Sell a package to a customer
/api/customer-packagesSnapshots name/price/sessions off the CURRENT book_packages row onto a new book_customer_packages row: v1's only sale path (BeNotely also sells from "New sale" and at close-out; both are follow-ups, see migration 20260917130000's own header). Service-role, not the RLS-scoped client: book_customer_packages has no INSERT grant for authenticated at all. No manage_services gate; selling an existing catalog item to a customer is the same everyday action a walk-in sale or a close-out payment already is.
Authorization
sessionCookie The dashboard's Supabase Auth session cookie, set at sign-in. Large sessions are split across
numbered chunks (…auth-token.0, .1), so treat this as a cookie family rather than one name.
Every request re-validates it against the Auth server (getUser()), never by decoding the cookie
locally: a JWT nothing has checked is not a credential. Tenancy is then read from the verified
app_metadata.company_id claim and enforced by row-level security; it is never read from request
input, on any route, ever.
role (admin / staff) is deliberately not in RLS. It gates specific actions in route code,
the operations marked admin below, so hiding a button in the UI is cosmetic only, and a route's
own check is the enforcement.
In: cookie
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/api/customer-packages" \ -H "Content-Type: application/json" \ -d '{ "customerId": "87d8e330-2878-4742-a86f-dbbb3bf522ac", "packageId": "471cc1d4-ec27-4504-b7c2-949af95662bc" }'{ "customerPackage": { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "name": "string", "sessionsTotal": 0, "sessionsRemaining": 0, "purchasedAt": "2019-08-24T14:15:22Z", "expiresAt": "2019-08-24T14:15:22Z" }}Update a package, or activate/deactivate it PATCH
Two shapes in one route, same posture PATCH /api/products/{id} takes. A body of exactly `{"active": true|false}` sets the flag and returns immediately. Any other body is a full replacement of the catalog fields (parsePackageInput's contract) followed by a delete-then-reinsert of book_package_services. RLS scopes the update, so an id from another org matches zero rows and returns 404. **Appointments only**, see POST /api/packages.
Apply, or manually correct, a customer package's sessions POST
Calls book_package_redeem() (migration 20260917130000), which atomically applies `delta` to sessions_remaining and records a book_package_redemptions ledger row in the same statement, the same shape book_gift_card_redeem() takes. `delta` is negative for an ordinary "use a session" (reason `visit`) and positive for a manual correction (reason `manual_adjustment`, e.g. undoing a mistaken use). Same permission bar as gift-card redemption: any signed-in staff member, no `manage_services` gate.