payload-reserve 1.6.0 → 2.1.0

package/dist/hooks/reservations/calculateEndTime.js

@@ -1,17 +1,30 @@
 import { ValidationError } from 'payload';
 import { computeEndTime } from '../../services/AvailabilityService.js';
-import { resolveReservationItems } from '../../utilities/resolveReservationItems.js';
-export const calculateEndTime = (config)=>async ({ context, data, req })=>{
+import { mergeReservationData, schedulingFieldsChanged } from '../../utilities/reservationChanges.js';
+import { extractId, resolveReservationItems } from '../../utilities/resolveReservationItems.js';
+export const calculateEndTime = (config)=>async ({ context, data, operation, originalDoc, req })=>{
         if (context?.skipReservationHooks) {
             return data;
         }
-        if (!data?.startTime || !data?.service) {
+        const isUpdate = operation === 'update';
+        // Skip when an update touches no scheduling-relevant field — a notes or
+        // status edit must not recompute (or invalidate) the stored times.
+        if (isUpdate && !schedulingFieldsChanged({
+            blockingStatuses: config.statusMachine.blockingStatuses,
+            data: data,
+            originalDoc: originalDoc
+        })) {
             return data;
         }
-        const items = resolveReservationItems(data);
+        // On update `data` is a partial patch — compute from the merged document.
+        const merged = isUpdate ? mergeReservationData(data, originalDoc) : data;
+        if (!merged?.startTime || !merged?.service) {
+            return data;
+        }
+        const items = resolveReservationItems(merged);
         if (items.length <= 1) {
             // Single-resource: compute top-level endTime
-            const serviceId = typeof data.service === 'object' ? data.service.id : data.service;
+            const serviceId = extractId(merged.service);
             // eslint-disable-next-line @typescript-eslint/no-explicit-any
             const service = await req.payload.findByID({
                 id: serviceId,
@@ -22,9 +35,9 @@ export const calculateEndTime = (config)=>async ({ context, data, req })=>{
                 return data;
             }
             const durationType = service.durationType ?? 'fixed';
-            const startDate = new Date(data.startTime);
+            const startDate = new Date(merged.startTime);
             if (durationType === 'flexible') {
-                if (!data.endTime) {
+                if (!merged.endTime) {
                     throw new ValidationError({
                         errors: [
                             {
@@ -34,32 +47,46 @@ export const calculateEndTime = (config)=>async ({ context, data, req })=>{
                         ]
                     });
                 }
-                // Validate customer-provided endTime (computeEndTime returns it back)
-                computeEndTime({
-                    durationType: 'flexible',
-                    endTime: new Date(data.endTime),
-                    serviceDuration: service.duration,
-                    startTime: startDate
-                });
+                // An inverted window would be invisible to overlap queries — reject it
+                // (computeEndTime performs no validation for flexible durations).
+                if (new Date(merged.endTime) <= startDate) {
+                    throw new ValidationError({
+                        errors: [
+                            {
+                                message: 'endTime must be after startTime',
+                                path: 'endTime'
+                            }
+                        ]
+                    });
+                }
             } else {
                 const result = computeEndTime({
                     durationType,
                     serviceDuration: service.duration ?? 0,
-                    startTime: startDate
+                    startTime: startDate,
+                    timeZone: config.timezone
                 });
                 data.endTime = result.endTime.toISOString();
             }
         } else {
-            // Multi-resource: compute endTime per item, then set a top-level endTime
-            // that spans all items so conflict detection (which queries top-level
-            // startTime/endTime) can see this reservation.
+            // Multi-resource: recompute only when the patch carries items[]. In
+            // practice Payload backfills items from originalDoc on API updates, so
+            // this guard mainly protects direct programmatic invocation; the
+            // schedulingFieldsChanged gate above is the real skip for benign edits.
+            // Rewriting items from a partial patch is A4 territory and out of scope.
+            if (isUpdate && !data.items) {
+                return data;
+            }
+            // Compute endTime per item, then set a top-level endTime that spans all
+            // items so conflict detection (which queries top-level startTime/endTime)
+            // can see this reservation.
             let earliestStart;
             let latestEnd;
             for (const item of data.items){
                 if (!item.startTime) {
                     continue;
                 }
-                const itemServiceId = typeof item.service === 'object' ? item.service.id : item.service ?? (typeof data.service === 'object' ? data.service.id : data.service);
+                const itemServiceId = extractId(item.service) ?? extractId(merged.service);
                 if (!itemServiceId) {
                     continue;
                 }
@@ -80,7 +107,8 @@ export const calculateEndTime = (config)=>async ({ context, data, req })=>{
                     const result = computeEndTime({
                         durationType,
                         serviceDuration: service.duration ?? 0,
-                        startTime: new Date(item.startTime)
+                        startTime: new Date(item.startTime),
+                        timeZone: config.timezone
                     });
                     item.endTime = result.endTime.toISOString();
                 }

package/dist/hooks/reservations/calculateEndTime.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/hooks/reservations/calculateEndTime.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload'\n\nimport { ValidationError } from 'payload'\n\nimport type { DurationType, ResolvedReservationPluginConfig } from '../../types.js'\n\nimport { computeEndTime } from '../../services/AvailabilityService.js'\nimport { resolveReservationItems } from '../../utilities/resolveReservationItems.js'\n\nexport const calculateEndTime =\n  (config: ResolvedReservationPluginConfig): CollectionBeforeChangeHook =>\n  async ({ context, data, req }) => {\n    if (context?.skipReservationHooks) {return data}\n\n    if (!data?.startTime || !data?.service) {return data}\n\n    const items = resolveReservationItems(data)\n\n    if (items.length <= 1) {\n      // Single-resource: compute top-level endTime\n      const serviceId = typeof data.service === 'object' ? data.service.id : data.service\n\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      const service = await (req.payload.findByID as any)({\n        id: serviceId,\n        collection: config.slugs.services,\n        req,\n      })\n\n      if (!service?.duration && service?.durationType !== 'full-day') {return data}\n\n      const durationType = ((service.durationType as string) ?? 'fixed') as DurationType\n      const startDate = new Date(data.startTime)\n\n      if (durationType === 'flexible') {\n        if (!data.endTime) {\n          throw new ValidationError({\n            errors: [{ message: 'endTime is required for flexible duration services', path: 'endTime' }],\n          })\n        }\n        // Validate customer-provided endTime (computeEndTime returns it back)\n        computeEndTime({\n          durationType: 'flexible',\n          endTime: new Date(data.endTime),\n          serviceDuration: service.duration as number,\n          startTime: startDate,\n        })\n      } else {\n        const result = computeEndTime({\n          durationType,\n          serviceDuration: (service.duration as number) ?? 0,\n          startTime: startDate,\n        })\n        data.endTime = result.endTime.toISOString()\n      }\n    } else {\n      // Multi-resource: compute endTime per item, then set a top-level endTime\n      // that spans all items so conflict detection (which queries top-level\n      // startTime/endTime) can see this reservation.\n      let earliestStart: Date | undefined\n      let latestEnd: Date | undefined\n      for (const item of data.items as Array<Record<string, unknown>>) {\n        if (!item.startTime) {continue}\n\n        const itemServiceId = typeof item.service === 'object'\n          ? (item.service as { id: string }).id\n          : (item.service as string) ?? (typeof data.service === 'object' ? data.service.id : data.service)\n\n        if (!itemServiceId) {continue}\n\n        // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        const service = await (req.payload.findByID as any)({\n          id: itemServiceId,\n          collection: config.slugs.services,\n          req,\n        })\n\n        if (!service?.duration && service?.durationType !== 'full-day') {continue}\n\n        const durationType = ((service.durationType as string) ?? 'fixed') as DurationType\n\n        if (durationType === 'flexible' && !item.endTime) {continue}\n\n        if (durationType !== 'flexible') {\n          const result = computeEndTime({\n            durationType,\n            serviceDuration: (service.duration as number) ?? 0,\n            startTime: new Date(item.startTime as string),\n          })\n          item.endTime = result.endTime.toISOString()\n        }\n\n        const start = new Date(item.startTime as string)\n        if (!earliestStart || start < earliestStart) {earliestStart = start}\n\n        if (item.endTime) {\n          const end = new Date(item.endTime as string)\n          if (!latestEnd || end > latestEnd) {latestEnd = end}\n        }\n      }\n\n      if (earliestStart) {\n        data.startTime = earliestStart.toISOString()\n      }\n\n      if (latestEnd) {\n        data.endTime = latestEnd.toISOString()\n      }\n    }\n\n    return data\n  }\n"],"names":["ValidationError","computeEndTime","resolveReservationItems","calculateEndTime","config","context","data","req","skipReservationHooks","startTime","service","items","length","serviceId","id","payload","findByID","collection","slugs","services","duration","durationType","startDate","Date","endTime","errors","message","path","serviceDuration","result","toISOString","earliestStart","latestEnd","item","itemServiceId","start","end"],"mappings":"AAEA,SAASA,eAAe,QAAQ,UAAS;AAIzC,SAASC,cAAc,QAAQ,wCAAuC;AACtE,SAASC,uBAAuB,QAAQ,6CAA4C;AAEpF,OAAO,MAAMC,mBACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,IAAI,EAAEC,GAAG,EAAE;QAC3B,IAAIF,SAASG,sBAAsB;YAAC,OAAOF;QAAI;QAE/C,IAAI,CAACA,MAAMG,aAAa,CAACH,MAAMI,SAAS;YAAC,OAAOJ;QAAI;QAEpD,MAAMK,QAAQT,wBAAwBI;QAEtC,IAAIK,MAAMC,MAAM,IAAI,GAAG;YACrB,6CAA6C;YAC7C,MAAMC,YAAY,OAAOP,KAAKI,OAAO,KAAK,WAAWJ,KAAKI,OAAO,CAACI,EAAE,GAAGR,KAAKI,OAAO;YAEnF,8DAA8D;YAC9D,MAAMA,UAAU,MAAM,AAACH,IAAIQ,OAAO,CAACC,QAAQ,CAAS;gBAClDF,IAAID;gBACJI,YAAYb,OAAOc,KAAK,CAACC,QAAQ;gBACjCZ;YACF;YAEA,IAAI,CAACG,SAASU,YAAYV,SAASW,iBAAiB,YAAY;gBAAC,OAAOf;YAAI;YAE5E,MAAMe,eAAgB,AAACX,QAAQW,YAAY,IAAe;YAC1D,MAAMC,YAAY,IAAIC,KAAKjB,KAAKG,SAAS;YAEzC,IAAIY,iBAAiB,YAAY;gBAC/B,IAAI,CAACf,KAAKkB,OAAO,EAAE;oBACjB,MAAM,IAAIxB,gBAAgB;wBACxByB,QAAQ;4BAAC;gCAAEC,SAAS;gCAAsDC,MAAM;4BAAU;yBAAE;oBAC9F;gBACF;gBACA,sEAAsE;gBACtE1B,eAAe;oBACboB,cAAc;oBACdG,SAAS,IAAID,KAAKjB,KAAKkB,OAAO;oBAC9BI,iBAAiBlB,QAAQU,QAAQ;oBACjCX,WAAWa;gBACb;YACF,OAAO;gBACL,MAAMO,SAAS5B,eAAe;oBAC5BoB;oBACAO,iBAAiB,AAAClB,QAAQU,QAAQ,IAAe;oBACjDX,WAAWa;gBACb;gBACAhB,KAAKkB,OAAO,GAAGK,OAAOL,OAAO,CAACM,WAAW;YAC3C;QACF,OAAO;YACL,yEAAyE;YACzE,sEAAsE;YACtE,+CAA+C;YAC/C,IAAIC;YACJ,IAAIC;YACJ,KAAK,MAAMC,QAAQ3B,KAAKK,KAAK,CAAoC;gBAC/D,IAAI,CAACsB,KAAKxB,SAAS,EAAE;oBAAC;gBAAQ;gBAE9B,MAAMyB,gBAAgB,OAAOD,KAAKvB,OAAO,KAAK,WAC1C,AAACuB,KAAKvB,OAAO,CAAoBI,EAAE,GACnC,AAACmB,KAAKvB,OAAO,IAAgB,CAAA,OAAOJ,KAAKI,OAAO,KAAK,WAAWJ,KAAKI,OAAO,CAACI,EAAE,GAAGR,KAAKI,OAAO,AAAD;gBAEjG,IAAI,CAACwB,eAAe;oBAAC;gBAAQ;gBAE7B,8DAA8D;gBAC9D,MAAMxB,UAAU,MAAM,AAACH,IAAIQ,OAAO,CAACC,QAAQ,CAAS;oBAClDF,IAAIoB;oBACJjB,YAAYb,OAAOc,KAAK,CAACC,QAAQ;oBACjCZ;gBACF;gBAEA,IAAI,CAACG,SAASU,YAAYV,SAASW,iBAAiB,YAAY;oBAAC;gBAAQ;gBAEzE,MAAMA,eAAgB,AAACX,QAAQW,YAAY,IAAe;gBAE1D,IAAIA,iBAAiB,cAAc,CAACY,KAAKT,OAAO,EAAE;oBAAC;gBAAQ;gBAE3D,IAAIH,iBAAiB,YAAY;oBAC/B,MAAMQ,SAAS5B,eAAe;wBAC5BoB;wBACAO,iBAAiB,AAAClB,QAAQU,QAAQ,IAAe;wBACjDX,WAAW,IAAIc,KAAKU,KAAKxB,SAAS;oBACpC;oBACAwB,KAAKT,OAAO,GAAGK,OAAOL,OAAO,CAACM,WAAW;gBAC3C;gBAEA,MAAMK,QAAQ,IAAIZ,KAAKU,KAAKxB,SAAS;gBACrC,IAAI,CAACsB,iBAAiBI,QAAQJ,eAAe;oBAACA,gBAAgBI;gBAAK;gBAEnE,IAAIF,KAAKT,OAAO,EAAE;oBAChB,MAAMY,MAAM,IAAIb,KAAKU,KAAKT,OAAO;oBACjC,IAAI,CAACQ,aAAaI,MAAMJ,WAAW;wBAACA,YAAYI;oBAAG;gBACrD;YACF;YAEA,IAAIL,eAAe;gBACjBzB,KAAKG,SAAS,GAAGsB,cAAcD,WAAW;YAC5C;YAEA,IAAIE,WAAW;gBACb1B,KAAKkB,OAAO,GAAGQ,UAAUF,WAAW;YACtC;QACF;QAEA,OAAOxB;IACT,EAAC"}
+{"version":3,"sources":["../../../src/hooks/reservations/calculateEndTime.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload'\n\nimport { ValidationError } from 'payload'\n\nimport type { DurationType, ResolvedReservationPluginConfig } from '../../types.js'\n\nimport { computeEndTime } from '../../services/AvailabilityService.js'\nimport {\n  mergeReservationData,\n  schedulingFieldsChanged,\n} from '../../utilities/reservationChanges.js'\nimport { extractId, resolveReservationItems } from '../../utilities/resolveReservationItems.js'\n\nexport const calculateEndTime =\n  (config: ResolvedReservationPluginConfig): CollectionBeforeChangeHook =>\n  async ({ context, data, operation, originalDoc, req }) => {\n    if (context?.skipReservationHooks) {\n      return data\n    }\n\n    const isUpdate = operation === 'update'\n\n    // Skip when an update touches no scheduling-relevant field — a notes or\n    // status edit must not recompute (or invalidate) the stored times.\n    if (\n      isUpdate &&\n      !schedulingFieldsChanged({\n        blockingStatuses: config.statusMachine.blockingStatuses,\n        data: data as Record<string, unknown>,\n        originalDoc: originalDoc as Record<string, unknown> | undefined,\n      })\n    ) {\n      return data\n    }\n\n    // On update `data` is a partial patch — compute from the merged document.\n    const merged = isUpdate\n      ? mergeReservationData(\n          data as Record<string, unknown>,\n          originalDoc as Record<string, unknown> | undefined,\n        )\n      : (data as Record<string, unknown>)\n\n    if (!merged?.startTime || !merged?.service) {\n      return data\n    }\n\n    const items = resolveReservationItems(merged)\n\n    if (items.length <= 1) {\n      // Single-resource: compute top-level endTime\n      const serviceId = extractId(merged.service)\n\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      const service = await (req.payload.findByID as any)({\n        id: serviceId,\n        collection: config.slugs.services,\n        req,\n      })\n\n      if (!service?.duration && service?.durationType !== 'full-day') {\n        return data\n      }\n\n      const durationType = ((service.durationType as string) ?? 'fixed') as DurationType\n      const startDate = new Date(merged.startTime as string)\n\n      if (durationType === 'flexible') {\n        if (!merged.endTime) {\n          throw new ValidationError({\n            errors: [\n              { message: 'endTime is required for flexible duration services', path: 'endTime' },\n            ],\n          })\n        }\n        // An inverted window would be invisible to overlap queries — reject it\n        // (computeEndTime performs no validation for flexible durations).\n        if (new Date(merged.endTime as string) <= startDate) {\n          throw new ValidationError({\n            errors: [{ message: 'endTime must be after startTime', path: 'endTime' }],\n          })\n        }\n      } else {\n        const result = computeEndTime({\n          durationType,\n          serviceDuration: (service.duration as number) ?? 0,\n          startTime: startDate,\n          timeZone: config.timezone,\n        })\n        data.endTime = result.endTime.toISOString()\n      }\n    } else {\n      // Multi-resource: recompute only when the patch carries items[]. In\n      // practice Payload backfills items from originalDoc on API updates, so\n      // this guard mainly protects direct programmatic invocation; the\n      // schedulingFieldsChanged gate above is the real skip for benign edits.\n      // Rewriting items from a partial patch is A4 territory and out of scope.\n      if (isUpdate && !data.items) {\n        return data\n      }\n\n      // Compute endTime per item, then set a top-level endTime that spans all\n      // items so conflict detection (which queries top-level startTime/endTime)\n      // can see this reservation.\n      let earliestStart: Date | undefined\n      let latestEnd: Date | undefined\n      for (const item of data.items as Array<Record<string, unknown>>) {\n        if (!item.startTime) {\n          continue\n        }\n\n        const itemServiceId = extractId(item.service) ?? extractId(merged.service)\n\n        if (!itemServiceId) {\n          continue\n        }\n\n        // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        const service = await (req.payload.findByID as any)({\n          id: itemServiceId,\n          collection: config.slugs.services,\n          req,\n        })\n\n        if (!service?.duration && service?.durationType !== 'full-day') {\n          continue\n        }\n\n        const durationType = ((service.durationType as string) ?? 'fixed') as DurationType\n\n        if (durationType === 'flexible' && !item.endTime) {\n          continue\n        }\n\n        if (durationType !== 'flexible') {\n          const result = computeEndTime({\n            durationType,\n            serviceDuration: (service.duration as number) ?? 0,\n            startTime: new Date(item.startTime as string),\n            timeZone: config.timezone,\n          })\n          item.endTime = result.endTime.toISOString()\n        }\n\n        const start = new Date(item.startTime as string)\n        if (!earliestStart || start < earliestStart) {\n          earliestStart = start\n        }\n\n        if (item.endTime) {\n          const end = new Date(item.endTime as string)\n          if (!latestEnd || end > latestEnd) {\n            latestEnd = end\n          }\n        }\n      }\n\n      if (earliestStart) {\n        data.startTime = earliestStart.toISOString()\n      }\n\n      if (latestEnd) {\n        data.endTime = latestEnd.toISOString()\n      }\n    }\n\n    return data\n  }\n"],"names":["ValidationError","computeEndTime","mergeReservationData","schedulingFieldsChanged","extractId","resolveReservationItems","calculateEndTime","config","context","data","operation","originalDoc","req","skipReservationHooks","isUpdate","blockingStatuses","statusMachine","merged","startTime","service","items","length","serviceId","payload","findByID","id","collection","slugs","services","duration","durationType","startDate","Date","endTime","errors","message","path","result","serviceDuration","timeZone","timezone","toISOString","earliestStart","latestEnd","item","itemServiceId","start","end"],"mappings":"AAEA,SAASA,eAAe,QAAQ,UAAS;AAIzC,SAASC,cAAc,QAAQ,wCAAuC;AACtE,SACEC,oBAAoB,EACpBC,uBAAuB,QAClB,wCAAuC;AAC9C,SAASC,SAAS,EAAEC,uBAAuB,QAAQ,6CAA4C;AAE/F,OAAO,MAAMC,mBACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,GAAG,EAAE;QACnD,IAAIJ,SAASK,sBAAsB;YACjC,OAAOJ;QACT;QAEA,MAAMK,WAAWJ,cAAc;QAE/B,wEAAwE;QACxE,mEAAmE;QACnE,IACEI,YACA,CAACX,wBAAwB;YACvBY,kBAAkBR,OAAOS,aAAa,CAACD,gBAAgB;YACvDN,MAAMA;YACNE,aAAaA;QACf,IACA;YACA,OAAOF;QACT;QAEA,0EAA0E;QAC1E,MAAMQ,SAASH,WACXZ,qBACEO,MACAE,eAEDF;QAEL,IAAI,CAACQ,QAAQC,aAAa,CAACD,QAAQE,SAAS;YAC1C,OAAOV;QACT;QAEA,MAAMW,QAAQf,wBAAwBY;QAEtC,IAAIG,MAAMC,MAAM,IAAI,GAAG;YACrB,6CAA6C;YAC7C,MAAMC,YAAYlB,UAAUa,OAAOE,OAAO;YAE1C,8DAA8D;YAC9D,MAAMA,UAAU,MAAM,AAACP,IAAIW,OAAO,CAACC,QAAQ,CAAS;gBAClDC,IAAIH;gBACJI,YAAYnB,OAAOoB,KAAK,CAACC,QAAQ;gBACjChB;YACF;YAEA,IAAI,CAACO,SAASU,YAAYV,SAASW,iBAAiB,YAAY;gBAC9D,OAAOrB;YACT;YAEA,MAAMqB,eAAgB,AAACX,QAAQW,YAAY,IAAe;YAC1D,MAAMC,YAAY,IAAIC,KAAKf,OAAOC,SAAS;YAE3C,IAAIY,iBAAiB,YAAY;gBAC/B,IAAI,CAACb,OAAOgB,OAAO,EAAE;oBACnB,MAAM,IAAIjC,gBAAgB;wBACxBkC,QAAQ;4BACN;gCAAEC,SAAS;gCAAsDC,MAAM;4BAAU;yBAClF;oBACH;gBACF;gBACA,uEAAuE;gBACvE,kEAAkE;gBAClE,IAAI,IAAIJ,KAAKf,OAAOgB,OAAO,KAAeF,WAAW;oBACnD,MAAM,IAAI/B,gBAAgB;wBACxBkC,QAAQ;4BAAC;gCAAEC,SAAS;gCAAmCC,MAAM;4BAAU;yBAAE;oBAC3E;gBACF;YACF,OAAO;gBACL,MAAMC,SAASpC,eAAe;oBAC5B6B;oBACAQ,iBAAiB,AAACnB,QAAQU,QAAQ,IAAe;oBACjDX,WAAWa;oBACXQ,UAAUhC,OAAOiC,QAAQ;gBAC3B;gBACA/B,KAAKwB,OAAO,GAAGI,OAAOJ,OAAO,CAACQ,WAAW;YAC3C;QACF,OAAO;YACL,oEAAoE;YACpE,uEAAuE;YACvE,iEAAiE;YACjE,wEAAwE;YACxE,yEAAyE;YACzE,IAAI3B,YAAY,CAACL,KAAKW,KAAK,EAAE;gBAC3B,OAAOX;YACT;YAEA,wEAAwE;YACxE,0EAA0E;YAC1E,4BAA4B;YAC5B,IAAIiC;YACJ,IAAIC;YACJ,KAAK,MAAMC,QAAQnC,KAAKW,KAAK,CAAoC;gBAC/D,IAAI,CAACwB,KAAK1B,SAAS,EAAE;oBACnB;gBACF;gBAEA,MAAM2B,gBAAgBzC,UAAUwC,KAAKzB,OAAO,KAAKf,UAAUa,OAAOE,OAAO;gBAEzE,IAAI,CAAC0B,eAAe;oBAClB;gBACF;gBAEA,8DAA8D;gBAC9D,MAAM1B,UAAU,MAAM,AAACP,IAAIW,OAAO,CAACC,QAAQ,CAAS;oBAClDC,IAAIoB;oBACJnB,YAAYnB,OAAOoB,KAAK,CAACC,QAAQ;oBACjChB;gBACF;gBAEA,IAAI,CAACO,SAASU,YAAYV,SAASW,iBAAiB,YAAY;oBAC9D;gBACF;gBAEA,MAAMA,eAAgB,AAACX,QAAQW,YAAY,IAAe;gBAE1D,IAAIA,iBAAiB,cAAc,CAACc,KAAKX,OAAO,EAAE;oBAChD;gBACF;gBAEA,IAAIH,iBAAiB,YAAY;oBAC/B,MAAMO,SAASpC,eAAe;wBAC5B6B;wBACAQ,iBAAiB,AAACnB,QAAQU,QAAQ,IAAe;wBACjDX,WAAW,IAAIc,KAAKY,KAAK1B,SAAS;wBAClCqB,UAAUhC,OAAOiC,QAAQ;oBAC3B;oBACAI,KAAKX,OAAO,GAAGI,OAAOJ,OAAO,CAACQ,WAAW;gBAC3C;gBAEA,MAAMK,QAAQ,IAAId,KAAKY,KAAK1B,SAAS;gBACrC,IAAI,CAACwB,iBAAiBI,QAAQJ,eAAe;oBAC3CA,gBAAgBI;gBAClB;gBAEA,IAAIF,KAAKX,OAAO,EAAE;oBAChB,MAAMc,MAAM,IAAIf,KAAKY,KAAKX,OAAO;oBACjC,IAAI,CAACU,aAAaI,MAAMJ,WAAW;wBACjCA,YAAYI;oBACd;gBACF;YACF;YAEA,IAAIL,eAAe;gBACjBjC,KAAKS,SAAS,GAAGwB,cAAcD,WAAW;YAC5C;YAEA,IAAIE,WAAW;gBACblC,KAAKwB,OAAO,GAAGU,UAAUF,WAAW;YACtC;QACF;QAEA,OAAOhC;IACT,EAAC"}

package/dist/hooks/reservations/enforceCustomerOwnership.d.ts

@@ -0,0 +1,11 @@
+import type { CollectionBeforeChangeHook } from 'payload';
+import type { ResolvedReservationPluginConfig } from '../../types.js';
+/**
+ * Prevents a non-privileged authenticated user from creating a reservation on
+ * behalf of another customer (mass assignment). The `/api/reserve/book` endpoint
+ * already enforces this, but a logged-in customer could reach the same write
+ * through Payload's default collection REST API — this guard closes that route
+ * (review B3 parallel path). Staff/admin may still book for anyone (walk-ins);
+ * guest bookings (no `customer`) are untouched.
+ */
+export declare const enforceCustomerOwnership: (config: ResolvedReservationPluginConfig) => CollectionBeforeChangeHook;

package/dist/hooks/reservations/enforceCustomerOwnership.js

@@ -0,0 +1,30 @@
+import { extractId } from '../../utilities/resolveReservationItems.js';
+import { isPrivilegedUser } from '../../utilities/userRoles.js';
+/**
+ * Prevents a non-privileged authenticated user from creating a reservation on
+ * behalf of another customer (mass assignment). The `/api/reserve/book` endpoint
+ * already enforces this, but a logged-in customer could reach the same write
+ * through Payload's default collection REST API — this guard closes that route
+ * (review B3 parallel path). Staff/admin may still book for anyone (walk-ins);
+ * guest bookings (no `customer`) are untouched.
+ */ export const enforceCustomerOwnership = (config)=>({ context, data, operation, req })=>{
+        if (context?.skipReservationHooks) {
+            return data;
+        }
+        if (operation !== 'create' || !req.user) {
+            return data;
+        }
+        if (isPrivilegedUser(req.user, config)) {
+            return data;
+        }
+        const customer = data?.customer;
+        if (customer != null && customer !== '') {
+            const customerId = extractId(customer);
+            if (String(customerId) !== String(req.user.id)) {
+                data.customer = req.user.id;
+            }
+        }
+        return data;
+    };
+
+//# sourceMappingURL=enforceCustomerOwnership.js.map

package/dist/hooks/reservations/enforceCustomerOwnership.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/hooks/reservations/enforceCustomerOwnership.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nimport { extractId } from '../../utilities/resolveReservationItems.js'\nimport { isPrivilegedUser } from '../../utilities/userRoles.js'\n\n/**\n * Prevents a non-privileged authenticated user from creating a reservation on\n * behalf of another customer (mass assignment). The `/api/reserve/book` endpoint\n * already enforces this, but a logged-in customer could reach the same write\n * through Payload's default collection REST API — this guard closes that route\n * (review B3 parallel path). Staff/admin may still book for anyone (walk-ins);\n * guest bookings (no `customer`) are untouched.\n */\nexport const enforceCustomerOwnership =\n  (config: ResolvedReservationPluginConfig): CollectionBeforeChangeHook =>\n  ({ context, data, operation, req }) => {\n    if (context?.skipReservationHooks) {\n      return data\n    }\n    if (operation !== 'create' || !req.user) {\n      return data\n    }\n    if (isPrivilegedUser(req.user, config)) {\n      return data\n    }\n\n    const customer = data?.customer\n    if (customer != null && customer !== '') {\n      const customerId = extractId(customer)\n      if (String(customerId) !== String(req.user.id)) {\n        data.customer = req.user.id\n      }\n    }\n\n    return data\n  }\n"],"names":["extractId","isPrivilegedUser","enforceCustomerOwnership","config","context","data","operation","req","skipReservationHooks","user","customer","customerId","String","id"],"mappings":"AAIA,SAASA,SAAS,QAAQ,6CAA4C;AACtE,SAASC,gBAAgB,QAAQ,+BAA8B;AAE/D;;;;;;;CAOC,GACD,OAAO,MAAMC,2BACX,CAACC,SACD,CAAC,EAAEC,OAAO,EAAEC,IAAI,EAAEC,SAAS,EAAEC,GAAG,EAAE;QAChC,IAAIH,SAASI,sBAAsB;YACjC,OAAOH;QACT;QACA,IAAIC,cAAc,YAAY,CAACC,IAAIE,IAAI,EAAE;YACvC,OAAOJ;QACT;QACA,IAAIJ,iBAAiBM,IAAIE,IAAI,EAAEN,SAAS;YACtC,OAAOE;QACT;QAEA,MAAMK,WAAWL,MAAMK;QACvB,IAAIA,YAAY,QAAQA,aAAa,IAAI;YACvC,MAAMC,aAAaX,UAAUU;YAC7B,IAAIE,OAAOD,gBAAgBC,OAAOL,IAAIE,IAAI,CAACI,EAAE,GAAG;gBAC9CR,KAAKK,QAAQ,GAAGH,IAAIE,IAAI,CAACI,EAAE;YAC7B;QACF;QAEA,OAAOR;IACT,EAAC"}

package/dist/hooks/reservations/onStatusChange.js

@@ -1,8 +1,14 @@
-export const onStatusChange = (config)=>async ({ context, doc, previousDoc, req })=>{
+export const onStatusChange = (config)=>async ({ context, doc, operation, previousDoc, req })=>{
         if (context?.skipReservationHooks) {
             return doc;
         }
-        if (!previousDoc || previousDoc.status === doc.status) {
+        // On create Payload passes previousDoc: {} (not undefined) — there is no
+        // previous status, so status-change hooks must not fire (afterBookingCreate
+        // covers creation).
+        if (operation !== 'update') {
+            return doc;
+        }
+        if (!previousDoc?.status || previousDoc.status === doc.status) {
             return doc;
         }
         const prev = previousDoc.status;
@@ -24,7 +30,7 @@ export const onStatusChange = (config)=>async ({ context, doc, previousDoc, req
                 }
             }
         }
-        if (next === 'confirmed' && config.hooks?.afterBookingConfirm) {
+        if (next === config.statusMachine.confirmStatus && config.hooks?.afterBookingConfirm) {
             for (const hook of config.hooks.afterBookingConfirm){
                 try {
                     await hook({
@@ -39,7 +45,7 @@ export const onStatusChange = (config)=>async ({ context, doc, previousDoc, req
                 }
             }
         }
-        if (next === 'cancelled' && config.hooks?.afterBookingCancel) {
+        if (next === config.statusMachine.cancelStatus && config.hooks?.afterBookingCancel) {
             for (const hook of config.hooks.afterBookingCancel){
                 try {
                     await hook({

package/dist/hooks/reservations/onStatusChange.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/hooks/reservations/onStatusChange.ts"],"sourcesContent":["import type { CollectionAfterChangeHook } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nexport const onStatusChange =\n  (config: ResolvedReservationPluginConfig): CollectionAfterChangeHook =>\n  async ({ context, doc, previousDoc, req }) => {\n    if (context?.skipReservationHooks) {return doc}\n    if (!previousDoc || previousDoc.status === doc.status) {return doc}\n\n    const prev = previousDoc.status as string\n    const next = doc.status as string\n\n    if (config.hooks?.afterStatusChange) {\n      for (const hook of config.hooks.afterStatusChange) {\n        try {\n          await hook({ doc: doc as Record<string, unknown>, newStatus: next, previousStatus: prev, req })\n        } catch (err) {\n          req.payload.logger.error({ err, msg: `afterStatusChange hook failed for reservation ${doc.id}` })\n        }\n      }\n    }\n\n    if (next === 'confirmed' && config.hooks?.afterBookingConfirm) {\n      for (const hook of config.hooks.afterBookingConfirm) {\n        try {\n          await hook({ doc: doc as Record<string, unknown>, req })\n        } catch (err) {\n          req.payload.logger.error({ err, msg: `afterBookingConfirm hook failed for reservation ${doc.id}` })\n        }\n      }\n    }\n    if (next === 'cancelled' && config.hooks?.afterBookingCancel) {\n      for (const hook of config.hooks.afterBookingCancel) {\n        try {\n          await hook({ doc: doc as Record<string, unknown>, req })\n        } catch (err) {\n          req.payload.logger.error({ err, msg: `afterBookingCancel hook failed for reservation ${doc.id}` })\n        }\n      }\n    }\n\n    return doc\n  }\n"],"names":["onStatusChange","config","context","doc","previousDoc","req","skipReservationHooks","status","prev","next","hooks","afterStatusChange","hook","newStatus","previousStatus","err","payload","logger","error","msg","id","afterBookingConfirm","afterBookingCancel"],"mappings":"AAIA,OAAO,MAAMA,iBACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,GAAG,EAAEC,WAAW,EAAEC,GAAG,EAAE;QACvC,IAAIH,SAASI,sBAAsB;YAAC,OAAOH;QAAG;QAC9C,IAAI,CAACC,eAAeA,YAAYG,MAAM,KAAKJ,IAAII,MAAM,EAAE;YAAC,OAAOJ;QAAG;QAElE,MAAMK,OAAOJ,YAAYG,MAAM;QAC/B,MAAME,OAAON,IAAII,MAAM;QAEvB,IAAIN,OAAOS,KAAK,EAAEC,mBAAmB;YACnC,KAAK,MAAMC,QAAQX,OAAOS,KAAK,CAACC,iBAAiB,CAAE;gBACjD,IAAI;oBACF,MAAMC,KAAK;wBAAET,KAAKA;wBAAgCU,WAAWJ;wBAAMK,gBAAgBN;wBAAMH;oBAAI;gBAC/F,EAAE,OAAOU,KAAK;oBACZV,IAAIW,OAAO,CAACC,MAAM,CAACC,KAAK,CAAC;wBAAEH;wBAAKI,KAAK,CAAC,8CAA8C,EAAEhB,IAAIiB,EAAE,EAAE;oBAAC;gBACjG;YACF;QACF;QAEA,IAAIX,SAAS,eAAeR,OAAOS,KAAK,EAAEW,qBAAqB;YAC7D,KAAK,MAAMT,QAAQX,OAAOS,KAAK,CAACW,mBAAmB,CAAE;gBACnD,IAAI;oBACF,MAAMT,KAAK;wBAAET,KAAKA;wBAAgCE;oBAAI;gBACxD,EAAE,OAAOU,KAAK;oBACZV,IAAIW,OAAO,CAACC,MAAM,CAACC,KAAK,CAAC;wBAAEH;wBAAKI,KAAK,CAAC,gDAAgD,EAAEhB,IAAIiB,EAAE,EAAE;oBAAC;gBACnG;YACF;QACF;QACA,IAAIX,SAAS,eAAeR,OAAOS,KAAK,EAAEY,oBAAoB;YAC5D,KAAK,MAAMV,QAAQX,OAAOS,KAAK,CAACY,kBAAkB,CAAE;gBAClD,IAAI;oBACF,MAAMV,KAAK;wBAAET,KAAKA;wBAAgCE;oBAAI;gBACxD,EAAE,OAAOU,KAAK;oBACZV,IAAIW,OAAO,CAACC,MAAM,CAACC,KAAK,CAAC;wBAAEH;wBAAKI,KAAK,CAAC,+CAA+C,EAAEhB,IAAIiB,EAAE,EAAE;oBAAC;gBAClG;YACF;QACF;QAEA,OAAOjB;IACT,EAAC"}
+{"version":3,"sources":["../../../src/hooks/reservations/onStatusChange.ts"],"sourcesContent":["import type { CollectionAfterChangeHook } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nexport const onStatusChange =\n  (config: ResolvedReservationPluginConfig): CollectionAfterChangeHook =>\n  async ({ context, doc, operation, previousDoc, req }) => {\n    if (context?.skipReservationHooks) {return doc}\n    // On create Payload passes previousDoc: {} (not undefined) — there is no\n    // previous status, so status-change hooks must not fire (afterBookingCreate\n    // covers creation).\n    if (operation !== 'update') {return doc}\n    if (!previousDoc?.status || previousDoc.status === doc.status) {return doc}\n\n    const prev = previousDoc.status as string\n    const next = doc.status as string\n\n    if (config.hooks?.afterStatusChange) {\n      for (const hook of config.hooks.afterStatusChange) {\n        try {\n          await hook({ doc: doc as Record<string, unknown>, newStatus: next, previousStatus: prev, req })\n        } catch (err) {\n          req.payload.logger.error({ err, msg: `afterStatusChange hook failed for reservation ${doc.id}` })\n        }\n      }\n    }\n\n    if (next === config.statusMachine.confirmStatus && config.hooks?.afterBookingConfirm) {\n      for (const hook of config.hooks.afterBookingConfirm) {\n        try {\n          await hook({ doc: doc as Record<string, unknown>, req })\n        } catch (err) {\n          req.payload.logger.error({ err, msg: `afterBookingConfirm hook failed for reservation ${doc.id}` })\n        }\n      }\n    }\n    if (next === config.statusMachine.cancelStatus && config.hooks?.afterBookingCancel) {\n      for (const hook of config.hooks.afterBookingCancel) {\n        try {\n          await hook({ doc: doc as Record<string, unknown>, req })\n        } catch (err) {\n          req.payload.logger.error({ err, msg: `afterBookingCancel hook failed for reservation ${doc.id}` })\n        }\n      }\n    }\n\n    return doc\n  }\n"],"names":["onStatusChange","config","context","doc","operation","previousDoc","req","skipReservationHooks","status","prev","next","hooks","afterStatusChange","hook","newStatus","previousStatus","err","payload","logger","error","msg","id","statusMachine","confirmStatus","afterBookingConfirm","cancelStatus","afterBookingCancel"],"mappings":"AAIA,OAAO,MAAMA,iBACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,GAAG,EAAEC,SAAS,EAAEC,WAAW,EAAEC,GAAG,EAAE;QAClD,IAAIJ,SAASK,sBAAsB;YAAC,OAAOJ;QAAG;QAC9C,yEAAyE;QACzE,4EAA4E;QAC5E,oBAAoB;QACpB,IAAIC,cAAc,UAAU;YAAC,OAAOD;QAAG;QACvC,IAAI,CAACE,aAAaG,UAAUH,YAAYG,MAAM,KAAKL,IAAIK,MAAM,EAAE;YAAC,OAAOL;QAAG;QAE1E,MAAMM,OAAOJ,YAAYG,MAAM;QAC/B,MAAME,OAAOP,IAAIK,MAAM;QAEvB,IAAIP,OAAOU,KAAK,EAAEC,mBAAmB;YACnC,KAAK,MAAMC,QAAQZ,OAAOU,KAAK,CAACC,iBAAiB,CAAE;gBACjD,IAAI;oBACF,MAAMC,KAAK;wBAAEV,KAAKA;wBAAgCW,WAAWJ;wBAAMK,gBAAgBN;wBAAMH;oBAAI;gBAC/F,EAAE,OAAOU,KAAK;oBACZV,IAAIW,OAAO,CAACC,MAAM,CAACC,KAAK,CAAC;wBAAEH;wBAAKI,KAAK,CAAC,8CAA8C,EAAEjB,IAAIkB,EAAE,EAAE;oBAAC;gBACjG;YACF;QACF;QAEA,IAAIX,SAAST,OAAOqB,aAAa,CAACC,aAAa,IAAItB,OAAOU,KAAK,EAAEa,qBAAqB;YACpF,KAAK,MAAMX,QAAQZ,OAAOU,KAAK,CAACa,mBAAmB,CAAE;gBACnD,IAAI;oBACF,MAAMX,KAAK;wBAAEV,KAAKA;wBAAgCG;oBAAI;gBACxD,EAAE,OAAOU,KAAK;oBACZV,IAAIW,OAAO,CAACC,MAAM,CAACC,KAAK,CAAC;wBAAEH;wBAAKI,KAAK,CAAC,gDAAgD,EAAEjB,IAAIkB,EAAE,EAAE;oBAAC;gBACnG;YACF;QACF;QACA,IAAIX,SAAST,OAAOqB,aAAa,CAACG,YAAY,IAAIxB,OAAOU,KAAK,EAAEe,oBAAoB;YAClF,KAAK,MAAMb,QAAQZ,OAAOU,KAAK,CAACe,kBAAkB,CAAE;gBAClD,IAAI;oBACF,MAAMb,KAAK;wBAAEV,KAAKA;wBAAgCG;oBAAI;gBACxD,EAAE,OAAOU,KAAK;oBACZV,IAAIW,OAAO,CAACC,MAAM,CAACC,KAAK,CAAC;wBAAEH;wBAAKI,KAAK,CAAC,+CAA+C,EAAEjB,IAAIkB,EAAE,EAAE;oBAAC;gBAClG;YACF;QACF;QAEA,OAAOlB;IACT,EAAC"}

package/dist/hooks/reservations/validateCancellation.js

@@ -9,8 +9,9 @@ export const validateCancellation = (config)=>({ context, data, operation, origi
         }
         const newStatus = data?.status;
         const previousStatus = originalDoc?.status;
-        // Only check when transitioning to cancelled
-        if (newStatus !== 'cancelled' || previousStatus === 'cancelled') {
+        // Only check when transitioning to the cancel status
+        const cancelStatus = config.statusMachine.cancelStatus;
+        if (newStatus !== cancelStatus || previousStatus === cancelStatus) {
             return data;
         }
         const startTime = data?.startTime ?? originalDoc?.startTime;

package/dist/hooks/reservations/validateCancellation.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/hooks/reservations/validateCancellation.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload'\n\nimport { ValidationError } from 'payload'\n\nimport type { PluginT } from '../../translations/index.js'\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nimport { hoursUntil } from '../../utilities/slotUtils.js'\n\nexport const validateCancellation =\n  (config: ResolvedReservationPluginConfig): CollectionBeforeChangeHook =>\n  ({ context, data, operation, originalDoc, req }) => {\n    if (context?.skipReservationHooks) {return data}\n\n    if (operation !== 'update') {return data}\n\n    const newStatus = data?.status\n    const previousStatus = originalDoc?.status\n\n    // Only check when transitioning to cancelled\n    if (newStatus !== 'cancelled' || previousStatus === 'cancelled') {return data}\n\n    const startTime = data?.startTime ?? originalDoc?.startTime\n    if (!startTime) {return data}\n\n    const startDate = new Date(startTime)\n    const hours = hoursUntil(startDate)\n\n    if (hours > 0 && hours < config.cancellationNoticePeriod) {\n      throw new ValidationError({\n        errors: [\n          {\n            message: (req.t as PluginT)('reservation:errorCancellationNotice', {\n              hours: String(Math.round(hours)),\n              period: String(config.cancellationNoticePeriod),\n            }),\n            path: 'status',\n          },\n        ],\n      })\n    }\n\n    return data\n  }\n"],"names":["ValidationError","hoursUntil","validateCancellation","config","context","data","operation","originalDoc","req","skipReservationHooks","newStatus","status","previousStatus","startTime","startDate","Date","hours","cancellationNoticePeriod","errors","message","t","String","Math","round","period","path"],"mappings":"AAEA,SAASA,eAAe,QAAQ,UAAS;AAKzC,SAASC,UAAU,QAAQ,+BAA8B;AAEzD,OAAO,MAAMC,uBACX,CAACC,SACD,CAAC,EAAEC,OAAO,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,GAAG,EAAE;QAC7C,IAAIJ,SAASK,sBAAsB;YAAC,OAAOJ;QAAI;QAE/C,IAAIC,cAAc,UAAU;YAAC,OAAOD;QAAI;QAExC,MAAMK,YAAYL,MAAMM;QACxB,MAAMC,iBAAiBL,aAAaI;QAEpC,6CAA6C;QAC7C,IAAID,cAAc,eAAeE,mBAAmB,aAAa;YAAC,OAAOP;QAAI;QAE7E,MAAMQ,YAAYR,MAAMQ,aAAaN,aAAaM;QAClD,IAAI,CAACA,WAAW;YAAC,OAAOR;QAAI;QAE5B,MAAMS,YAAY,IAAIC,KAAKF;QAC3B,MAAMG,QAAQf,WAAWa;QAEzB,IAAIE,QAAQ,KAAKA,QAAQb,OAAOc,wBAAwB,EAAE;YACxD,MAAM,IAAIjB,gBAAgB;gBACxBkB,QAAQ;oBACN;wBACEC,SAAS,AAACX,IAAIY,CAAC,CAAa,uCAAuC;4BACjEJ,OAAOK,OAAOC,KAAKC,KAAK,CAACP;4BACzBQ,QAAQH,OAAOlB,OAAOc,wBAAwB;wBAChD;wBACAQ,MAAM;oBACR;iBACD;YACH;QACF;QAEA,OAAOpB;IACT,EAAC"}
+{"version":3,"sources":["../../../src/hooks/reservations/validateCancellation.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload'\n\nimport { ValidationError } from 'payload'\n\nimport type { PluginT } from '../../translations/index.js'\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nimport { hoursUntil } from '../../utilities/slotUtils.js'\n\nexport const validateCancellation =\n  (config: ResolvedReservationPluginConfig): CollectionBeforeChangeHook =>\n  ({ context, data, operation, originalDoc, req }) => {\n    if (context?.skipReservationHooks) {return data}\n\n    if (operation !== 'update') {return data}\n\n    const newStatus = data?.status\n    const previousStatus = originalDoc?.status\n\n    // Only check when transitioning to the cancel status\n    const cancelStatus = config.statusMachine.cancelStatus\n    if (newStatus !== cancelStatus || previousStatus === cancelStatus) {return data}\n\n    const startTime = data?.startTime ?? originalDoc?.startTime\n    if (!startTime) {return data}\n\n    const startDate = new Date(startTime)\n    const hours = hoursUntil(startDate)\n\n    if (hours > 0 && hours < config.cancellationNoticePeriod) {\n      throw new ValidationError({\n        errors: [\n          {\n            message: (req.t as PluginT)('reservation:errorCancellationNotice', {\n              hours: String(Math.round(hours)),\n              period: String(config.cancellationNoticePeriod),\n            }),\n            path: 'status',\n          },\n        ],\n      })\n    }\n\n    return data\n  }\n"],"names":["ValidationError","hoursUntil","validateCancellation","config","context","data","operation","originalDoc","req","skipReservationHooks","newStatus","status","previousStatus","cancelStatus","statusMachine","startTime","startDate","Date","hours","cancellationNoticePeriod","errors","message","t","String","Math","round","period","path"],"mappings":"AAEA,SAASA,eAAe,QAAQ,UAAS;AAKzC,SAASC,UAAU,QAAQ,+BAA8B;AAEzD,OAAO,MAAMC,uBACX,CAACC,SACD,CAAC,EAAEC,OAAO,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,GAAG,EAAE;QAC7C,IAAIJ,SAASK,sBAAsB;YAAC,OAAOJ;QAAI;QAE/C,IAAIC,cAAc,UAAU;YAAC,OAAOD;QAAI;QAExC,MAAMK,YAAYL,MAAMM;QACxB,MAAMC,iBAAiBL,aAAaI;QAEpC,qDAAqD;QACrD,MAAME,eAAeV,OAAOW,aAAa,CAACD,YAAY;QACtD,IAAIH,cAAcG,gBAAgBD,mBAAmBC,cAAc;YAAC,OAAOR;QAAI;QAE/E,MAAMU,YAAYV,MAAMU,aAAaR,aAAaQ;QAClD,IAAI,CAACA,WAAW;YAAC,OAAOV;QAAI;QAE5B,MAAMW,YAAY,IAAIC,KAAKF;QAC3B,MAAMG,QAAQjB,WAAWe;QAEzB,IAAIE,QAAQ,KAAKA,QAAQf,OAAOgB,wBAAwB,EAAE;YACxD,MAAM,IAAInB,gBAAgB;gBACxBoB,QAAQ;oBACN;wBACEC,SAAS,AAACb,IAAIc,CAAC,CAAa,uCAAuC;4BACjEJ,OAAOK,OAAOC,KAAKC,KAAK,CAACP;4BACzBQ,QAAQH,OAAOpB,OAAOgB,wBAAwB;wBAChD;wBACAQ,MAAM;oBACR;iBACD;YACH;QACF;QAEA,OAAOtB;IACT,EAAC"}

package/dist/hooks/reservations/validateConflicts.js

@@ -1,11 +1,25 @@
 import { ValidationError } from 'payload';
 import { checkAvailability } from '../../services/AvailabilityService.js';
-import { resolveReservationItems } from '../../utilities/resolveReservationItems.js';
+import { mergeReservationData, schedulingFieldsChanged } from '../../utilities/reservationChanges.js';
+import { extractId, resolveReservationItems } from '../../utilities/resolveReservationItems.js';
 export const validateConflicts = (config)=>async ({ context, data, operation, originalDoc, req })=>{
         if (context?.skipReservationHooks) {
             return data;
         }
-        const items = resolveReservationItems(data);
+        const isUpdate = operation === 'update';
+        // Skip when an update touches no scheduling-relevant field, so reservations
+        // booked under older buffers/schedules can still take benign edits.
+        if (isUpdate && !schedulingFieldsChanged({
+            blockingStatuses: config.statusMachine.blockingStatuses,
+            data: data,
+            originalDoc: originalDoc
+        })) {
+            return data;
+        }
+        // Validate the merged document — Payload usually backfills update patches
+        // from originalDoc before beforeChange, but the hook must not rely on it.
+        const source = isUpdate ? mergeReservationData(data, originalDoc) : data;
+        const items = resolveReservationItems(source);
         if (items.length === 0) {
             return data;
         }
@@ -15,7 +29,7 @@ export const validateConflicts = (config)=>async ({ context, data, operation, or
                 continue;
             }
             // Fetch buffer times from the item's own service (not just the primary)
-            const itemServiceId = item.service ?? (typeof data?.service === 'object' ? data.service.id : data?.service);
+            const itemServiceId = item.service ?? extractId(source.service);
             let bufferBefore = config.defaultBufferTime;
             let bufferAfter = config.defaultBufferTime;
             if (itemServiceId) {
@@ -34,18 +48,23 @@ export const validateConflicts = (config)=>async ({ context, data, operation, or
                 // Use defaults if service lookup fails
                 }
             }
+            // Other items of this same booking on the same resource count as occupancy
+            // so two items can't double-book one resource within one create (review A5).
+            const siblingItems = items.filter((other, j)=>j !== i && other.resource === item.resource);
             const result = await checkAvailability({
                 blockingStatuses: config.statusMachine.blockingStatuses,
                 bufferAfter,
                 bufferBefore,
                 endTime: new Date(item.endTime),
-                excludeReservationId: operation === 'update' ? originalDoc?.id : undefined,
+                excludeReservationId: isUpdate ? originalDoc?.id : undefined,
                 guestCount: item.guestCount,
                 payload: req.payload,
                 req,
                 reservationSlug: config.slugs.reservations,
                 resourceId: item.resource,
                 resourceSlug: config.slugs.resources,
+                servicesSlug: config.slugs.services,
+                siblingItems,
                 startTime: new Date(item.startTime)
             });
             if (!result.available) {

package/dist/hooks/reservations/validateConflicts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/hooks/reservations/validateConflicts.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload'\n\nimport { ValidationError } from 'payload'\n\nimport type { PluginT } from '../../translations/index.js'\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nimport { checkAvailability } from '../../services/AvailabilityService.js'\nimport { resolveReservationItems } from '../../utilities/resolveReservationItems.js'\n\nexport const validateConflicts =\n  (config: ResolvedReservationPluginConfig): CollectionBeforeChangeHook =>\n  async ({ context, data, operation, originalDoc, req }) => {\n    if (context?.skipReservationHooks) {return data}\n\n    const items = resolveReservationItems(data as Record<string, unknown>)\n\n    if (items.length === 0) {return data}\n\n    for (let i = 0; i < items.length; i++) {\n      const item = items[i]\n      if (!item.endTime) {continue}\n\n      // Fetch buffer times from the item's own service (not just the primary)\n      const itemServiceId = item.service\n        ?? (typeof data?.service === 'object' ? data.service.id : data?.service)\n      let bufferBefore = config.defaultBufferTime\n      let bufferAfter = config.defaultBufferTime\n\n      if (itemServiceId) {\n        try {\n          // eslint-disable-next-line @typescript-eslint/no-explicit-any\n          const service = await (req.payload.findByID as any)({\n            id: itemServiceId,\n            collection: config.slugs.services,\n            req,\n          })\n          if (service) {\n            bufferBefore = (service.bufferTimeBefore as number) ?? config.defaultBufferTime\n            bufferAfter = (service.bufferTimeAfter as number) ?? config.defaultBufferTime\n          }\n        } catch {\n          // Use defaults if service lookup fails\n        }\n      }\n\n      const result = await checkAvailability({\n        blockingStatuses: config.statusMachine.blockingStatuses,\n        bufferAfter,\n        bufferBefore,\n        endTime: new Date(item.endTime),\n        excludeReservationId: operation === 'update' ? originalDoc?.id : undefined,\n        guestCount: item.guestCount,\n        payload: req.payload,\n        req,\n        reservationSlug: config.slugs.reservations,\n        resourceId: item.resource,\n        resourceSlug: config.slugs.resources,\n        startTime: new Date(item.startTime),\n      })\n\n      if (!result.available) {\n        throw new ValidationError({\n          errors: [\n            {\n              message: result.reason ?? (req.t as PluginT)('reservation:errorConflict'),\n              path: items.length > 1 ? `items.${i}.startTime` : 'startTime',\n            },\n          ],\n        })\n      }\n    }\n\n    return data\n  }\n"],"names":["ValidationError","checkAvailability","resolveReservationItems","validateConflicts","config","context","data","operation","originalDoc","req","skipReservationHooks","items","length","i","item","endTime","itemServiceId","service","id","bufferBefore","defaultBufferTime","bufferAfter","payload","findByID","collection","slugs","services","bufferTimeBefore","bufferTimeAfter","result","blockingStatuses","statusMachine","Date","excludeReservationId","undefined","guestCount","reservationSlug","reservations","resourceId","resource","resourceSlug","resources","startTime","available","errors","message","reason","t","path"],"mappings":"AAEA,SAASA,eAAe,QAAQ,UAAS;AAKzC,SAASC,iBAAiB,QAAQ,wCAAuC;AACzE,SAASC,uBAAuB,QAAQ,6CAA4C;AAEpF,OAAO,MAAMC,oBACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,GAAG,EAAE;QACnD,IAAIJ,SAASK,sBAAsB;YAAC,OAAOJ;QAAI;QAE/C,MAAMK,QAAQT,wBAAwBI;QAEtC,IAAIK,MAAMC,MAAM,KAAK,GAAG;YAAC,OAAON;QAAI;QAEpC,IAAK,IAAIO,IAAI,GAAGA,IAAIF,MAAMC,MAAM,EAAEC,IAAK;YACrC,MAAMC,OAAOH,KAAK,CAACE,EAAE;YACrB,IAAI,CAACC,KAAKC,OAAO,EAAE;gBAAC;YAAQ;YAE5B,wEAAwE;YACxE,MAAMC,gBAAgBF,KAAKG,OAAO,IAC5B,CAAA,OAAOX,MAAMW,YAAY,WAAWX,KAAKW,OAAO,CAACC,EAAE,GAAGZ,MAAMW,OAAM;YACxE,IAAIE,eAAef,OAAOgB,iBAAiB;YAC3C,IAAIC,cAAcjB,OAAOgB,iBAAiB;YAE1C,IAAIJ,eAAe;gBACjB,IAAI;oBACF,8DAA8D;oBAC9D,MAAMC,UAAU,MAAM,AAACR,IAAIa,OAAO,CAACC,QAAQ,CAAS;wBAClDL,IAAIF;wBACJQ,YAAYpB,OAAOqB,KAAK,CAACC,QAAQ;wBACjCjB;oBACF;oBACA,IAAIQ,SAAS;wBACXE,eAAe,AAACF,QAAQU,gBAAgB,IAAevB,OAAOgB,iBAAiB;wBAC/EC,cAAc,AAACJ,QAAQW,eAAe,IAAexB,OAAOgB,iBAAiB;oBAC/E;gBACF,EAAE,OAAM;gBACN,uCAAuC;gBACzC;YACF;YAEA,MAAMS,SAAS,MAAM5B,kBAAkB;gBACrC6B,kBAAkB1B,OAAO2B,aAAa,CAACD,gBAAgB;gBACvDT;gBACAF;gBACAJ,SAAS,IAAIiB,KAAKlB,KAAKC,OAAO;gBAC9BkB,sBAAsB1B,cAAc,WAAWC,aAAaU,KAAKgB;gBACjEC,YAAYrB,KAAKqB,UAAU;gBAC3Bb,SAASb,IAAIa,OAAO;gBACpBb;gBACA2B,iBAAiBhC,OAAOqB,KAAK,CAACY,YAAY;gBAC1CC,YAAYxB,KAAKyB,QAAQ;gBACzBC,cAAcpC,OAAOqB,KAAK,CAACgB,SAAS;gBACpCC,WAAW,IAAIV,KAAKlB,KAAK4B,SAAS;YACpC;YAEA,IAAI,CAACb,OAAOc,SAAS,EAAE;gBACrB,MAAM,IAAI3C,gBAAgB;oBACxB4C,QAAQ;wBACN;4BACEC,SAAShB,OAAOiB,MAAM,IAAI,AAACrC,IAAIsC,CAAC,CAAa;4BAC7CC,MAAMrC,MAAMC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAEC,EAAE,UAAU,CAAC,GAAG;wBACpD;qBACD;gBACH;YACF;QACF;QAEA,OAAOP;IACT,EAAC"}
+{"version":3,"sources":["../../../src/hooks/reservations/validateConflicts.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload'\n\nimport { ValidationError } from 'payload'\n\nimport type { PluginT } from '../../translations/index.js'\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nimport { checkAvailability } from '../../services/AvailabilityService.js'\nimport {\n  mergeReservationData,\n  schedulingFieldsChanged,\n} from '../../utilities/reservationChanges.js'\nimport { extractId, resolveReservationItems } from '../../utilities/resolveReservationItems.js'\n\nexport const validateConflicts =\n  (config: ResolvedReservationPluginConfig): CollectionBeforeChangeHook =>\n  async ({ context, data, operation, originalDoc, req }) => {\n    if (context?.skipReservationHooks) {\n      return data\n    }\n\n    const isUpdate = operation === 'update'\n\n    // Skip when an update touches no scheduling-relevant field, so reservations\n    // booked under older buffers/schedules can still take benign edits.\n    if (\n      isUpdate &&\n      !schedulingFieldsChanged({\n        blockingStatuses: config.statusMachine.blockingStatuses,\n        data: data as Record<string, unknown>,\n        originalDoc: originalDoc as Record<string, unknown> | undefined,\n      })\n    ) {\n      return data\n    }\n\n    // Validate the merged document — Payload usually backfills update patches\n    // from originalDoc before beforeChange, but the hook must not rely on it.\n    const source = isUpdate\n      ? mergeReservationData(\n          data as Record<string, unknown>,\n          originalDoc as Record<string, unknown> | undefined,\n        )\n      : (data as Record<string, unknown>)\n\n    const items = resolveReservationItems(source)\n\n    if (items.length === 0) {\n      return data\n    }\n\n    for (let i = 0; i < items.length; i++) {\n      const item = items[i]\n      if (!item.endTime) {\n        continue\n      }\n\n      // Fetch buffer times from the item's own service (not just the primary)\n      const itemServiceId = item.service ?? extractId(source.service)\n      let bufferBefore = config.defaultBufferTime\n      let bufferAfter = config.defaultBufferTime\n\n      if (itemServiceId) {\n        try {\n          // eslint-disable-next-line @typescript-eslint/no-explicit-any\n          const service = await (req.payload.findByID as any)({\n            id: itemServiceId,\n            collection: config.slugs.services,\n            req,\n          })\n          if (service) {\n            bufferBefore = (service.bufferTimeBefore as number) ?? config.defaultBufferTime\n            bufferAfter = (service.bufferTimeAfter as number) ?? config.defaultBufferTime\n          }\n        } catch {\n          // Use defaults if service lookup fails\n        }\n      }\n\n      // Other items of this same booking on the same resource count as occupancy\n      // so two items can't double-book one resource within one create (review A5).\n      const siblingItems = items.filter((other, j) => j !== i && other.resource === item.resource)\n\n      const result = await checkAvailability({\n        blockingStatuses: config.statusMachine.blockingStatuses,\n        bufferAfter,\n        bufferBefore,\n        endTime: new Date(item.endTime),\n        excludeReservationId: isUpdate ? originalDoc?.id : undefined,\n        guestCount: item.guestCount,\n        payload: req.payload,\n        req,\n        reservationSlug: config.slugs.reservations,\n        resourceId: item.resource,\n        resourceSlug: config.slugs.resources,\n        servicesSlug: config.slugs.services,\n        siblingItems,\n        startTime: new Date(item.startTime),\n      })\n\n      if (!result.available) {\n        throw new ValidationError({\n          errors: [\n            {\n              message: result.reason ?? (req.t as PluginT)('reservation:errorConflict'),\n              path: items.length > 1 ? `items.${i}.startTime` : 'startTime',\n            },\n          ],\n        })\n      }\n    }\n\n    return data\n  }\n"],"names":["ValidationError","checkAvailability","mergeReservationData","schedulingFieldsChanged","extractId","resolveReservationItems","validateConflicts","config","context","data","operation","originalDoc","req","skipReservationHooks","isUpdate","blockingStatuses","statusMachine","source","items","length","i","item","endTime","itemServiceId","service","bufferBefore","defaultBufferTime","bufferAfter","payload","findByID","id","collection","slugs","services","bufferTimeBefore","bufferTimeAfter","siblingItems","filter","other","j","resource","result","Date","excludeReservationId","undefined","guestCount","reservationSlug","reservations","resourceId","resourceSlug","resources","servicesSlug","startTime","available","errors","message","reason","t","path"],"mappings":"AAEA,SAASA,eAAe,QAAQ,UAAS;AAKzC,SAASC,iBAAiB,QAAQ,wCAAuC;AACzE,SACEC,oBAAoB,EACpBC,uBAAuB,QAClB,wCAAuC;AAC9C,SAASC,SAAS,EAAEC,uBAAuB,QAAQ,6CAA4C;AAE/F,OAAO,MAAMC,oBACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,GAAG,EAAE;QACnD,IAAIJ,SAASK,sBAAsB;YACjC,OAAOJ;QACT;QAEA,MAAMK,WAAWJ,cAAc;QAE/B,4EAA4E;QAC5E,oEAAoE;QACpE,IACEI,YACA,CAACX,wBAAwB;YACvBY,kBAAkBR,OAAOS,aAAa,CAACD,gBAAgB;YACvDN,MAAMA;YACNE,aAAaA;QACf,IACA;YACA,OAAOF;QACT;QAEA,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAMQ,SAASH,WACXZ,qBACEO,MACAE,eAEDF;QAEL,MAAMS,QAAQb,wBAAwBY;QAEtC,IAAIC,MAAMC,MAAM,KAAK,GAAG;YACtB,OAAOV;QACT;QAEA,IAAK,IAAIW,IAAI,GAAGA,IAAIF,MAAMC,MAAM,EAAEC,IAAK;YACrC,MAAMC,OAAOH,KAAK,CAACE,EAAE;YACrB,IAAI,CAACC,KAAKC,OAAO,EAAE;gBACjB;YACF;YAEA,wEAAwE;YACxE,MAAMC,gBAAgBF,KAAKG,OAAO,IAAIpB,UAAUa,OAAOO,OAAO;YAC9D,IAAIC,eAAelB,OAAOmB,iBAAiB;YAC3C,IAAIC,cAAcpB,OAAOmB,iBAAiB;YAE1C,IAAIH,eAAe;gBACjB,IAAI;oBACF,8DAA8D;oBAC9D,MAAMC,UAAU,MAAM,AAACZ,IAAIgB,OAAO,CAACC,QAAQ,CAAS;wBAClDC,IAAIP;wBACJQ,YAAYxB,OAAOyB,KAAK,CAACC,QAAQ;wBACjCrB;oBACF;oBACA,IAAIY,SAAS;wBACXC,eAAe,AAACD,QAAQU,gBAAgB,IAAe3B,OAAOmB,iBAAiB;wBAC/EC,cAAc,AAACH,QAAQW,eAAe,IAAe5B,OAAOmB,iBAAiB;oBAC/E;gBACF,EAAE,OAAM;gBACN,uCAAuC;gBACzC;YACF;YAEA,2EAA2E;YAC3E,6EAA6E;YAC7E,MAAMU,eAAelB,MAAMmB,MAAM,CAAC,CAACC,OAAOC,IAAMA,MAAMnB,KAAKkB,MAAME,QAAQ,KAAKnB,KAAKmB,QAAQ;YAE3F,MAAMC,SAAS,MAAMxC,kBAAkB;gBACrCc,kBAAkBR,OAAOS,aAAa,CAACD,gBAAgB;gBACvDY;gBACAF;gBACAH,SAAS,IAAIoB,KAAKrB,KAAKC,OAAO;gBAC9BqB,sBAAsB7B,WAAWH,aAAamB,KAAKc;gBACnDC,YAAYxB,KAAKwB,UAAU;gBAC3BjB,SAAShB,IAAIgB,OAAO;gBACpBhB;gBACAkC,iBAAiBvC,OAAOyB,KAAK,CAACe,YAAY;gBAC1CC,YAAY3B,KAAKmB,QAAQ;gBACzBS,cAAc1C,OAAOyB,KAAK,CAACkB,SAAS;gBACpCC,cAAc5C,OAAOyB,KAAK,CAACC,QAAQ;gBACnCG;gBACAgB,WAAW,IAAIV,KAAKrB,KAAK+B,SAAS;YACpC;YAEA,IAAI,CAACX,OAAOY,SAAS,EAAE;gBACrB,MAAM,IAAIrD,gBAAgB;oBACxBsD,QAAQ;wBACN;4BACEC,SAASd,OAAOe,MAAM,IAAI,AAAC5C,IAAI6C,CAAC,CAAa;4BAC7CC,MAAMxC,MAAMC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAEC,EAAE,UAAU,CAAC,GAAG;wBACpD;qBACD;gBACH;YACF;QACF;QAEA,OAAOX;IACT,EAAC"}

package/dist/hooks/reservations/validateGuestBooking.js

@@ -83,10 +83,9 @@ export const validateGuestBooking = (config)=>async ({ context, data, operation,
                 }
             }
         }
-        // Generate a cancellation token the host project can deliver to the guest.
-        if (!data.cancellationToken) {
-            data.cancellationToken = randomUUID();
-        }
+        // Always server-generate the cancellation token the host project delivers
+        // to the guest — never honor a caller-supplied value (it's a secret).
+        data.cancellationToken = randomUUID();
         return data;
     };
 

package/dist/hooks/reservations/validateGuestBooking.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/hooks/reservations/validateGuestBooking.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload'\n\nimport { randomUUID } from 'node:crypto'\nimport { ValidationError } from 'payload'\n\nimport type { PluginT } from '../../translations/index.js'\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nimport { resolveGuestBookingAllowed } from '../../utilities/guestBooking.js'\n\ntype GuestData = { email?: string; name?: string; phone?: string }\n\nexport const validateGuestBooking =\n  (config: ResolvedReservationPluginConfig): CollectionBeforeChangeHook =>\n  async ({ context, data, operation, req }) => {\n    if (context?.skipReservationHooks) {\n      return data\n    }\n    if (operation !== 'create') {\n      return data\n    }\n\n    const customer = data?.customer\n    const guest = data?.guest as GuestData | undefined\n    const hasCustomer = customer != null && customer !== ''\n    const hasGuest =\n      guest != null && (Boolean(guest.name) || Boolean(guest.email) || Boolean(guest.phone))\n\n    if (!hasCustomer && !hasGuest) {\n      throw new ValidationError({\n        errors: [\n          {\n            message: (req.t as PluginT)('reservation:errorGuestOrCustomerRequired'),\n            path: 'customer',\n          },\n        ],\n      })\n    }\n\n    if (hasCustomer && hasGuest) {\n      throw new ValidationError({\n        errors: [\n          {\n            message: (req.t as PluginT)('reservation:errorGuestAndCustomer'),\n            path: 'guest',\n          },\n        ],\n      })\n    }\n\n    if (hasCustomer) {\n      return data\n    }\n\n    // Guest path\n    if (!guest?.name) {\n      throw new ValidationError({\n        errors: [\n          { message: (req.t as PluginT)('reservation:errorGuestNameRequired'), path: 'guest.name' },\n        ],\n      })\n    }\n    if (!guest.email && !guest.phone) {\n      throw new ValidationError({\n        errors: [\n          {\n            message: (req.t as PluginT)('reservation:errorGuestContactRequired'),\n            path: 'guest.email',\n          },\n        ],\n      })\n    }\n\n    // Gate by service — admins (non-customer collection users) bypass.\n    const isAdmin = req.user != null && req.user.collection !== config.slugs.customers\n    if (!isAdmin) {\n      const serviceId =\n        typeof data.service === 'object'\n          ? (data.service as { id?: string } | null)?.id\n          : data.service\n      // `service` is a required field on the collection, so Payload's field\n      // validation (which runs before this beforeChange hook) guarantees it is\n      // present for any booking that reaches here. The guard is purely defensive.\n      if (serviceId) {\n        // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        const service = await (req.payload.findByID as any)({\n          id: serviceId,\n          collection: config.slugs.services,\n          depth: 0,\n          req,\n        })\n        if (!resolveGuestBookingAllowed(service, config.allowGuestBooking)) {\n          throw new ValidationError({\n            errors: [\n              {\n                message: (req.t as PluginT)('reservation:errorGuestNotAllowed'),\n                path: 'guest',\n              },\n            ],\n          })\n        }\n      }\n    }\n\n    // Generate a cancellation token the host project can deliver to the guest.\n    if (!data.cancellationToken) {\n      data.cancellationToken = randomUUID()\n    }\n\n    return data\n  }\n"],"names":["randomUUID","ValidationError","resolveGuestBookingAllowed","validateGuestBooking","config","context","data","operation","req","skipReservationHooks","customer","guest","hasCustomer","hasGuest","Boolean","name","email","phone","errors","message","t","path","isAdmin","user","collection","slugs","customers","serviceId","service","id","payload","findByID","services","depth","allowGuestBooking","cancellationToken"],"mappings":"AAEA,SAASA,UAAU,QAAQ,cAAa;AACxC,SAASC,eAAe,QAAQ,UAAS;AAKzC,SAASC,0BAA0B,QAAQ,kCAAiC;AAI5E,OAAO,MAAMC,uBACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,IAAI,EAAEC,SAAS,EAAEC,GAAG,EAAE;QACtC,IAAIH,SAASI,sBAAsB;YACjC,OAAOH;QACT;QACA,IAAIC,cAAc,UAAU;YAC1B,OAAOD;QACT;QAEA,MAAMI,WAAWJ,MAAMI;QACvB,MAAMC,QAAQL,MAAMK;QACpB,MAAMC,cAAcF,YAAY,QAAQA,aAAa;QACrD,MAAMG,WACJF,SAAS,QAASG,CAAAA,QAAQH,MAAMI,IAAI,KAAKD,QAAQH,MAAMK,KAAK,KAAKF,QAAQH,MAAMM,KAAK,CAAA;QAEtF,IAAI,CAACL,eAAe,CAACC,UAAU;YAC7B,MAAM,IAAIZ,gBAAgB;gBACxBiB,QAAQ;oBACN;wBACEC,SAAS,AAACX,IAAIY,CAAC,CAAa;wBAC5BC,MAAM;oBACR;iBACD;YACH;QACF;QAEA,IAAIT,eAAeC,UAAU;YAC3B,MAAM,IAAIZ,gBAAgB;gBACxBiB,QAAQ;oBACN;wBACEC,SAAS,AAACX,IAAIY,CAAC,CAAa;wBAC5BC,MAAM;oBACR;iBACD;YACH;QACF;QAEA,IAAIT,aAAa;YACf,OAAON;QACT;QAEA,aAAa;QACb,IAAI,CAACK,OAAOI,MAAM;YAChB,MAAM,IAAId,gBAAgB;gBACxBiB,QAAQ;oBACN;wBAAEC,SAAS,AAACX,IAAIY,CAAC,CAAa;wBAAuCC,MAAM;oBAAa;iBACzF;YACH;QACF;QACA,IAAI,CAACV,MAAMK,KAAK,IAAI,CAACL,MAAMM,KAAK,EAAE;YAChC,MAAM,IAAIhB,gBAAgB;gBACxBiB,QAAQ;oBACN;wBACEC,SAAS,AAACX,IAAIY,CAAC,CAAa;wBAC5BC,MAAM;oBACR;iBACD;YACH;QACF;QAEA,mEAAmE;QACnE,MAAMC,UAAUd,IAAIe,IAAI,IAAI,QAAQf,IAAIe,IAAI,CAACC,UAAU,KAAKpB,OAAOqB,KAAK,CAACC,SAAS;QAClF,IAAI,CAACJ,SAAS;YACZ,MAAMK,YACJ,OAAOrB,KAAKsB,OAAO,KAAK,WACnBtB,KAAKsB,OAAO,EAA6BC,KAC1CvB,KAAKsB,OAAO;YAClB,sEAAsE;YACtE,yEAAyE;YACzE,4EAA4E;YAC5E,IAAID,WAAW;gBACb,8DAA8D;gBAC9D,MAAMC,UAAU,MAAM,AAACpB,IAAIsB,OAAO,CAACC,QAAQ,CAAS;oBAClDF,IAAIF;oBACJH,YAAYpB,OAAOqB,KAAK,CAACO,QAAQ;oBACjCC,OAAO;oBACPzB;gBACF;gBACA,IAAI,CAACN,2BAA2B0B,SAASxB,OAAO8B,iBAAiB,GAAG;oBAClE,MAAM,IAAIjC,gBAAgB;wBACxBiB,QAAQ;4BACN;gCACEC,SAAS,AAACX,IAAIY,CAAC,CAAa;gCAC5BC,MAAM;4BACR;yBACD;oBACH;gBACF;YACF;QACF;QAEA,2EAA2E;QAC3E,IAAI,CAACf,KAAK6B,iBAAiB,EAAE;YAC3B7B,KAAK6B,iBAAiB,GAAGnC;QAC3B;QAEA,OAAOM;IACT,EAAC"}
+{"version":3,"sources":["../../../src/hooks/reservations/validateGuestBooking.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload'\n\nimport { randomUUID } from 'node:crypto'\nimport { ValidationError } from 'payload'\n\nimport type { PluginT } from '../../translations/index.js'\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nimport { resolveGuestBookingAllowed } from '../../utilities/guestBooking.js'\n\ntype GuestData = { email?: string; name?: string; phone?: string }\n\nexport const validateGuestBooking =\n  (config: ResolvedReservationPluginConfig): CollectionBeforeChangeHook =>\n  async ({ context, data, operation, req }) => {\n    if (context?.skipReservationHooks) {\n      return data\n    }\n    if (operation !== 'create') {\n      return data\n    }\n\n    const customer = data?.customer\n    const guest = data?.guest as GuestData | undefined\n    const hasCustomer = customer != null && customer !== ''\n    const hasGuest =\n      guest != null && (Boolean(guest.name) || Boolean(guest.email) || Boolean(guest.phone))\n\n    if (!hasCustomer && !hasGuest) {\n      throw new ValidationError({\n        errors: [\n          {\n            message: (req.t as PluginT)('reservation:errorGuestOrCustomerRequired'),\n            path: 'customer',\n          },\n        ],\n      })\n    }\n\n    if (hasCustomer && hasGuest) {\n      throw new ValidationError({\n        errors: [\n          {\n            message: (req.t as PluginT)('reservation:errorGuestAndCustomer'),\n            path: 'guest',\n          },\n        ],\n      })\n    }\n\n    if (hasCustomer) {\n      return data\n    }\n\n    // Guest path\n    if (!guest?.name) {\n      throw new ValidationError({\n        errors: [\n          { message: (req.t as PluginT)('reservation:errorGuestNameRequired'), path: 'guest.name' },\n        ],\n      })\n    }\n    if (!guest.email && !guest.phone) {\n      throw new ValidationError({\n        errors: [\n          {\n            message: (req.t as PluginT)('reservation:errorGuestContactRequired'),\n            path: 'guest.email',\n          },\n        ],\n      })\n    }\n\n    // Gate by service — admins (non-customer collection users) bypass.\n    const isAdmin = req.user != null && req.user.collection !== config.slugs.customers\n    if (!isAdmin) {\n      const serviceId =\n        typeof data.service === 'object'\n          ? (data.service as { id?: string } | null)?.id\n          : data.service\n      // `service` is a required field on the collection, so Payload's field\n      // validation (which runs before this beforeChange hook) guarantees it is\n      // present for any booking that reaches here. The guard is purely defensive.\n      if (serviceId) {\n        // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        const service = await (req.payload.findByID as any)({\n          id: serviceId,\n          collection: config.slugs.services,\n          depth: 0,\n          req,\n        })\n        if (!resolveGuestBookingAllowed(service, config.allowGuestBooking)) {\n          throw new ValidationError({\n            errors: [\n              {\n                message: (req.t as PluginT)('reservation:errorGuestNotAllowed'),\n                path: 'guest',\n              },\n            ],\n          })\n        }\n      }\n    }\n\n    // Always server-generate the cancellation token the host project delivers\n    // to the guest — never honor a caller-supplied value (it's a secret).\n    data.cancellationToken = randomUUID()\n\n    return data\n  }\n"],"names":["randomUUID","ValidationError","resolveGuestBookingAllowed","validateGuestBooking","config","context","data","operation","req","skipReservationHooks","customer","guest","hasCustomer","hasGuest","Boolean","name","email","phone","errors","message","t","path","isAdmin","user","collection","slugs","customers","serviceId","service","id","payload","findByID","services","depth","allowGuestBooking","cancellationToken"],"mappings":"AAEA,SAASA,UAAU,QAAQ,cAAa;AACxC,SAASC,eAAe,QAAQ,UAAS;AAKzC,SAASC,0BAA0B,QAAQ,kCAAiC;AAI5E,OAAO,MAAMC,uBACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,IAAI,EAAEC,SAAS,EAAEC,GAAG,EAAE;QACtC,IAAIH,SAASI,sBAAsB;YACjC,OAAOH;QACT;QACA,IAAIC,cAAc,UAAU;YAC1B,OAAOD;QACT;QAEA,MAAMI,WAAWJ,MAAMI;QACvB,MAAMC,QAAQL,MAAMK;QACpB,MAAMC,cAAcF,YAAY,QAAQA,aAAa;QACrD,MAAMG,WACJF,SAAS,QAASG,CAAAA,QAAQH,MAAMI,IAAI,KAAKD,QAAQH,MAAMK,KAAK,KAAKF,QAAQH,MAAMM,KAAK,CAAA;QAEtF,IAAI,CAACL,eAAe,CAACC,UAAU;YAC7B,MAAM,IAAIZ,gBAAgB;gBACxBiB,QAAQ;oBACN;wBACEC,SAAS,AAACX,IAAIY,CAAC,CAAa;wBAC5BC,MAAM;oBACR;iBACD;YACH;QACF;QAEA,IAAIT,eAAeC,UAAU;YAC3B,MAAM,IAAIZ,gBAAgB;gBACxBiB,QAAQ;oBACN;wBACEC,SAAS,AAACX,IAAIY,CAAC,CAAa;wBAC5BC,MAAM;oBACR;iBACD;YACH;QACF;QAEA,IAAIT,aAAa;YACf,OAAON;QACT;QAEA,aAAa;QACb,IAAI,CAACK,OAAOI,MAAM;YAChB,MAAM,IAAId,gBAAgB;gBACxBiB,QAAQ;oBACN;wBAAEC,SAAS,AAACX,IAAIY,CAAC,CAAa;wBAAuCC,MAAM;oBAAa;iBACzF;YACH;QACF;QACA,IAAI,CAACV,MAAMK,KAAK,IAAI,CAACL,MAAMM,KAAK,EAAE;YAChC,MAAM,IAAIhB,gBAAgB;gBACxBiB,QAAQ;oBACN;wBACEC,SAAS,AAACX,IAAIY,CAAC,CAAa;wBAC5BC,MAAM;oBACR;iBACD;YACH;QACF;QAEA,mEAAmE;QACnE,MAAMC,UAAUd,IAAIe,IAAI,IAAI,QAAQf,IAAIe,IAAI,CAACC,UAAU,KAAKpB,OAAOqB,KAAK,CAACC,SAAS;QAClF,IAAI,CAACJ,SAAS;YACZ,MAAMK,YACJ,OAAOrB,KAAKsB,OAAO,KAAK,WACnBtB,KAAKsB,OAAO,EAA6BC,KAC1CvB,KAAKsB,OAAO;YAClB,sEAAsE;YACtE,yEAAyE;YACzE,4EAA4E;YAC5E,IAAID,WAAW;gBACb,8DAA8D;gBAC9D,MAAMC,UAAU,MAAM,AAACpB,IAAIsB,OAAO,CAACC,QAAQ,CAAS;oBAClDF,IAAIF;oBACJH,YAAYpB,OAAOqB,KAAK,CAACO,QAAQ;oBACjCC,OAAO;oBACPzB;gBACF;gBACA,IAAI,CAACN,2BAA2B0B,SAASxB,OAAO8B,iBAAiB,GAAG;oBAClE,MAAM,IAAIjC,gBAAgB;wBACxBiB,QAAQ;4BACN;gCACEC,SAAS,AAACX,IAAIY,CAAC,CAAa;gCAC5BC,MAAM;4BACR;yBACD;oBACH;gBACF;YACF;QACF;QAEA,0EAA0E;QAC1E,sEAAsE;QACtEf,KAAK6B,iBAAiB,GAAGnC;QAEzB,OAAOM;IACT,EAAC"}

package/dist/hooks/reservations/validateStatusTransition.js

@@ -56,7 +56,7 @@ export const validateStatusTransition = (config)=>async ({ context, data, operat
                     });
                 }
                 // Call beforeBookingConfirm plugin hooks
-                if (newStatus === 'confirmed' && config.hooks?.beforeBookingConfirm) {
+                if (newStatus === config.statusMachine.confirmStatus && config.hooks?.beforeBookingConfirm) {
                     for (const hook of config.hooks.beforeBookingConfirm){
                         await hook({
                             doc: {
@@ -69,7 +69,7 @@ export const validateStatusTransition = (config)=>async ({ context, data, operat
                     }
                 }
                 // Call beforeBookingCancel plugin hooks
-                if (newStatus === 'cancelled' && config.hooks?.beforeBookingCancel) {
+                if (newStatus === config.statusMachine.cancelStatus && config.hooks?.beforeBookingCancel) {
                     for (const hook of config.hooks.beforeBookingCancel){
                         await hook({
                             doc: {

package/dist/hooks/reservations/validateStatusTransition.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/hooks/reservations/validateStatusTransition.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload'\n\nimport { ValidationError } from 'payload'\n\nimport type { PluginT } from '../../translations/index.js'\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nimport { validateTransition } from '../../services/AvailabilityService.js'\nimport { isPrivilegedUser } from '../../utilities/userRoles.js'\n\nexport const validateStatusTransition =\n  (config: ResolvedReservationPluginConfig): CollectionBeforeChangeHook =>\n  async ({ context, data, operation, originalDoc, req }) => {\n    if (context?.skipReservationHooks) {return data}\n\n    const newStatus = data?.status as string | undefined\n    const { statusMachine } = config\n\n    if (operation === 'create') {\n      // context.allowConfirmedOnCreate is the escape hatch for payment hooks\n      // that need to create confirmed reservations programmatically\n      const hasContextBypass = Boolean(context?.allowConfirmedOnCreate)\n      // Staff/admin detection: collection-based, with a role-based fallback for\n      // single-collection deployments (userCollection set). See isPrivilegedUser.\n      const isAdmin = isPrivilegedUser(req.user, config)\n      const defaultStatus = statusMachine.defaultStatus\n      const nonDefaultStatuses = statusMachine.transitions[defaultStatus] ?? []\n      const allowedOnCreate: string[] = (isAdmin || hasContextBypass)\n        ? [defaultStatus, ...nonDefaultStatuses]\n        : [defaultStatus]\n\n      if (newStatus && !allowedOnCreate.includes(newStatus)) {\n        const allowed = allowedOnCreate.map((s) => `\"${s}\"`).join(' or ')\n        throw new ValidationError({\n          errors: [\n            {\n              message: (req.t as PluginT)('reservation:errorInvalidCreateStatus', { allowed }),\n              path: 'status',\n            },\n          ],\n        })\n      }\n\n      return data\n    }\n\n    // On update\n    if (operation === 'update' && newStatus) {\n      const previousStatus = originalDoc?.status as string | undefined\n\n      if (previousStatus && previousStatus !== newStatus) {\n        const result = validateTransition(previousStatus, newStatus, statusMachine)\n\n        if (!result.valid) {\n          throw new ValidationError({\n            errors: [\n              {\n                message: (req.t as PluginT)('reservation:errorInvalidTransition', {\n                  from: previousStatus,\n                  to: newStatus,\n                }),\n                path: 'status',\n              },\n            ],\n          })\n        }\n\n        // Call beforeBookingConfirm plugin hooks\n        if (newStatus === 'confirmed' && config.hooks?.beforeBookingConfirm) {\n          for (const hook of config.hooks.beforeBookingConfirm) {\n            await hook({\n              doc: { ...(originalDoc as Record<string, unknown>), ...(data as Record<string, unknown>) },\n              newStatus,\n              req,\n            })\n          }\n        }\n\n        // Call beforeBookingCancel plugin hooks\n        if (newStatus === 'cancelled' && config.hooks?.beforeBookingCancel) {\n          for (const hook of config.hooks.beforeBookingCancel) {\n            await hook({\n              doc: { ...(originalDoc as Record<string, unknown>), ...(data as Record<string, unknown>) },\n              reason: data?.cancellationReason as string | undefined,\n              req,\n            })\n          }\n        }\n      }\n    }\n\n    return data\n  }\n"],"names":["ValidationError","validateTransition","isPrivilegedUser","validateStatusTransition","config","context","data","operation","originalDoc","req","skipReservationHooks","newStatus","status","statusMachine","hasContextBypass","Boolean","allowConfirmedOnCreate","isAdmin","user","defaultStatus","nonDefaultStatuses","transitions","allowedOnCreate","includes","allowed","map","s","join","errors","message","t","path","previousStatus","result","valid","from","to","hooks","beforeBookingConfirm","hook","doc","beforeBookingCancel","reason","cancellationReason"],"mappings":"AAEA,SAASA,eAAe,QAAQ,UAAS;AAKzC,SAASC,kBAAkB,QAAQ,wCAAuC;AAC1E,SAASC,gBAAgB,QAAQ,+BAA8B;AAE/D,OAAO,MAAMC,2BACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,GAAG,EAAE;QACnD,IAAIJ,SAASK,sBAAsB;YAAC,OAAOJ;QAAI;QAE/C,MAAMK,YAAYL,MAAMM;QACxB,MAAM,EAAEC,aAAa,EAAE,GAAGT;QAE1B,IAAIG,cAAc,UAAU;YAC1B,uEAAuE;YACvE,8DAA8D;YAC9D,MAAMO,mBAAmBC,QAAQV,SAASW;YAC1C,0EAA0E;YAC1E,4EAA4E;YAC5E,MAAMC,UAAUf,iBAAiBO,IAAIS,IAAI,EAAEd;YAC3C,MAAMe,gBAAgBN,cAAcM,aAAa;YACjD,MAAMC,qBAAqBP,cAAcQ,WAAW,CAACF,cAAc,IAAI,EAAE;YACzE,MAAMG,kBAA4B,AAACL,WAAWH,mBAC1C;gBAACK;mBAAkBC;aAAmB,GACtC;gBAACD;aAAc;YAEnB,IAAIR,aAAa,CAACW,gBAAgBC,QAAQ,CAACZ,YAAY;gBACrD,MAAMa,UAAUF,gBAAgBG,GAAG,CAAC,CAACC,IAAM,CAAC,CAAC,EAAEA,EAAE,CAAC,CAAC,EAAEC,IAAI,CAAC;gBAC1D,MAAM,IAAI3B,gBAAgB;oBACxB4B,QAAQ;wBACN;4BACEC,SAAS,AAACpB,IAAIqB,CAAC,CAAa,wCAAwC;gCAAEN;4BAAQ;4BAC9EO,MAAM;wBACR;qBACD;gBACH;YACF;YAEA,OAAOzB;QACT;QAEA,YAAY;QACZ,IAAIC,cAAc,YAAYI,WAAW;YACvC,MAAMqB,iBAAiBxB,aAAaI;YAEpC,IAAIoB,kBAAkBA,mBAAmBrB,WAAW;gBAClD,MAAMsB,SAAShC,mBAAmB+B,gBAAgBrB,WAAWE;gBAE7D,IAAI,CAACoB,OAAOC,KAAK,EAAE;oBACjB,MAAM,IAAIlC,gBAAgB;wBACxB4B,QAAQ;4BACN;gCACEC,SAAS,AAACpB,IAAIqB,CAAC,CAAa,sCAAsC;oCAChEK,MAAMH;oCACNI,IAAIzB;gCACN;gCACAoB,MAAM;4BACR;yBACD;oBACH;gBACF;gBAEA,yCAAyC;gBACzC,IAAIpB,cAAc,eAAeP,OAAOiC,KAAK,EAAEC,sBAAsB;oBACnE,KAAK,MAAMC,QAAQnC,OAAOiC,KAAK,CAACC,oBAAoB,CAAE;wBACpD,MAAMC,KAAK;4BACTC,KAAK;gCAAE,GAAIhC,WAAW;gCAA8B,GAAIF,IAAI;4BAA6B;4BACzFK;4BACAF;wBACF;oBACF;gBACF;gBAEA,wCAAwC;gBACxC,IAAIE,cAAc,eAAeP,OAAOiC,KAAK,EAAEI,qBAAqB;oBAClE,KAAK,MAAMF,QAAQnC,OAAOiC,KAAK,CAACI,mBAAmB,CAAE;wBACnD,MAAMF,KAAK;4BACTC,KAAK;gCAAE,GAAIhC,WAAW;gCAA8B,GAAIF,IAAI;4BAA6B;4BACzFoC,QAAQpC,MAAMqC;4BACdlC;wBACF;oBACF;gBACF;YACF;QACF;QAEA,OAAOH;IACT,EAAC"}
+{"version":3,"sources":["../../../src/hooks/reservations/validateStatusTransition.ts"],"sourcesContent":["import type { CollectionBeforeChangeHook } from 'payload'\n\nimport { ValidationError } from 'payload'\n\nimport type { PluginT } from '../../translations/index.js'\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\nimport { validateTransition } from '../../services/AvailabilityService.js'\nimport { isPrivilegedUser } from '../../utilities/userRoles.js'\n\nexport const validateStatusTransition =\n  (config: ResolvedReservationPluginConfig): CollectionBeforeChangeHook =>\n  async ({ context, data, operation, originalDoc, req }) => {\n    if (context?.skipReservationHooks) {return data}\n\n    const newStatus = data?.status as string | undefined\n    const { statusMachine } = config\n\n    if (operation === 'create') {\n      // context.allowConfirmedOnCreate is the escape hatch for payment hooks\n      // that need to create confirmed reservations programmatically\n      const hasContextBypass = Boolean(context?.allowConfirmedOnCreate)\n      // Staff/admin detection: collection-based, with a role-based fallback for\n      // single-collection deployments (userCollection set). See isPrivilegedUser.\n      const isAdmin = isPrivilegedUser(req.user, config)\n      const defaultStatus = statusMachine.defaultStatus\n      const nonDefaultStatuses = statusMachine.transitions[defaultStatus] ?? []\n      const allowedOnCreate: string[] = (isAdmin || hasContextBypass)\n        ? [defaultStatus, ...nonDefaultStatuses]\n        : [defaultStatus]\n\n      if (newStatus && !allowedOnCreate.includes(newStatus)) {\n        const allowed = allowedOnCreate.map((s) => `\"${s}\"`).join(' or ')\n        throw new ValidationError({\n          errors: [\n            {\n              message: (req.t as PluginT)('reservation:errorInvalidCreateStatus', { allowed }),\n              path: 'status',\n            },\n          ],\n        })\n      }\n\n      return data\n    }\n\n    // On update\n    if (operation === 'update' && newStatus) {\n      const previousStatus = originalDoc?.status as string | undefined\n\n      if (previousStatus && previousStatus !== newStatus) {\n        const result = validateTransition(previousStatus, newStatus, statusMachine)\n\n        if (!result.valid) {\n          throw new ValidationError({\n            errors: [\n              {\n                message: (req.t as PluginT)('reservation:errorInvalidTransition', {\n                  from: previousStatus,\n                  to: newStatus,\n                }),\n                path: 'status',\n              },\n            ],\n          })\n        }\n\n        // Call beforeBookingConfirm plugin hooks\n        if (newStatus === config.statusMachine.confirmStatus && config.hooks?.beforeBookingConfirm) {\n          for (const hook of config.hooks.beforeBookingConfirm) {\n            await hook({\n              doc: { ...(originalDoc as Record<string, unknown>), ...(data as Record<string, unknown>) },\n              newStatus,\n              req,\n            })\n          }\n        }\n\n        // Call beforeBookingCancel plugin hooks\n        if (newStatus === config.statusMachine.cancelStatus && config.hooks?.beforeBookingCancel) {\n          for (const hook of config.hooks.beforeBookingCancel) {\n            await hook({\n              doc: { ...(originalDoc as Record<string, unknown>), ...(data as Record<string, unknown>) },\n              reason: data?.cancellationReason as string | undefined,\n              req,\n            })\n          }\n        }\n      }\n    }\n\n    return data\n  }\n"],"names":["ValidationError","validateTransition","isPrivilegedUser","validateStatusTransition","config","context","data","operation","originalDoc","req","skipReservationHooks","newStatus","status","statusMachine","hasContextBypass","Boolean","allowConfirmedOnCreate","isAdmin","user","defaultStatus","nonDefaultStatuses","transitions","allowedOnCreate","includes","allowed","map","s","join","errors","message","t","path","previousStatus","result","valid","from","to","confirmStatus","hooks","beforeBookingConfirm","hook","doc","cancelStatus","beforeBookingCancel","reason","cancellationReason"],"mappings":"AAEA,SAASA,eAAe,QAAQ,UAAS;AAKzC,SAASC,kBAAkB,QAAQ,wCAAuC;AAC1E,SAASC,gBAAgB,QAAQ,+BAA8B;AAE/D,OAAO,MAAMC,2BACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,GAAG,EAAE;QACnD,IAAIJ,SAASK,sBAAsB;YAAC,OAAOJ;QAAI;QAE/C,MAAMK,YAAYL,MAAMM;QACxB,MAAM,EAAEC,aAAa,EAAE,GAAGT;QAE1B,IAAIG,cAAc,UAAU;YAC1B,uEAAuE;YACvE,8DAA8D;YAC9D,MAAMO,mBAAmBC,QAAQV,SAASW;YAC1C,0EAA0E;YAC1E,4EAA4E;YAC5E,MAAMC,UAAUf,iBAAiBO,IAAIS,IAAI,EAAEd;YAC3C,MAAMe,gBAAgBN,cAAcM,aAAa;YACjD,MAAMC,qBAAqBP,cAAcQ,WAAW,CAACF,cAAc,IAAI,EAAE;YACzE,MAAMG,kBAA4B,AAACL,WAAWH,mBAC1C;gBAACK;mBAAkBC;aAAmB,GACtC;gBAACD;aAAc;YAEnB,IAAIR,aAAa,CAACW,gBAAgBC,QAAQ,CAACZ,YAAY;gBACrD,MAAMa,UAAUF,gBAAgBG,GAAG,CAAC,CAACC,IAAM,CAAC,CAAC,EAAEA,EAAE,CAAC,CAAC,EAAEC,IAAI,CAAC;gBAC1D,MAAM,IAAI3B,gBAAgB;oBACxB4B,QAAQ;wBACN;4BACEC,SAAS,AAACpB,IAAIqB,CAAC,CAAa,wCAAwC;gCAAEN;4BAAQ;4BAC9EO,MAAM;wBACR;qBACD;gBACH;YACF;YAEA,OAAOzB;QACT;QAEA,YAAY;QACZ,IAAIC,cAAc,YAAYI,WAAW;YACvC,MAAMqB,iBAAiBxB,aAAaI;YAEpC,IAAIoB,kBAAkBA,mBAAmBrB,WAAW;gBAClD,MAAMsB,SAAShC,mBAAmB+B,gBAAgBrB,WAAWE;gBAE7D,IAAI,CAACoB,OAAOC,KAAK,EAAE;oBACjB,MAAM,IAAIlC,gBAAgB;wBACxB4B,QAAQ;4BACN;gCACEC,SAAS,AAACpB,IAAIqB,CAAC,CAAa,sCAAsC;oCAChEK,MAAMH;oCACNI,IAAIzB;gCACN;gCACAoB,MAAM;4BACR;yBACD;oBACH;gBACF;gBAEA,yCAAyC;gBACzC,IAAIpB,cAAcP,OAAOS,aAAa,CAACwB,aAAa,IAAIjC,OAAOkC,KAAK,EAAEC,sBAAsB;oBAC1F,KAAK,MAAMC,QAAQpC,OAAOkC,KAAK,CAACC,oBAAoB,CAAE;wBACpD,MAAMC,KAAK;4BACTC,KAAK;gCAAE,GAAIjC,WAAW;gCAA8B,GAAIF,IAAI;4BAA6B;4BACzFK;4BACAF;wBACF;oBACF;gBACF;gBAEA,wCAAwC;gBACxC,IAAIE,cAAcP,OAAOS,aAAa,CAAC6B,YAAY,IAAItC,OAAOkC,KAAK,EAAEK,qBAAqB;oBACxF,KAAK,MAAMH,QAAQpC,OAAOkC,KAAK,CAACK,mBAAmB,CAAE;wBACnD,MAAMH,KAAK;4BACTC,KAAK;gCAAE,GAAIjC,WAAW;gCAA8B,GAAIF,IAAI;4BAA6B;4BACzFsC,QAAQtC,MAAMuC;4BACdpC;wBACF;oBACF;gBACF;YACF;QACF;QAEA,OAAOH;IACT,EAAC"}

package/dist/hooks/users/provisionStaffResource.js

@@ -13,7 +13,7 @@
  * whose `user` is the new staff user (spreading the original req preserves
  * `transactionID` for atomicity). The owner field's force-owner-to-req.user
  * rule then assigns the correct owner with no bypass flag — nothing to exploit.
- */ export const provisionStaffResource = (config)=>async ({ context, doc, operation, previousDoc, req })=>{
+ */ export const provisionStaffResource = (config)=>async ({ context, doc, req })=>{
         if (context?.skipReservationHooks) {
             return doc;
         }
@@ -26,13 +26,10 @@
         if (!isStaffNow) {
             return doc;
         }
-        if (operation === 'update') {
-            // Skip if the user was already staff — provisioned on a prior save.
-            const wasStaff = roleMatches(previousDoc?.[sp.roleField], sp.staffRoles);
-            if (wasStaff) {
-                return doc;
-            }
-        }
+        // Idempotency is enforced by the dedup-by-owner query below — NOT by an
+        // early "was already staff" return. Relying on the query means pre-existing
+        // staff (enabled after the fact) and users whose Resource was deleted get
+        // (re)provisioned on their next save (review C5).
         const ownerField = config.resourceOwnerMode?.ownerField ?? 'owner';
         try {
             // Idempotency: skip if a resource already owns this user.

package/dist/hooks/users/provisionStaffResource.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/hooks/users/provisionStaffResource.ts"],"sourcesContent":["import type { CollectionAfterChangeHook, CollectionSlug } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\n/** True if the user's role value (string or string[]) intersects staffRoles. */\nexport function roleMatches(role: unknown, staffRoles: string[]): boolean {\n  if (Array.isArray(role)) {\n    return role.some((r) => staffRoles.includes(r as string))\n  }\n  return typeof role === 'string' && staffRoles.includes(role)\n}\n\n/**\n * afterChange hook for the staff user collection. On create — or on an update\n * that promotes a user into a staff role — provisions a paired Resource owned\n * by that user, unless one already exists.\n *\n * Ownership is assigned via IMPERSONATION: the Resource is created with a `req`\n * whose `user` is the new staff user (spreading the original req preserves\n * `transactionID` for atomicity). The owner field's force-owner-to-req.user\n * rule then assigns the correct owner with no bypass flag — nothing to exploit.\n */\nexport const provisionStaffResource =\n  (config: ResolvedReservationPluginConfig): CollectionAfterChangeHook =>\n  async ({ context, doc, operation, previousDoc, req }) => {\n    if (context?.skipReservationHooks) {\n      return doc\n    }\n\n    const sp = config.staffProvisioning\n    if (!sp) {\n      return doc\n    }\n\n    const d = doc as Record<string, unknown>\n    const isStaffNow = roleMatches(d[sp.roleField], sp.staffRoles)\n    if (!isStaffNow) {\n      return doc\n    }\n\n    if (operation === 'update') {\n      // Skip if the user was already staff — provisioned on a prior save.\n      const wasStaff = roleMatches(\n        (previousDoc as Record<string, unknown> | undefined)?.[sp.roleField],\n        sp.staffRoles,\n      )\n      if (wasStaff) {\n        return doc\n      }\n    }\n\n    const ownerField = config.resourceOwnerMode?.ownerField ?? 'owner'\n\n    try {\n      // Idempotency: skip if a resource already owns this user.\n      const existing = await req.payload.find({\n        collection: config.slugs.resources as unknown as CollectionSlug,\n        depth: 0,\n        limit: 1,\n        req,\n        where: { [ownerField]: { equals: d.id } },\n      })\n      if (existing.docs.length > 0) {\n        return doc\n      }\n\n      let data: Record<string, unknown> = {\n        name: (d[sp.nameFrom] as string) ?? (d.email as string),\n        [ownerField]: d.id,\n        quantity: 1,\n        resourceType: sp.resourceType,\n      }\n\n      if (sp.beforeCreate) {\n        data = await sp.beforeCreate({ data, req, user: d })\n      }\n\n      // Impersonate the new staff user so the owner field resolves to them, not\n      // the admin who triggered the create. Spread preserves the transaction.\n      await req.payload.create({\n        collection: config.slugs.resources as unknown as CollectionSlug,\n        data,\n        req: { ...req, user: { ...d, collection: sp.userCollection } } as typeof req,\n      })\n    } catch (err) {\n      req.payload.logger.error({\n        err,\n        msg: `provisionStaffResource: failed to provision a resource for user ${String(d.id)}`,\n      })\n    }\n\n    return doc\n  }\n"],"names":["roleMatches","role","staffRoles","Array","isArray","some","r","includes","provisionStaffResource","config","context","doc","operation","previousDoc","req","skipReservationHooks","sp","staffProvisioning","d","isStaffNow","roleField","wasStaff","ownerField","resourceOwnerMode","existing","payload","find","collection","slugs","resources","depth","limit","where","equals","id","docs","length","data","name","nameFrom","email","quantity","resourceType","beforeCreate","user","create","userCollection","err","logger","error","msg","String"],"mappings":"AAIA,8EAA8E,GAC9E,OAAO,SAASA,YAAYC,IAAa,EAAEC,UAAoB;IAC7D,IAAIC,MAAMC,OAAO,CAACH,OAAO;QACvB,OAAOA,KAAKI,IAAI,CAAC,CAACC,IAAMJ,WAAWK,QAAQ,CAACD;IAC9C;IACA,OAAO,OAAOL,SAAS,YAAYC,WAAWK,QAAQ,CAACN;AACzD;AAEA;;;;;;;;;CASC,GACD,OAAO,MAAMO,yBACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,GAAG,EAAEC,SAAS,EAAEC,WAAW,EAAEC,GAAG,EAAE;QAClD,IAAIJ,SAASK,sBAAsB;YACjC,OAAOJ;QACT;QAEA,MAAMK,KAAKP,OAAOQ,iBAAiB;QACnC,IAAI,CAACD,IAAI;YACP,OAAOL;QACT;QAEA,MAAMO,IAAIP;QACV,MAAMQ,aAAanB,YAAYkB,CAAC,CAACF,GAAGI,SAAS,CAAC,EAAEJ,GAAGd,UAAU;QAC7D,IAAI,CAACiB,YAAY;YACf,OAAOR;QACT;QAEA,IAAIC,cAAc,UAAU;YAC1B,oEAAoE;YACpE,MAAMS,WAAWrB,YACda,aAAqD,CAACG,GAAGI,SAAS,CAAC,EACpEJ,GAAGd,UAAU;YAEf,IAAImB,UAAU;gBACZ,OAAOV;YACT;QACF;QAEA,MAAMW,aAAab,OAAOc,iBAAiB,EAAED,cAAc;QAE3D,IAAI;YACF,0DAA0D;YAC1D,MAAME,WAAW,MAAMV,IAAIW,OAAO,CAACC,IAAI,CAAC;gBACtCC,YAAYlB,OAAOmB,KAAK,CAACC,SAAS;gBAClCC,OAAO;gBACPC,OAAO;gBACPjB;gBACAkB,OAAO;oBAAE,CAACV,WAAW,EAAE;wBAAEW,QAAQf,EAAEgB,EAAE;oBAAC;gBAAE;YAC1C;YACA,IAAIV,SAASW,IAAI,CAACC,MAAM,GAAG,GAAG;gBAC5B,OAAOzB;YACT;YAEA,IAAI0B,OAAgC;gBAClCC,MAAM,AAACpB,CAAC,CAACF,GAAGuB,QAAQ,CAAC,IAAgBrB,EAAEsB,KAAK;gBAC5C,CAAClB,WAAW,EAAEJ,EAAEgB,EAAE;gBAClBO,UAAU;gBACVC,cAAc1B,GAAG0B,YAAY;YAC/B;YAEA,IAAI1B,GAAG2B,YAAY,EAAE;gBACnBN,OAAO,MAAMrB,GAAG2B,YAAY,CAAC;oBAAEN;oBAAMvB;oBAAK8B,MAAM1B;gBAAE;YACpD;YAEA,0EAA0E;YAC1E,wEAAwE;YACxE,MAAMJ,IAAIW,OAAO,CAACoB,MAAM,CAAC;gBACvBlB,YAAYlB,OAAOmB,KAAK,CAACC,SAAS;gBAClCQ;gBACAvB,KAAK;oBAAE,GAAGA,GAAG;oBAAE8B,MAAM;wBAAE,GAAG1B,CAAC;wBAAES,YAAYX,GAAG8B,cAAc;oBAAC;gBAAE;YAC/D;QACF,EAAE,OAAOC,KAAK;YACZjC,IAAIW,OAAO,CAACuB,MAAM,CAACC,KAAK,CAAC;gBACvBF;gBACAG,KAAK,CAAC,gEAAgE,EAAEC,OAAOjC,EAAEgB,EAAE,GAAG;YACxF;QACF;QAEA,OAAOvB;IACT,EAAC"}
+{"version":3,"sources":["../../../src/hooks/users/provisionStaffResource.ts"],"sourcesContent":["import type { CollectionAfterChangeHook, CollectionSlug } from 'payload'\n\nimport type { ResolvedReservationPluginConfig } from '../../types.js'\n\n/** True if the user's role value (string or string[]) intersects staffRoles. */\nexport function roleMatches(role: unknown, staffRoles: string[]): boolean {\n  if (Array.isArray(role)) {\n    return role.some((r) => staffRoles.includes(r as string))\n  }\n  return typeof role === 'string' && staffRoles.includes(role)\n}\n\n/**\n * afterChange hook for the staff user collection. On create — or on an update\n * that promotes a user into a staff role — provisions a paired Resource owned\n * by that user, unless one already exists.\n *\n * Ownership is assigned via IMPERSONATION: the Resource is created with a `req`\n * whose `user` is the new staff user (spreading the original req preserves\n * `transactionID` for atomicity). The owner field's force-owner-to-req.user\n * rule then assigns the correct owner with no bypass flag — nothing to exploit.\n */\nexport const provisionStaffResource =\n  (config: ResolvedReservationPluginConfig): CollectionAfterChangeHook =>\n  async ({ context, doc, req }) => {\n    if (context?.skipReservationHooks) {\n      return doc\n    }\n\n    const sp = config.staffProvisioning\n    if (!sp) {\n      return doc\n    }\n\n    const d = doc as Record<string, unknown>\n    const isStaffNow = roleMatches(d[sp.roleField], sp.staffRoles)\n    if (!isStaffNow) {\n      return doc\n    }\n\n    // Idempotency is enforced by the dedup-by-owner query below — NOT by an\n    // early \"was already staff\" return. Relying on the query means pre-existing\n    // staff (enabled after the fact) and users whose Resource was deleted get\n    // (re)provisioned on their next save (review C5).\n    const ownerField = config.resourceOwnerMode?.ownerField ?? 'owner'\n\n    try {\n      // Idempotency: skip if a resource already owns this user.\n      const existing = await req.payload.find({\n        collection: config.slugs.resources as unknown as CollectionSlug,\n        depth: 0,\n        limit: 1,\n        req,\n        where: { [ownerField]: { equals: d.id } },\n      })\n      if (existing.docs.length > 0) {\n        return doc\n      }\n\n      let data: Record<string, unknown> = {\n        name: (d[sp.nameFrom] as string) ?? (d.email as string),\n        [ownerField]: d.id,\n        quantity: 1,\n        resourceType: sp.resourceType,\n      }\n\n      if (sp.beforeCreate) {\n        data = await sp.beforeCreate({ data, req, user: d })\n      }\n\n      // Impersonate the new staff user so the owner field resolves to them, not\n      // the admin who triggered the create. Spread preserves the transaction.\n      await req.payload.create({\n        collection: config.slugs.resources as unknown as CollectionSlug,\n        data,\n        req: { ...req, user: { ...d, collection: sp.userCollection } } as typeof req,\n      })\n    } catch (err) {\n      req.payload.logger.error({\n        err,\n        msg: `provisionStaffResource: failed to provision a resource for user ${String(d.id)}`,\n      })\n    }\n\n    return doc\n  }\n"],"names":["roleMatches","role","staffRoles","Array","isArray","some","r","includes","provisionStaffResource","config","context","doc","req","skipReservationHooks","sp","staffProvisioning","d","isStaffNow","roleField","ownerField","resourceOwnerMode","existing","payload","find","collection","slugs","resources","depth","limit","where","equals","id","docs","length","data","name","nameFrom","email","quantity","resourceType","beforeCreate","user","create","userCollection","err","logger","error","msg","String"],"mappings":"AAIA,8EAA8E,GAC9E,OAAO,SAASA,YAAYC,IAAa,EAAEC,UAAoB;IAC7D,IAAIC,MAAMC,OAAO,CAACH,OAAO;QACvB,OAAOA,KAAKI,IAAI,CAAC,CAACC,IAAMJ,WAAWK,QAAQ,CAACD;IAC9C;IACA,OAAO,OAAOL,SAAS,YAAYC,WAAWK,QAAQ,CAACN;AACzD;AAEA;;;;;;;;;CASC,GACD,OAAO,MAAMO,yBACX,CAACC,SACD,OAAO,EAAEC,OAAO,EAAEC,GAAG,EAAEC,GAAG,EAAE;QAC1B,IAAIF,SAASG,sBAAsB;YACjC,OAAOF;QACT;QAEA,MAAMG,KAAKL,OAAOM,iBAAiB;QACnC,IAAI,CAACD,IAAI;YACP,OAAOH;QACT;QAEA,MAAMK,IAAIL;QACV,MAAMM,aAAajB,YAAYgB,CAAC,CAACF,GAAGI,SAAS,CAAC,EAAEJ,GAAGZ,UAAU;QAC7D,IAAI,CAACe,YAAY;YACf,OAAON;QACT;QAEA,wEAAwE;QACxE,4EAA4E;QAC5E,0EAA0E;QAC1E,kDAAkD;QAClD,MAAMQ,aAAaV,OAAOW,iBAAiB,EAAED,cAAc;QAE3D,IAAI;YACF,0DAA0D;YAC1D,MAAME,WAAW,MAAMT,IAAIU,OAAO,CAACC,IAAI,CAAC;gBACtCC,YAAYf,OAAOgB,KAAK,CAACC,SAAS;gBAClCC,OAAO;gBACPC,OAAO;gBACPhB;gBACAiB,OAAO;oBAAE,CAACV,WAAW,EAAE;wBAAEW,QAAQd,EAAEe,EAAE;oBAAC;gBAAE;YAC1C;YACA,IAAIV,SAASW,IAAI,CAACC,MAAM,GAAG,GAAG;gBAC5B,OAAOtB;YACT;YAEA,IAAIuB,OAAgC;gBAClCC,MAAM,AAACnB,CAAC,CAACF,GAAGsB,QAAQ,CAAC,IAAgBpB,EAAEqB,KAAK;gBAC5C,CAAClB,WAAW,EAAEH,EAAEe,EAAE;gBAClBO,UAAU;gBACVC,cAAczB,GAAGyB,YAAY;YAC/B;YAEA,IAAIzB,GAAG0B,YAAY,EAAE;gBACnBN,OAAO,MAAMpB,GAAG0B,YAAY,CAAC;oBAAEN;oBAAMtB;oBAAK6B,MAAMzB;gBAAE;YACpD;YAEA,0EAA0E;YAC1E,wEAAwE;YACxE,MAAMJ,IAAIU,OAAO,CAACoB,MAAM,CAAC;gBACvBlB,YAAYf,OAAOgB,KAAK,CAACC,SAAS;gBAClCQ;gBACAtB,KAAK;oBAAE,GAAGA,GAAG;oBAAE6B,MAAM;wBAAE,GAAGzB,CAAC;wBAAEQ,YAAYV,GAAG6B,cAAc;oBAAC;gBAAE;YAC/D;QACF,EAAE,OAAOC,KAAK;YACZhC,IAAIU,OAAO,CAACuB,MAAM,CAACC,KAAK,CAAC;gBACvBF;gBACAG,KAAK,CAAC,gEAAgE,EAAEC,OAAOhC,EAAEe,EAAE,GAAG;YACxF;QACF;QAEA,OAAOpB;IACT,EAAC"}