Selectable booking duration per meeting type

[asm0dey]

A meeting type could only ever be booked at one length, so an owner running 30-, 60- and 120-minute sessions kept three near-duplicate types. It now carries a set of allowed lengths, each with optional per-duration buffers, and the invitee picks one above the slot grid.

Closes #119.

What changed

• meeting_type_duration (V29, DDL only) holds the extra lengths. The type's own duration_minutes is an implicit member of the set — read as a union — so a set omitting the default is not expressible, there is no backfill, and no reject-at-save path exists anywhere (ADR-0003).
• Start times sit on one lattice anchored to the shortest allowed length, so switching length never moves the times on offer; only the slot body varies.
• Buffers are per-duration. Where a host override and a duration override both apply, the larger of those actually set governs — a NULL is the absence of a requirement, not a floor at the type's buffer, so a host's deliberate 5 is never raised to the type's 10 (ADR-0002).
• The picker is plain links. ?duration=N above the grid, no JavaScript. A single-duration type renders an identical page to before.
• Reschedule preserves a booking's length rather than resetting it to the type's default, and emails print the booked length.

The owner's editor

A table of allowed durations on the meeting-type page, with a per-row before/after buffer.

• + Duration adds a row and × drops one, both client-side, so several lengths can be entered before saving. With JavaScript disabled the button does nothing — which is why the table always renders one spare blank row: that is the no-JS path, and it adds one length per save.
• A Default radio picks the length an invitee sees before choosing. It carries the row index rather than a duration, which is what lets a length typed into the blank spare be made default in the same save — at render time that row has no value for the server to match on.
• The default's × is disabled, not absent: the default is always a member of the set, so an empty cell would read as a broken column rather than a rule. Its title says which rule.
• An empty buffer box shows the meeting type's own buffer as a greyed placeholder, so a blank field displays the number it will actually inherit.

Three bugs fixed alongside

Rescheduling resized bookings. Both reschedule paths recomputed the end from type.durationMinutes. Latent until a type could offer a second length, then it silently shrank a 120-minute booking to 30.

Shared types across timezones offered nothing at all. Multi-host slot grids were anchored to midnight in each host's own timezone and then intersected by exact instant, so two hosts whose UTC offsets differed by a non-multiple of the cadence matched on nothing — London and Berlin on a 45-minute type, forever, behind an ordinary "no available times" message. Every host now shares one lattice defined by local time-of-day in the creator's clock (ADR-0008). The zone's rules are read at each instant rather than frozen at an origin date, which is what keeps a team wholly inside one timezone on the round times they already have — Asia/Kathmandu moved +05:30→+05:45 in 1986, and an epoch-anchored design would have shifted them 15 minutes for a problem they do not have.

A zero duration hung slot generation. Saving durationMinutes=0 returned 200 and persisted — the field had no min, the setter no validation, and meeting_type.duration_minutes no CHECK. The cadence falls back to the shortest allowed length, so a zero step meant neither slot loop could advance, and each iteration allocates: jstack showed the request thread parked in SlotService with GC at 93–98%, racing toward OOM while pinning the thread. Refused now at the input, at the setter, and in V30 — which repairs any existing non-positive row before adding the CHECK, so the constraint cannot fail validation and take an instance down at boot on someone else's data. SlotService also floors the step at 1 for rows written before the guard.

Upgrade

Nothing to do — no configuration, no manual data migration. Existing meeting types keep exactly the lengths and start times they have.

Two caveats worth knowing:

• A shared type whose hosts span timezones may now show start times at unround local minutes for some hosts (a Kathmandu co-host on a Berlin creator's 30-minute type reads :15/:45). Those are the only instants everyone can actually share, and previously the type offered none.
• V30 rewrites any meeting type whose duration_minutes is zero or negative to 30. Such a type is already broken — every render of its public page hangs — so this repairs it rather than failing the migration.

Verification

mvn test — 983 tests, 0 failures, 0 errors. spotless:check clean. The five SonarCloud findings this branch raised are cleared, including a cognitive-complexity refactor of generateRawSlots.

Exercised manually against quarkus:dev with curl, which runs no script at all — the honest test for the no-JS guarantee: a single-duration type renders no picker; ?duration=120 and ?duration=30 share an identical lattice prefix with the longer grid stopping earlier; ?duration=45 and ?duration=abc fall back to the default rather than erroring; a 120-minute booking made through plain HTML forms confirmed and rescheduled at 120. The editor's add/remove/default behaviour was driven in a real browser: two lengths added in one save, and a brand-new 90 made default in that same save with 60 surviving as an ordinary length.

Docs (changelog, meeting-type usage, and screenshots of the editor, the picker and a co-host's buffer) are on the docs-site branch, pushed separately.

Follow-ups filed

• calit-o89d — no page has any og:/twitter: meta, so a booking link unfurls as a bare URL. Its first task is a leak that exists today: the token-bearing manage pages need noindex and no preview.
• calit-xqle — heldOverlapping cannot use the GiST index the exclusion constraint already provides, so it scans every held booking an owner has ever had. Measurement first.
• calit-ntek — a 1-minute allowed duration silently drops the cadence to 1.
• calit-he09 — verify whether the working-hours grid really cannot add a frame without JavaScript.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MrnPiNwAQhe2RtmYTteNcj

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
91.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud