[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_107":108,"_109":110},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","Thokolosh","name","abschlag","path","index.ts","project",{"_22":46,"_11":12,"_33":47,"_48":-5,"_49":42,"_50":51,"_52":51,"_53":54,"_55":-5,"_56":57,"_58":25,"_59":32,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_13":45},"permalink","https://www.val.town/x/Thokolosh/abschlag/code/index.ts","extension","id","bccd6142-9f2d-4004-b15c-67eb3dcb9c80","fileId","828c2900-ad59-11f1-99a3-1607ee4eb77e","parentId","branchId","5c695ecc-ad62-4780-8b26-43dbcfbbf94b","branchVersion",52,"latest",true,"createdAt",["D",1789078487659],"version",22,"fileType","http","content","// Abschlag – Buchungssystem für den Golfsimulator (und später weitere Ressourcen).\n// HTTP-Val: Hono + std/sqlite. Diese Datei ist der HTTP-Einstieg.\n\nimport { Hono } from \"npm:hono\";\nimport { getCookie, setCookie, deleteCookie } from \"npm:hono/cookie\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { parseVal, readFile, serveFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { email as sendEmail } from \"https://esm.town/v/std/email\";\nimport {\n canCancel,\n DEFAULT_GOLF,\n evaluateBooking,\n seatsAvailableFor,\n slotHours,\n type Member,\n type Resource,\n type Seat,\n} from \"./lib/rules.ts\";\nimport { addDays, isValidDate, localNow, slotStartEpoch } from \"./lib/time.ts\";\n\n// ───────────────────────── Schema ─────────────────────────\n\nconst ADMIN_NAME = Deno.env.get(\"ADMIN_NAME\") ?? \"Kirk Lenke\";\nconst SESSION_DAYS = 90;\n\nasync function initDb() {\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS members (\n id INTEGER PRIMARY KEY,\n name TEXT NOT NULL UNIQUE COLLATE NOCASE,\n pin_hash TEXT,\n pin_salt TEXT,\n invite_code TEXT,\n is_vip INTEGER NOT NULL DEFAULT 0,\n is_admin INTEGER NOT NULL DEFAULT 0,\n active INTEGER NOT NULL DEFAULT 1,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n `CREATE TABLE IF NOT EXISTS resources (\n id TEXT PRIMARY KEY,\n name TEXT NOT NULL,\n capacity INTEGER NOT NULL,\n vip_reserved INTEGER NOT NULL,\n reserve_release_hours INTEGER NOT NULL,\n lead_days_vip INTEGER NOT NULL,\n lead_days_std INTEGER NOT NULL,\n weekday_open INTEGER NOT NULL,\n weekday_close INTEGER NOT NULL,\n weekend_open INTEGER NOT NULL,\n weekend_close INTEGER NOT NULL,\n max_open_per_member INTEGER NOT NULL,\n active INTEGER NOT NULL DEFAULT 1,\n sort INTEGER NOT NULL DEFAULT 0\n )`,\n `CREATE TABLE IF NOT EXISTS bookings (\n id INTEGER PRIMARY KEY,\n resource_id TEXT NOT NULL,\n member_id INTEGER NOT NULL,\n date TEXT NOT NULL,\n hour INTEGER NOT NULL,\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n UNIQUE(resource_id, date, hour, member_id)\n )`,\n `CREATE INDEX IF NOT EXISTS bookings_slot ON bookings(resource_id, date, hour)`,\n `CREATE TABLE IF NOT EXISTS sessions (\n token TEXT PRIMARY KEY,\n member_id INTEGER NOT NULL,\n expires_at TEXT NOT NULL\n )`,\n ]);\n\n // Migrationen für bestehende Datenbanken\n for (const sql of [\n \"ALTER TABLE members ADD COLUMN alias TEXT\",\n \"ALTER TABLE members ADD COLUMN reset_requested_at TEXT\",\n \"ALTER TABLE members ADD COLUMN email TEXT\",\n ]) {\n try { await sqlite.execute(sql); } catch (_) { /* Spalte existiert schon */ }\n }\n await sqlite.execute(\"CREATE UNIQUE INDEX IF NOT EXISTS members_alias ON members(alias COLLATE NOCASE)\");\n await sqlite.execute(\"CREATE UNIQUE INDEX IF NOT EXISTS members_email ON members(email COLLATE NOCASE)\");\n\n const r = await sqlite.execute(\"SELECT COUNT(*) AS n FROM resources\");\n if (Number(r.rows[0].n) === 0) await upsertResource(DEFAULT_GOLF);\n\n const m = await sqlite.execute(\"SELECT COUNT(*) AS n FROM members\");\n if (Number(m.rows[0].n) === 0) {\n const code = newInviteCode();\n await sqlite.execute({\n sql: \"INSERT INTO members (name, invite_code, is_admin, is_vip) VALUES (?, ?, 1, 1)\",\n args: [ADMIN_NAME, code],\n });\n console.log(`Admin \"${ADMIN_NAME}\" angelegt. Einladungscode: ${code}`);\n }\n}\nconst ready = initDb();\n\n// ───────────────────────── Helfer ─────────────────────────\n\nfunction newInviteCode(): string {\n const alphabet = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\"; // ohne 0/O/1/I\n const bytes = crypto.getRandomValues(new Uint8Array(6));\n let s = \"\";\n for (const b of bytes) s += alphabet[b % alphabet.length];\n return s.slice(0, 3) + \"-\" + s.slice(3);\n}\n\nfunction hex(buf: ArrayBuffer | Uint8Array): string {\n return [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function hashPin(pin: string, saltHex: string): Promise {\n const key = await crypto.subtle.importKey(\"raw\", new TextEncoder().encode(pin), \"PBKDF2\", false, [\"deriveBits\"]);\n const salt = Uint8Array.from(saltHex.match(/../g)!.map((h) => parseInt(h, 16)));\n const bits = await crypto.subtle.deriveBits({ name: \"PBKDF2\", hash: \"SHA-256\", salt, iterations: 120_000 }, key, 256);\n return hex(bits);\n}\n\nfunction validPin(pin: unknown): pin is string {\n return typeof pin === \"string\" && /^\\d{4,8}$/.test(pin);\n}\n\nfunction cleanName(name: unknown): string | null {\n if (typeof name !== \"string\") return null;\n const n = name.replace(/\\s+/g, \" \").trim();\n if (n.length < 3 || n.length > 60) return null;\n if (!/^[\\p{L}][\\p{L}\\p{M}' .-]*\\s[\\p{L}][\\p{L}\\p{M}' .-]*$/u.test(n)) return null; // Vor- und Nachname\n return n;\n}\n\nfunction cleanEmail(v: unknown): string | null {\n if (typeof v !== \"string\") return null;\n const e = v.trim().toLowerCase();\n return e.length <= 120 && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]{2,}$/.test(e) ? e : null;\n}\n\nconst ALIAS_RE = /^[\\p{L}\\p{N}][\\p{L}\\p{N}._-]{2,19}$/u;\nfunction cleanAlias(alias: unknown): string | null {\n if (typeof alias !== \"string\") return null;\n const a = alias.trim();\n return ALIAS_RE.test(a) ? a : null;\n}\n\n/** Findet ein aktives Mitglied über Klarnamen oder Alias. */\nasync function findByLogin(input: unknown): Promise | null> {\n if (typeof input !== \"string\") return null;\n const raw = input.replace(/\\s+/g, \" \").trim();\n if (!raw) return null;\n const name = cleanName(raw);\n const r = await sqlite.execute({\n sql: \"SELECT * FROM members WHERE active = 1 AND (name = ? OR alias = ? COLLATE NOCASE OR email = ? COLLATE NOCASE) LIMIT 1\",\n args: [name ?? raw, raw, raw.toLowerCase()],\n });\n return r.rows[0] ?? null;\n}\n\nfunction normCode(code: unknown): string {\n return String(code ?? \"\").toUpperCase().replace(/[^A-Z0-9]/g, \"\").replace(/^(.{3})(.{3})$/, \"$1-$2\");\n}\n\nfunction rowToMember(row: Record): Member {\n return {\n id: Number(row.id),\n name: String(row.name),\n alias: row.alias ? String(row.alias) : null,\n email: row.email ? String(row.email) : null,\n isVip: Number(row.is_vip) === 1,\n isAdmin: Number(row.is_admin) === 1,\n active: Number(row.active) === 1,\n };\n}\n\nfunction rowToResource(row: Record): Resource {\n return {\n id: String(row.id),\n name: String(row.name),\n capacity: Number(row.capacity),\n vipReserved: Number(row.vip_reserved),\n reserveReleaseHours: Number(row.reserve_release_hours),\n leadDaysVip: Number(row.lead_days_vip),\n leadDaysStd: Number(row.lead_days_std),\n weekdayOpen: Number(row.weekday_open),\n weekdayClose: Number(row.weekday_close),\n weekendOpen: Number(row.weekend_open),\n weekendClose: Number(row.weekend_close),\n maxOpenPerMember: Number(row.max_open_per_member),\n active: Number(row.active),\n };\n}\n\nasync function upsertResource(r: Resource, sort = 0) {\n await sqlite.execute({\n sql: `INSERT INTO resources (id, name, capacity, vip_reserved, reserve_release_hours, lead_days_vip, lead_days_std,\n weekday_open, weekday_close, weekend_open, weekend_close, max_open_per_member, active, sort)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)\n ON CONFLICT(id) DO UPDATE SET name=excluded.name, capacity=excluded.capacity, vip_reserved=excluded.vip_reserved,\n reserve_release_hours=excluded.reserve_release_hours, lead_days_vip=excluded.lead_days_vip,\n lead_days_std=excluded.lead_days_std, weekday_open=excluded.weekday_open, weekday_close=excluded.weekday_close,\n weekend_open=excluded.weekend_open, weekend_close=excluded.weekend_close,\n max_open_per_member=excluded.max_open_per_member, active=excluded.active`,\n args: [\n r.id, r.name, r.capacity, r.vipReserved, r.reserveReleaseHours, r.leadDaysVip, r.leadDaysStd,\n r.weekdayOpen, r.weekdayClose, r.weekendOpen, r.weekendClose, r.maxOpenPerMember, r.active, sort,\n ],\n });\n}\n\nasync function getResource(id: string): Promise {\n const r = await sqlite.execute({ sql: \"SELECT * FROM resources WHERE id = ?\", args: [id] });\n return r.rows[0] ? rowToResource(r.rows[0]) : null;\n}\n\nasync function listResources(onlyActive: boolean): Promise {\n const r = await sqlite.execute(\n onlyActive ? \"SELECT * FROM resources WHERE active = 1 ORDER BY sort, name\" : \"SELECT * FROM resources ORDER BY sort, name\",\n );\n return r.rows.map(rowToResource);\n}\n\nasync function seatsFor(resourceId: string, date: string, hour: number): Promise {\n const r = await sqlite.execute({\n sql: `SELECT b.id AS booking_id, m.id AS member_id, m.name, m.is_vip\n FROM bookings b JOIN members m ON m.id = b.member_id\n WHERE b.resource_id = ? AND b.date = ? AND b.hour = ? ORDER BY b.created_at, b.id`,\n args: [resourceId, date, hour],\n });\n return r.rows.map((row) => ({\n bookingId: Number(row.booking_id),\n memberId: Number(row.member_id),\n name: String(row.name),\n isVip: Number(row.is_vip) === 1,\n }));\n}\n\nasync function openBookingCount(resourceId: string, memberId: number): Promise {\n const now = localNow();\n const r = await sqlite.execute({\n sql: `SELECT date, hour FROM bookings WHERE resource_id = ? AND member_id = ? AND date >= ?`,\n args: [resourceId, memberId, now.date],\n });\n return r.rows.filter((row) => slotStartEpoch(String(row.date), Number(row.hour)) > now.epoch).length;\n}\n\n// ───────────────────────── Auth ─────────────────────────\n\ntype Env = { Variables: { member: Member | null } };\nconst app = new Hono();\n\napp.use(\"*\", async (c, next) => {\n await ready;\n c.set(\"member\", null);\n const token = getCookie(c, \"abschlag_session\");\n if (token) {\n const r = await sqlite.execute({\n sql: `SELECT m.* FROM sessions s JOIN members m ON m.id = s.member_id\n WHERE s.token = ? AND s.expires_at > datetime('now') AND m.active = 1`,\n args: [token],\n });\n if (r.rows[0]) c.set(\"member\", rowToMember(r.rows[0]));\n }\n await next();\n});\n\nfunction requireMember(c: any): Member {\n const m = c.get(\"member\") as Member | null;\n if (!m) throw new HttpError(401, \"Bitte anmelden.\");\n return m;\n}\nfunction requireAdmin(c: any): Member {\n const m = requireMember(c);\n if (!m.isAdmin) throw new HttpError(403, \"Nur für Administratoren.\");\n return m;\n}\nclass HttpError extends Error {\n constructor(public status: number, message: string) {\n super(message);\n }\n}\napp.onError((err, c) => {\n if (err instanceof HttpError) return c.json({ error: err.message }, err.status as any);\n console.error(err);\n return c.json({ error: \"Interner Fehler: \" + err.message }, 500);\n});\n\nasync function createSession(c: any, memberId: number) {\n const token = hex(crypto.getRandomValues(new Uint8Array(32)));\n const expires = new Date(Date.now() + SESSION_DAYS * 86400_000);\n await sqlite.execute({\n sql: \"INSERT INTO sessions (token, member_id, expires_at) VALUES (?, ?, ?)\",\n args: [token, memberId, expires.toISOString().replace(\"T\", \" \").slice(0, 19)],\n });\n setCookie(c, \"abschlag_session\", token, {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n path: \"/\",\n expires,\n });\n}\n\n// ───────────────────────── Seiten & Assets ─────────────────────────\n\napp.get(\"/\", (c) => serveFile(\"/frontend/index.html\", import.meta.url));\n// Logo liegt als Base64-Text im Val (Binärdateien lassen sich nicht direkt anlegen) und wird hier dekodiert.\nlet logoBytes: Uint8Array | null = null;\napp.get(\"/frontend/logo.png\", async (c) => {\n if (!logoBytes) {\n const b64 = (await readFile(\"/frontend/logo.b64\", import.meta.url)).replace(/\\s+/g, \"\");\n logoBytes = Uint8Array.from(atob(b64), (ch) => ch.charCodeAt(0));\n }\n return new Response(logoBytes, { headers: { \"content-type\": \"image/png\", \"cache-control\": \"public, max-age=86400\" } });\n});\napp.get(\"/frontend/*\", (c) => serveFile(c.req.path, import.meta.url));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// ───────────────────────── Öffentliche API ─────────────────────────\n\napp.get(\"/api/me\", async (c) => {\n const member = c.get(\"member\");\n const setup = await sqlite.execute(\"SELECT COUNT(*) AS n FROM members WHERE pin_hash IS NOT NULL\");\n const firstRun = Number(setup.rows[0].n) === 0;\n let setupCode: string | null = null;\n if (firstRun) {\n const a = await sqlite.execute(\"SELECT name, invite_code FROM members WHERE is_admin = 1 ORDER BY id LIMIT 1\");\n if (a.rows[0]) setupCode = `${a.rows[0].name} · ${a.rows[0].invite_code}`;\n }\n let pendingResets = 0;\n if (member?.isAdmin) {\n const p = await sqlite.execute(\"SELECT COUNT(*) AS n FROM members WHERE reset_requested_at IS NOT NULL AND active = 1\");\n pendingResets = Number(p.rows[0].n);\n }\n return c.json({\n member,\n resources: await listResources(true),\n now: localNow(),\n setupCode,\n pendingResets,\n });\n});\n\napp.post(\"/api/register\", async (c) => {\n const body = await c.req.json().catch(() => ({}));\n const code = normCode(body.code);\n if (!validPin(body.pin)) throw new HttpError(400, \"Die PIN muss aus 4 bis 8 Ziffern bestehen.\");\n const row = await findByLogin(body.name);\n if (!row || !row.invite_code || String(row.invite_code) !== code) {\n throw new HttpError(400, \"Name oder Einladungscode stimmen nicht.\");\n }\n const mail = cleanEmail(body.email) ?? (row.email ? String(row.email) : null);\n if (!mail) throw new HttpError(400, \"Bitte eine gültige E-Mail-Adresse angeben – sie wird für das Zurücksetzen der PIN gebraucht.\");\n const taken = await sqlite.execute({ sql: \"SELECT id FROM members WHERE email = ? COLLATE NOCASE AND id != ?\", args: [mail, Number(row.id)] });\n if (taken.rows[0]) throw new HttpError(409, \"Diese E-Mail-Adresse ist schon einem anderen Spieler zugeordnet.\");\n const salt = hex(crypto.getRandomValues(new Uint8Array(16)));\n const pinHash = await hashPin(body.pin, salt);\n await sqlite.execute({\n sql: \"UPDATE members SET pin_hash = ?, pin_salt = ?, email = ?, invite_code = NULL, reset_requested_at = NULL WHERE id = ?\",\n args: [pinHash, salt, mail, Number(row.id)],\n });\n await createSession(c, Number(row.id));\n return c.json({ member: rowToMember({ ...row, pin_hash: pinHash, email: mail }) });\n});\n\napp.post(\"/api/login\", async (c) => {\n const body = await c.req.json().catch(() => ({}));\n if (!validPin(body.pin)) throw new HttpError(400, \"Name oder PIN stimmen nicht.\");\n const row = await findByLogin(body.name);\n if (!row) throw new HttpError(400, \"Name oder PIN stimmen nicht.\");\n if (!row.pin_hash) throw new HttpError(400, \"Für diesen Namen wurde noch keine PIN festgelegt – bitte zuerst mit dem Einladungscode registrieren.\");\n const check = await hashPin(body.pin, String(row.pin_salt));\n if (check !== String(row.pin_hash)) throw new HttpError(400, \"Name oder PIN stimmen nicht.\");\n await createSession(c, Number(row.id));\n return c.json({ member: rowToMember(row) });\n});\n\napp.post(\"/api/logout\", async (c) => {\n const token = getCookie(c, \"abschlag_session\");\n if (token) await sqlite.execute({ sql: \"DELETE FROM sessions WHERE token = ?\", args: [token] });\n deleteCookie(c, \"abschlag_session\", { path: \"/\" });\n return c.json({ ok: true });\n});\n\n// „PIN vergessen“: hinterlegt eine Anfrage, die der Verwalter in der Verwaltung sieht.\n// Antwortet immer gleich, damit niemand Namen ausprobieren kann.\napp.post(\"/api/reset-request\", async (c) => {\n const body = await c.req.json().catch(() => ({}));\n const row = await findByLogin(body.name);\n if (row && row.pin_hash) {\n // Neuer Einladungscode; die alte PIN bleibt gültig, bis mit dem Code eine neue gesetzt wird.\n const code = newInviteCode();\n await sqlite.execute({\n sql: \"UPDATE members SET invite_code = ?, reset_requested_at = datetime('now') WHERE id = ?\",\n args: [code, Number(row.id)],\n });\n const name = String(row.name);\n const to = row.email ? String(row.email) : null;\n const origin = new URL(c.req.url).origin;\n const text = `Hallo ${name},\\n\\nfür dein Konto bei der JK Golfakademie wurde ein PIN-Reset angefordert.\\n\\n` +\n `Dein Einladungscode: ${code}\\n\\nÖffne ${origin}, wähle „Registrieren“, gib deinen Namen, diesen Code und eine neue PIN ein.\\n` +\n `Falls du das nicht warst, kannst du diese E-Mail ignorieren – deine bisherige PIN bleibt gültig.`;\n let delivered = false;\n if (to) {\n try {\n await sendEmail({ to, subject: \"JK Golfakademie – PIN zurücksetzen\", text });\n delivered = true;\n } catch (err) {\n console.error(\"E-Mail an Spieler fehlgeschlagen:\", (err as Error).message);\n }\n }\n if (!delivered) {\n // Fallback: der Verwalter (Val-Owner) bekommt die Anfrage und gibt den Code weiter.\n try {\n await sendEmail({\n subject: `PIN-Reset angefragt: ${name}`,\n text: `${name}${to ? ` (${to})` : \"\"} hat einen PIN-Reset angefragt.\\nNeuer Einladungscode: ${code}\\n` +\n `Bitte an die Person weitergeben (auch sichtbar in der Verwaltung).`,\n });\n } catch (err) {\n console.error(\"E-Mail an Verwalter fehlgeschlagen:\", (err as Error).message);\n }\n }\n }\n return c.json({ ok: true });\n});\n\napp.post(\"/api/profile/email\", async (c) => {\n const member = requireMember(c);\n const body = await c.req.json().catch(() => ({}));\n const mail = cleanEmail(body.email);\n if (!mail) throw new HttpError(400, \"Bitte eine gültige E-Mail-Adresse angeben.\");\n const taken = await sqlite.execute({ sql: \"SELECT id FROM members WHERE email = ? COLLATE NOCASE AND id != ?\", args: [mail, member.id] });\n if (taken.rows[0]) throw new HttpError(409, \"Diese E-Mail-Adresse ist schon einem anderen Spieler zugeordnet.\");\n await sqlite.execute({ sql: \"UPDATE members SET email = ? WHERE id = ?\", args: [mail, member.id] });\n return c.json({ ok: true, email: mail });\n});\n\n// ───────────────────────── Profil ─────────────────────────\n\napp.post(\"/api/profile/alias\", async (c) => {\n const member = requireMember(c);\n const body = await c.req.json().catch(() => ({}));\n if (body.alias === \"\" || body.alias === null) {\n await sqlite.execute({ sql: \"UPDATE members SET alias = NULL WHERE id = ?\", args: [member.id] });\n return c.json({ ok: true, alias: null });\n }\n const alias = cleanAlias(body.alias);\n if (!alias) throw new HttpError(400, \"Alias: 3–20 Zeichen, Buchstaben, Ziffern, Punkt, Bindestrich oder Unterstrich.\");\n if (alias.includes(\" \")) throw new HttpError(400, \"Ein Alias darf keine Leerzeichen enthalten.\");\n const clash = await sqlite.execute({\n sql: \"SELECT id FROM members WHERE (alias = ? COLLATE NOCASE OR name = ?) AND id != ?\",\n args: [alias, alias, member.id],\n });\n if (clash.rows[0]) throw new HttpError(409, \"Dieser Alias ist schon vergeben.\");\n await sqlite.execute({ sql: \"UPDATE members SET alias = ? WHERE id = ?\", args: [alias, member.id] });\n return c.json({ ok: true, alias });\n});\n\napp.post(\"/api/profile/pin\", async (c) => {\n const member = requireMember(c);\n const body = await c.req.json().catch(() => ({}));\n if (!validPin(body.current) || !validPin(body.next)) throw new HttpError(400, \"Die PIN muss aus 4 bis 8 Ziffern bestehen.\");\n const r = await sqlite.execute({ sql: \"SELECT pin_hash, pin_salt FROM members WHERE id = ?\", args: [member.id] });\n const row = r.rows[0];\n const check = await hashPin(body.current, String(row.pin_salt));\n if (check !== String(row.pin_hash)) throw new HttpError(400, \"Die aktuelle PIN stimmt nicht.\");\n const salt = hex(crypto.getRandomValues(new Uint8Array(16)));\n const pinHash = await hashPin(body.next, salt);\n const token = getCookie(c, \"abschlag_session\");\n await sqlite.batch([\n { sql: \"UPDATE members SET pin_hash = ?, pin_salt = ? WHERE id = ?\", args: [pinHash, salt, member.id] },\n { sql: \"DELETE FROM sessions WHERE member_id = ? AND token != ?\", args: [member.id, token ?? \"\"] },\n ]);\n return c.json({ ok: true });\n});\n\n// ───────────────────────── Slots & Buchungen ─────────────────────────\n\napp.get(\"/api/slots\", async (c) => {\n const member = requireMember(c);\n const resourceId = c.req.query(\"resource\") ?? \"golf\";\n const date = c.req.query(\"date\");\n if (!isValidDate(date)) throw new HttpError(400, \"Ungültiges Datum.\");\n const resource = await getResource(resourceId);\n if (!resource || !resource.active) throw new HttpError(404, \"Unbekannte Ressource.\");\n\n const now = localNow();\n const rows = await sqlite.execute({\n sql: `SELECT b.id AS booking_id, b.hour, m.id AS member_id, m.name, m.is_vip\n FROM bookings b JOIN members m ON m.id = b.member_id\n WHERE b.resource_id = ? AND b.date = ? ORDER BY b.created_at, b.id`,\n args: [resourceId, date],\n });\n const byHour = new Map();\n for (const row of rows.rows) {\n const h = Number(row.hour);\n if (!byHour.has(h)) byHour.set(h, []);\n byHour.get(h)!.push({\n bookingId: Number(row.booking_id),\n memberId: Number(row.member_id),\n name: String(row.name),\n isVip: Number(row.is_vip) === 1,\n });\n }\n const openCount = await openBookingCount(resourceId, member.id);\n\n const slots = slotHours(resource, date).map((hour) => {\n const seats = byHour.get(hour) ?? [];\n const verdict = evaluateBooking({ resource, member, date, hour, seats, now, openBookingsOfMember: openCount });\n const startMs = slotStartEpoch(date, hour);\n const avail = seatsAvailableFor(resource, member, seats, startMs, now.epoch);\n const mine = seats.find((s) => s.memberId === member.id) ?? null;\n return {\n hour,\n seats,\n capacity: resource.capacity,\n freeForYou: avail.free,\n reserveActive: avail.reserveActive,\n past: startMs <= now.epoch,\n canBook: verdict.ok,\n reasonCode: verdict.code,\n reason: verdict.reason,\n myBookingId: mine?.bookingId ?? null,\n canCancel: !!mine && canCancel({ date, hour, now }),\n };\n });\n\n return c.json({ date, resource, slots, openCount, now });\n});\n\napp.post(\"/api/bookings\", async (c) => {\n const member = requireMember(c);\n const body = await c.req.json().catch(() => ({}));\n const resourceId = String(body.resource ?? \"golf\");\n const date = body.date;\n const hour = Number(body.hour);\n if (!isValidDate(date) || !Number.isInteger(hour)) throw new HttpError(400, \"Ungültiger Termin.\");\n const resource = await getResource(resourceId);\n if (!resource || !resource.active) throw new HttpError(404, \"Unbekannte Ressource.\");\n\n const now = localNow();\n const seats = await seatsFor(resourceId, date, hour);\n const openCount = await openBookingCount(resourceId, member.id);\n const verdict = evaluateBooking({ resource, member, date, hour, seats, now, openBookingsOfMember: openCount });\n if (!verdict.ok) throw new HttpError(409, verdict.reason);\n\n const ins = await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO bookings (resource_id, member_id, date, hour) VALUES (?, ?, ?, ?)\",\n args: [resourceId, member.id, date, hour],\n });\n const id = Number(ins.lastInsertRowid);\n\n // Schutz gegen gleichzeitige Buchungen: nach dem Schreiben noch einmal zählen.\n const after = await seatsFor(resourceId, date, hour);\n const mine = after.find((s) => s.memberId === member.id);\n if (after.length > resource.capacity && mine && after.indexOf(mine) >= resource.capacity) {\n await sqlite.execute({ sql: \"DELETE FROM bookings WHERE id = ?\", args: [mine.bookingId] });\n throw new HttpError(409, \"Diese Stunde wurde gerade von jemand anderem gefüllt.\");\n }\n return c.json({ ok: true, id: mine?.bookingId ?? id });\n});\n\napp.delete(\"/api/bookings/:id\", async (c) => {\n const member = requireMember(c);\n const id = Number(c.req.param(\"id\"));\n const r = await sqlite.execute({ sql: \"SELECT * FROM bookings WHERE id = ?\", args: [id] });\n const row = r.rows[0];\n if (!row) throw new HttpError(404, \"Buchung nicht gefunden.\");\n if (Number(row.member_id) !== member.id && !member.isAdmin) throw new HttpError(403, \"Das ist nicht deine Buchung.\");\n if (!canCancel({ date: String(row.date), hour: Number(row.hour), now: localNow() })) {\n throw new HttpError(409, \"Der Termin hat bereits begonnen und kann nicht mehr storniert werden.\");\n }\n await sqlite.execute({ sql: \"DELETE FROM bookings WHERE id = ?\", args: [id] });\n return c.json({ ok: true });\n});\n\napp.get(\"/api/bookings/mine\", async (c) => {\n const member = requireMember(c);\n const now = localNow();\n const r = await sqlite.execute({\n sql: `SELECT b.id, b.resource_id, r.name AS resource_name, b.date, b.hour\n FROM bookings b JOIN resources r ON r.id = b.resource_id\n WHERE b.member_id = ? AND b.date >= ? ORDER BY b.date, b.hour`,\n args: [member.id, addDays(now.date, -1)],\n });\n const bookings = r.rows\n .map((row) => ({\n id: Number(row.id),\n resourceId: String(row.resource_id),\n resourceName: String(row.resource_name),\n date: String(row.date),\n hour: Number(row.hour),\n }))\n .filter((b) => slotStartEpoch(b.date, b.hour) + 3600_000 > now.epoch);\n return c.json({ bookings });\n});\n\n// ───────────────────────── Admin ─────────────────────────\n\napp.get(\"/api/admin/members\", async (c) => {\n requireAdmin(c);\n const r = await sqlite.execute(\"SELECT * FROM members ORDER BY active DESC, name\");\n return c.json({\n members: r.rows.map((row) => ({\n ...rowToMember(row),\n registered: !!row.pin_hash,\n inviteCode: row.invite_code ? String(row.invite_code) : null,\n resetRequestedAt: row.reset_requested_at ? String(row.reset_requested_at) : null,\n email: row.email ? String(row.email) : null,\n createdAt: String(row.created_at),\n })),\n });\n});\n\napp.post(\"/api/admin/members\", async (c) => {\n requireAdmin(c);\n const body = await c.req.json().catch(() => ({}));\n const name = cleanName(body.name);\n if (!name) throw new HttpError(400, \"Bitte Vor- und Nachnamen eingeben (z. B. „Anna Müller“).\");\n const dup = await sqlite.execute({ sql: \"SELECT id FROM members WHERE name = ? OR alias = ? COLLATE NOCASE\", args: [name, name] });\n if (dup.rows[0]) throw new HttpError(409, \"Diesen Namen gibt es schon.\");\n const code = newInviteCode();\n await sqlite.execute({\n sql: \"INSERT INTO members (name, invite_code, is_vip) VALUES (?, ?, ?)\",\n args: [name, code, body.isVip ? 1 : 0],\n });\n return c.json({ ok: true, inviteCode: code });\n});\n\napp.patch(\"/api/admin/members/:id\", async (c) => {\n const admin = requireAdmin(c);\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json().catch(() => ({}));\n const sets: string[] = [];\n const args: unknown[] = [];\n if (typeof body.isVip === \"boolean\") { sets.push(\"is_vip = ?\"); args.push(body.isVip ? 1 : 0); }\n if (typeof body.isAdmin === \"boolean\") {\n if (id === admin.id && !body.isAdmin) throw new HttpError(400, \"Du kannst dir nicht selbst die Admin-Rechte entziehen.\");\n sets.push(\"is_admin = ?\"); args.push(body.isAdmin ? 1 : 0);\n }\n if (typeof body.active === \"boolean\") {\n if (id === admin.id && !body.active) throw new HttpError(400, \"Du kannst dich nicht selbst deaktivieren.\");\n sets.push(\"active = ?\"); args.push(body.active ? 1 : 0);\n }\n if (body.name !== undefined) {\n const name = cleanName(body.name);\n if (!name) throw new HttpError(400, \"Ungültiger Name.\");\n sets.push(\"name = ?\"); args.push(name);\n }\n if (!sets.length) throw new HttpError(400, \"Nichts zu ändern.\");\n args.push(id);\n await sqlite.execute({ sql: `UPDATE members SET ${sets.join(\", \")} WHERE id = ?`, args });\n if (body.active === false) {\n await sqlite.batch([\n { sql: \"DELETE FROM sessions WHERE member_id = ?\", args: [id] },\n { sql: \"DELETE FROM bookings WHERE member_id = ? AND date >= date('now')\", args: [id] },\n ]);\n }\n return c.json({ ok: true });\n});\n\napp.post(\"/api/admin/members/:id/reset\", async (c) => {\n requireAdmin(c);\n const id = Number(c.req.param(\"id\"));\n const code = newInviteCode();\n await sqlite.batch([\n { sql: \"UPDATE members SET pin_hash = NULL, pin_salt = NULL, invite_code = ?, reset_requested_at = NULL WHERE id = ?\", args: [code, id] },\n { sql: \"DELETE FROM sessions WHERE member_id = ?\", args: [id] },\n ]);\n return c.json({ ok: true, inviteCode: code });\n});\n\napp.delete(\"/api/admin/members/:id\", async (c) => {\n const admin = requireAdmin(c);\n const id = Number(c.req.param(\"id\"));\n if (id === admin.id) throw new HttpError(400, \"Du kannst dich nicht selbst löschen.\");\n await sqlite.batch([\n { sql: \"DELETE FROM sessions WHERE member_id = ?\", args: [id] },\n { sql: \"DELETE FROM bookings WHERE member_id = ?\", args: [id] },\n { sql: \"DELETE FROM members WHERE id = ?\", args: [id] },\n ]);\n return c.json({ ok: true });\n});\n\napp.get(\"/api/admin/resources\", async (c) => {\n requireAdmin(c);\n return c.json({ resources: await listResources(false) });\n});\n\napp.put(\"/api/admin/resources/:id\", async (c) => {\n requireAdmin(c);\n const id = c.req.param(\"id\");\n const body = await c.req.json().catch(() => ({}));\n const existing = await getResource(id);\n const base: Resource = existing ?? { ...DEFAULT_GOLF, id, name: id };\n const num = (key: keyof Resource, min: number, max: number) => {\n const v = body[key] === undefined ? base[key] : Number(body[key]);\n if (!Number.isInteger(v) || v < min || v > max) throw new HttpError(400, `Ungültiger Wert für ${key}.`);\n return v as number;\n };\n const r: Resource = {\n id,\n name: typeof body.name === \"string\" && body.name.trim() ? body.name.trim().slice(0, 40) : base.name,\n capacity: num(\"capacity\", 1, 50),\n vipReserved: num(\"vipReserved\", 0, 50),\n reserveReleaseHours: num(\"reserveReleaseHours\", 0, 240),\n leadDaysVip: num(\"leadDaysVip\", 0, 90),\n leadDaysStd: num(\"leadDaysStd\", 0, 90),\n weekdayOpen: num(\"weekdayOpen\", 0, 23),\n weekdayClose: num(\"weekdayClose\", 1, 24),\n weekendOpen: num(\"weekendOpen\", 0, 23),\n weekendClose: num(\"weekendClose\", 1, 24),\n maxOpenPerMember: num(\"maxOpenPerMember\", 1, 50),\n active: body.active === undefined ? base.active : (body.active ? 1 : 0),\n };\n if (r.vipReserved > r.capacity) throw new HttpError(400, \"Reservierte Plätze dürfen die Kapazität nicht übersteigen.\");\n if (r.weekdayOpen >= r.weekdayClose || r.weekendOpen >= r.weekendClose) throw new HttpError(400, \"Öffnung muss vor Schließung liegen.\");\n await upsertResource(r, existing ? undefined : 10);\n return c.json({ ok: true, resource: r });\n});\n\napp.get(\"/api/admin/bookings\", async (c) => {\n requireAdmin(c);\n const now = localNow();\n const from = c.req.query(\"from\") ?? now.date;\n const to = c.req.query(\"to\") ?? addDays(now.date, 14);\n if (!isValidDate(from) || !isValidDate(to)) throw new HttpError(400, \"Ungültiges Datum.\");\n const r = await sqlite.execute({\n sql: `SELECT b.id, b.resource_id, b.date, b.hour, b.created_at, m.name, m.is_vip\n FROM bookings b JOIN members m ON m.id = b.member_id\n WHERE b.date BETWEEN ? AND ? ORDER BY b.date, b.hour, b.created_at`,\n args: [from, to],\n });\n return c.json({\n bookings: r.rows.map((row) => ({\n id: Number(row.id),\n resourceId: String(row.resource_id),\n date: String(row.date),\n hour: Number(row.hour),\n createdAt: String(row.created_at),\n name: String(row.name),\n isVip: Number(row.is_vip) === 1,\n })),\n });\n});\n\nexport default app.fetch;\n","deleted",false,"label","jk-golfakademie",[14],"e5718bb4-559b-409d-a723-e72077efaced",["D",1789073537776],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Buchungssystem Golfsimulator (4 Plätze/Std., VIP, PIN-Login)","imageUrl","userId","aa4a2c1b-3d04-409c-88c5-af54cb1d3470","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a08d16-8467-769a-84f6-caf4cfc8139c","tursoName","e5718bb4559b409da723e72077efaced","tursoHostname","e5718bb4559b409da723e72077efaced-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789512044203],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_106":102},"org",{"_9":10,"_99":100,"_101":102,"_56":57,"_103":104,"_105":42},"branch",{"_35":89,"_11":90,"_22":28,"_91":46,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":12,"_98":10},"isOwned",60,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Kirk Lenke","avatar","https://lh3.googleusercontent.com/a/ACg8ocJoDfrcBCOirw40MHfesVj8rSjuldOifXKqr9767Swx6brFywwEAQ=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_82":-5,"_140":141,"_142":143,"_144":145,"_146":42,"_147":42,"_148":42,"_149":32,"_150":-5,"_151":-7,"_152":-7,"_153":63,"_154":42,"_155":42,"_156":-5,"_157":42,"_158":42,"_159":42,"_160":-5},"ENV",{"_111":112,"_113":114,"_115":90,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137,"_138":139},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]