Phase 4

Seed data extended with a second barber (different hours/services), a beard-trim service + category, breaks, time off, a guest customer, and appointments in all three key states — verified against a live throwaway Postgres.
14 new integration tests (38 total with Phase 3's) covering guest/authenticated booking, any-barber assignment, slot-conflict handling, ownership enforcement, guest-data isolation, and book-again repricing.
Playwright E2E suite for the 6 required customer journeys, with its own global-setup.ts that migrates and seeds a database automatically.
Full verification pass, which caught and fixed three real bugs along the way (not just test-workarounds):
A date off-by-one bug in the calendar picker that made real weekdays show as closed for anyone in a UTC+ timezone (including the business's own).
A dialog that could vanish mid-confirmation on cancellation, before the customer could read the late-cancellation notice.
A silent test-cleanup leak in the Phase 3 fixtures that had been leaking stray businesses since Phase 3.
Plus a baseline desktop-responsive fix (centered max-w-2xl columns) across Home/Appointments/Settings/booking flow, since desktop had been effectively unstyled.
Final state: 90 unit tests, 38 integration tests, and all 6 E2E journeys passing together on a fresh database; clean tsc, eslint, and next build. Full writeup with routes, security model, guest-matching rules, known limitations, and what to check before Phase 5 is in docs/phase-4-summary.md.

src/lib/calendar/__tests__/ics.test.ts

@@ -0,0 +1,94 @@
+import { describe, expect, it } from "vitest";
+import { generateAppointmentIcs } from "../ics";
+
+const BASE_INPUT = {
+  appointmentId: "appt_123",
+  businessName: "Blake Heritage Barbershop",
+  businessAddress: "79 Joel Street, HA6 1LW",
+  staffName: "Marcus Reed",
+  serviceNames: ["Haircut & Style"],
+  startAt: new Date("2026-08-10T09:00:00.000Z"),
+  endAt: new Date("2026-08-10T09:30:00.000Z"),
+};
+
+describe("generateAppointmentIcs", () => {
+  it("produces a well-formed VCALENDAR/VEVENT block", () => {
+    const ics = generateAppointmentIcs(BASE_INPUT);
+    expect(ics).toMatch(/^BEGIN:VCALENDAR\r\n/);
+    expect(ics).toContain("BEGIN:VEVENT\r\n");
+    expect(ics).toContain("END:VEVENT\r\n");
+    expect(ics.trimEnd()).toMatch(/END:VCALENDAR$/);
+  });
+
+  it("formats DTSTART/DTEND as UTC instants regardless of local time zone", () => {
+    const ics = generateAppointmentIcs(BASE_INPUT);
+    expect(ics).toContain("DTSTART:20260810T090000Z");
+    expect(ics).toContain("DTEND:20260810T093000Z");
+  });
+
+  it("includes a UID derived from the appointment id, stable across re-generation", () => {
+    const first = generateAppointmentIcs(BASE_INPUT);
+    const second = generateAppointmentIcs(BASE_INPUT);
+    const uidPattern = /UID:appt_123@nextchair/;
+    expect(first).toMatch(uidPattern);
+    expect(second).toMatch(uidPattern);
+  });
+
+  it("combines multiple service names in the summary and description", () => {
+    const ics = generateAppointmentIcs({ ...BASE_INPUT, serviceNames: ["Haircut & Style", "Beard Trim"] });
+    expect(ics).toContain("SUMMARY:Haircut & Style + Beard Trim at Blake Heritage Barbershop");
+    expect(ics).toContain("Services: Haircut & Style\\, Beard Trim");
+  });
+
+  it("escapes commas, semicolons, and backslashes per RFC 5545", () => {
+    const ics = generateAppointmentIcs({
+      ...BASE_INPUT,
+      businessName: "Sam's Cuts; Trims, & More\\Co",
+    });
+    // Escaped backslash first, then semicolon, then comma — order matters so
+    // the escaping backslashes themselves don't get re-escaped.
+    expect(ics).toContain("Sam's Cuts\\; Trims\\, & More\\\\Co");
+  });
+
+  it("escapes newlines in notes as literal \\n rather than breaking the content line", () => {
+    const ics = generateAppointmentIcs({ ...BASE_INPUT, notes: "Line one\nLine two" });
+    expect(ics).toContain("Line one\\nLine two");
+    // No raw, unescaped newline should appear inside the DESCRIPTION value itself.
+    const descriptionLine = ics.split("\r\n").find((l) => l.startsWith("DESCRIPTION"));
+    expect(descriptionLine).toBeDefined();
+  });
+
+  it("omits the Notes line entirely when there are no notes", () => {
+    const ics = generateAppointmentIcs(BASE_INPUT);
+    expect(ics).not.toContain("Notes:");
+  });
+
+  it("falls back to just the business name when no address is given", () => {
+    const ics = generateAppointmentIcs({ ...BASE_INPUT, businessAddress: undefined });
+    expect(ics).toContain("LOCATION:Blake Heritage Barbershop");
+  });
+
+  it("folds content lines longer than 75 octets per RFC 5545", () => {
+    const longNotes = "N".repeat(200);
+    const ics = generateAppointmentIcs({ ...BASE_INPUT, notes: longNotes });
+    const rawLines = ics.split("\r\n");
+    // No single physical line (before folding continuation) should exceed 75 octets.
+    for (const line of rawLines) {
+      expect(line.length).toBeLessThanOrEqual(75);
+    }
+    // Continuation lines start with a single space, per the spec.
+    const descriptionStart = rawLines.findIndex((l) => l.startsWith("DESCRIPTION"));
+    expect(rawLines[descriptionStart + 1]?.startsWith(" ")).toBe(true);
+  });
+
+  it("uses CRLF line endings throughout", () => {
+    const ics = generateAppointmentIcs(BASE_INPUT);
+    expect(ics.includes("\r\n")).toBe(true);
+    // Every bare \n should be immediately preceded by \r.
+    for (let i = 0; i < ics.length; i++) {
+      if (ics[i] === "\n") {
+        expect(ics[i - 1]).toBe("\r");
+      }
+    }
+  });
+});