3C,IAAIC,cAAcjB,OAAOgB,iBAAiB;YAE1C,IAAIJ,eAAe;gBACjB,IAAI;oBACF,8DAA8D;oBAC9D,MAAMC,UAAU,MAAM,AAACR,IAAIa,OAAO,CAACC,QAAQ,CAAS;wBAClDL,IAAIF;wBACJQ,YAAYpB,OAAOqB,KAAK,CAACC,QAAQ;wBACjCjB;oBACF;oBACA,IAAIQ,SAAS;wBACXE,eAAe,AAACF,QAAQU,gBAAgB,IAAevB,OAAOgB,iBAAiB;wBAC/EC,cAAc,AAACJ,QAAQW,eAAe,IAAexB,OAAOgB,iBAAiB;oBAC/E;gBACF,EAAE,OAAM;gBACN,uCAAuC;gBACzC;YACF;YAEA,MAAMS,SAAS,MAAM5B,kBAAkB;gBACrC6B,kBAAkB1B,OAAO2B,aAAa,CAACD,gBAAgB;gBACvDT;gBACAF;gBACAJ,SAAS,IAAIiB,KAAKlB,KAAKC,OAAO;gBAC9BkB,sBAAsB1B,cAAc,WAAWC,aAAaU,KAAKgB;gBACjEC,YAAYrB,KAAKqB,UAAU;gBAC3Bb,SAASb,IAAIa,OAAO;gBACpBb;gBACA2B,iBAAiBhC,OAAOqB,KAAK,CAACY,YAAY;gBAC1CC,YAAYxB,KAAKyB,QAAQ;gBACzBC,cAAcpC,OAAOqB,KAAK,CAACgB,SAAS;gBACpCC,WAAW,IAAIV,KAAKlB,KAAK4B,SAAS;YACpC;YAEA,IAAI,CAACb,OAAOc,SAAS,EAAE;gBACrB,MAAM,IAAI3C,gBAAgB;oBACxB4C,QAAQ;wBACN;4BACEC,SAAShB,OAAOiB,MAAM,IAAI,AAACrC,IAAIsC,CAAC,CAAa;4BAC7CC,MAAMrC,MAAMC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAEC,EAAE,UAAU,CAAC,GAAG;wBACpD;qBACD;gBACH;YACF;QACF;QAEA,OAAOP;IACT,EAAC"}
+{"version":3,"sources":["../../../src/hooks/reservations/validateConflicts.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload'\n\nimport { ValidationError } from 'payload'\n\nimport type { PluginT } from '../../translations/index.js'\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nimport { checkAvailability } from '../../services/AvailabilityService.js'\nimport {\n  mergeReservationData,\n  schedulingFieldsChanged,\n} from '../../utilities/reservationChanges.js'\nimport { extractId, resolveReservationItems } from '../../utilities/resolveReservationItems.js'\n\nexport const validateConflicts =\n  (config: ResolvedReservationPluginConfig): CollectionBeforeChangeHook =>\n  async ({ context, data, operation, originalDoc, req }) => {\n    if (context?.skipReservationHooks) {\n      return data\n    }\n\n    const isUpdate = operation === 'update'\n\n    // Skip when an update touches no scheduling-relevant field, so reservations\n    // booked under older buffers/schedules can still take benign edits.\n    if (\n      isUpdate &&\n      !schedulingFieldsChanged({\n        blockingStatuses: config.statusMachine.blockingStatuses,\n        data: data as Record<string, unknown>,\n        originalDoc: originalDoc as Record<string, unknown> | undefined,\n      })\n    ) {\n      return data\n    }\n\n    // Validate the merged document — Payload usually backfills update patches\n    // from originalDoc before beforeChange, but the hook must not rely on it.\n    const source = isUpdate\n      ? mergeReservationData(\n          data as Record<string, unknown>,\n          originalDoc as Record<string, unknown> | undefined,\n        )\n      : (data as Record<string, unknown>)\n\n    const items = resolveReservationItems(source)\n\n    if (items.length === 0) {\n      return data\n    }\n\n    for (let i = 0; i < items.length; i++) {\n      const item = items[i]\n      if (!item.endTime) {\n        continue\n      }\n\n      // Fetch buffer times from the item's own service (not just the primary)\n      const itemServiceId = item.service ?? extractId(source.service)\n      let bufferBefore = config.defaultBufferTime\n      let bufferAfter = config.defaultBufferTime\n\n      if (itemServiceId) {\n        try {\n          // eslint-disable-next-line @typescript-eslint/no-explicit-any\n          const service = await (req.payload.findByID as any)({\n            id: itemServiceId,\n            collection: config.slugs.services,\n            req,\n          })\n          if (service) {\n            bufferBefore = (service.bufferTimeBefore as number) ?? config.defaultBufferTime\n            bufferAfter = (service.bufferTimeAfter as number) ?? config.defaultBufferTime\n          }\n        } catch {\n          // Use defaults if service lookup fails\n        }\n      }\n\n      // Other items of this same booking on the same resource count as occupancy\n      // so two items can't double-book one resource within one create (review A5).\n      const siblingItems = items.filter((other, j) => j !== i && other.resource === item.resource)\n\n      const result = await checkAvailability({\n        blockingStatuses: config.statusMachine.blockingStatuses,\n        bufferAfter,\n        bufferBefore,\n        endTime: new Date(item.endTime),\n        excludeReservationId: isUpdate ? originalDoc?.id : undefined,\n        guestCount: item.guestCount,\n        payload: req.payload,\n        req,\n        reservationSlug: config.slugs.reservations,\n        resourceId: item.resource,\n        resourceSlug: config.slugs.resources,\n        servicesSlug: config.slugs.services,\n        siblingItems,\n        startTime: new Date(item.startTime),\n      })\n\n      if (!result.available) {\n        throw new ValidationError({\n          errors: [\n            {\n              message: result.reason ?? (req.t as PluginT)('reservation:errorConflict'),\n              path: items.length > 1 ? `items.${i}.startTime` : 'startTime',\n            },\n          ],\n        })\n      }\n    }\n\n    return data\n  }\n"],"names":["ValidationError","checkAvailability","mergeReservationData","schedulingFieldsChanged","extractId","resolveReservationItems","validateConflicts","config","context","data","operation","originalDoc","req","skipReservationHooks","isUpdate","blockingStatuses","statusMachine","source","items","length","i","item","endTime","itemServiceId","service","bufferBefore","defaultBufferTime","bufferAfter","payload","findByID","id","collection","slugs","services","bufferTimeBefore","bufferTimeAfter","siblingItems","filter","other","j","resource","result","Date","excludeReservationId","undefined","guestCount","reservationSlug","reservations","resourceId","resourceSlug","resources","servicesSlug","startTime","available","errors","message","reason","t","path"],"mappings":"AAEA,SAASA,eAAe,QAAQ,UAAS;AAKzC,SAASC,iBAAiB,QAAQ,wCAAuC;AACzE,SACEC,oBAAoB,EACpBC,uBAAuB,QAClB,wCAAuC;AAC9C,SAASC,SAAS,EAAEC,uBAAuB,QAAQ,6CAA4C;AAE/F,OAAO,MAAMC,oBACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,GAAG,EAAE;QACnD,IAAIJ,SAASK,sBAAsB;YACjC,OAAOJ;QACT;QAEA,MAAMK,WAAWJ,cAAc;QAE/B,4EAA4E;QAC5E,oEAAoE;QACpE,IACEI,YACA,CAACX,wBAAwB;YACvBY,kBAAkBR,OAAOS,aAAa,CAACD,gBAAgB;YACvDN,MAAMA;YACNE,aAAaA;QACf,IACA;YACA,OAAOF;QACT;QAEA,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAMQ,SAASH,WACXZ,qBACEO,MACAE,eAEDF;QAEL,MAAMS,QAAQb,wBAAwBY;QAEtC,IAAIC,MAAMC,MAAM,KAAK,GAAG;YACtB,OAAOV;QACT;QAEA,IAAK,IAAIW,IAAI,GAAGA,IAAIF,MAAMC,MAAM,EAAEC,IAAK;YACrC,MAAMC,OAAOH,KAAK,CAACE,EAAE;YACrB,IAAI,CAACC,KAAKC,OAAO,EAAE;gBACjB;YACF;YAEA,wEAAwE;YACxE,MAAMC,gBAAgBF,KAAKG,OAAO,IAAIpB,UAAUa,OAAOO,OAAO;YAC9D,IAAIC,eAAelB,OAAOmB,iBAAiB;YAC3C,IAAIC,cAAcpB,OAAOmB,iBAAiB;YAE1C,IAAIH,eAAe;gBACjB,IAAI;oBACF,8DAA8D;oBAC9D,MAAMC,UAAU,MAAM,AAACZ,IAAIgB,OAAO,CAACC,QAAQ,CAAS;wBAClDC,IAAIP;wBACJQ,YAAYxB,OAAOyB,KAAK,CAACC,QAAQ;wBACjCrB;oBACF;oBACA,IAAIY,SAAS;wBACXC,eAAe,AAACD,QAAQU,gBAAgB,IAAe3B,OAAOmB,iBAAiB;wBAC/EC,cAAc,AAACH,QAAQW,eAAe,IAAe5B,OAAOmB,iBAAiB;oBAC/E;gBACF,EAAE,OAAM;gBACN,uCAAuC;gBACzC;YACF;YAEA,2EAA2E;YAC3E,6EAA6E;YAC7E,MAAMU,eAAelB,MAAMmB,MAAM,CAAC,CAACC,OAAOC,IAAMA,MAAMnB,KAAKkB,MAAME,QAAQ,KAAKnB,KAAKmB,QAAQ;YAE3F,MAAMC,SAAS,MAAMxC,kBAAkB;gBACrCc,kBAAkBR,OAAOS,aAAa,CAACD,gBAAgB;gBACvDY;gBACAF;gBACAH,SAAS,IAAIoB,KAAKrB,KAAKC,OAAO;gBAC9BqB,sBAAsB7B,WAAWH,aAAamB,KAAKc;gBACnDC,YAAYxB,KAAKwB,UAAU;gBAC3BjB,SAAShB,IAAIgB,OAAO;gBACpBhB;gBACAkC,iBAAiBvC,OAAOyB,KAAK,CAACe,YAAY;gBAC1CC,YAAY3B,KAAKmB,QAAQ;gBACzBS,cAAc1C,OAAOyB,KAAK,CAACkB,SAAS;gBACpCC,cAAc5C,OAAOyB,KAAK,CAACC,QAAQ;gBACnCG;gBACAgB,WAAW,IAAIV,KAAKrB,KAAK+B,SAAS;YACpC;YAEA,IAAI,CAACX,OAAOY,SAAS,EAAE;gBACrB,MAAM,IAAIrD,gBAAgB;oBACxBsD,QAAQ;wBACN;4BACEC,SAASd,OAAOe,MAAM,IAAI,AAAC5C,IAAI6C,CAAC,CAAa;4BAC7CC,MAAMxC,MAAMC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAEC,EAAE,UAAU,CAAC,GAAG;wBACpD;qBACD;gBACH;YACF;QACF;QAEA,OAAOX;IACT,EAAC"}

package/dist/hooks/reservations/validateGuestBooking.js

@@ -83,10 +83,9 @@ export const validateGuestBooking = (config)=>async ({ context, data, operation,
                 }
             }
         }
-        // Generate a cancellation token the host project can deliver to the guest.
-        if (!data.cancellationToken) {
-            data.cancellationToken = randomUUID();
-        }
+        // Always server-generate the cancellation token the host project delivers
+        // to the guest — never honor a caller-supplied value (it's a secret).
+        data.cancellationToken = randomUUID();
         return data;
     };
 

package/dist/hooks/reservations/validateGuestBooking.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/hooks/reservations/validateGuestBooking.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload'\n\nimport { randomUUID } from 'node:crypto'\nimport { ValidationError } from 'payload'\n\nimport type { PluginT } from '../../translations/index.js'\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nimport { resolveGuestBookingAllowed } from '../../utilities/guestBooking.js'\n\ntype GuestData = { email?: string; name?: string; phone?: string }\n\nexport const validateGuestBooking =\n  (config: ResolvedReservationPluginConfig): CollectionBeforeChangeHook =>\n  async ({ context, data, operation, req }) => {\n    if (context?.skipReservationHooks) {\n      return data\n    }\n    if (operation !== 'create') {\n      return data\n    }\n\n    const customer = data?.customer\n    const guest = data?.guest as GuestData | undefined\n    const hasCustomer = customer != null && customer !== ''\n    const hasGuest =\n      guest != null && (Boolean(guest.name) || Boolean(guest.email) || Boolean(guest.phone))\n\n    if (!hasCustomer && !hasGuest) {\n      throw new ValidationError({\n        errors: [\n          {\n            message: (req.t as PluginT)('reservation:errorGuestOrCustomerRequired'),\n            path: 'customer',\n          },\n        ],\n      })\n    }\n\n    if (hasCustomer && hasGuest) {\n      throw new ValidationError({\n        errors: [\n          {\n            message: (req.t as PluginT)('reservation:errorGuestAndCustomer'),\n            path: 'guest',\n          },\n        ],\n      })\n    }\n\n    if (hasCustomer) {\n      return data\n    }\n\n    // Guest path\n    if (!guest?.name) {\n      throw new ValidationError({\n        errors: [\n          { message: (req.t as PluginT)('reservation:errorGuestNameRequired'), path: 'guest.name' },\n        ],\n      })\n    }\n    if (!guest.email && !guest.phone) {\n      throw new ValidationError({\n        errors: [\n          {\n            message: (req.t as PluginT)('reservation:errorGuestContactRequired'),\n            path: 'guest.email',\n          },\n        ],\n      })\n    }\n\n    // Gate by service — admins (non-customer collection users) bypass.\n    const isAdmin = req.user != null && req.user.collection !== config.slugs.customers\n    if (!isAdmin) {\n      const serviceId =\n        typeof data.service === 'object'\n          ? (data.service as { id?: string } | null)?.id\n          : data.service\n      // `service` is a required field on the collection, so Payload's field\n      // validation (which runs before this beforeChange hook) guarantees it is\n      // present for any booking that reaches here. The guard is purely defensive.\n      if (serviceId) {\n        // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        const service = await (req.payload.findByID as any)({\n          id: serviceId,\n          collection: config.slugs.services,\n          depth: 0,\n          req,\n        })\n        if (!resolveGuestBookingAllowed(service, config.allowGuestBooking)) {\n          throw new ValidationError({\n            errors: [\n              {\n                message: (req.t as PluginT)('reservation:errorGuestNotAllowed'),\n                path: 'guest',\n              },\n            ],\n          })\n        }\n      }\n    }\n\n    // Generate a cancellation token the host project can deliver to the guest.\n    if (!data.cancellationToken) {\n      data.cancellationToken = randomUUID()\n    }\n\n    return data\n  }\n"],"names":["randomUUID","ValidationError","resolveGuestBookingAllowed","validateGuestBooking","config","context","data","operation","req","skipReservationHooks","customer","guest","hasCustomer","hasGuest","Boolean","name","email","phone","errors","message","t","path","isAdmin","user","collection","slugs","customers","serviceId","service","id","payload","findByID","services","depth","allowGuestBooking","cancellationToken"],"mappings":"AAEA,SAASA,UAAU,QAAQ,cAAa;AACxC,SAASC,eAAe,QAAQ,UAAS;AAKzC,SAASC,0BAA0B,QAAQ,kCAAiC;AAI5E,OAAO,MAAMC,uBACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,IAAI,EAAEC,SAAS,EAAEC,GAAG,EAAE;QACtC,IAAIH,SAASI,sBAAsB;YACjC,OAAOH;QACT;QACA,IAAIC,cAAc,UAAU;YAC1B,OAAOD;QACT;QAEA,MAAMI,WAAWJ,MAAMI;QACvB,MAAMC,QAAQL,MAAMK;QACpB,MAAMC,cAAcF,YAAY,QAAQA,aAAa;QACrD,MAAMG,WACJF,SAAS,QAASG,CAAAA,QAAQH,MAAMI,IAAI,KAAKD,QAAQH,MAAMK,KAAK,KAAKF,QAAQH,MAAMM,KAAK,CAAA;QAEtF,IAAI,CAACL,eAAe,CAACC,UAAU;YAC7B,MAAM,IAAIZ,gBAAgB;gBACxBiB,QAAQ;oBACN;wBACEC,SAAS,AAACX,IAAIY,CAAC,CAAa;wBAC5BC,MAAM;oBACR;iBACD;YACH;QACF;QAEA,IAAIT,eAAeC,UAAU;YAC3B,MAAM,IAAIZ,gBAAgB;gBACxBiB,QAAQ;oBACN;wBACEC,SAAS,AAACX,IAAIY,CAAC,CAAa;wBAC5BC,MAAM;oBACR;iBACD;YACH;QACF;QAEA,IAAIT,aAAa;YACf,OAAON;QACT;QAEA,aAAa;QACb,IAAI,CAACK,OAAOI,MAAM;YAChB,MAAM,IAAId,gBAAgB;gBACxBiB,QAAQ;oBACN;wBAAEC,SAAS,AAACX,IAAIY,CAAC,CAAa;wBAAuCC,MAAM;oBAAa;iBACzF;YACH;QACF;QACA,IAAI,CAACV,MAAMK,KAAK,IAAI,CAACL,MAAMM,KAAK,EAAE;YAChC,MAAM,IAAIhB,gBAAgB;gBACxBiB,QAAQ;oBACN;wBACEC,SAAS,AAACX,IAAIY,CAAC,CAAa;wBAC5BC,MAAM;oBACR;iBACD;YACH;QACF;QAEA,mEAAmE;QACnE,MAAMC,UAAUd,IAAIe,IAAI,IAAI,QAAQf,IAAIe,IAAI,CAACC,UAAU,KAAKpB,OAAOqB,KAAK,CAACC,SAAS;QAClF,IAAI,CAACJ,SAAS;YACZ,MAAMK,YACJ,OAAOrB,KAAKsB,OAAO,KAAK,WACnBtB,KAAKsB,OAAO,EAA6BC,KAC1CvB,KAAKsB,OAAO;YAClB,sEAAsE;YACtE,yEAAyE;YACzE,4EAA4E;YAC5E,IAAID,WAAW;gBACb,8DAA8D;gBAC9D,MAAMC,UAAU,MAAM,AAACpB,IAAIsB,OAAO,CAACC,QAAQ,CAAS;oBAClDF,IAAIF;oBACJH,YAAYpB,OAAOqB,KAAK,CAACO,QAAQ;oBACjCC,OAAO;oBACPzB;gBACF;gBACA,IAAI,CAACN,2BAA2B0B,SAASxB,OAAO8B,iBAAiB,GAAG;oBAClE,MAAM,IAAIjC,gBAAgB;wBACxBiB,QAAQ;4BACN;gCACEC,SAAS,AAACX,IAAIY,CAAC,CAAa;gCAC5BC,MAAM;4BACR;yBACD;oBACH;gBACF;YACF;QACF;QAEA,2EAA2E;QAC3E,IAAI,CAACf,KAAK6B,iBAAiB,EAAE;YAC3B7B,KAAK6B,iBAAiB,GAAGnC;QAC3B;QAEA,OAAOM;IACT,EAAC"}
+{"version":3,"sources":["../../../src/hooks/reservations/validateGuestBooking.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload'\n\nimport { randomUUID } from 'node:crypto'\nimport { ValidationError } from 'payload'\n\nimport type { PluginT } from '../../translations/index.js'\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nimport { resolveGuestBookingAllowed } from '../../utilities/guestBooking.js'\n\ntype GuestData = { email?: string; name?: string; phone?: string }\n\nexport const validateGuestBooking =\n  (config: ResolvedReservationPluginConfig): CollectionBeforeChangeHook =>\n  async ({ context, data, operation, req }) => {\n    if (context?.skipReservationHooks) {\n      return data\n    }\n    if (operation !== 'create') {\n      return data\n    }\n\n    const customer = data?.customer\n    const guest = data?.guest as GuestData | undefined\n    const hasCustomer = customer != null && customer !== ''\n    const hasGuest =\n      guest != null && (Boolean(guest.name) || Boolean(guest.email) || Boolean(guest.phone))\n\n    if (!hasCustomer && !hasGuest) {\n      throw new ValidationError({\n        errors: [\n          {\n            message: (req.t as PluginT)('reservation:errorGuestOrCustomerRequired'),\n            path: 'customer',\n          },\n        ],\n      })\n    }\n\n    if (hasCustomer && hasGuest) {\n      throw new ValidationError({\n        errors: [\n          {\n            message: (req.t as PluginT)('reservation:errorGuestAndCustomer'),\n            path: 'guest',\n          },\n        ],\n      })\n    }\n\n    if (hasCustomer) {\n      return data\n    }\n\n    // Guest path\n    if (!guest?.name) {\n      throw new ValidationError({\n        errors: [\n          { message: (req.t as PluginT)('reservation:errorGuestNameRequired'), path: 'guest.name' },\n        ],\n      })\n    }\n    if (!guest.email && !guest.phone) {\n      throw new ValidationError({\n        errors: [\n          {\n            message: (req.t as PluginT)('reservation:errorGuestContactRequired'),\n            path: 'guest.email',\n          },\n        ],\n      })\n    }\n\n    // Gate by service — admins (non-customer collection users) bypass.\n    const isAdmin = req.user != null && req.user.collection !== config.slugs.customers\n    if (!isAdmin) {\n      const serviceId =\n        typeof data.service === 'object'\n          ? (data.service as { id?: string } | null)?.id\n          : data.service\n      // `service` is a required field on the collection, so Payload's field\n      // validation (which runs before this beforeChange hook) guarantees it is\n      // present for any booking that reaches here. The guard is purely defensive.\n      if (serviceId) {\n        // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        const service = await (req.payload.findByID as any)({\n          id: serviceId,\n          collection: config.slugs.services,\n          depth: 0,\n          req,\n        })\n        if (!resolveGuestBookingAllowed(service, config.allowGuestBooking)) {\n          throw new ValidationError({\n            errors: [\n              {\n                message: (req.t as PluginT)('reservation:errorGuestNotAllowed'),\n                path: 'guest',\n              },\n            ],\n          })\n        }\n      }\n    }\n\n    // Always server-generate the cancellation token the host project delivers\n    // to the guest — never honor a caller-supplied value (it's a secret).\n    data.cancellationToken = randomUUID()\n\n    return data\n  }\n"],"names":["randomUUID","ValidationError","resolveGuestBookingAllowed","validateGuestBooking","config","context","data","operation","req","skipReservationHooks","customer","guest","hasCustomer","hasGuest","Boolean","name","email","phone","errors","message","t","path","isAdmin","user","collection","slugs","customers","serviceId","service","id","payload","findByID","services","depth","allowGuestBooking","cancellationToken"],"mappings":"AAEA,SAASA,UAAU,QAAQ,cAAa;AACxC,SAASC,eAAe,QAAQ,UAAS;AAKzC,SAASC,0BAA0B,QAAQ,kCAAiC;AAI5E,OAAO,MAAMC,uBACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,IAAI,EAAEC,SAAS,EAAEC,GAAG,EAAE;QACtC,IAAIH,SAASI,sBAAsB;YACjC,OAAOH;QACT;QACA,IAAIC,cAAc,UAAU;YAC1B,OAAOD;QACT;QAEA,MAAMI,WAAWJ,MAAMI;QACvB,MAAMC,QAAQL,MAAMK;QACpB,MAAMC,cAAcF,YAAY,QAAQA,aAAa;QACrD,MAAMG,WACJF,SAAS,QAASG,CAAAA,QAAQH,MAAMI,IAAI,KAAKD,QAAQH,MAAMK,KAAK,KAAKF,QAAQH,MAAMM,KAAK,CAAA;QAEtF,IAAI,CAACL,eAAe,CAACC,UAAU;YAC7B,MAAM,IAAIZ,gBAAgB;gBACxBiB,QAAQ;oBACN;wBACEC,SAAS,AAACX,IAAIY,CAAC,CAAa;wBAC5BC,MAAM;oBACR;iBACD;YACH;QACF;QAEA,IAAIT,eAAeC,UAAU;YAC3B,MAAM,IAAIZ,gBAAgB;gBACxBiB,QAAQ;oBACN;wBACEC,SAAS,AAACX,IAAIY,CAAC,CAAa;wBAC5BC,MAAM;oBACR;iBACD;YACH;QACF;QAEA,IAAIT,aAAa;YACf,OAAON;QACT;QAEA,aAAa;QACb,IAAI,CAACK,OAAOI,MAAM;YAChB,MAAM,IAAId,gBAAgB;gBACxBiB,QAAQ;oBACN;wBAAEC,SAAS,AAACX,IAAIY,CAAC,CAAa;wBAAuCC,MAAM;oBAAa;iBACzF;YACH;QACF;QACA,IAAI,CAACV,MAAMK,KAAK,IAAI,CAACL,MAAMM,KAAK,EAAE;YAChC,MAAM,IAAIhB,gBAAgB;gBACxBiB,QAAQ;oBACN;wBACEC,SAAS,AAACX,IAAIY,CAAC,CAAa;wBAC5BC,MAAM;oBACR;iBACD;YACH;QACF;QAEA,mEAAmE;QACnE,MAAMC,UAAUd,IAAIe,IAAI,IAAI,QAAQf,IAAIe,IAAI,CAACC,UAAU,KAAKpB,OAAOqB,KAAK,CAACC,SAAS;QAClF,IAAI,CAACJ,SAAS;YACZ,MAAMK,YACJ,OAAOrB,KAAKsB,OAAO,KAAK,WACnBtB,KAAKsB,OAAO,EAA6BC,KAC1CvB,KAAKsB,OAAO;YAClB,sEAAsE;YACtE,yEAAyE;YACzE,4EAA4E;YAC5E,IAAID,WAAW;gBACb,8DAA8D;gBAC9D,MAAMC,UAAU,MAAM,AAACpB,IAAIsB,OAAO,CAACC,QAAQ,CAAS;oBAClDF,IAAIF;oBACJH,YAAYpB,OAAOqB,KAAK,CAACO,QAAQ;oBACjCC,OAAO;oBACPzB;gBACF;gBACA,IAAI,CAACN,2BAA2B0B,SAASxB,OAAO8B,iBAAiB,GAAG;oBAClE,MAAM,IAAIjC,gBAAgB;wBACxBiB,QAAQ;4BACN;gCACEC,SAAS,AAACX,IAAIY,CAAC,CAAa;gCAC5BC,MAAM;4BACR;yBACD;oBACH;gBACF;YACF;QACF;QAEA,0EAA0E;QAC1E,sEAAsE;QACtEf,KAAK6B,iBAAiB,GAAGnC;QAEzB,OAAOM;IACT,EAAC"}

package/dist/hooks/reservations/validateStatusTransition.js

@@ -56,7 +56,7 @@ export const validateStatusTransition = (config)=>async ({ context, data, operat
                     });
                 }
                 // Call beforeBookingConfirm plugin hooks
-                if (newStatus === 'confirmed' && config.hooks?.beforeBookingConfirm) {
+                if (newStatus === config.statusMachine.confirmStatus && config.hooks?.beforeBookingConfirm) {
                     for (const hook of config.hooks.beforeBookingConfirm){
                         await hook({
                             doc: {
@@ -69,7 +69,7 @@ export const validateStatusTransition = (config)=>async ({ context, data, operat
                     }
                 }
                 // Call beforeBookingCancel plugin hooks
-                if (newStatus === 'cancelled' && config.hooks?.beforeBookingCancel) {
+                if (newStatus === config.statusMachine.cancelStatus && config.hooks?.beforeBookingCancel) {
                     for (const hook of config.hooks.beforeBookingCancel){
                         await hook({
                             doc: {

package/dist/hooks/reservations/validateStatusTransition.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/hooks/reservations/validateStatusTransition.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload'\n\nimport { ValidationError } from 'payload'\n\nimport type { PluginT } from '../../translations/index.js'\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nimport { validateTransition } from '../../services/AvailabilityService.js'\nimport { isPrivilegedUser } from '../../utilities/userRoles.js'\n\nexport const validateStatusTransition =\n  (config: ResolvedReservationPluginConfig): CollectionBeforeChangeHook =>\n  async ({ context, data, operation, originalDoc, req }) => {\n    if (context?.skipReservationHooks) {return data}\n\n    const newStatus = data?.status as string | undefined\n    const { statusMachine } = config\n\n    if (operation === 'create') {\n      // context.allowConfirmedOnCreate is the escape hatch for payment hooks\n      // that need to create confirmed reservations programmatically\n      const hasContextBypass = Boolean(context?.allowConfirmedOnCreate)\n      // Staff/admin detection: collection-based, with a role-based fallback for\n      // single-collection deployments (userCollection set). See isPrivilegedUser.\n      const isAdmin = isPrivilegedUser(req.user, config)\n      const defaultStatus = statusMachine.defaultStatus\n      const nonDefaultStatuses = statusMachine.transitions[defaultStatus] ?? []\n      const allowedOnCreate: string[] = (isAdmin || hasContextBypass)\n        ? [defaultStatus, ...nonDefaultStatuses]\n        : [defaultStatus]\n\n      if (newStatus && !allowedOnCreate.includes(newStatus)) {\n        const allowed = allowedOnCreate.map((s) => `\"${s}\"`).join(' or ')\n        throw new ValidationError({\n          errors: [\n            {\n              message: (req.t as PluginT)('reservation:errorInvalidCreateStatus', { allowed }),\n              path: 'status',\n            },\n          ],\n        })\n      }\n\n      return data\n    }\n\n    // On update\n    if (operation === 'update' && newStatus) {\n      const previousStatus = originalDoc?.status as string | undefined\n\n      if (previousStatus && previousStatus !== newStatus) {\n        const result = validateTransition(previousStatus, newStatus, statusMachine)\n\n        if (!result.valid) {\n          throw new ValidationError({\n            errors: [\n              {\n                message: (req.t as PluginT)('reservation:errorInvalidTransition', {\n                  from: previousStatus,\n                  to: newStatus,\n                }),\n                path: 'status',\n              },\n            ],\n          })\n        }\n\n        // Call beforeBookingConfirm plugin hooks\n        if (newStatus === 'confirmed' && config.hooks?.beforeBookingConfirm) {\n          for (const hook of config.hooks.beforeBookingConfirm) {\n            await hook({\n              doc: { ...(originalDoc as Record<string, unknown>), ...(data as Record<string, unknown>) },\n              newStatus,\n              req,\n            })\n          }\n        }\n\n        // Call beforeBookingCancel plugin hooks\n        if (newStatus === 'cancelled' && config.hooks?.beforeBookingCancel) {\n          for (const hook of config.hooks.beforeBookingCancel) {\n            await hook({\n              doc: { ...(originalDoc as Record<string, unknown>), ...(data as Record<string, unknown>) },\n              reason: data?.cancellationReason as string | undefined,\n              req,\n            })\n          }\n        }\n      }\n    }\n\n    return data\n  }\n"],"names":["ValidationError","validateTransition","isPrivilegedUser","validateStatusTransition","config","context","data","operation","originalDoc","req","skipReservationHooks","newStatus","status","statusMachine","hasContextBypass","Boolean","allowConfirmedOnCreate","isAdmin","user","defaultStatus","nonDefaultStatuses","transitions","allowedOnCreate","includes","allowed","map","s","join","errors","message","t","path","previousStatus","result","valid","from","to","hooks","beforeBookingConfirm","hook","doc","beforeBookingCancel","reason","cancellationReason"],"mappings":"AAEA,SAASA,eAAe,QAAQ,UAAS;AAKzC,SAASC,kBAAkB,QAAQ,wCAAuC;AAC1E,SAASC,gBAAgB,QAAQ,+BAA8B;AAE/D,OAAO,MAAMC,2BACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,GAAG,EAAE;QACnD,IAAIJ,SAASK,sBAAsB;YAAC,OAAOJ;QAAI;QAE/C,MAAMK,YAAYL,MAAMM;QACxB,MAAM,EAAEC,aAAa,EAAE,GAAGT;QAE1B,IAAIG,cAAc,UAAU;YAC1B,uEAAuE;YACvE,8DAA8D;YAC9D,MAAMO,mBAAmBC,QAAQV,SAASW;YAC1C,0EAA0E;YAC1E,4EAA4E;YAC5E,MAAMC,UAAUf,iBAAiBO,IAAIS,IAAI,EAAEd;YAC3C,MAAMe,gBAAgBN,cAAcM,aAAa;YACjD,MAAMC,qBAAqBP,cAAcQ,WAAW,CAACF,cAAc,IAAI,EAAE;YACzE,MAAMG,kBAA4B,AAACL,WAAWH,mBAC1C;gBAACK;mBAAkBC;aAAmB,GACtC;gBAACD;aAAc;YAEnB,IAAIR,aAAa,CAACW,gBAAgBC,QAAQ,CAACZ,YAAY;gBACrD,MAAMa,UAAUF,gBAAgBG,GAAG,CAAC,CAACC,IAAM,CAAC,CAAC,EAAEA,EAAE,CAAC,CAAC,EAAEC,IAAI,CAAC;gBAC1D,MAAM,IAAI3B,gBAAgB;oBACxB4B,QAAQ;wBACN;4BACEC,SAAS,AAACpB,IAAIqB,CAAC,CAAa,wCAAwC;gCAAEN;4BAAQ;4BAC9EO,MAAM;wBACR;qBACD;gBACH;YACF;YAEA,OAAOzB;QACT;QAEA,YAAY;QACZ,IAAIC,cAAc,YAAYI,WAAW;YACvC,MAAMqB,iBAAiBxB,aAAaI;YAEpC,IAAIoB,kBAAkBA,mBAAmBrB,WAAW;gBAClD,MAAMsB,SAAShC,mBAAmB+B,gBAAgBrB,WAAWE;gBAE7D,IAAI,CAACoB,OAAOC,KAAK,EAAE;oBACjB,MAAM,IAAIlC,gBAAgB;wBACxB4B,QAAQ;4BACN;gCACEC,SAAS,AAACpB,IAAIqB,CAAC,CAAa,sCAAsC;oCAChEK,MAAMH;oCACNI,IAAIzB;gCACN;gCACAoB,MAAM;4BACR;yBACD;oBACH;gBACF;gBAEA,yCAAyC;gBACzC,IAAIpB,cAAc,eAAeP,OAAOiC,KAAK,EAAEC,sBAAsB;oBACnE,KAAK,MAAMC,QAAQnC,OAAOiC,KAAK,CAACC,oBAAoB,CAAE;wBACpD,MAAMC,KAAK;4BACTC,KAAK;gCAAE,GAAIhC,WAAW;gCAA8B,GAAIF,IAAI;4BAA6B;4BACzFK;4BACAF;wBACF;oBACF;gBACF;gBAEA,wCAAwC;gBACxC,IAAIE,cAAc,eAAeP,OAAOiC,KAAK,EAAEI,qBAAqB;oBAClE,KAAK,MAAMF,QAAQnC,OAAOiC,KAAK,CAACI,mBAAmB,CAAE;wBACnD,MAAMF,KAAK;4BACTC,KAAK;gCAAE,GAAIhC,WAAW;gCAA8B,GAAIF,IAAI;4BAA6B;4BACzFoC,QAAQpC,MAAMqC;4BACdlC;wBACF;oBACF;gBACF;YACF;QACF;QAEA,OAAOH;IACT,EAAC"}
+{"version":3,"sources":["../../../src/hooks/reservations/validateStatusTransition.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload'\n\nimport { ValidationError } from 'payload'\n\nimport type { PluginT } from '../../translations/index.js'\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nimport { validateTransition } from '../../services/AvailabilityService.js'\nimport { isPrivilegedUser } from '../../utilities/userRoles.js'\n\nexport const validateStatusTransition =\n  (config: ResolvedReservationPluginConfig): CollectionBeforeChangeHook =>\n  async ({ context, data, operation, originalDoc, req }) => {\n    if (context?.skipReservationHooks) {return data}\n\n    const newStatus = data?.status as string | undefined\n    const { statusMachine } = config\n\n    if (operation === 'create') {\n      // context.allowConfirmedOnCreate is the escape hatch for payment hooks\n      // that need to create confirmed reservations programmatically\n      const hasContextBypass = Boolean(context?.allowConfirmedOnCreate)\n      // Staff/admin detection: collection-based, with a role-based fallback for\n      // single-collection deployments (userCollection set). See isPrivilegedUser.\n      const isAdmin = isPrivilegedUser(req.user, config)\n      const defaultStatus = statusMachine.defaultStatus\n      const nonDefaultStatuses = statusMachine.transitions[defaultStatus] ?? []\n      const allowedOnCreate: string[] = (isAdmin || hasContextBypass)\n        ? [defaultStatus, ...nonDefaultStatuses]\n        : [defaultStatus]\n\n      if (newStatus && !allowedOnCreate.includes(newStatus)) {\n        const allowed = allowedOnCreate.map((s) => `\"${s}\"`).join(' or ')\n        throw new ValidationError({\n          errors: [\n            {\n              message: (req.t as PluginT)('reservation:errorInvalidCreateStatus', { allowed }),\n              path: 'status',\n            },\n          ],\n        })\n      }\n\n      return data\n    }\n\n    // On update\n    if (operation === 'update' && newStatus) {\n      const previousStatus = originalDoc?.status as string | undefined\n\n      if (previousStatus && previousStatus !== newStatus) {\n        const result = validateTransition(previousStatus, newStatus, statusMachine)\n\n        if (!result.valid) {\n          throw new ValidationError({\n            errors: [\n              {\n                message: (req.t as PluginT)('reservation:errorInvalidTransition', {\n                  from: previousStatus,\n                  to: newStatus,\n                }),\n                path: 'status',\n              },\n            ],\n          })\n        }\n\n        // Call beforeBookingConfirm plugin hooks\n        if (newStatus === config.statusMachine.confirmStatus && config.hooks?.beforeBookingConfirm) {\n          for (const hook of config.hooks.beforeBookingConfirm) {\n            await hook({\n              doc: { ...(originalDoc as Record<string, unknown>), ...(data as Record<string, unknown>) },\n              newStatus,\n              req,\n            })\n          }\n        }\n\n        // Call beforeBookingCancel plugin hooks\n        if (newStatus === config.statusMachine.cancelStatus && config.hooks?.beforeBookingCancel) {\n          for (const hook of config.hooks.beforeBookingCancel) {\n            await hook({\n              doc: { ...(originalDoc as Record<string, unknown>), ...(data as Record<string, unknown>) },\n              reason: data?.cancellationReason as string | undefined,\n              req,\n            })\n          }\n        }\n      }\n    }\n\n    return data\n  }\n"],"names":["ValidationError","validateTransition","isPrivilegedUser","validateStatusTransition","config","context","data","operation","originalDoc","req","skipReservationHooks","newStatus","status","statusMachine","hasContextBypass","Boolean","allowConfirmedOnCreate","isAdmin","user","defaultStatus","nonDefaultStatuses","transitions","allowedOnCreate","includes","allowed","map","s","join","errors","message","t","path","previousStatus","result","valid","from","to","confirmStatus","hooks","beforeBookingConfirm","hook","doc","cancelStatus","beforeBookingCancel","reason","cancellationReason"],"mappings":"AAEA,SAASA,eAAe,QAAQ,UAAS;AAKzC,SAASC,kBAAkB,QAAQ,wCAAuC;AAC1E,SAASC,gBAAgB,QAAQ,+BAA8B;AAE/D,OAAO,MAAMC,2BACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,GAAG,EAAE;QACnD,IAAIJ,SAASK,sBAAsB;YAAC,OAAOJ;QAAI;QAE/C,MAAMK,YAAYL,MAAMM;QACxB,MAAM,EAAEC,aAAa,EAAE,GAAGT;QAE1B,IAAIG,cAAc,UAAU;YAC1B,uEAAuE;YACvE,8DAA8D;YAC9D,MAAMO,mBAAmBC,QAAQV,SAASW;YAC1C,0EAA0E;YAC1E,4EAA4E;YAC5E,MAAMC,UAAUf,iBAAiBO,IAAIS,IAAI,EAAEd;YAC3C,MAAMe,gBAAgBN,cAAcM,aAAa;YACjD,MAAMC,qBAAqBP,cAAcQ,WAAW,CAACF,cAAc,IAAI,EAAE;YACzE,MAAMG,kBAA4B,AAACL,WAAWH,mBAC1C;gBAACK;mBAAkBC;aAAmB,GACtC;gBAACD;aAAc;YAEnB,IAAIR,aAAa,CAACW,gBAAgBC,QAAQ,CAACZ,YAAY;gBACrD,MAAMa,UAAUF,gBAAgBG,GAAG,CAAC,CAACC,IAAM,CAAC,CAAC,EAAEA,EAAE,CAAC,CAAC,EAAEC,IAAI,CAAC;gBAC1D,MAAM,IAAI3B,gBAAgB;oBACxB4B,QAAQ;wBACN;4BACEC,SAAS,AAACpB,IAAIqB,CAAC,CAAa,wCAAwC;gCAAEN;4BAAQ;4BAC9EO,MAAM;wBACR;qBACD;gBACH;YACF;YAEA,OAAOzB;QACT;QAEA,YAAY;QACZ,IAAIC,cAAc,YAAYI,WAAW;YACvC,MAAMqB,iBAAiBxB,aAAaI;YAEpC,IAAIoB,kBAAkBA,mBAAmBrB,WAAW;gBAClD,MAAMsB,SAAShC,mBAAmB+B,gBAAgBrB,WAAWE;gBAE7D,IAAI,CAACoB,OAAOC,KAAK,EAAE;oBACjB,MAAM,IAAIlC,gBAAgB;wBACxB4B,QAAQ;4BACN;gCACEC,SAAS,AAACpB,IAAIqB,CAAC,CAAa,sCAAsC;oCAChEK,MAAMH;oCACNI,IAAIzB;gCACN;gCACAoB,MAAM;4BACR;yBACD;oBACH;gBACF;gBAEA,yCAAyC;gBACzC,IAAIpB,cAAcP,OAAOS,aAAa,CAACwB,aAAa,IAAIjC,OAAOkC,KAAK,EAAEC,sBAAsB;oBAC1F,KAAK,MAAMC,QAAQpC,OAAOkC,KAAK,CAACC,oBAAoB,CAAE;wBACpD,MAAMC,KAAK;4BACTC,KAAK;gCAAE,GAAIjC,WAAW;gCAA8B,GAAIF,IAAI;4BAA6B;4BACzFK;4BACAF;wBACF;oBACF;gBACF;gBAEA,wCAAwC;gBACxC,IAAIE,cAAcP,OAAOS,aAAa,CAAC6B,YAAY,IAAItC,OAAOkC,KAAK,EAAEK,qBAAqB;oBACxF,KAAK,MAAMH,QAAQpC,OAAOkC,KAAK,CAACK,mBAAmB,CAAE;wBACnD,MAAMH,KAAK;4BACTC,KAAK;gCAAE,GAAIjC,WAAW;gCAA8B,GAAIF,IAAI;4BAA6B;4BACzFsC,QAAQtC,MAAMuC;4BACdpC;wBACF;oBACF;gBACF;YACF;QACF;QAEA,OAAOH;IACT,EAAC"}

package/dist/hooks/users/provisionStaffResource.js

@@ -13,7 +13,7 @@
  * whose `user` is the new staff user (spreading the original req preserves
  * `transactionID` for atomicity). The owner field's force-owner-to-req.user
  * rule then assigns the correct owner with no bypass flag — nothing to exploit.
- */ export const provisionStaffResource = (config)=>async ({ context, doc, operation, previousDoc, req })=>{
+ */ export const provisionStaffResource = (config)=>async ({ context, doc, req })=>{
         if (context?.skipReservationHooks) {
             return doc;
         }
@@ -26,13 +26,10 @@
         if (!isStaffNow) {
             return doc;
         }
-        if (operation === 'update') {
-            // Skip if the user was already staff — provisioned on a prior save.
-            const wasStaff = roleMatches(previousDoc?.[sp.roleField], sp.staffRoles);
-            if (wasStaff) {
-                return doc;
-            }
-        }
+        // Idempotency is enforced by the dedup-by-owner query below — NOT by an
+        // early "was already staff" return. Relying on the query means pre-existing
+        // staff (enabled after the fact) and users whose Resource was deleted get
+        // (re)provisioned on their next save (review C5).
         const ownerField = config.resourceOwnerMode?.ownerField ?? 'owner';
         try {
             // Idempotency: skip if a resource already owns this user.

package/dist/hooks/users/provisionStaffResource.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/hooks/users/provisionStaffResource.ts"],"sourcesContent":["import type { CollectionAfterChangeHook, CollectionSlug } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\n/** True if the user's role value (string or string[]) intersects staffRoles. */\nexport function roleMatches(role: unknown, staffRoles: string[]): boolean {\n  if (Array.isArray(role)) {\n    return role.some((r) => staffRoles.includes(r as string))\n  }\n  return typeof role === 'string' && staffRoles.includes(role)\n}\n\n/**\n * afterChange hook for the staff user collection. On create — or on an update\n * that promotes a user into a staff role — provisions a paired Resource owned\n * by that user, unless one already exists.\n *\n * Ownership is assigned via IMPERSONATION: the Resource is created with a `req`\n * whose `user` is the new staff user (spreading the original req preserves\n * `transactionID` for atomicity). The owner field's force-owner-to-req.user\n * rule then assigns the correct owner with no bypass flag — nothing to exploit.\n */\nexport const provisionStaffResource =\n  (config: ResolvedReservationPluginConfig): CollectionAfterChangeHook =>\n  async ({ context, doc, operation, previousDoc, req }) => {\n    if (context?.skipReservationHooks) {\n      return doc\n    }\n\n    const sp = config.staffProvisioning\n    if (!sp) {\n      return doc\n    }\n\n    const d = doc as Record<string, unknown>\n    const isStaffNow = roleMatches(d[sp.roleField], sp.staffRoles)\n    if (!isStaffNow) {\n      return doc\n    }\n\n    if (operation === 'update') {\n      // Skip if the user was already staff — provisioned on a prior save.\n      const wasStaff = roleMatches(\n        (previousDoc as Record<string, unknown> | undefined)?.[sp.roleField],\n        sp.staffRoles,\n      )\n      if (wasStaff) {\n        return doc\n      }\n    }\n\n    const ownerField = config.resourceOwnerMode?.ownerField ?? 'owner'\n\n    try {\n      // Idempotency: skip if a resource already owns this user.\n      const existing = await req.payload.find({\n        collection: config.slugs.resources as unknown as CollectionSlug,\n        depth: 0,\n        limit: 1,\n        req,\n        where: { [ownerField]: { equals: d.id } },\n      })\n      if (existing.docs.length > 0) {\n        return doc\n      }\n\n      let data: Record<string, unknown> = {\n        name: (d[sp.nameFrom] as string) ?? (d.email as string),\n        [ownerField]: d.id,\n        quantity: 1,\n        resourceType: sp.resourceType,\n      }\n\n      if (sp.beforeCreate) {\n        data = await sp.beforeCreate({ data, req, user: d })\n      }\n\n      // Impersonate the new staff user so the owner field resolves to them, not\n      // the admin who triggered the create. Spread preserves the transaction.\n      await req.payload.create({\n        collection: config.slugs.resources as unknown as CollectionSlug,\n        data,\n        req: { ...req, user: { ...d, collection: sp.userCollection } } as typeof req,\n      })\n    } catch (err) {\n      req.payload.logger.error({\n        err,\n        msg: `provisionStaffResource: failed to provision a resource for user ${String(d.id)}`,\n      })\n    }\n\n    return doc\n  }\n"],"names":["roleMatches","role","staffRoles","Array","isArray","some","r","includes","provisionStaffResource","config","context","doc","operation","previousDoc","req","skipReservationHooks","sp","staffProvisioning","d","isStaffNow","roleField","wasStaff","ownerField","resourceOwnerMode","existing","payload","find","collection","slugs","resources","depth","limit","where","equals","id","docs","length","data","name","nameFrom","email","quantity","resourceType","beforeCreate","user","create","userCollection","err","logger","error","msg","String"],"mappings":"AAIA,8EAA8E,GAC9E,OAAO,SAASA,YAAYC,IAAa,EAAEC,UAAoB;IAC7D,IAAIC,MAAMC,OAAO,CAACH,OAAO;QACvB,OAAOA,KAAKI,IAAI,CAAC,CAACC,IAAMJ,WAAWK,QAAQ,CAACD;IAC9C;IACA,OAAO,OAAOL,SAAS,YAAYC,WAAWK,QAAQ,CAACN;AACzD;AAEA;;;;;;;;;CASC,GACD,OAAO,MAAMO,yBACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,GAAG,EAAEC,SAAS,EAAEC,WAAW,EAAEC,GAAG,EAAE;QAClD,IAAIJ,SAASK,sBAAsB;YACjC,OAAOJ;QACT;QAEA,MAAMK,KAAKP,OAAOQ,iBAAiB;QACnC,IAAI,CAACD,IAAI;YACP,OAAOL;QACT;QAEA,MAAMO,IAAIP;QACV,MAAMQ,aAAanB,YAAYkB,CAAC,CAACF,GAAGI,SAAS,CAAC,EAAEJ,GAAGd,UAAU;QAC7D,IAAI,CAACiB,YAAY;YACf,OAAOR;QACT;QAEA,IAAIC,cAAc,UAAU;YAC1B,oEAAoE;YACpE,MAAMS,WAAWrB,YACda,aAAqD,CAACG,GAAGI,SAAS,CAAC,EACpEJ,GAAGd,UAAU;YAEf,IAAImB,UAAU;gBACZ,OAAOV;YACT;QACF;QAEA,MAAMW,aAAab,OAAOc,iBAAiB,EAAED,cAAc;QAE3D,IAAI;YACF,0DAA0D;YAC1D,MAAME,WAAW,MAAMV,IAAIW,OAAO,CAACC,IAAI,CAAC;gBACtCC,YAAYlB,OAAOmB,KAAK,CAACC,SAAS;gBAClCC,OAAO;gBACPC,OAAO;gBACPjB;gBACAkB,OAAO;oBAAE,CAACV,WAAW,EAAE;wBAAEW,QAAQf,EAAEgB,EAAE;oBAAC;gBAAE;YAC1C;YACA,IAAIV,SAASW,IAAI,CAACC,MAAM,GAAG,GAAG;gBAC5B,OAAOzB;YACT;YAEA,IAAI0B,OAAgC;gBAClCC,MAAM,AAACpB,CAAC,CAACF,GAAGuB,QAAQ,CAAC,IAAgBrB,EAAEsB,KAAK;gBAC5C,CAAClB,WAAW,EAAEJ,EAAEgB,EAAE;gBAClBO,UAAU;gBACVC,cAAc1B,GAAG0B,YAAY;YAC/B;YAEA,IAAI1B,GAAG2B,YAAY,EAAE;gBACnBN,OAAO,MAAMrB,GAAG2B,YAAY,CAAC;oBAAEN;oBAAMvB;oBAAK8B,MAAM1B;gBAAE;YACpD;YAEA,0EAA0E;YAC1E,wEAAwE;YACxE,MAAMJ,IAAIW,OAAO,CAACoB,MAAM,CAAC;gBACvBlB,YAAYlB,OAAOmB,KAAK,CAACC,SAAS;gBAClCQ;gBACAvB,KAAK;oBAAE,GAAGA,GAAG;oBAAE8B,MAAM;wBAAE,GAAG1B,CAAC;wBAAES,YAAYX,GAAG8B,cAAc;oBAAC;gBAAE;YAC/D;QACF,EAAE,OAAOC,KAAK;YACZjC,IAAIW,OAAO,CAACuB,MAAM,CAACC,KAAK,CAAC;gBACvBF;gBACAG,KAAK,CAAC,gEAAgE,EAAEC,OAAOjC,EAAEgB,EAAE,GAAG;YACxF;QACF;QAEA,OAAOvB;IACT,EAAC"}
+{"version":3,"sources":["../../../src/hooks/users/provisionStaffResource.ts"],"sourcesContent":["import type { CollectionAfterChangeHook, CollectionSlug } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\n/** True if the user's role value (string or string[]) intersects staffRoles. */\nexport function roleMatches(role: unknown, staffRoles: string[]): boolean {\n  if (Array.isArray(role)) {\n    return role.some((r) => staffRoles.includes(r as string))\n  }\n  return typeof role === 'string' && staffRoles.includes(role)\n}\n\n/**\n * afterChange hook for the staff user collection. On create — or on an update\n * that promotes a user into a staff role — provisions a paired Resource owned\n * by that user, unless one already exists.\n *\n * Ownership is assigned via IMPERSONATION: the Resource is created with a `req`\n * whose `user` is the new staff user (spreading the original req preserves\n * `transactionID` for atomicity). The owner field's force-owner-to-req.user\n * rule then assigns the correct owner with no bypass flag — nothing to exploit.\n */\nexport const provisionStaffResource =\n  (config: ResolvedReservationPluginConfig): CollectionAfterChangeHook =>\n  async ({ context, doc, req }) => {\n    if (context?.skipReservationHooks) {\n      return doc\n    }\n\n    const sp = config.staffProvisioning\n    if (!sp) {\n      return doc\n    }\n\n    const d = doc as Record<string, unknown>\n    const isStaffNow = roleMatches(d[sp.roleField], sp.staffRoles)\n    if (!isStaffNow) {\n      return doc\n    }\n\n    // Idempotency is enforced by the dedup-by-owner query below — NOT by an\n    // early \"was already staff\" return. Relying on the query means pre-existing\n    // staff (enabled after the fact) and users whose Resource was deleted get\n    // (re)provisioned on their next save (review C5).\n    const ownerField = config.resourceOwnerMode?.ownerField ?? 'owner'\n\n    try {\n      // Idempotency: skip if a resource already owns this user.\n      const existing = await req.payload.find({\n        collection: config.slugs.resources as unknown as CollectionSlug,\n        depth: 0,\n        limit: 1,\n        req,\n        where: { [ownerField]: { equals: d.id } },\n      })\n      if (existing.docs.length > 0) {\n        return doc\n      }\n\n      let data: Record<string, unknown> = {\n        name: (d[sp.nameFrom] as string) ?? (d.email as string),\n        [ownerField]: d.id,\n        quantity: 1,\n        resourceType: sp.resourceType,\n      }\n\n      if (sp.beforeCreate) {\n        data = await sp.beforeCreate({ data, req, user: d })\n      }\n\n      // Impersonate the new staff user so the owner field resolves to them, not\n      // the admin who triggered the create. Spread preserves the transaction.\n      await req.payload.create({\n        collection: config.slugs.resources as unknown as CollectionSlug,\n        data,\n        req: { ...req, user: { ...d, collection: sp.userCollection } } as typeof req,\n      })\n    } catch (err) {\n      req.payload.logger.error({\n        err,\n        msg: `provisionStaffResource: failed to provision a resource for user ${String(d.id)}`,\n      })\n    }\n\n    return doc\n  }\n"],"names":["roleMatches","role","staffRoles","Array","isArray","some","r","includes","provisionStaffResource","config","context","doc","req","skipReservationHooks","sp","staffProvisioning","d","isStaffNow","roleField","ownerField","resourceOwnerMode","existing","payload","find","collection","slugs","resources","depth","limit","where","equals","id","docs","length","data","name","nameFrom","email","quantity","resourceType","beforeCreate","user","create","userCollection","err","logger","error","msg","String"],"mappings":"AAIA,8EAA8E,GAC9E,OAAO,SAASA,YAAYC,IAAa,EAAEC,UAAoB;IAC7D,IAAIC,MAAMC,OAAO,CAACH,OAAO;QACvB,OAAOA,KAAKI,IAAI,CAAC,CAACC,IAAMJ,WAAWK,QAAQ,CAACD;IAC9C;IACA,OAAO,OAAOL,SAAS,YAAYC,WAAWK,QAAQ,CAACN;AACzD;AAEA;;;;;;;;;CASC,GACD,OAAO,MAAMO,yBACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,GAAG,EAAEC,GAAG,EAAE;QAC1B,IAAIF,SAASG,sBAAsB;YACjC,OAAOF;QACT;QAEA,MAAMG,KAAKL,OAAOM,iBAAiB;QACnC,IAAI,CAACD,IAAI;YACP,OAAOH;QACT;QAEA,MAAMK,IAAIL;QACV,MAAMM,aAAajB,YAAYgB,CAAC,CAACF,GAAGI,SAAS,CAAC,EAAEJ,GAAGZ,UAAU;QAC7D,IAAI,CAACe,YAAY;YACf,OAAON;QACT;QAEA,wEAAwE;QACxE,4EAA4E;QAC5E,0EAA0E;QAC1E,kDAAkD;QAClD,MAAMQ,aAAaV,OAAOW,iBAAiB,EAAED,cAAc;QAE3D,IAAI;YACF,0DAA0D;YAC1D,MAAME,WAAW,MAAMT,IAAIU,OAAO,CAACC,IAAI,CAAC;gBACtCC,YAAYf,OAAOgB,KAAK,CAACC,SAAS;gBAClCC,OAAO;gBACPC,OAAO;gBACPhB;gBACAiB,OAAO;oBAAE,CAACV,WAAW,EAAE;wBAAEW,QAAQd,EAAEe,EAAE;oBAAC;gBAAE;YAC1C;YACA,IAAIV,SAASW,IAAI,CAACC,MAAM,GAAG,GAAG;gBAC5B,OAAOtB;YACT;YAEA,IAAIuB,OAAgC;gBAClCC,MAAM,AAACnB,CAAC,CAACF,GAAGsB,QAAQ,CAAC,IAAgBpB,EAAEqB,KAAK;gBAC5C,CAAClB,WAAW,EAAEH,EAAEe,EAAE;gBAClBO,UAAU;gBACVC,cAAczB,GAAGyB,YAAY;YAC/B;YAEA,IAAIzB,GAAG0B,YAAY,EAAE;gBACnBN,OAAO,MAAMpB,GAAG0B,YAAY,CAAC;oBAAEN;oBAAMtB;oBAAK6B,MAAMzB;gBAAE;YACpD;YAEA,0EAA0E;YAC1E,wEAAwE;YACxE,MAAMJ,IAAIU,OAAO,CAACoB,MAAM,CAAC;gBACvBlB,YAAYf,OAAOgB,KAAK,CAACC,SAAS;gBAClCQ;gBACAtB,KAAK;oBAAE,GAAGA,GAAG;oBAAE6B,MAAM;wBAAE,GAAGzB,CAAC;wBAAEQ,YAAYV,GAAG6B,cAAc;oBAAC;gBAAE;YAC/D;QACF,EAAE,OAAOC,KAAK;YACZhC,IAAIU,OAAO,CAACuB,MAAM,CAACC,KAAK,CAAC;gBACvBF;gBACAG,KAAK,CAAC,gEAAgE,EAAEC,OAAOhC,EAAEe,EAAE,GAAG;YACxF;QACF;QAEA,OAAOpB;IACT,EAAC"}

package/dist/plugin.js

@@ -13,6 +13,36 @@ import { createGetSlotsEndpoint } from './endpoints/getSlots.js';
 import { createResourceAvailabilityEndpoint } from './endpoints/resourceAvailability.js';
 import { provisionStaffResource } from './hooks/users/provisionStaffResource.js';
 import { translations } from './translations/index.js';
+import { applyCollectionOverride } from './utilities/collectionOverrides.js';
+/**
+ * All named field paths reachable from a field list, descending through
+ * presentational containers (tabs, rows, collapsibles, unnamed groups) that
+ * don't create their own data nesting — so dedup catches a field declared
+ * inside one of them. Named groups/arrays DO nest data, so we don't recurse
+ * into them (a `name` inside a named group is a different path).
+ */ function collectFieldNames(fields) {
+    const names = new Set();
+    const walk = (list)=>{
+        for (const field of list){
+            if ('name' in field && field.name) {
+                names.add(field.name);
+            } else if ('tabs' in field && Array.isArray(field.tabs)) {
+                for (const tab of field.tabs){
+                    if ('name' in tab && tab.name) {
+                        names.add(tab.name);
+                    } else if (Array.isArray(tab.fields)) {
+                        walk(tab.fields);
+                    }
+                }
+            } else if ('fields' in field && Array.isArray(field.fields)) {
+                // row / collapsible / unnamed group
+                walk(field.fields);
+            }
+        }
+    };
+    walk(fields);
+    return names;
+}
 export const payloadReserve = (pluginOptions = {})=>(config)=>{
         const resolved = resolveConfig(pluginOptions);
         // Detect localization from the Payload config
@@ -22,24 +52,29 @@ export const payloadReserve = (pluginOptions = {})=>(config)=>{
         if (!config.collections) {
             config.collections = [];
         }
-        if (resolved.disabled) {
-            return config;
-        }
         if (resolved.userCollection) {
             // Extend the existing auth collection with customer fields
             const targetCollection = config.collections.find((col)=>col.slug === resolved.userCollection);
-            if (targetCollection) {
-                // Collect existing field names for deduplication check
-                const existingFieldNames = new Set(targetCollection.fields.map((field)=>'name' in field ? field.name : undefined).filter(Boolean));
+            if (!targetCollection) {
+                // Fail loudly rather than silently skipping field injection and pointing
+                // the customers slug at a collection that doesn't exist (review C2).
+                throw new Error(`payload-reserve: userCollection "${resolved.userCollection}" was not found in config.collections. ` + `Define it before payloadReserve() runs, or correct the slug.`);
+            }
+            {
+                // Collect existing field names — descend into presentational containers
+                // (tabs/rows/collapsibles/groups) so a field nested there isn't
+                // re-injected at the top level (review C4).
+                const existingFieldNames = collectFieldNames(targetCollection.fields);
                 // Fields to inject if not already present. `name` is added so that
                 // admin.useAsTitle: 'name' works out of the box on the extended user
                 // collection (matches the v1.0.0 behaviour documented in README/SKILL).
+                // It is NOT required — an existing users collection may have rows
+                // without a name, and forcing required would fail their next update (C4).
                 const fieldsToAdd = [
                     {
                         name: 'name',
                         type: 'text',
-                        maxLength: 200,
-                        required: true
+                        maxLength: 200
                     },
                     {
                         name: 'phone',
@@ -67,11 +102,43 @@ export const payloadReserve = (pluginOptions = {})=>(config)=>{
             // Point the customers slug at the user collection so other parts of the
             // plugin (endpoints, hooks) reference the correct collection
             resolved.slugs.customers = resolved.userCollection;
-            // Push only the 4 domain collections (no standalone Customers)
-            config.collections.push(createServicesCollection(resolved), createResourcesCollection(resolved), createSchedulesCollection(resolved), createReservationsCollection(resolved));
-        } else {
-            // Default behaviour: push all 5 collections including standalone Customers
-            config.collections.push(createServicesCollection(resolved), createResourcesCollection(resolved), createSchedulesCollection(resolved), createReservationsCollection(resolved), createCustomersCollection(resolved));
+        }
+        // The slugs this plugin is about to register (Customers only in standalone mode)
+        const slugsToRegister = [
+            resolved.slugs.services,
+            resolved.slugs.resources,
+            resolved.slugs.schedules,
+            resolved.slugs.reservations,
+            ...resolved.userCollection ? [] : [
+                resolved.slugs.customers
+            ]
+        ];
+        // C11: fail with a clear, actionable error on slug collision instead of
+        // Payload's generic DuplicateCollection throw.
+        for (const slug of slugsToRegister){
+            if (config.collections.some((col)=>col.slug === slug)) {
+                throw new Error(`payload-reserve: a collection with slug "${slug}" already exists. ` + `Override the plugin's slug via the \`slugs\` option.`);
+            }
+        }
+        // Image upload fields are added only when the media collection actually
+        // exists, so installs without one don't hit an opaque init error (C8).
+        resolved.hasMediaCollection = config.collections.some((col)=>col.slug === resolved.slugs.media);
+        const ov = resolved.collectionOverrides;
+        config.collections.push(applyCollectionOverride(createServicesCollection(resolved), ov.services), applyCollectionOverride(createResourcesCollection(resolved), ov.resources), applyCollectionOverride(createSchedulesCollection(resolved), ov.schedules), applyCollectionOverride(createReservationsCollection(resolved), ov.reservations), // The customers override applies only in standalone mode; in userCollection
+        // mode the host owns that collection and can edit it directly.
+        ...resolved.userCollection ? [] : [
+            applyCollectionOverride(createCustomersCollection(resolved), ov.customers)
+        ]);
+        // C3: collections are registered (above) even when disabled so the DB schema
+        // stays stable; behavior (hooks, endpoints, admin, provisioning) is inert.
+        if (resolved.disabled) {
+            for (const slug of slugsToRegister){
+                const col = config.collections.find((c)=>c.slug === slug);
+                if (col) {
+                    delete col.hooks;
+                }
+            }
+            return config;
         }
         // Register custom endpoints
         if (!config.endpoints) {
@@ -108,6 +175,8 @@ export const payloadReserve = (pluginOptions = {})=>(config)=>{
             ...resolved.slugs
         };
         config.admin.custom.reservationStatusMachine = resolved.statusMachine;
+        config.admin.custom.reservationTenant = resolved.multiTenant;
+        config.admin.custom.reservationTimezone = resolved.timezone;
         // Add dashboard widget
         if (!config.admin.dashboard) {
             config.admin.dashboard = {