Per-client ICS calendar feed, replacing the shared ICS_TOKEN (#22)

Each client now gets their own clients.ics_token (lazily generated on
first /owner/settings visit), which both authenticates and scopes
/api/bookings.ics -- closing the gap where any shared-token holder
could view another client's bookings by swapping the client_id query
param. The owner settings page now surfaces a copyable subscribe URL.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backoffice/app/tests/test_bookings_ics.py

@@ -0,0 +1,120 @@
+"""Flask test client / real-DB integration tests for the per-client ICS
+calendar feed (#22): each client's clients.ics_token gates and scopes
+/api/bookings.ics, replacing the old shared ICS_TOKEN + client_id query
+param. Same testing decision as #20/#21: assert on HTTP response + DB state.
+"""
+from datetime import datetime, timedelta, timezone
+
+import pytest
+
+import booking_db as bdb
+from app import app as flask_app
+
+CLIENT_A = "C-TEST-ICS-A"
+CLIENT_B = "C-TEST-ICS-B"
+
+
+@pytest.fixture
+def client():
+    flask_app.config["TESTING"] = True
+    flask_app.secret_key = "test-secret"
+    return flask_app.test_client()
+
+
+def _setup(client_id, business_name):
+    with bdb.db.connect() as conn, conn.cursor() as cur:
+        cur.execute(
+            "INSERT INTO clients (client_id, business_name, timezone, auto_confirm, ics_token) "
+            "VALUES (%s, %s, %s, %s, NULL) ON CONFLICT (client_id) DO UPDATE SET "
+            "business_name = EXCLUDED.business_name, ics_token = NULL",
+            (client_id, business_name, "Europe/Berlin", True))
+        conn.commit()
+    resource = bdb.create_resource(client_id, "Chair 1")
+    start = datetime.now(timezone.utc).replace(microsecond=0) + timedelta(days=1)
+    booking = bdb.create_booking(
+        client_id, resource["resource_id"], "Ivy", "ivy@example.com",
+        "Haircut", start, start + timedelta(minutes=30))
+    return resource, booking
+
+
+def _login(client, client_id, email="owner@example.com", password="correct horse"):
+    bdb.create_user(client_id, email, password)
+    client.post("/owner/login", data={"email": email, "password": password})
+
+
+# ---- token gating ----
+
+def test_missing_token_is_forbidden(client):
+    _setup(CLIENT_A, "Happy Nails")
+    resp = client.get("/api/bookings.ics")
+    assert resp.status_code == 403
+
+
+def test_bogus_token_is_forbidden(client):
+    _setup(CLIENT_A, "Happy Nails")
+    resp = client.get("/api/bookings.ics", query_string={"token": "not-a-real-token"})
+    assert resp.status_code == 403
+
+
+def test_valid_token_returns_only_that_clients_bookings(client):
+    _setup(CLIENT_A, "Happy Nails")
+    _setup(CLIENT_B, "Cafe Lichtblick")
+    token_a = bdb.ensure_ics_token(CLIENT_A)
+    resp = client.get("/api/bookings.ics", query_string={"token": token_a})
+    assert resp.status_code == 200
+    body = resp.get_data(as_text=True)
+    assert "Ivy" in body
+    assert CLIENT_A in body
+    assert CLIENT_B not in body
+
+
+def test_swapping_client_id_query_param_has_no_effect(client):
+    """The old feed let any token holder view another client's bookings by
+    changing client_id -- the new feed resolves the client from the token
+    alone, so a client_id param (even another tenant's) is simply ignored."""
+    _setup(CLIENT_A, "Happy Nails")
+    resource_b, booking_b = _setup(CLIENT_B, "Cafe Lichtblick")
+    token_a = bdb.ensure_ics_token(CLIENT_A)
+    resp = client.get("/api/bookings.ics", query_string={
+        "token": token_a, "client_id": CLIENT_B})
+    assert resp.status_code == 200
+    body = resp.get_data(as_text=True)
+    assert CLIENT_B not in body
+    assert CLIENT_A in body
+
+
+# ---- token provisioning ----
+
+def test_ensure_ics_token_generates_and_persists(client):
+    _setup(CLIENT_A, "Happy Nails")
+    assert bdb.get_client(CLIENT_A)["ics_token"] is None
+    token = bdb.ensure_ics_token(CLIENT_A)
+    assert token
+    assert bdb.get_client(CLIENT_A)["ics_token"] == token
+
+
+def test_ensure_ics_token_is_stable_across_calls(client):
+    _setup(CLIENT_A, "Happy Nails")
+    first = bdb.ensure_ics_token(CLIENT_A)
+    second = bdb.ensure_ics_token(CLIENT_A)
+    assert first == second
+
+
+def test_ensure_ics_token_differs_per_client(client):
+    _setup(CLIENT_A, "Happy Nails")
+    _setup(CLIENT_B, "Cafe Lichtblick")
+    assert bdb.ensure_ics_token(CLIENT_A) != bdb.ensure_ics_token(CLIENT_B)
+
+
+# ---- owner dashboard surfacing ----
+
+def test_settings_page_shows_subscribe_url_with_own_token(client):
+    _setup(CLIENT_A, "Happy Nails")
+    _login(client, CLIENT_A)
+    resp = client.get("/owner/settings")
+    assert resp.status_code == 200
+    body = resp.get_data(as_text=True)
+    token = bdb.get_client(CLIENT_A)["ics_token"]
+    assert token
+    assert f"token={token}" in body
+    assert "bookings.ics" in body