Phase 4

Seed data extended with a second barber (different hours/services), a beard-trim service + category, breaks, time off, a guest customer, and appointments in all three key states — verified against a live throwaway Postgres.
14 new integration tests (38 total with Phase 3's) covering guest/authenticated booking, any-barber assignment, slot-conflict handling, ownership enforcement, guest-data isolation, and book-again repricing.
Playwright E2E suite for the 6 required customer journeys, with its own global-setup.ts that migrates and seeds a database automatically.
Full verification pass, which caught and fixed three real bugs along the way (not just test-workarounds):
A date off-by-one bug in the calendar picker that made real weekdays show as closed for anyone in a UTC+ timezone (including the business's own).
A dialog that could vanish mid-confirmation on cancellation, before the customer could read the late-cancellation notice.
A silent test-cleanup leak in the Phase 3 fixtures that had been leaking stray businesses since Phase 3.
Plus a baseline desktop-responsive fix (centered max-w-2xl columns) across Home/Appointments/Settings/booking flow, since desktop had been effectively unstyled.
Final state: 90 unit tests, 38 integration tests, and all 6 E2E journeys passing together on a fresh database; clean tsc, eslint, and next build. Full writeup with routes, security model, guest-matching rules, known limitations, and what to check before Phase 5 is in docs/phase-4-summary.md.

src/features/booking/__tests__/authorization.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, it } from "vitest";
+import { PermissionDeniedError, assertCanAccessAppointment, canAccessAppointment } from "../authorization";
+
+describe("assertCanAccessAppointment", () => {
+  it("allows a registered customer to access their own appointment", () => {
+    expect(() =>
+      assertCanAccessAppointment({ customer: { userId: "user_1" } }, "user_1"),
+    ).not.toThrow();
+  });
+
+  it("denies a different signed-in user from accessing a registered customer's appointment", () => {
+    expect(() => assertCanAccessAppointment({ customer: { userId: "user_1" } }, "user_2")).toThrow(
+      PermissionDeniedError,
+    );
+  });
+
+  it("denies an unauthenticated caller from accessing a registered customer's appointment", () => {
+    expect(() => assertCanAccessAppointment({ customer: { userId: "user_1" } }, undefined)).toThrow(
+      PermissionDeniedError,
+    );
+  });
+
+  it("allows access to a guest appointment (no linked user) regardless of session — the documented guest access model", () => {
+    expect(() => assertCanAccessAppointment({ customer: { userId: null } }, undefined)).not.toThrow();
+    expect(() => assertCanAccessAppointment({ customer: { userId: null } }, "some_other_user")).not.toThrow();
+  });
+});
+
+describe("canAccessAppointment", () => {
+  it("mirrors assertCanAccessAppointment as a boolean", () => {
+    expect(canAccessAppointment({ customer: { userId: "user_1" } }, "user_1")).toBe(true);
+    expect(canAccessAppointment({ customer: { userId: "user_1" } }, "user_2")).toBe(false);
+    expect(canAccessAppointment({ customer: { userId: null } }, undefined)).toBe(true);
+  });
+});