Booking

About

A visitor picks a real time slot on the host site, the appointment appears in the Payload admin, both sides get email, either side can cancel, and the same slot can never be sold twice. The duplicate-prevention guarantee is enforced by a database uniqueness constraint on a lock key, not by application logic, and is verified on both PostgreSQL and MongoDB. The plugin registers four collections and one global: `appointments`, `booking-resources`, `booking-blackout-dates`, `booking-settings`. Public REST endpoints mount under `/api/booking` by default and cover availability, resources, form-token issuance, booking, and token-based cancellation, plus staff actions for cancelling an appointment and marking it completed or no-show. All time is computed server-side in the configured business timezone, so the browser only receives rendered labels and opaque ISO strings. Cancellations are signed magic links, not deletes, so the audit trail, slot release and customer email all run through one status-change path. Confirmations and cancellation notices go out through Payload's own email adapter, with optional per-event template overrides and ICS calendar attachments. The package logs every send attempt back onto the appointment record and warns loudly when no real adapter is configured. Spam protection runs in four layers: a hidden honeypot field, a signed time-trap token measured from page load, and per-IP and per-email caps, plus an optional `verifyChallenge` hook for providers like Cloudflare Turnstile. The host renders the exported `BookingForm` and `CancelView` React components on its own pages, or builds its own UI against the same endpoints. No prices, payments or deposits are included.

Package info

Package name

@ogutdgn/payload-booking

Latest version

0.1.2

Unpacked size

666 kB

License

MIT

Weekly downloads

21

Last publish

Sep 17, 2026