Phase 4

Seed data extended with a second barber (different hours/services), a beard-trim service + category, breaks, time off, a guest customer, and appointments in all three key states — verified against a live throwaway Postgres.
14 new integration tests (38 total with Phase 3's) covering guest/authenticated booking, any-barber assignment, slot-conflict handling, ownership enforcement, guest-data isolation, and book-again repricing.
Playwright E2E suite for the 6 required customer journeys, with its own global-setup.ts that migrates and seeds a database automatically.
Full verification pass, which caught and fixed three real bugs along the way (not just test-workarounds):
A date off-by-one bug in the calendar picker that made real weekdays show as closed for anyone in a UTC+ timezone (including the business's own).
A dialog that could vanish mid-confirmation on cancellation, before the customer could read the late-cancellation notice.
A silent test-cleanup leak in the Phase 3 fixtures that had been leaking stray businesses since Phase 3.
Plus a baseline desktop-responsive fix (centered max-w-2xl columns) across Home/Appointments/Settings/booking flow, since desktop had been effectively unstyled.
Final state: 90 unit tests, 38 integration tests, and all 6 E2E journeys passing together on a fresh database; clean tsc, eslint, and next build. Full writeup with routes, security model, guest-matching rules, known limitations, and what to check before Phase 5 is in docs/phase-4-summary.md.

src/features/booking/actions/customer-appointments.ts

@@ -0,0 +1,87 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { auth } from "@/auth";
+import { prisma } from "@/lib/db/prisma";
+import { getAppointmentById } from "@/services/scheduling/appointment.service";
+import { cancelBooking, rescheduleBooking } from "@/services/scheduling/booking.service";
+import { assertCanAccessAppointment, PermissionDeniedError } from "../authorization";
+import { getFirstFriendlyMessage } from "../error-messages";
+import { customerCancelSchema, customerRescheduleSchema } from "../schemas";
+
+/**
+ * Every mutation here re-checks ownership against the current session
+ * before touching anything — never trusts that "the client only shows
+ * this button for your own appointments" is actually true, since the
+ * action can be called directly regardless of what the UI renders.
+ */
+
+export interface CustomerAppointmentActionResult {
+  success: boolean;
+  error?: string;
+  wasLateCancellation?: boolean;
+}
+
+export async function cancelCustomerAppointmentAction(input: unknown): Promise<CustomerAppointmentActionResult> {
+  const parsed = customerCancelSchema.safeParse(input);
+  if (!parsed.success) return { success: false, error: "Please try again." };
+
+  const appointment = await getAppointmentById(prisma, parsed.data.appointmentId);
+  if (!appointment) return { success: false, error: "We couldn't find that appointment." };
+
+  const session = await auth();
+  try {
+    assertCanAccessAppointment(appointment, session?.user?.id);
+  } catch (error) {
+    if (error instanceof PermissionDeniedError) return { success: false, error: error.message };
+    throw error;
+  }
+
+  const result = await cancelBooking(prisma, {
+    appointmentId: parsed.data.appointmentId,
+    cancelledByUserId: session?.user?.id,
+    reason: parsed.data.reason,
+  });
+
+  if (!result.success) {
+    return { success: false, error: getFirstFriendlyMessage(result.validation) };
+  }
+
+  // Deliberately not revalidating here (unlike reschedule) — every affected
+  // page is already `dynamic = "force-dynamic"`, so revalidatePath buys no
+  // extra freshness, and doing it immediately would drop the cancelled
+  // appointment out of the Upcoming list mid-render, unmounting this very
+  // dialog before the customer can read the late-cancellation notice or
+  // click "Done". The dialog's own onClose already calls router.refresh().
+  return { success: true, wasLateCancellation: result.wasLateCancellation };
+}
+
+export async function rescheduleCustomerAppointmentAction(input: unknown): Promise<CustomerAppointmentActionResult> {
+  const parsed = customerRescheduleSchema.safeParse(input);
+  if (!parsed.success) return { success: false, error: "Please choose a valid time." };
+
+  const appointment = await getAppointmentById(prisma, parsed.data.appointmentId);
+  if (!appointment) return { success: false, error: "We couldn't find that appointment." };
+
+  const session = await auth();
+  try {
+    assertCanAccessAppointment(appointment, session?.user?.id);
+  } catch (error) {
+    if (error instanceof PermissionDeniedError) return { success: false, error: error.message };
+    throw error;
+  }
+
+  const result = await rescheduleBooking(prisma, {
+    appointmentId: parsed.data.appointmentId,
+    staffId: parsed.data.staffId,
+    startAt: new Date(parsed.data.startAt),
+  });
+
+  if (!result.success) {
+    return { success: false, error: getFirstFriendlyMessage(result.validation) };
+  }
+
+  revalidatePath("/appointments");
+  revalidatePath(`/appointments/${parsed.data.appointmentId}`);
+  return { success: true };
+}