Add locations (Filialen) as a grouping layer above resources
Test backoffice (smb-crm) / test (push) Successful in 1m46s

Enables multiple barbers/staff bookable at the same location and time
-- previously "resource" conflated "location" and "the thing that
can't double-book itself" into one row, so a Filiale could only ever
have exactly one bookable slot at once.

- New `locations` table; `resources.location_id` with a generic,
  idempotent backfill migration (any resource without a location gets
  one auto-created matching its name -- not a one-off for any single
  client, protects any future resource stuck in the old flat shape too)
- `resources`/`resource_hours`/services keep everything they already
  had (hours, min-notice, max-advance, buffer, the no-overlap
  constraint) scoped to resource_id, not location_id -- two barbers at
  one location must stay independently bookable at the same time
- booking_db.py: new locations CRUD mirroring the existing
  resources/services pattern; create_resource now requires a
  location_id, guarded the same way every other tenant check here is
  (get_location existence check, no real FK -- matches this schema's
  existing no-FK convention throughout)
- app.py: new POST /api/locations provisioning route; POST
  /api/resources now requires location_id
- owner_settings.py + settings.html: new self-service "add a Filiale"
  / "add a barber" UI -- there was previously no way to create a
  resource at all outside the CRM/n8n provisioning API
- public_booking.py + book.html: new Filiale picker (reuses the
  existing wireOptionGroup button-group pattern), filtering the
  Mitarbeiter picker to the selected location -- a single-location
  client sees no extra click, same as before Filialen existed
- owner_booking.py + agenda.html: the Filiale show/hide toggle and
  hide-cancelled toggle (shipped earlier this session) now key off
  location_id instead of resource_id, so hiding a Filiale hides every
  barber's bookings at it; manual-booking dropdown grouped by Filiale
- n8n/onboarding.json: default provisioning now creates a "Hauptfiliale"
  location before its resource (inert until re-imported into the live
  n8n instance)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
2026-09-12 03:02:56 +02:00
parent a56a238e81
commit 456ca3872f
19 changed files with 585 additions and 99 deletions
+1 -1
View File
@@ -69,7 +69,7 @@ os.environ["DATABASE_URL"] = DATABASE_URL
def _clean_tables():
with psycopg.connect(DATABASE_URL) as conn, conn.cursor() as cur:
cur.execute(
"TRUNCATE resources, services, bookings, users, "
"TRUNCATE locations, resources, services, bookings, users, "
"password_reset_tokens RESTART IDENTITY CASCADE")
conn.commit()
yield
+2 -1
View File
@@ -34,7 +34,8 @@ def _setup_resource_and_service(client_id=CLIENT_A, auto_confirm=True, **resourc
"auto_confirm = EXCLUDED.auto_confirm",
(client_id, "Europe/Berlin", auto_confirm))
conn.commit()
resource = bdb.create_resource(client_id, "Chair 1", **resource_kwargs)
location = bdb.create_location(client_id, "Main")
resource = bdb.create_resource(client_id, location["location_id"], "Chair 1", **resource_kwargs)
bdb.set_resource_hours(client_id, resource["resource_id"], 0, time(9, 0), time(17, 0))
service = bdb.create_service(client_id, "Haircut", 60, price=25)
return resource, service
+24 -19
View File
@@ -13,10 +13,14 @@ def _dt(hour, minute=0):
return datetime(2026, 8, 3, hour, minute, tzinfo=timezone.utc)
def _loc(client_id):
return bdb.create_location(client_id, "Main")["location_id"]
# ---- resources / services ----
def test_create_and_get_resource():
r = bdb.create_resource(CLIENT_A, "Chair 1")
r = bdb.create_resource(CLIENT_A, _loc(CLIENT_A), "Chair 1")
assert r["client_id"] == CLIENT_A
assert r["name"] == "Chair 1"
assert r["active"] is True
@@ -24,7 +28,7 @@ def test_create_and_get_resource():
def test_get_resource_is_tenant_scoped():
r = bdb.create_resource(CLIENT_A, "Chair 1")
r = bdb.create_resource(CLIENT_A, _loc(CLIENT_A), "Chair 1")
assert bdb.get_resource(CLIENT_B, r["resource_id"]) is None
@@ -42,7 +46,7 @@ def test_get_service_is_tenant_scoped():
# ---- bookings: double-booking protection ----
def test_create_booking_succeeds():
r = bdb.create_resource(CLIENT_A, "Chair 1")
r = bdb.create_resource(CLIENT_A, _loc(CLIENT_A), "Chair 1")
b = bdb.create_booking(CLIENT_A, r["resource_id"], "Alice", "alice@example.com",
"Haircut", _dt(10), _dt(11))
assert b["status"] == "confirmed"
@@ -50,7 +54,7 @@ def test_create_booking_succeeds():
def test_overlapping_booking_same_resource_raises_conflict():
r = bdb.create_resource(CLIENT_A, "Chair 1")
r = bdb.create_resource(CLIENT_A, _loc(CLIENT_A), "Chair 1")
bdb.create_booking(CLIENT_A, r["resource_id"], "Alice", "a@x.com",
"Haircut", _dt(10), _dt(11))
with pytest.raises(bdb.BookingConflict):
@@ -63,7 +67,7 @@ def test_truly_concurrent_overlapping_inserts_only_one_wins():
overlapping slot -- not just a sequential second-request-fails check.
The Postgres EXCLUDE constraint (not app-level locking) is what has to
serialize this."""
r = bdb.create_resource(CLIENT_A, "Chair 1")
r = bdb.create_resource(CLIENT_A, _loc(CLIENT_A), "Chair 1")
start_barrier = threading.Barrier(2)
results = {}
@@ -92,7 +96,7 @@ def test_truly_concurrent_overlapping_inserts_only_one_wins():
def test_adjacent_non_overlapping_bookings_both_succeed():
r = bdb.create_resource(CLIENT_A, "Chair 1")
r = bdb.create_resource(CLIENT_A, _loc(CLIENT_A), "Chair 1")
bdb.create_booking(CLIENT_A, r["resource_id"], "Alice", "a@x.com",
"Haircut", _dt(10), _dt(11))
b2 = bdb.create_booking(CLIENT_A, r["resource_id"], "Bob", "b@x.com",
@@ -101,15 +105,15 @@ def test_adjacent_non_overlapping_bookings_both_succeed():
def test_create_booking_rejects_resource_from_another_client():
other = bdb.create_resource(CLIENT_B, "Chair 1")
other = bdb.create_resource(CLIENT_B, _loc(CLIENT_B), "Chair 1")
with pytest.raises(bdb.UnknownResource):
bdb.create_booking(CLIENT_A, other["resource_id"], "Alice", "a@x.com",
"Haircut", _dt(10), _dt(11))
def test_update_booking_rejects_moving_to_another_clients_resource():
r = bdb.create_resource(CLIENT_A, "Chair 1")
other = bdb.create_resource(CLIENT_B, "Chair 1")
r = bdb.create_resource(CLIENT_A, _loc(CLIENT_A), "Chair 1")
other = bdb.create_resource(CLIENT_B, _loc(CLIENT_B), "Chair 1")
b = bdb.create_booking(CLIENT_A, r["resource_id"], "Alice", "a@x.com",
"Haircut", _dt(10), _dt(11))
with pytest.raises(bdb.UnknownResource):
@@ -117,15 +121,16 @@ def test_update_booking_rejects_moving_to_another_clients_resource():
def test_create_pending_booking():
r = bdb.create_resource(CLIENT_A, "Chair 1")
r = bdb.create_resource(CLIENT_A, _loc(CLIENT_A), "Chair 1")
b = bdb.create_booking(CLIENT_A, r["resource_id"], "Alice", "a@x.com",
"Haircut", _dt(10), _dt(11), status="pending")
assert bdb.get_booking(CLIENT_A, b["booking_id"])["status"] == "pending"
def test_overlap_on_different_resource_succeeds():
r1 = bdb.create_resource(CLIENT_A, "Chair 1")
r2 = bdb.create_resource(CLIENT_A, "Chair 2")
loc = _loc(CLIENT_A)
r1 = bdb.create_resource(CLIENT_A, loc, "Chair 1")
r2 = bdb.create_resource(CLIENT_A, loc, "Chair 2")
bdb.create_booking(CLIENT_A, r1["resource_id"], "Alice", "a@x.com",
"Haircut", _dt(10), _dt(11))
b2 = bdb.create_booking(CLIENT_A, r2["resource_id"], "Bob", "b@x.com",
@@ -134,7 +139,7 @@ def test_overlap_on_different_resource_succeeds():
def test_reschedule_into_conflict_raises_and_leaves_original_untouched():
r = bdb.create_resource(CLIENT_A, "Chair 1")
r = bdb.create_resource(CLIENT_A, _loc(CLIENT_A), "Chair 1")
bdb.create_booking(CLIENT_A, r["resource_id"], "Alice", "a@x.com",
"Haircut", _dt(10), _dt(11))
b2 = bdb.create_booking(CLIENT_A, r["resource_id"], "Bob", "b@x.com",
@@ -147,7 +152,7 @@ def test_reschedule_into_conflict_raises_and_leaves_original_untouched():
def test_reschedule_to_free_slot_succeeds():
r = bdb.create_resource(CLIENT_A, "Chair 1")
r = bdb.create_resource(CLIENT_A, _loc(CLIENT_A), "Chair 1")
b = bdb.create_booking(CLIENT_A, r["resource_id"], "Alice", "a@x.com",
"Haircut", _dt(10), _dt(11))
updated = bdb.update_booking(CLIENT_A, b["booking_id"], start_time=_dt(14),
@@ -156,7 +161,7 @@ def test_reschedule_to_free_slot_succeeds():
def test_update_booking_rejects_non_updatable_field():
r = bdb.create_resource(CLIENT_A, "Chair 1")
r = bdb.create_resource(CLIENT_A, _loc(CLIENT_A), "Chair 1")
b = bdb.create_booking(CLIENT_A, r["resource_id"], "Alice", "a@x.com",
"Haircut", _dt(10), _dt(11))
with pytest.raises(ValueError):
@@ -166,14 +171,14 @@ def test_update_booking_rejects_non_updatable_field():
# ---- bookings: tenancy isolation ----
def test_get_booking_is_tenant_scoped_even_with_correct_id():
r = bdb.create_resource(CLIENT_A, "Chair 1")
r = bdb.create_resource(CLIENT_A, _loc(CLIENT_A), "Chair 1")
b = bdb.create_booking(CLIENT_A, r["resource_id"], "Alice", "a@x.com",
"Haircut", _dt(10), _dt(11))
assert bdb.get_booking(CLIENT_B, b["booking_id"]) is None
def test_update_booking_cannot_touch_other_clients_booking():
r = bdb.create_resource(CLIENT_A, "Chair 1")
r = bdb.create_resource(CLIENT_A, _loc(CLIENT_A), "Chair 1")
b = bdb.create_booking(CLIENT_A, r["resource_id"], "Alice", "a@x.com",
"Haircut", _dt(10), _dt(11))
result = bdb.update_booking(CLIENT_B, b["booking_id"], status="cancelled")
@@ -182,8 +187,8 @@ def test_update_booking_cannot_touch_other_clients_booking():
def test_list_bookings_only_returns_own_client():
ra = bdb.create_resource(CLIENT_A, "Chair 1")
rb = bdb.create_resource(CLIENT_B, "Chair 1")
ra = bdb.create_resource(CLIENT_A, _loc(CLIENT_A), "Chair 1")
rb = bdb.create_resource(CLIENT_B, _loc(CLIENT_B), "Chair 1")
bdb.create_booking(CLIENT_A, ra["resource_id"], "Alice", "a@x.com",
"Haircut", _dt(10), _dt(11))
bdb.create_booking(CLIENT_B, rb["resource_id"], "Zoe", "z@x.com",
+2 -1
View File
@@ -29,7 +29,8 @@ def _setup(client_id, business_name):
"business_name = EXCLUDED.business_name, ics_token = NULL",
(client_id, business_name, "Europe/Berlin", True))
conn.commit()
resource = bdb.create_resource(client_id, "Chair 1")
location = bdb.create_location(client_id, "Main")
resource = bdb.create_resource(client_id, location["location_id"], "Chair 1")
start = datetime.now(timezone.utc).replace(microsecond=0) + timedelta(days=1)
booking = bdb.create_booking(
client_id, resource["resource_id"], "Ivy", "ivy@example.com",
+3 -2
View File
@@ -34,8 +34,9 @@ def _setup_resource_and_service(client_id=CLIENT_A):
"auto_confirm = EXCLUDED.auto_confirm",
(client_id, "Europe/Berlin", True))
conn.commit()
resource = bdb.create_resource(client_id, "Chair 1", min_notice_minutes=0,
max_advance_days=365)
location = bdb.create_location(client_id, "Main")
resource = bdb.create_resource(client_id, location["location_id"], "Chair 1",
min_notice_minutes=0, max_advance_days=365)
bdb.set_resource_hours(client_id, resource["resource_id"], 0, time(9, 0), time(17, 0))
service = bdb.create_service(client_id, "Haircut", 60, price=25)
return resource, service
+2 -1
View File
@@ -35,7 +35,8 @@ def _setup(client_id=CLIENT_A, **resource_kwargs):
"auto_confirm = EXCLUDED.auto_confirm",
(client_id, "Europe/Berlin", True))
conn.commit()
resource = bdb.create_resource(client_id, "Chair 1", **resource_kwargs)
location = bdb.create_location(client_id, "Main")
resource = bdb.create_resource(client_id, location["location_id"], "Chair 1", **resource_kwargs)
bdb.set_resource_hours(client_id, resource["resource_id"], 0, time(9, 0), time(17, 0))
service = bdb.create_service(client_id, "Haircut", 60, price=25)
return resource, service
+76 -4
View File
@@ -30,7 +30,8 @@ def _setup(client_id=CLIENT_A, **resource_kwargs):
"notify_channel = EXCLUDED.notify_channel",
(client_id, "Europe/Berlin", True, None))
conn.commit()
resource = bdb.create_resource(client_id, "Chair 1", **resource_kwargs)
location = bdb.create_location(client_id, "Main")
resource = bdb.create_resource(client_id, location["location_id"], "Chair 1", **resource_kwargs)
service = bdb.create_service(client_id, "Haircut", 60, price=25)
return resource, service
@@ -110,7 +111,8 @@ def test_owner_can_update_resource_notice_and_buffer(client):
resource, service = _setup(CLIENT_A)
_login(client, CLIENT_A)
resp = client.post(f"/owner/settings/resources/{resource['resource_id']}", data={
"min_notice_minutes": "120", "max_advance_days": "14", "buffer_minutes": "15"})
"name": "Chair 1", "min_notice_minutes": "120", "max_advance_days": "14",
"buffer_minutes": "15"})
assert "error" not in resp.headers["Location"]
updated = bdb.get_resource(CLIENT_A, resource["resource_id"])
assert updated["min_notice_minutes"] == 120
@@ -118,11 +120,38 @@ def test_owner_can_update_resource_notice_and_buffer(client):
assert updated["buffer_minutes"] == 15
def test_owner_can_rename_resource_and_toggle_active(client):
resource, service = _setup(CLIENT_A)
_login(client, CLIENT_A)
resp = client.post(f"/owner/settings/resources/{resource['resource_id']}", data={
"name": "Anna", "min_notice_minutes": "60", "max_advance_days": "30",
"buffer_minutes": "0"})
assert "error" not in resp.headers["Location"]
updated = bdb.get_resource(CLIENT_A, resource["resource_id"])
assert updated["name"] == "Anna"
assert updated["active"] is False # checkbox omitted == unchecked
resp = client.post(f"/owner/settings/resources/{resource['resource_id']}", data={
"name": "Anna", "active": "on", "min_notice_minutes": "60",
"max_advance_days": "30", "buffer_minutes": "0"})
assert bdb.get_resource(CLIENT_A, resource["resource_id"])["active"] is True
def test_update_resource_rejects_missing_name(client):
resource, service = _setup(CLIENT_A)
_login(client, CLIENT_A)
resp = client.post(f"/owner/settings/resources/{resource['resource_id']}", data={
"name": "", "min_notice_minutes": "0", "max_advance_days": "14",
"buffer_minutes": "15"})
assert "error=invalid_resource" in resp.headers["Location"]
def test_update_resource_rejects_negative_values(client):
resource, service = _setup(CLIENT_A)
_login(client, CLIENT_A)
resp = client.post(f"/owner/settings/resources/{resource['resource_id']}", data={
"min_notice_minutes": "-1", "max_advance_days": "14", "buffer_minutes": "15"})
"name": "Chair 1", "min_notice_minutes": "-1", "max_advance_days": "14",
"buffer_minutes": "15"})
assert "error=invalid_resource" in resp.headers["Location"]
@@ -131,11 +160,54 @@ def test_owner_cannot_update_another_tenants_resource(client):
_setup(CLIENT_A)
_login(client, CLIENT_A)
resp = client.post(f"/owner/settings/resources/{resource_b['resource_id']}", data={
"min_notice_minutes": "0", "max_advance_days": "1", "buffer_minutes": "0"})
"name": "Hijacked", "min_notice_minutes": "0", "max_advance_days": "1",
"buffer_minutes": "0"})
assert "error=not_found" in resp.headers["Location"]
assert bdb.get_resource(CLIENT_B, resource_b["resource_id"])["max_advance_days"] != 1
# ---- locations / resources self-service ----
def test_owner_can_create_location(client):
_setup(CLIENT_A)
_login(client, CLIENT_A)
resp = client.post("/owner/settings/locations", data={"name": "Zweite Filiale"})
assert "error" not in resp.headers["Location"]
names = {l["name"] for l in bdb.list_locations(CLIENT_A)}
assert "Zweite Filiale" in names
def test_create_location_rejects_missing_name(client):
_setup(CLIENT_A)
_login(client, CLIENT_A)
resp = client.post("/owner/settings/locations", data={"name": ""})
assert "error=invalid_location" in resp.headers["Location"]
def test_owner_can_add_a_second_barber_to_a_location(client):
resource, service = _setup(CLIENT_A)
_login(client, CLIENT_A)
location_id = resource["location_id"]
resp = client.post("/owner/settings/resources", data={
"location_id": location_id, "name": "Jonas"})
assert "error" not in resp.headers["Location"]
names = {r["name"] for r in bdb.list_resources(CLIENT_A)}
assert {"Chair 1", "Jonas"} <= names
jonas = [r for r in bdb.list_resources(CLIENT_A) if r["name"] == "Jonas"][0]
assert jonas["location_id"] == location_id
def test_create_resource_rejects_another_tenants_location(client):
resource_b, service_b = _setup(CLIENT_B)
_setup(CLIENT_A)
_login(client, CLIENT_A)
resp = client.post("/owner/settings/resources", data={
"location_id": resource_b["location_id"], "name": "Hijacked"})
assert "error=invalid_resource" in resp.headers["Location"]
names = {r["name"] for r in bdb.list_resources(CLIENT_B)}
assert "Hijacked" not in names
def test_owner_can_set_opening_hours(client):
resource, service = _setup(CLIENT_A)
_login(client, CLIENT_A)
+41 -2
View File
@@ -40,6 +40,28 @@ def test_create_client_persists_slug(client):
assert bdb.get_client_by_slug("slug-test-abcd")["client_id"] == client_id
# ---- /api/locations ----
def test_create_location_requires_crm_token(client):
resp = client.post("/api/locations", json={"client_id": CLIENT_A, "name": "Hauptfiliale"})
assert resp.status_code == 403
def test_create_location_creates_row(client):
_insert_client(CLIENT_A)
resp = client.post("/api/locations", headers=AUTH,
json={"client_id": CLIENT_A, "name": "Hauptfiliale"})
assert resp.status_code == 201
location_id = resp.get_json()["location_id"]
assert bdb.get_location(CLIENT_A, location_id)["name"] == "Hauptfiliale"
def test_create_location_requires_name(client):
_insert_client(CLIENT_A)
resp = client.post("/api/locations", headers=AUTH, json={"client_id": CLIENT_A})
assert resp.status_code == 400
# ---- /api/resources ----
def test_create_resource_requires_crm_token(client):
@@ -49,8 +71,9 @@ def test_create_resource_requires_crm_token(client):
def test_create_resource_sets_hours(client):
_insert_client(CLIENT_A)
location = bdb.create_location(CLIENT_A, "Hauptfiliale")
resp = client.post("/api/resources", headers=AUTH, json={
"client_id": CLIENT_A, "name": "Hauptressource",
"client_id": CLIENT_A, "location_id": location["location_id"], "name": "Hauptressource",
"hours": [{"weekday": 0, "opens_at": "09:00", "closes_at": "18:00"}]})
assert resp.status_code == 201
resource_id = resp.get_json()["resource_id"]
@@ -60,10 +83,26 @@ def test_create_resource_sets_hours(client):
def test_create_resource_requires_name(client):
_insert_client(CLIENT_A)
resp = client.post("/api/resources", headers=AUTH, json={"client_id": CLIENT_A})
location = bdb.create_location(CLIENT_A, "Hauptfiliale")
resp = client.post("/api/resources", headers=AUTH,
json={"client_id": CLIENT_A, "location_id": location["location_id"]})
assert resp.status_code == 400
def test_create_resource_requires_location_id(client):
_insert_client(CLIENT_A)
resp = client.post("/api/resources", headers=AUTH,
json={"client_id": CLIENT_A, "name": "Hauptressource"})
assert resp.status_code == 400
def test_create_resource_rejects_unknown_location(client):
_insert_client(CLIENT_A)
resp = client.post("/api/resources", headers=AUTH, json={
"client_id": CLIENT_A, "location_id": "LOC-does-not-exist", "name": "Hauptressource"})
assert resp.status_code == 404
# ---- /api/services ----
def test_create_service_requires_crm_token(client):
+26 -4
View File
@@ -40,8 +40,9 @@ def _make_client(client_id=CLIENT_A, slug="happynails", business_name="Happy Nai
def _setup_bookable_client(client_id=CLIENT_A, slug="happynails"):
_make_client(client_id, slug)
resource = bdb.create_resource(client_id, "Chair 1", min_notice_minutes=0,
max_advance_days=365)
location = bdb.create_location(client_id, "Main")
resource = bdb.create_resource(client_id, location["location_id"], "Chair 1",
min_notice_minutes=0, max_advance_days=365)
bdb.set_resource_hours(client_id, resource["resource_id"], 0, time(9, 0), time(17, 0))
service = bdb.create_service(client_id, "Haircut", 60, price=25)
return resource, service
@@ -64,7 +65,7 @@ def test_book_page_404s_for_unknown_slug(client):
def test_book_page_404s_when_client_has_no_active_service(client):
_make_client(CLIENT_B, slug="no-services-client")
bdb.create_resource(CLIENT_B, "Chair 1")
bdb.create_resource(CLIENT_B, bdb.create_location(CLIENT_B, "Main")["location_id"], "Chair 1")
# No services created for this client.
resp = client.get("/book/no-services-client")
assert resp.status_code == 404
@@ -72,12 +73,33 @@ def test_book_page_404s_when_client_has_no_active_service(client):
def test_book_page_404s_when_client_has_only_inactive_service(client):
_make_client(CLIENT_B, slug="inactive-service-client")
bdb.create_resource(CLIENT_B, "Chair 1")
bdb.create_resource(CLIENT_B, bdb.create_location(CLIENT_B, "Main")["location_id"], "Chair 1")
bdb.create_service(CLIENT_B, "Haircut", 60, active=False)
resp = client.get("/book/inactive-service-client")
assert resp.status_code == 404
def test_book_page_includes_location_in_context(client):
resource, service = _setup_bookable_client()
resp = client.get("/book/happynails")
assert resp.status_code == 200
body = resp.get_data(as_text=True)
assert "LOCATIONS" in body
assert resource["location_id"] in body
def test_book_page_404s_when_only_location_is_inactive(client):
"""A resource whose Filiale was deactivated must not stay bookable even
though the resource row itself is still active."""
_make_client(CLIENT_B, slug="inactive-location-client")
location = bdb.create_location(CLIENT_B, "Main")
bdb.create_resource(CLIENT_B, location["location_id"], "Chair 1")
bdb.create_service(CLIENT_B, "Haircut", 60)
bdb.update_location(CLIENT_B, location["location_id"], active=False)
resp = client.get("/book/inactive-location-client")
assert resp.status_code == 404
def test_honeypot_filled_silently_rejects_booking(client):
resource, service = _setup_bookable_client()
day = _next_monday(date.today())