Area locks touching a date
/api/locksEvery lock overlapping one UTC calendar day, whatever tier it names. A lock running 22:00 into tomorrow's 02:00 is returned for both days; a host looking at either one needs to see it.
The overlap test is the same half-open comparison the allocator applies to instants and the public booking routes apply in SQL, so this screen and the booking page can never disagree about whether a lock covers a day.
Authorization
sessionCookie The dashboard's Supabase Auth session cookie, set at sign-in. Large sessions are split across
numbered chunks (…auth-token.0, .1), so treat this as a cookie family rather than one name.
Every request re-validates it against the Auth server (getUser()), never by decoding the cookie
locally: a JWT nothing has checked is not a credential. Tenancy is then read from the verified
app_metadata.company_id claim and enforced by row-level security; it is never read from request
input, on any route, ever.
role (admin / staff) is deliberately not in RLS. It gates specific actions in route code,
the operations marked admin below, so hiding a button in the UI is cosmetic only, and a route's
own check is the enforcement.
In: cookie
Query Parameters
UTC calendar date, YYYY-MM-DD.
^\d{4}-\d{2}-\d{2}$Response Body
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/api/locks?date=string"{ "locks": [ { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "levelId": "a70368c7-b12e-43a9-9830-ab2485710b95", "areaId": "ebbb2a49-d827-4796-8d8a-108c229835e9", "tableId": "073fbfcb-cd05-4203-be18-a1ce6f8e4d2d", "startsAt": "2019-08-24T14:15:22Z", "endsAt": "2019-08-24T14:15:22Z", "reason": "string" } ]}Remove an adjacency edge DELETE
Deletes one book_table_link_adjacencies row. Both tables and their group are untouched: this only withdraws staff's claim that the two tables sit next to each other, the same way removing a furniture-set combo withdraws a combining permission without touching the pieces it named.
Lock a floor, room or table POST
Holds part of the room back from booking; a private function on the mezzanine, a table kept for the owner's guests; without shutting the venue. **This is not a closure.** A `book_blocked_periods` row with no provider (0011) takes the WHOLE venue off sale; this takes one floor, room or table. Migration 0047 keeps them in separate tables deliberately: a lock necessarily has no provider, so had it been a fourth nullable column on `book_blocked_periods`, the four public routes that spell "fetch the venue closures" as `provider_id is null` would have started shutting the venue over one held two-top. **Enforced, not decorative.** Locks reach the allocator as occupancy, so all four public reservation paths honour them: the availability grid, the checkout POST, the table picker and guest self-service reschedule. A date left with nothing bookable by locks alone reports `reason: "locked"` on the availability endpoint and is **never** offered a waitlist, no cancellation frees a table the venue deliberately held back. Staff, not admin, matching every sibling in this hierarchy. Deleting is the admin half.