BPPP/smb-online
2
0
Fork 0
Code Issues 15 Pull Requests Actions Packages Projects Releases Wiki Activity

Per-client ICS calendar feed, replacing the shared ICS_TOKEN (#22)
Test backoffice (smb-crm) / test (push) Has been cancelled
Details

Browse Source 
Each client now gets their own clients.ics_token (lazily generated on
first /owner/settings visit), which both authenticates and scopes
/api/bookings.ics -- closing the gap where any shared-token holder
could view another client's bookings by swapping the client_id query
param. The owner settings page now surfaces a copyable subscribe URL.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
rogalik27
2026-08-04 11:55:35 +02:00
parent 319218ce21
commit 24d9aca812
9 changed files with 196 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backoffice/db/init.sql
+5
View File
@@ -213,3 +213,8 @@ CREATE INDEX IF NOT EXISTS services_client_idx ON services (client_id);
CREATE INDEX IF NOT EXISTS bookings_client_idx ON bookings (client_id);
CREATE INDEX IF NOT EXISTS users_client_idx ON users (client_id);
CREATE INDEX IF NOT EXISTS password_reset_tokens_user_idx ON password_reset_tokens (user_id);
-- Partial (NULL-excluding) so many clients can share ics_token IS NULL before
-- their first ensure_ics_token() call lazily backfills a real value (#22).
CREATE UNIQUE INDEX IF NOT EXISTS clients_ics_token_idx ON clients (ics_token)
WHERE ics_token IS NOT NULL;