Initial commit: ANOUMA website with Payload CMS, WebRTC meetings, and booking system

- Next.js 16 App Router site with the ANOUMA design system
- Payload CMS (PostgreSQL) for offers, events, posts and page content
- WebRTC video-call system with custom signaling server
- SMTP email reminders and booking-request notifications
- Customer accounts, calendar-based availability, and booking workflow

app/(payload)/api/booking/[id]/accept-alternative/route.ts

@@ -0,0 +1,51 @@
+import { NextResponse } from "next/server";
+import { getPayload } from "payload";
+import config from "@payload-config";
+
+export const dynamic = "force-dynamic";
+
+type Args = { params: Promise<{ id: string }> };
+
+export async function POST(request: Request, { params }: Args) {
+  const { id } = await params;
+
+  try {
+    const payload = await getPayload({ config });
+    const { user } = await payload.auth({ headers: request.headers });
+    if (!user || user.collection !== "customers") {
+      return NextResponse.json({ error: "Bitte melde dich an." }, { status: 401 });
+    }
+
+    const booking = await payload.findByID({ collection: "booking-requests", id, depth: 0 }).catch(() => null);
+    if (!booking || Number(booking.user) !== Number(user.id)) {
+      return NextResponse.json({ error: "Buchung nicht gefunden." }, { status: 404 });
+    }
+    const alternative = booking.proposedAlternative;
+    if (booking.status !== "pending" || !alternative?.date || !alternative.startTime || !alternative.endTime) {
+      return NextResponse.json({ error: "Für diese Buchung liegt kein alternativer Termin vor." }, { status: 409 });
+    }
+
+    // The beforeChange hook on booking-requests re-checks for conflicts
+    // (with an advisory lock) before allowing this to become "confirmed" —
+    // the alternative slot may have been taken by someone else since it was
+    // proposed.
+    await payload.update({
+      collection: "booking-requests",
+      id,
+      data: {
+        status: "confirmed",
+        date: alternative.date,
+        startTime: alternative.startTime,
+        endTime: alternative.endTime,
+      },
+    });
+
+    return NextResponse.json({ ok: true });
+  } catch (error) {
+    if (error instanceof Error && "status" in error && (error as { status: number }).status === 409) {
+      return NextResponse.json({ error: error.message }, { status: 409 });
+    }
+    console.error("accept-alternative failed", error);
+    return NextResponse.json({ error: "Der Termin konnte nicht angenommen werden." }, { status: 500 });
+  }
+}

app/(payload)/api/booking/[id]/cancel/route.ts

@@ -0,0 +1,33 @@
+import { NextResponse } from "next/server";
+import { getPayload } from "payload";
+import config from "@payload-config";
+
+export const dynamic = "force-dynamic";
+
+type Args = { params: Promise<{ id: string }> };
+
+export async function POST(request: Request, { params }: Args) {
+  const { id } = await params;
+
+  try {
+    const payload = await getPayload({ config });
+    const { user } = await payload.auth({ headers: request.headers });
+    if (!user || user.collection !== "customers") {
+      return NextResponse.json({ error: "Bitte melde dich an." }, { status: 401 });
+    }
+
+    const booking = await payload.findByID({ collection: "booking-requests", id, depth: 0 }).catch(() => null);
+    if (!booking || Number(booking.user) !== Number(user.id)) {
+      return NextResponse.json({ error: "Buchung nicht gefunden." }, { status: 404 });
+    }
+    if (booking.status === "cancelled") {
+      return NextResponse.json({ ok: true });
+    }
+
+    await payload.update({ collection: "booking-requests", id, data: { status: "cancelled" } });
+    return NextResponse.json({ ok: true });
+  } catch (error) {
+    console.error("booking cancel failed", error);
+    return NextResponse.json({ error: "Der Termin konnte nicht storniert werden." }, { status: 500 });
+  }
+}

app/(payload)/api/booking/request/route.ts

@@ -0,0 +1,93 @@
+import { NextResponse } from "next/server";
+import { getPayload } from "payload";
+import config from "@payload-config";
+import { getAvailableSlots } from "@/lib/booking/slots";
+
+export const dynamic = "force-dynamic";
+
+type Body = {
+  offerSlug?: unknown;
+  start?: unknown;
+  appointmentType?: unknown;
+  message?: unknown;
+};
+
+export async function POST(request: Request) {
+  let body: Body;
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: "Ungültige Anfrage." }, { status: 400 });
+  }
+
+  const offerSlug = typeof body.offerSlug === "string" ? body.offerSlug : "";
+  const startISO = typeof body.start === "string" ? body.start : "";
+  const appointmentType = body.appointmentType === "online" ? "online" : "onsite";
+  const message = typeof body.message === "string" ? body.message.trim().slice(0, 2000) : "";
+
+  if (!offerSlug || !startISO) {
+    return NextResponse.json({ error: "Angebot und Termin sind erforderlich." }, { status: 400 });
+  }
+
+  try {
+    const payload = await getPayload({ config });
+    const { user } = await payload.auth({ headers: request.headers });
+    if (!user || user.collection !== "customers") {
+      return NextResponse.json({ error: "Bitte melde dich an, um einen Termin anzufragen." }, { status: 401 });
+    }
+
+    const { docs } = await payload.find({
+      collection: "offers",
+      where: { slug: { equals: offerSlug } },
+      limit: 1,
+      overrideAccess: false,
+    });
+    const offer = docs[0];
+    if (!offer || !offer.bookable || !offer.durationMinutes) {
+      return NextResponse.json({ error: "Dieses Angebot ist nicht buchbar." }, { status: 404 });
+    }
+
+    const start = new Date(startISO);
+    if (Number.isNaN(start.getTime()) || start < new Date()) {
+      return NextResponse.json({ error: "Bitte wähle einen gültigen, zukünftigen Termin." }, { status: 400 });
+    }
+    const end = new Date(start.getTime() + offer.durationMinutes * 60_000);
+
+    // Re-validate the slot is actually free right now (defense against a
+    // stale slot list) — the hard, race-safe check still runs again when
+    // Anna confirms (see collections/BookingRequests.ts).
+    const dayStart = new Date(start);
+    dayStart.setHours(0, 0, 0, 0);
+    const dayEnd = new Date(start);
+    dayEnd.setHours(23, 59, 59, 999);
+    const slotsByDay = await getAvailableSlots(payload, {
+      durationMinutes: offer.durationMinutes,
+      from: dayStart,
+      to: dayEnd,
+    });
+    const key = dayStart.toISOString().slice(0, 10);
+    const isStillFree = (slotsByDay.get(key) ?? []).some((s) => s.start.getTime() === start.getTime());
+    if (!isStillFree) {
+      return NextResponse.json({ error: "Dieser Termin ist leider nicht mehr verfügbar." }, { status: 409 });
+    }
+
+    await payload.create({
+      collection: "booking-requests",
+      data: {
+        user: user.id,
+        offer: offer.id,
+        date: start.toISOString(),
+        startTime: start.toISOString(),
+        endTime: end.toISOString(),
+        appointmentType,
+        status: "pending",
+        userMessage: message || undefined,
+      },
+    });
+
+    return NextResponse.json({ ok: true });
+  } catch (error) {
+    console.error("booking request failed", error);
+    return NextResponse.json({ error: "Die Anfrage konnte nicht gesendet werden. Bitte versuche es später erneut." }, { status: 500 });
+  }
+}

app/(payload)/api/booking/slots/route.ts

@@ -0,0 +1,55 @@
+import { NextResponse } from "next/server";
+import { getPayload } from "payload";
+import config from "@payload-config";
+import { getAvailableSlots } from "@/lib/booking/slots";
+
+export const dynamic = "force-dynamic";
+
+/** GET /api/booking/slots?offer=<slug>&from=YYYY-MM-DD&to=YYYY-MM-DD */
+export async function GET(request: Request) {
+  const { searchParams } = new URL(request.url);
+  const offerSlug = searchParams.get("offer");
+  const fromParam = searchParams.get("from");
+  const toParam = searchParams.get("to");
+
+  if (!offerSlug) {
+    return NextResponse.json({ error: "offer ist erforderlich." }, { status: 400 });
+  }
+
+  try {
+    const payload = await getPayload({ config });
+    const { docs } = await payload.find({
+      collection: "offers",
+      where: { slug: { equals: offerSlug } },
+      limit: 1,
+      overrideAccess: false,
+    });
+    const offer = docs[0];
+    if (!offer || !offer.bookable || !offer.durationMinutes) {
+      return NextResponse.json({ error: "Dieses Angebot ist nicht buchbar." }, { status: 404 });
+    }
+
+    const from = fromParam ? new Date(fromParam) : new Date();
+    from.setHours(0, 0, 0, 0);
+    const to = toParam ? new Date(toParam) : new Date(from.getTime() + 21 * 24 * 60 * 60 * 1000);
+    to.setHours(23, 59, 59, 999);
+
+    // Cap the range so this can't be abused to run an expensive scan.
+    const maxRangeMs = 62 * 24 * 60 * 60 * 1000;
+    if (to.getTime() - from.getTime() > maxRangeMs) {
+      return NextResponse.json({ error: "Zeitraum zu groß." }, { status: 400 });
+    }
+
+    const slotsByDay = await getAvailableSlots(payload, { durationMinutes: offer.durationMinutes, from, to });
+
+    const result: Record<string, { start: string; end: string }[]> = {};
+    for (const [day, slots] of slotsByDay) {
+      result[day] = slots.map((s) => ({ start: s.start.toISOString(), end: s.end.toISOString() }));
+    }
+
+    return NextResponse.json({ durationMinutes: offer.durationMinutes, slots: result });
+  } catch (error) {
+    console.error("booking slots failed", error);
+    return NextResponse.json({ error: "Verfügbarkeiten konnten nicht geladen werden." }, { status: 500 });
+  }
+}