From 4c85c170fb8764158b17836f4507368676c55c97 Mon Sep 17 00:00:00 2001
From: Omar <omarmorshedy@proton.me>
Date: Wed, 17 Jun 2026 18:23:16 +0100
Subject: [PATCH 1/3] fix: correct booking overlap detection query in getByDate

The previous query used '.where('ends', '<=', end)' which only returned
bookings ending on or before the end date. This missed bookings that end
after the end date but still overlap the requested range.

Changed to '.where('ends', '>', start)' so all bookings ending after the
start of the requested range are returned. The overlap check in the
bookings route then correctly filters them.
---
 api/model/bookingItems.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api/model/bookingItems.js b/api/model/bookingItems.js
index 63fbb75..15ddd27 100644
--- a/api/model/bookingItems.js
+++ b/api/model/bookingItems.js
@@ -63,7 +63,7 @@ class BookingItems extends ModelItemsBase {
       .join('resources', 'resources.id', '=', 'bookings.resource_id')
       .where('bookings.resource_id', '=', resourceId)
       .where('starts', '>=', start.toISOString())
-      .where('ends', '<=', end.toISOString())
+      .where('ends', '>', start.toISOString())
       .where('cancelled', '=', false);
     return query.then((bookings) => { return bookings; });
   }

From ff20c3027c6d9ae230a14cb87648b791551cfa71 Mon Sep 17 00:00:00 2001
From: Omar <omarmorshedy@proton.me>
Date: Wed, 17 Jun 2026 18:23:31 +0100
Subject: [PATCH 2/3] fix: correct admin slots create route to use correct API
 endpoint and redirect

The POST /admin/slots/create route was sending requests to
/api/resource-types instead of /api/slots, and redirecting to
/admin/resource-types instead of /admin/slots. Both have been
corrected to match the intended functionality.
---
 website/routes/admin/slots.js | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/website/routes/admin/slots.js b/website/routes/admin/slots.js
index bbe57e1..97fce7b 100644
--- a/website/routes/admin/slots.js
+++ b/website/routes/admin/slots.js
@@ -36,10 +36,13 @@ router.get('/slots/create', async function (req, res) {
 router.post('/slots/create', async function (req, res) {
   const name = req.body.name;
   try {
-    await axios.post(`${apiUrl}/resource-types`, {
-      name: name
+    await axios.post(`${apiUrl}/slots`, {
+      name: name,
+      day: parseInt(req.body.day),
+      starts: req.body.starts,
+      ends: req.body.ends
     });
-    res.redirect('/admin/resource-types');
+    res.redirect('/admin/slots');
   } catch (error) {
     console.log(error);
     res.render('error.html', {

From eca78b8717687a8cd26f31d14916bbe060c0fdb5 Mon Sep 17 00:00:00 2001
From: Omar <omarmorshedy@proton.me>
Date: Wed, 17 Jun 2026 18:23:43 +0100
Subject: [PATCH 3/3] fix: read session secret from environment variable
 instead of hardcoding

Moved the hardcoded session secret to an environment variable
(OPTIMISM_SESSION_SECRET) with the previous value as a fallback.
Hardcoded secrets in source code are a security risk.
---
 website/app.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/website/app.js b/website/app.js
index 52ceaee..00f5318 100644
--- a/website/app.js
+++ b/website/app.js
@@ -42,7 +42,7 @@ app.use(express.static(staticFilesRootDirectory));
 app.use(bodyParser.urlencoded({ extended: true }));
 app.use(express.json());
 app.use(session({
-  secret: 'b8268fa1-3b29-4885-80fc-e916b9949386',
+  secret: process.env.OPTIMISM_SESSION_SECRET || 'b8268fa1-3b29-4885-80fc-e916b9949386',
   resave: true,
   saveUninitialized: true
 }));