- README: payments/2FA sections rewritten for the SCA-only posture (no
TWO_FACTOR_FALLBACK, tokenize-result wire contract, 402 refusal), deposit
carve-out clarified, gift-card 12-hex codes + 14-day cancellation, flood-cap
insert sites enumerated, escalating lockout tiers documented, ICO
registration note, updated test counts (2,555 backend + 129 frontend).
- local-dev-2.sh: fail-closed dev secret bootstrap (auto-generates
JWT_SECRET_KEY / TWO_FACTOR_PEPPER into the gitignored .env), kills stale
backends holding :8080 before the tmux reset, passes
RUSTFS_ENDPOINT/GO_TESTING=1 to the dev backend, and backdates seeded patch
tests 60 days so past gel bookings pass the 24h notice gate.
- Obsidian manuals (Technical/Admin/User/Feature Catalog/Overview/Gift Card
T&C/Privacy/T&C/Testing Architecture/payments and money processes + p14 plan
+ workspace state) updated to the post-round-2 state.
- Remove automatic deposits_required=3 on no-shows, give admin flexibility
- Add tests for no-show deposit logic (forgiven, over 24h, under 24h)
- Add tests for reservation cleanup TTL (admin walk-in/call-in 15min)
- Add tests for EXIF GPS data stripping in portfolio images
- Add tests for contact info endpoint
- Add tests for guest account anonymization
FIXES:
- Clarified that 1-hour minimum advance requirement applies to USER bookings only
- Admins can create walk-in bookings with no advance notice via AdminCreateBookingForUserHandler
- Updated test comments to reflect this distinction
NEW TESTS ADDED:
- TestAdminBookings_Create_WalkIn: Admin creates booking with < 1h notice (walk-in)
- TestAdminBookings_Create_WalkInWithDeposits: Admin walk-in with outstanding deposits + enforce_deposits=false
TEST SCENARIOS VERIFIED:
✓ User: Cannot book < 1h in advance (400 error)
✓ Admin: CAN book < 1h in advance (walk-in, 201 created)
✓ Admin: Can create walk-ins even with user deposits (with enforce_deposits bypass)
✓ Admin: Can bypass minimum advance requirement
BUILD STATUS:
✓ go build -tags test ./handlers/bookings
✓ go build -tags test ./handlers/admin
✓ go build -tags dev ./main.go
Documentation now clearly distinguishes:
- User journey: 1h minimum advance (universal)
- Admin journey: No minimum advance (accept walk-ins)
Backend:
- Enriched GetAllUserBookings response with calculated total_amount,
amount_paid, and duration_minutes.
- Refactored GetBookingHandler to return a flat booking object matching
frontend expectations.
- Added account_role to admin user list response and sorted users by
booking activity.
- Corrected function name oo to AdminCreateBookingForUserHandler.
Frontend:
- Rebuilt BookingCreateModal into a 4-step wizard supporting guest
bookings, service overrides, and real-time availability checks.
- Fixed account dashboard logic to correctly identify upcoming vs past
bookings and sort unpaid items to the top.
- Extracted booking flow into a shared BookingFlow component.
- Redirected admin users from home page to /today.
popertots
