Public booking page + iframe embed (#17)

Adds the customer-facing /book/<slug> page: service/slot picker, booking form, and confirmation screen, built on #16's existing booking JSON API. Includes iframe auto-fit height reporting (mirroring deploy/booking/booking_layout.js's eaBookingHeight message), brand-color theming via a ?color= query param, a honeypot field with a fake-success response indistinguishable from a real booking, and a clear "just taken" message on slot-conflict. Caddy per-IP rate limiting is documented in deploy/booking/RATE_LIMIT.md for manual application (no Caddyfile is tracked in this repo). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-23 15:15:29 +02:00
parent 2f6e0c1459
commit b895663c3a
7 changed files with 556 additions and 5 deletions
@@ -0,0 +1,120 @@
+"""Flask test client / real-DB integration tests for the public booking page
+and its honeypot abuse-protection (#17), per #14's testing decision: assert on
+HTTP response + resulting DB state.
+"""
+from datetime import date, time, timedelta
+
+import pytest
+
+import booking_db as bdb
+from app import app as flask_app
+
+CLIENT_A = "C-TEST-PUBLIC-A"
+CLIENT_B = "C-TEST-PUBLIC-B"
+
+
+@pytest.fixture
+def client():
+    flask_app.config["TESTING"] = True
+    return flask_app.test_client()
+
+
+def _next_monday(after):
+    d = after + timedelta(days=1)
+    while d.weekday() != 0:
+        d += timedelta(days=1)
+    return d
+
+
+def _make_client(client_id=CLIENT_A, slug="happynails", business_name="Happy Nails"):
+    with bdb.db.connect() as conn, conn.cursor() as cur:
+        cur.execute(
+            "INSERT INTO clients (client_id, business_name, slug, timezone, auto_confirm) "
+            "VALUES (%s, %s, %s, %s, %s) "
+            "ON CONFLICT (client_id) DO UPDATE SET business_name = EXCLUDED.business_name, "
+            "slug = EXCLUDED.slug, timezone = EXCLUDED.timezone, "
+            "auto_confirm = EXCLUDED.auto_confirm",
+            (client_id, business_name, slug, "Europe/Berlin", True))
+        conn.commit()
+
+
+def _setup_bookable_client(client_id=CLIENT_A, slug="happynails"):
+    _make_client(client_id, slug)
+    resource = bdb.create_resource(client_id, "Chair 1", min_notice_minutes=0,
+                                    max_advance_days=365)
+    bdb.set_resource_hours(client_id, resource["resource_id"], 0, time(9, 0), time(17, 0))
+    service = bdb.create_service(client_id, "Haircut", 60, price=25)
+    return resource, service
+
+
+def test_book_page_renders_for_known_slug_with_services_and_resources(client):
+    resource, service = _setup_bookable_client()
+    resp = client.get("/book/happynails")
+    assert resp.status_code == 200
+    body = resp.get_data(as_text=True)
+    assert "Happy Nails" in body
+    assert "Haircut" in body
+    assert resource["resource_id"] in body
+
+
+def test_book_page_404s_for_unknown_slug(client):
+    resp = client.get("/book/does-not-exist")
+    assert resp.status_code == 404
+
+
+def test_book_page_404s_when_client_has_no_active_service(client):
+    _make_client(CLIENT_B, slug="no-services-client")
+    bdb.create_resource(CLIENT_B, "Chair 1")
+    # No services created for this client.
+    resp = client.get("/book/no-services-client")
+    assert resp.status_code == 404
+
+
+def test_book_page_404s_when_client_has_only_inactive_service(client):
+    _make_client(CLIENT_B, slug="inactive-service-client")
+    bdb.create_resource(CLIENT_B, "Chair 1")
+    bdb.create_service(CLIENT_B, "Haircut", 60, active=False)
+    resp = client.get("/book/inactive-service-client")
+    assert resp.status_code == 404
+
+
+def test_honeypot_filled_silently_rejects_booking(client):
+    resource, service = _setup_bookable_client()
+    day = _next_monday(date.today())
+    slot = client.get("/api/booking/slots", query_string={
+        "client_id": CLIENT_A, "resource_id": resource["resource_id"],
+        "service_id": service["service_id"],
+        "date_from": day.isoformat(), "date_to": day.isoformat()}).get_json()["slots"]
+    assert slot
+
+    resp = client.post("/api/booking", json={
+        "client_id": CLIENT_A, "resource_id": resource["resource_id"],
+        "service_id": service["service_id"], "start_time": slot[0],
+        "customer_name": "Bot", "customer_contact": "bot@example.com",
+        "website": "https://spam.example"})
+
+    # Looks like an ordinary success to the caller...
+    assert resp.status_code == 201
+    body = resp.get_json()
+    assert body["status"] == "confirmed"
+    assert "token" in body
+    # ...but no booking was actually created.
+    assert bdb.list_bookings(CLIENT_A) == []
+
+
+def test_honeypot_empty_creates_a_real_booking(client):
+    resource, service = _setup_bookable_client()
+    day = _next_monday(date.today())
+    slot = client.get("/api/booking/slots", query_string={
+        "client_id": CLIENT_A, "resource_id": resource["resource_id"],
+        "service_id": service["service_id"],
+        "date_from": day.isoformat(), "date_to": day.isoformat()}).get_json()["slots"]
+
+    resp = client.post("/api/booking", json={
+        "client_id": CLIENT_A, "resource_id": resource["resource_id"],
+        "service_id": service["service_id"], "start_time": slot[0],
+        "customer_name": "Real Customer", "customer_contact": "real@example.com",
+        "website": ""})
+
+    assert resp.status_code == 201
+    assert len(bdb.list_bookings(CLIENT_A)) == 1