Change Due
@@ -1487,7 +1496,7 @@
diff --git a/frontend/src/lib/square/square.test.ts b/frontend/src/lib/square/square.test.ts
index 4ec619e..fe63395 100644
--- a/frontend/src/lib/square/square.test.ts
+++ b/frontend/src/lib/square/square.test.ts
@@ -8,8 +8,10 @@ import {
SCA_REFUSAL_MESSAGE_TILL,
VERIFICATION_REQUIRED_MESSAGE,
adminRequestNewTwoFactorCode,
+ buildCashTillPaymentBody,
campaignDiscountPence,
canSaveCardsForRole,
+ cashChargeBasePence,
depositChargePence,
isAmbiguousPaymentFailure,
isNonceStale,
@@ -20,11 +22,13 @@ import {
newCardTokenizeResult,
parseTokenizeVerificationResult,
requestNewTwoFactorCode,
+ resendEmailVerification,
sanitizeDecimalInput,
scaFallbackConsentFields,
shouldShowSCARefusal,
submitPaymentWithRetry,
- type SavedCardVerificationOutcome
+ type SavedCardVerificationOutcome,
+ verifyEmailCode
} from './square';
import type * as SquareModule from './square';
@@ -199,6 +203,74 @@ describe('canSaveCardsForRole', () => {
});
});
+describe('buildCashTillPaymentBody', () => {
+ it('sends the due amount alone with no tip flag when no tip applies', () => {
+ // `tip_enabled` is intentionally absent (undefined) — the old inline
+ // bodies only set it when a tip actually existed.
+ expect(buildCashTillPaymentBody(4000, 0)).toEqual({
+ amount: 4000,
+ payment_type: 'full',
+ payment_method: 'cash'
+ });
+ expect(buildCashTillPaymentBody(4000, 0).tip_enabled).toBeUndefined();
+ });
+
+ it('folds the tip into the amount and flags tip_enabled (backend has no tip_amount field)', () => {
+ // CreateTerminalPaymentRequest derives the tip from `amount - remaining`
+ // when tip_enabled — the tip must ride inside `amount`, never as a dead
+ // `tip_amount` key.
+ expect(buildCashTillPaymentBody(4000, 500)).toEqual({
+ amount: 4500,
+ payment_type: 'full',
+ payment_method: 'cash',
+ tip_enabled: true
+ });
+ });
+
+ it('always carries the full/cash payment contract the backend keys on', () => {
+ expect(buildCashTillPaymentBody(4000, 0)).toMatchObject({
+ payment_type: 'full',
+ payment_method: 'cash'
+ });
+ });
+
+ it('rounds via the caller; the helper sums the pence inputs verbatim', () => {
+ expect(buildCashTillPaymentBody(4000, 50).amount).toBe(4050);
+ });
+});
+
+describe('cashChargeBasePence', () => {
+ // Concrete arithmetic pinned to the FIX-1 scenario: booking £100, pending
+ // 10% campaign preview (£10), £10 loyalty redemption, £100 cash tender with
+ // the keep-change-as-tip checkbox on. netTotal = £90 (campaign subtracted),
+ // so the current charge base of £85 (totalDue − loyalty) understates the
+ // backend's remaining basis and absorbs the tip.
+ it('restores the pending campaign credit into the charge base (tip carve basis)', () => {
+ // totalDuePence = £90 net (campaign subtracted, pre-loyalty)
+ expect(cashChargeBasePence(9000, 1000, 1000)).toBe(9000);
+ });
+
+ it('keeps the plain net total when no campaign is eligible', () => {
+ // totalDue = £90 (no campaign), loyalty £10 → base = £80 = the net obligation
+ expect(cashChargeBasePence(9000, 0, 1000)).toBe(8000);
+ });
+
+ it('never goes below zero (fully covered by discounts + loyalty)', () => {
+ expect(cashChargeBasePence(1000, 0, 5000)).toBe(0);
+ });
+
+ it('the folded tip body uses the base, so UI tip == backend-recorded tip', () => {
+ // Booking £100, campaign £10, loyalty £10: base = 9000 (100 − 20 + 10).
+ // Tender £100 → tip £10 → amount £100. The backend carves against the
+ // full £100 remaining, so it records £0 tip — matching the UI claim
+ // that only the amount above the charge base is a tip.
+ const basePence = cashChargeBasePence(9000, 1000, 1000);
+ const tipPence = 10000 - basePence;
+ expect(buildCashTillPaymentBody(basePence, tipPence).amount).toBe(10000);
+ expect(tipPence).toBe(1000);
+ });
+});
+
describe('payment failure classification', () => {
it('a definitive 402 on a saved-card charge is an issuer verification failure', () => {
expect(isSavedCardVerificationRequired(402, true)).toBe(true);
@@ -746,6 +818,94 @@ describe('adminRequestNewTwoFactorCode', () => {
});
});
+describe('resendEmailVerification', () => {
+ function jsonResponse(body: unknown, status = 200): Response {
+ return new Response(JSON.stringify(body), {
+ status,
+ headers: { 'Content-Type': 'application/json' }
+ });
+ }
+
+ afterEach(() => {
+ vi.unstubAllGlobals();
+ });
+
+ it('POSTs to /api/verify/generate with the email and email_verify purpose', async () => {
+ const fetchMock = vi.fn().mockResolvedValue(jsonResponse({ success: true, message: 'ok' }));
+ vi.stubGlobal('fetch', fetchMock);
+ const response = await resendEmailVerification('user@example.com');
+ expect(response.ok).toBe(true);
+ const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit];
+ expect(url).toBe('/api/verify/generate');
+ expect(init.method).toBe('POST');
+ expect((init.headers as Record
)['Content-Type']).toBe('application/json');
+ expect(init.body).toBe(JSON.stringify({ email: 'user@example.com', purpose: 'email_verify' }));
+ });
+
+ it('passes through the backend response (the caller surfaces success/message)', async () => {
+ const fetchMock = vi
+ .fn()
+ .mockResolvedValue(jsonResponse({ success: false, message: 'cooldown' }, 429));
+ vi.stubGlobal('fetch', fetchMock);
+ const response = await resendEmailVerification('user@example.com');
+ expect(response.status).toBe(429);
+ expect(response.ok).toBe(false);
+ });
+});
+
+describe('verifyEmailCode', () => {
+ function jsonResponse(body: unknown, status = 200): Response {
+ return new Response(JSON.stringify(body), {
+ status,
+ headers: { 'Content-Type': 'application/json' }
+ });
+ }
+
+ afterEach(() => {
+ vi.unstubAllGlobals();
+ });
+
+ it('POSTs to /api/verify/check with the email, code and email_verify purpose', async () => {
+ const fetchMock = vi
+ .fn()
+ .mockResolvedValue(jsonResponse({ success: true, message: 'Email verified successfully' }));
+ vi.stubGlobal('fetch', fetchMock);
+ const response = await verifyEmailCode('user@example.com', 'a1b2c3d4e5f6');
+ expect(response.ok).toBe(true);
+ const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit];
+ expect(url).toBe('/api/verify/check');
+ expect(init.method).toBe('POST');
+ expect((init.headers as Record)['Content-Type']).toBe('application/json');
+ expect(init.body).toBe(
+ JSON.stringify({
+ email: 'user@example.com',
+ code: 'a1b2c3d4e5f6',
+ purpose: 'email_verify'
+ })
+ );
+ });
+
+ it('passes through the backend success response body', async () => {
+ const fetchMock = vi
+ .fn()
+ .mockResolvedValue(jsonResponse({ success: true, message: 'Email verified successfully' }));
+ vi.stubGlobal('fetch', fetchMock);
+ const response = await verifyEmailCode('user@example.com', 'a1b2c3d4e5f6');
+ const data = await response.json();
+ expect(data).toEqual({ success: true, message: 'Email verified successfully' });
+ });
+
+ it('passes through a failed verification (invalid/expired code)', async () => {
+ const fetchMock = vi
+ .fn()
+ .mockResolvedValue(new Response('invalid or expired code', { status: 400 }));
+ vi.stubGlobal('fetch', fetchMock);
+ const response = await verifyEmailCode('user@example.com', 'wrong-code');
+ expect(response.status).toBe(400);
+ expect(response.ok).toBe(false);
+ });
+});
+
describe('SCA-unavailable fallback consent (C6)', () => {
it('SCA_FALLBACK_CONSENT_VERSION is a non-empty versioned string', () => {
expect(SCA_FALLBACK_CONSENT_VERSION).toMatch(/^v\d+$/);
diff --git a/frontend/src/lib/square/square.ts b/frontend/src/lib/square/square.ts
index f316313..3fe7e18 100644
--- a/frontend/src/lib/square/square.ts
+++ b/frontend/src/lib/square/square.ts
@@ -31,6 +31,60 @@ export const NONCE_STALENESS_MS = 240_000;
// 'saved_card' across the booking, tip, account, till and admin surfaces.
export const PAYMENT_METHOD_SAVED_CARD = 'saved_card';
+/**
+ * Cash till-sale request body shared by every cash payment surface. The
+ * backend's CreateTerminalPaymentRequest derives the tip from
+ * `amount - remaining` when `tip_enabled && remaining < amount` — it has NO
+ * `tip_amount` field — so the tip must be FOLDED INTO the amount (a separate
+ * `tip_amount` key is dead: it is never parsed and the tip would be silently
+ * dropped). Single source of truth so the admin and customer cash flows can't
+ * drift. `tip_enabled` is set only when there actually IS a tip, exactly like
+ * the old inline bodies.
+ */
+export type CashTillPaymentBody = {
+ amount: number;
+ payment_type: 'full';
+ payment_method: 'cash';
+ tip_enabled?: true;
+};
+
+export function buildCashTillPaymentBody(
+ cashDuePence: number,
+ tipPence: number
+): CashTillPaymentBody {
+ const body: CashTillPaymentBody = {
+ amount: cashDuePence + tipPence,
+ payment_type: 'full',
+ payment_method: 'cash'
+ };
+ if (tipPence > 0) body.tip_enabled = true;
+ return body;
+}
+
+/**
+ * The cash till-sale charge base in pence, aligned with the backend's
+ * CreateTerminalPayment tip carve (backend/handlers/payments/handlers.go
+ * ~577-630). The backend derives the recorded tip from `amount − remaining`,
+ * where `remaining` comes from GetBookingRemainingBalancePence (service.go) —
+ * which does NOT subtract the pending campaign discount: campaigns auto-apply
+ * AFTER the remaining is read, minting `payment_method='discount'` rows that
+ * never reduce the balance. If the frontend charges the campaign-reduced total
+ * (`totalDuePence`), the sent amount is smaller than the backend's remaining,
+ * so `amount − remaining` is absorbed (the tip is under-recorded or the whole
+ * payment lands as booking credit). Restoring the campaign credit into the
+ * charge base keeps the sent amount on the same basis the backend carves
+ * against. `totalDuePence` is the net total (campaign already subtracted,
+ * pre-loyalty), `campaignPence` the eligible preview credit and `loyaltyPence`
+ * the redemption being applied on top.
+ */
+export function cashChargeBasePence(
+ totalDuePence: number,
+ campaignPence: number,
+ loyaltyPence: number
+): number {
+ return Math.max(0, totalDuePence - loyaltyPence + campaignPence);
+}
+
/**
* True when a user's role is allowed to save cards for reuse. Only VERIFIED
* accounts (verified_email, admin) may save cards — guests, unverified accounts
@@ -588,6 +642,47 @@ export async function adminRequestNewTwoFactorCode(
return requestTwoFactorCode(`/api/admin/users/${encodeURIComponent(userID)}/2fa/code`);
}
+/**
+ * Re-sends the account email-verification code via POST /api/verify/generate
+ * (backend/handlers/auth/local.go GenerateVerificationCodeHandler), minting a
+ * fresh code for the given email with purpose `email_verify`. Response shape:
+ * `{ success, message }`.
+ *
+ * The legacy `/api/verify-email` endpoint does NOT exist in the backend; its
+ * ONLY caller was +layout.svelte's verify_email() (frontend/src/routes/+layout.svelte
+ * lines ~45-61), which still POSTs to the dead URL with no body. +layout.svelte
+ * is OUTSIDE this fix's ownership, so this helper is the fix vehicle: the
+ * round-2 agent must switch verify_email() to call
+ * `resendEmailVerification(authStore.currentUser?.email)` — the endpoint keys
+ * on the logged-in user's email, so it must be passed in, never read from the
+ * store inside this helper (keeps it import-free for the vitest suite). No
+ * other call site references the dead endpoint.
+ */
+export async function resendEmailVerification(email: string): Promise {
+ return fetch('/api/verify/generate', {
+ method: 'POST',
+ headers: { 'Content-Type': 'application/json' },
+ body: JSON.stringify({ email, purpose: 'email_verify' })
+ });
+}
+
+/**
+ * Submits the emailed verification code via POST /api/verify/check
+ * (backend/handlers/auth/local.go VerifyCodeHandler), escalating the account
+ * from unverified_email to verified_email. The handler keys on the submitted
+ * `code` alone (the remaining fields are ignored server-side but kept for
+ * forward-compatibility with a purpose-keyed check). Response shape:
+ * `{ success, message }` — a success clears the +layout.svelte banner via a
+ * reload.
+ */
+export async function verifyEmailCode(email: string, code: string): Promise {
+ return fetch('/api/verify/check', {
+ method: 'POST',
+ headers: { 'Content-Type': 'application/json' },
+ body: JSON.stringify({ email, code, purpose: 'email_verify' })
+ });
+}
+
/** Minimal `{"error"|"message": "..."}` extractor for the 2FA code-request
* endpoint bodies (429/503), kept inline so square.ts stays import-free for
* the vitest suite. */
diff --git a/frontend/src/routes/+layout.svelte b/frontend/src/routes/+layout.svelte
index 6dbe51e..a200fe9 100644
--- a/frontend/src/routes/+layout.svelte
+++ b/frontend/src/routes/+layout.svelte
@@ -5,6 +5,8 @@
import { Toaster } from '$lib/components/ui/sonner/index.js';
import { toast } from 'svelte-sonner';
import { authStore } from '$lib/stores/auth.svelte';
+ import { resendEmailVerification, verifyEmailCode } from '$lib/square/square';
+ import { extractErrorMessage } from '$lib/utils/toast-safe';
import { resetZIndexStack } from '$lib/components/ui/dialog/zindex.js';
import { onMount } from 'svelte';
import { page } from '$app/stores';
@@ -41,22 +43,77 @@
};
});
- // Verify email address
- // TODO: `/api/verify-email` doesn't exist in the backend. The correct endpoints are
- // `POST /api/verify/generate` (send verification code) and `POST /api/verify/check` (verify code).
- // This call silently 404s. Fix required — either add the missing backend route or refactor
- // to use `/api/verify/generate` + `/api/verify/check`.
+ // Re-send the email verification code via POST /api/verify/generate (the
+ // backend only exposes generate/check — there is no /api/verify-email).
async function verify_email() {
- const loadingToast = toast.loading('Verifying email address...');
- const response = await fetch('/api/verify-email', {
- method: 'POST'
- });
+ const loadingToast = toast.loading('Sending verification code...');
+ if (!authStore.currentUser?.email) {
+ toast.error('Unable to resend the verification code — no email on file', {
+ id: loadingToast
+ });
+ return;
+ }
+ try {
+ const response = await resendEmailVerification(authStore.currentUser.email);
- if (response.ok) {
- toast.success('Email verified successfully!', { id: loadingToast });
- window.location.reload();
- } else {
- toast.error('Failed to verify email address', { id: loadingToast });
+ if (response.ok) {
+ toast.success('If the email exists, a verification code has been sent', {
+ id: loadingToast
+ });
+ window.location.reload();
+ } else {
+ toast.error('Failed to send the verification code', { id: loadingToast });
+ }
+ } catch {
+ toast.error('Network error sending the verification code — please try again', {
+ id: loadingToast
+ });
+ }
+ }
+
+ // The banner has no submit surface on its own — the code lands out-of-band
+ // (email/SMS, or the dev [VERIFY] server log), so this inline input submits
+ // the received code to POST /api/verify/check. A success escalates the
+ // account to verified_email; the reload clears the banner.
+ let verificationCode = $state('');
+ let isVerifyingCode = $state(false);
+
+ async function submitVerificationCode() {
+ if (isVerifyingCode) return;
+ if (!authStore.currentUser?.email) {
+ toast.error('Unable to verify — no email on file');
+ return;
+ }
+ const code = verificationCode.trim();
+ if (!code) {
+ toast.error('Please enter the verification code');
+ return;
+ }
+ isVerifyingCode = true;
+ const loadingToast = toast.loading('Verifying code...');
+ try {
+ const response = await verifyEmailCode(authStore.currentUser.email, code);
+ if (response.ok) {
+ const data = (await response.json().catch(() => null)) as {
+ message?: unknown;
+ } | null;
+ toast.success(
+ typeof data?.message === 'string' ? data.message : 'Email verified successfully',
+ { id: loadingToast }
+ );
+ window.location.reload();
+ } else {
+ const errData = await response.text().catch(() => '');
+ toast.error(
+ extractErrorMessage(errData) ||
+ 'Verification failed — please check the code and try again',
+ { id: loadingToast }
+ );
+ }
+ } catch {
+ toast.error('Network error verifying your code — please try again', { id: loadingToast });
+ } finally {
+ isVerifyingCode = false;
}
}
@@ -78,15 +135,37 @@
{#if authStore.currentUser?.role === 'unverified_email'}
- Please verify your email address to continue. Didn't recieve the email? Check your spam
- folder, or
- to resend it.
+
+ Please verify your email address to continue. Didn't recieve the email? Check your spam
+ folder, or
+
+ to resend it.
+
+
+ (verificationCode = (e.target as HTMLInputElement).value)}
+ class="w-44 rounded-md border border-white/50 bg-white px-3 py-1.5 text-sm text-gray-900 placeholder:text-gray-400 focus:border-white focus:outline-none"
+ />
+
+
-
-
Notifications
-
+
+
Notifications
+
+
+
+ {#if suppressed > 0}
+
+
+
+
+
+ {suppressed} money-critical alert{suppressed === 1 ? '' : 's'} suppressed
+
+
+ The unacknowledged queue hit the flood cap. Acknowledge outstanding notifications to re-arm
+ money alerts.
+
+ {#if suppressedDetails.length > 0}
+
+ {#each suppressedDetails as d (d.reason)}
+ - • {reasonLabels[d.reason] || d.reason}: {d.suppressed_count} suppressed
+ {/each}
+
+ {/if}
+
+
+ {/if}
{#if notifications.length === 0}
@@ -458,6 +510,19 @@
{getNotificationTitle(n)}
{getNotificationSubtitle(n)}
+ {#if n.amount !== undefined || n.square_id || n.description}
+
+ {#if n.amount !== undefined}
+
Amount: £{n.amount.toFixed(2)}
+ {/if}
+ {#if n.square_id}
+
Square: {n.square_id}
+ {/if}
+ {#if n.description}
+
{n.description}
+ {/if}
+
+ {/if}
{#if hasAction(n.reason)}
diff --git a/frontend/src/routes/cancellation-policy/+page.svelte b/frontend/src/routes/cancellation-policy/+page.svelte
index 913f9d1..ad8f44e 100644
--- a/frontend/src/routes/cancellation-policy/+page.svelte
+++ b/frontend/src/routes/cancellation-policy/+page.svelte
@@ -2,6 +2,19 @@
import { page } from '$app/stores';
import { resolve } from '$app/paths';
import { onMount } from 'svelte';
+ import {
+ DEPOSIT_ADVANCE_HOURS,
+ FULL_REFUND_THRESHOLD_HOURS,
+ NO_SHOW_THRESHOLD_HOURS,
+ PARTIAL_REFUND_THRESHOLD_HOURS,
+ PROTECTED_DEPOSIT_MAX_PCT,
+ REQUIRED_DEPOSIT_PCT
+ } from '$lib/constants/policy';
+
+ // Whole-number percents derived from the fractional policy constants so the
+ // legal prose renders "20%" / "50%" without hardcoding the digits.
+ const depositPct = Math.round(REQUIRED_DEPOSIT_PCT * 100);
+ const protectedDepositMaxPct = Math.round(PROTECTED_DEPOSIT_MAX_PCT * 100);
let format = $state('html');
@@ -58,13 +71,14 @@
1. Deposit Requirements & Booking Rules
+
Where a deposit is required to secure your appointment, you must pay at least
- 20% of the total service cost before the 24-hour deadline prior to the
- appointment. The 20% can be paid in a single payment or accumulated across multiple payments
+ {depositPct}% of the total service cost before the 24-hour deadline prior to the
+ appointment. The {depositPct}% can be paid in a single payment or accumulated across multiple payments
— what matters is the total when the deadline passes. When deposit restrictions are active
on your account, appointments must be scheduled at least
- 36 hours in advance.
+ {DEPOSIT_ADVANCE_HOURS} hours in advance.
Payments toward your booking are capped at 100% of the total booking value based on service
@@ -84,6 +98,7 @@
2. Unpaid Deposits & The "Pending Release" Window
+
If a required deposit is not paid at least 24 hours before the appointment begins, the
booking is shifted into a "Pending Release" status. The slot becomes vulnerable
@@ -123,7 +138,7 @@
-
Notice of more than 72 hours
+
Notice of more than {FULL_REFUND_THRESHOLD_HOURS} hours
You are entitled to a full 100% refund of all booking payments made.
@@ -131,19 +146,20 @@
- Notice between 24 and 72 hours (including exactly 24 or 72 hours)
+ Notice between {PARTIAL_REFUND_THRESHOLD_HOURS} and {FULL_REFUND_THRESHOLD_HOURS} hours
+ (including exactly {PARTIAL_REFUND_THRESHOLD_HOURS} or {FULL_REFUND_THRESHOLD_HOURS} hours)
- Any booking payments made up to 50% of the total booking value are treated as a
+ Any booking payments made up to {protectedDepositMaxPct}% of the total booking value are treated as a
Protected Deposit. This Protected Deposit is retained to cover the short-notice vacancy,
- while any balance paid above 50% will be fully refunded. The protected deposit is capped
- at 50% of the booking total AND at what you actually paid — so if you only paid a
- 20% deposit, no more than that is ever retained.
+ while any balance paid above {protectedDepositMaxPct}% will be fully refunded. The protected deposit is capped
+ at {protectedDepositMaxPct}% of the booking total AND at what you actually paid — so if you only paid a
+ {depositPct}% deposit, no more than that is ever retained.
-
Notice of less than 24 hours
+
Notice of less than {NO_SHOW_THRESHOLD_HOURS} hours
All booking payments and deposits are retained (no refund). The cancellation will be
logged as a missed appointment history strike.
@@ -220,6 +236,7 @@
4. Missed Appointments (No-Shows)
+
Failing to attend a confirmed appointment without notifying us in advance constitutes a
"No-Show". Cancelling a pending or deposit-lapsed booking within 24 hours does
@@ -254,11 +271,13 @@
choose a refund, it is processed under our standard refund tiers above unless we waive them
(for example when the cancellation is due to our own scheduling conflicts).
+
Please note that in accordance with UK statutory exclusions for distance contracts, the
standard 14-day statutory cancellation "cooling-off" period under the Consumer Contracts
Regulations 2013 does not apply to online bookings scheduled for a specific date or time.
+
That exclusion does not apply to gift cards: online gift-card purchases may be cancelled
within 14 days for a refund to the original payment method under the Consumer Contracts
diff --git a/frontend/src/routes/gift-card-terms/+page.svelte b/frontend/src/routes/gift-card-terms/+page.svelte
index 2fc4c51..75c3271 100644
--- a/frontend/src/routes/gift-card-terms/+page.svelte
+++ b/frontend/src/routes/gift-card-terms/+page.svelte
@@ -91,6 +91,7 @@
3. Expiry
+
Gift cards expire 24 months after their last use (rolling expiry). Each use resets
the 24-month period.
@@ -147,6 +148,7 @@
6. Refunds and Cancellation
+
Non-refundable except where the law requires: except for the 14-day right
to cancel described below, and except as required by consumer law or by an express refund we
@@ -157,6 +159,7 @@
>, gift cards and gift-card balances are non-refundable — they are not
redeemable for cash (unless required by law).
+
14-day right to cancel online purchases: if you buy a gift card online, the Consumer
Contracts (Information, Cancellation and Additional Charges) Regulations 2013 give you a 14-day
diff --git a/frontend/src/routes/privacy-policy/+page.svelte b/frontend/src/routes/privacy-policy/+page.svelte
index 372eab3..0b60ebf 100644
--- a/frontend/src/routes/privacy-policy/+page.svelte
+++ b/frontend/src/routes/privacy-policy/+page.svelte
@@ -407,6 +407,7 @@
6 months after the appointment, then anonymized |
GDPR storage limitation |
+
| Gift cards |
diff --git a/frontend/src/routes/terms/+page.svelte b/frontend/src/routes/terms/+page.svelte
index ac9e01e..8e290f4 100644
--- a/frontend/src/routes/terms/+page.svelte
+++ b/frontend/src/routes/terms/+page.svelte
@@ -3,6 +3,18 @@
import { resolve } from '$app/paths';
import { onMount } from 'svelte';
import { SUPPORT_EMAIL, BUSINESS_NAME, BUSINESS_ADDRESS, TRADER_LEGAL_NAME } from '$lib/constants/contact';
+ import {
+ FULL_REFUND_THRESHOLD_HOURS,
+ NO_SHOW_THRESHOLD_HOURS,
+ PARTIAL_REFUND_THRESHOLD_HOURS,
+ PROTECTED_DEPOSIT_MAX_PCT,
+ REQUIRED_DEPOSIT_PCT
+ } from '$lib/constants/policy';
+
+ // Whole-number percents derived from the fractional policy constants so the
+ // legal prose renders "20%" / "50%" without hardcoding the digits.
+ const depositPct = Math.round(REQUIRED_DEPOSIT_PCT * 100);
+ const protectedDepositMaxPct = Math.round(PROTECTED_DEPOSIT_MAX_PCT * 100);
let format = $state('html');
@@ -130,9 +142,9 @@
delivery is available).
- Some services require a deposit (typically 20% of the service cost; a
- protected-deposit cap of 50% may be retained on short-notice cancellation, capped at
- what you actually paid).
+ Some services require a deposit (typically {depositPct}% of the service cost; a
+ protected-deposit cap of {protectedDepositMaxPct}% may be retained on short-notice
+ cancellation, capped at what you actually paid).
Cancellations & rescheduling
@@ -145,16 +157,16 @@
-
- Notice of more than 72 hours: you are entitled to a full 100% refund of all
+ Notice of more than {FULL_REFUND_THRESHOLD_HOURS} hours: you are entitled to a full 100% refund of all
booking payments made.
-
- Notice between 24 and 72 hours: any booking payments made up to 50% of the
+ Notice between {PARTIAL_REFUND_THRESHOLD_HOURS} and {FULL_REFUND_THRESHOLD_HOURS} hours: any booking payments made up to {protectedDepositMaxPct}% of the
total booking value are treated as a Protected Deposit. This Protected Deposit is retained to
- cover the short-notice vacancy, while any balance paid above 50% will be fully refunded.
+ cover the short-notice vacancy, while any balance paid above {protectedDepositMaxPct}% will be fully refunded.
-
- Notice of less than 24 hours: all booking payments and deposits are entirely
+ Notice of less than {NO_SHOW_THRESHOLD_HOURS} hours: all booking payments and deposits are entirely
non-refundable and will be retained. The cancellation will be logged as a missed appointment
history strike.
@@ -172,8 +184,8 @@
Deposits
-
- Deposits are retained on cancellation in line with the tiered schedule above (up to 50% of
- the booking value between 24 and 72 hours' notice; all payments retained under 24 hours).
+ Deposits are retained on cancellation in line with the tiered schedule above (up to {protectedDepositMaxPct}% of
+ the booking value between {PARTIAL_REFUND_THRESHOLD_HOURS} and {FULL_REFUND_THRESHOLD_HOURS} hours' notice; all payments retained under {NO_SHOW_THRESHOLD_HOURS} hours).
- Deposits are applied to your final bill.
- If we cancel, any deposit paid is refunded under the business-cancellation terms above.
@@ -263,6 +275,7 @@
Gift card expiry
+
-
Gift cards expire after the expiry period set in the salon's business settings (24 months
after last use by default, and never less than 12 months).
@@ -289,6 +302,7 @@
VAT is charged at the point of gift card purchase, not at redemption. When you pay with gift card
balance, no additional VAT is charged (it has already been paid).
+
Right to cancel: if you buy a gift card online, you can cancel the purchase
within 14 days for a refund to the original payment method. If the card has been partly used
@@ -301,6 +315,7 @@
>
for the full position.
+
Non-refundable except where the law requires: except for the 14-day right
to cancel online purchases above, and except as required by consumer law or by an express
@@ -318,10 +333,12 @@
Purchases made on our Platform (rather than face-to-face in the salon) are
distance contracts under the Consumer Contracts (Information, Cancellation
and Additional Charges) Regulations 2013. This gives you a
+
14-day right to cancel most online purchases, running from the day after
purchase.
+
-
Gift cards bought online carry this 14-day right, refunded to the
original payment method — in full if unused, or the unspent balance if partly used
@@ -338,6 +355,7 @@
activities), so the 14-day right does not apply to the service itself; our cancellation and
refund policy in section 3 applies instead.
+
-
How to exercise it: for gift cards, cancel in-app from your account
within 14 days (no email needed); for anything else, email {SUPPORT_EMAIL} within 14 days.
|