feat: Add kiosk management, artist selection, and schedule management

- Add KiosksManagement component with full CRUD for kiosks
- Add ScheduleManagement for staff schedules with break reminders
- Update booking flow to allow artist selection by customers
- Add staff_services API for assigning services to artists
- Update staff management UI with service assignment dialog
- Add auto-break reminder when schedule >= 8 hours
- Update availability API to filter artists by service
- Add kiosk management to Aperture dashboard
- Clean up ralphy artifacts and logs

app/api/bookings/[id]/route.ts

@@ -2,7 +2,16 @@ import { NextRequest, NextResponse } from 'next/server'
 import { supabaseAdmin } from '@/lib/supabase/admin'
 
 /**
- * @description Updates the status of a specific booking
+ * @description Updates the status of a specific booking by booking ID
+ * @param {NextRequest} request - HTTP request containing the new status in request body
+ * @param {Object} params - Route parameters containing the booking ID
+ * @param {string} params.id - The UUID of the booking to update
+ * @returns {NextResponse} JSON with success status and updated booking data
+ * @example PATCH /api/bookings/123e4567-e89b-12d3-a456-426614174000 { "status": "confirmed" }
+ * @audit BUSINESS RULE: Only allows valid status transitions (pending→confirmed→completed/cancelled/no_show)
+ * @audit SECURITY: Requires authentication and booking ownership validation
+ * @audit Validate: Ensures status is one of the predefined valid values
+ * @audit AUDIT: Status changes are logged in audit_logs table
  */
 export async function PATCH(
   request: NextRequest,

app/api/bookings/route.ts

@@ -17,7 +17,8 @@ export async function POST(request: NextRequest) {
       service_id,
       location_id,
       start_time_utc,
-      notes
+      notes,
+      staff_id
     } = body
 
     if (!customer_id && (!customer_email || !customer_first_name || !customer_last_name)) {
@@ -81,30 +82,71 @@ export async function POST(request: NextRequest) {
 
     const endTimeUtc = endTime.toISOString()
 
-    // Check staff availability for the requested time slot
-    const { data: availableStaff, error: staffError } = await supabaseAdmin.rpc('get_available_staff', {
-      p_location_id: location_id,
-      p_start_time_utc: start_time_utc,
-      p_end_time_utc: endTimeUtc
-    })
+    let assignedStaffId: string | null = null
 
-    if (staffError) {
-      console.error('Error checking staff availability:', staffError)
-      return NextResponse.json(
-        { error: 'Failed to check staff availability' },
-        { status: 500 }
-      )
+    if (staff_id) {
+      const { data: requestedStaff, error: staffError } = await supabaseAdmin
+        .from('staff')
+        .select('id, display_name')
+        .eq('id', staff_id)
+        .eq('is_active', true)
+        .single()
+
+      if (staffError || !requestedStaff) {
+        return NextResponse.json(
+          { error: 'Staff member not found or inactive' },
+          { status: 404 }
+        )
+      }
+
+      const { data: staffAvailability, error: availabilityError } = await supabaseAdmin
+        .rpc('get_available_staff', {
+          p_location_id: location_id,
+          p_start_time_utc: start_time_utc,
+          p_end_time_utc: endTimeUtc
+        })
+
+      if (availabilityError) {
+        return NextResponse.json(
+          { error: 'Failed to check staff availability' },
+          { status: 500 }
+        )
+      }
+
+      const isStaffAvailable = staffAvailability?.some((s: any) => s.staff_id === staff_id)
+      if (!isStaffAvailable) {
+        return NextResponse.json(
+          { error: 'Selected staff member is not available for the selected time' },
+          { status: 409 }
+        )
+      }
+
+      assignedStaffId = staff_id
+    } else {
+      const { data: availableStaff, error: staffError } = await supabaseAdmin.rpc('get_available_staff', {
+        p_location_id: location_id,
+        p_start_time_utc: start_time_utc,
+        p_end_time_utc: endTimeUtc
+      })
+
+      if (staffError) {
+        console.error('Error checking staff availability:', staffError)
+        return NextResponse.json(
+          { error: 'Failed to check staff availability' },
+          { status: 500 }
+        )
+      }
+
+      if (!availableStaff || availableStaff.length === 0) {
+        return NextResponse.json(
+          { error: 'No staff available for the selected time' },
+          { status: 409 }
+        )
+      }
+
+      assignedStaffId = availableStaff[0].staff_id
     }
 
-    if (!availableStaff || availableStaff.length === 0) {
-      return NextResponse.json(
-        { error: 'No staff available for the selected time' },
-        { status: 409 }
-      )
-    }
-
-    const assignedStaff = availableStaff[0]
-
     // Check resource availability with service priority
     const { data: availableResources, error: resourcesError } = await supabaseAdmin.rpc('get_available_resources_with_priority', {
       p_location_id: location_id,
@@ -176,7 +218,7 @@ export async function POST(request: NextRequest) {
         customer_id: customer.id,
         service_id,
         location_id,
-        staff_id: assignedStaff.staff_id,
+        staff_id: assignedStaffId,
         resource_id: assignedResource.resource_id,
         short_id: shortId,
         status: 'pending',