feat(catalog): add service and staff management end-to-end

Services and staff existed as schema + booking FK targets but had no
management surface. Adds full CRUD: repository (pgx + in-memory with
matching FK semantics), catalog service validation with tenant isolation,
MaxStaff entitlement enforcement, protected API routes, OpenAPI schemas,
and dashboard screens for both entities.

Dashboard summary now resolves staff names on bookings and computes
setup completion from real configured state. Booking modal selects from
the tenant's actual services; blocked days can be scoped per staff member.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/catalog/service.go

@@ -18,6 +18,9 @@ var (
 	ErrBlockedDayNotFound = errors.New("blocked day not found")
 	ErrCustomerNotFound   = errors.New("customer not found")
 	ErrBookingNotFound    = errors.New("booking not found")
+	ErrServiceNotFound    = errors.New("service not found")
+	ErrStaffNotFound      = errors.New("staff member not found")
+	ErrInvalidInput       = errors.New("invalid request")
 	ErrInvalidBooking     = errors.New("invalid booking request")
 	ErrBookingConflict    = errors.New("booking conflicts with an existing reservation")
 	ErrTenantNotFound     = errors.New("tenant not found")
@@ -183,6 +186,310 @@ func (s *Service) DeleteLocation(ctx context.Context, principal domain.Principal
 	return s.repo.DeleteLocation(ctx, locationID)
 }
 
+// ============================================
+// SERVICE CATALOG MANAGEMENT
+// ============================================
+
+func serviceToDomain(rec db.ServiceRecord) domain.Service {
+	return domain.Service{
+		ID:                  rec.ID,
+		TenantID:            rec.TenantID,
+		Name:                rec.Name,
+		DurationMinutes:     rec.DurationMinutes,
+		BufferBeforeMinutes: rec.BufferBeforeMinutes,
+		BufferAfterMinutes:  rec.BufferAfterMinutes,
+		PriceCents:          rec.PriceCents,
+		CreatedAt:           rec.CreatedAt,
+	}
+}
+
+func validateServiceValues(name string, duration, bufferBefore, bufferAfter, priceCents int) error {
+	if trimmed := len(strings.TrimSpace(name)); trimmed < 1 || trimmed > 120 {
+		return fmt.Errorf("%w: name must be between 1 and 120 characters", ErrInvalidInput)
+	}
+	if duration <= 0 || duration > 24*60 {
+		return fmt.Errorf("%w: durationMinutes must be between 1 and 1440", ErrInvalidInput)
+	}
+	if bufferBefore < 0 || bufferBefore > 480 {
+		return fmt.Errorf("%w: bufferBeforeMinutes must be between 0 and 480", ErrInvalidInput)
+	}
+	if bufferAfter < 0 || bufferAfter > 480 {
+		return fmt.Errorf("%w: bufferAfterMinutes must be between 0 and 480", ErrInvalidInput)
+	}
+	if priceCents < 0 {
+		return fmt.Errorf("%w: priceCents cannot be negative", ErrInvalidInput)
+	}
+	return nil
+}
+
+func (s *Service) ListServices(ctx context.Context, principal domain.Principal) ([]domain.Service, error) {
+	membership, err := s.repo.GetTenantMembershipBySubject(ctx, principal.Subject)
+	if err != nil {
+		return nil, ErrTenantMembership
+	}
+
+	records, err := s.repo.ListServicesByTenant(ctx, membership.Tenant.ID)
+	if err != nil {
+		return nil, err
+	}
+
+	services := make([]domain.Service, len(records))
+	for i, rec := range records {
+		services[i] = serviceToDomain(rec)
+	}
+	return services, nil
+}
+
+func (s *Service) CreateService(ctx context.Context, principal domain.Principal, req domain.CreateServiceRequest) (domain.Service, error) {
+	membership, err := s.repo.GetTenantMembershipBySubject(ctx, principal.Subject)
+	if err != nil {
+		return domain.Service{}, ErrTenantMembership
+	}
+
+	name := strings.TrimSpace(req.Name)
+	if err := validateServiceValues(name, req.DurationMinutes, req.BufferBeforeMinutes, req.BufferAfterMinutes, req.PriceCents); err != nil {
+		return domain.Service{}, err
+	}
+
+	rec, err := s.repo.CreateService(ctx, db.CreateServiceParams{
+		TenantID:            membership.Tenant.ID,
+		Name:                name,
+		DurationMinutes:     req.DurationMinutes,
+		BufferBeforeMinutes: req.BufferBeforeMinutes,
+		BufferAfterMinutes:  req.BufferAfterMinutes,
+		PriceCents:          req.PriceCents,
+	})
+	if err != nil {
+		return domain.Service{}, err
+	}
+	return serviceToDomain(rec), nil
+}
+
+func (s *Service) UpdateService(ctx context.Context, principal domain.Principal, serviceID string, req domain.UpdateServiceRequest) (domain.Service, error) {
+	membership, err := s.repo.GetTenantMembershipBySubject(ctx, principal.Subject)
+	if err != nil {
+		return domain.Service{}, ErrTenantMembership
+	}
+
+	existing, err := s.repo.GetServiceByID(ctx, serviceID)
+	if err != nil || existing.TenantID != membership.Tenant.ID {
+		return domain.Service{}, ErrServiceNotFound
+	}
+
+	params := db.UpdateServiceParams{}
+	if req.Name != nil {
+		name := strings.TrimSpace(*req.Name)
+		params.Name = &name
+	}
+	if req.DurationMinutes != nil {
+		params.DurationMinutes = req.DurationMinutes
+	}
+	if req.BufferBeforeMinutes != nil {
+		params.BufferBeforeMinutes = req.BufferBeforeMinutes
+	}
+	if req.BufferAfterMinutes != nil {
+		params.BufferAfterMinutes = req.BufferAfterMinutes
+	}
+	if req.PriceCents != nil {
+		params.PriceCents = req.PriceCents
+	}
+
+	// Validate against the merged result so partial updates cannot produce an
+	// invalid record (e.g. setting duration to 0 while keeping the name).
+	merged := existing
+	if params.Name != nil {
+		merged.Name = *params.Name
+	}
+	if params.DurationMinutes != nil {
+		merged.DurationMinutes = *params.DurationMinutes
+	}
+	if params.BufferBeforeMinutes != nil {
+		merged.BufferBeforeMinutes = *params.BufferBeforeMinutes
+	}
+	if params.BufferAfterMinutes != nil {
+		merged.BufferAfterMinutes = *params.BufferAfterMinutes
+	}
+	if params.PriceCents != nil {
+		merged.PriceCents = *params.PriceCents
+	}
+	if err := validateServiceValues(merged.Name, merged.DurationMinutes, merged.BufferBeforeMinutes, merged.BufferAfterMinutes, merged.PriceCents); err != nil {
+		return domain.Service{}, err
+	}
+
+	rec, err := s.repo.UpdateService(ctx, serviceID, params)
+	if err != nil {
+		return domain.Service{}, err
+	}
+	return serviceToDomain(rec), nil
+}
+
+func (s *Service) DeleteService(ctx context.Context, principal domain.Principal, serviceID string) error {
+	membership, err := s.repo.GetTenantMembershipBySubject(ctx, principal.Subject)
+	if err != nil {
+		return ErrTenantMembership
+	}
+
+	existing, err := s.repo.GetServiceByID(ctx, serviceID)
+	if err != nil || existing.TenantID != membership.Tenant.ID {
+		return ErrServiceNotFound
+	}
+
+	return s.repo.DeleteService(ctx, serviceID)
+}
+
+// ============================================
+// STAFF MANAGEMENT
+// ============================================
+
+func staffToDomain(rec db.StaffRecord) domain.StaffMember {
+	return domain.StaffMember{
+		ID:          rec.ID,
+		TenantID:    rec.TenantID,
+		LocationID:  rec.LocationID,
+		DisplayName: rec.DisplayName,
+		Active:      rec.Active,
+		CreatedAt:   rec.CreatedAt,
+	}
+}
+
+func validateStaffName(name string) error {
+	if trimmed := len(strings.TrimSpace(name)); trimmed < 1 || trimmed > 120 {
+		return fmt.Errorf("%w: displayName must be between 1 and 120 characters", ErrInvalidInput)
+	}
+	return nil
+}
+
+// validateStaffLocation returns the normalized location reference: nil when the
+// input is empty, the id when it belongs to the tenant, or an error otherwise.
+func (s *Service) validateStaffLocation(ctx context.Context, tenantID string, locationID *string) (*string, error) {
+	if locationID == nil {
+		return nil, nil
+	}
+	trimmed := strings.TrimSpace(*locationID)
+	if trimmed == "" {
+		return nil, nil
+	}
+	loc, err := s.repo.GetLocationByID(ctx, trimmed)
+	if err != nil || loc.TenantID != tenantID {
+		return nil, fmt.Errorf("%w: locationId does not belong to this tenant", ErrInvalidInput)
+	}
+	return &trimmed, nil
+}
+
+func (s *Service) ListStaff(ctx context.Context, principal domain.Principal) ([]domain.StaffMember, error) {
+	membership, err := s.repo.GetTenantMembershipBySubject(ctx, principal.Subject)
+	if err != nil {
+		return nil, ErrTenantMembership
+	}
+
+	records, err := s.repo.ListStaffByTenant(ctx, membership.Tenant.ID)
+	if err != nil {
+		return nil, err
+	}
+
+	staff := make([]domain.StaffMember, len(records))
+	for i, rec := range records {
+		staff[i] = staffToDomain(rec)
+	}
+	return staff, nil
+}
+
+func (s *Service) CreateStaff(ctx context.Context, principal domain.Principal, req domain.CreateStaffRequest) (domain.StaffMember, error) {
+	membership, err := s.repo.GetTenantMembershipBySubject(ctx, principal.Subject)
+	if err != nil {
+		return domain.StaffMember{}, ErrTenantMembership
+	}
+
+	if s.billingService != nil {
+		entitlements, err := s.billingService.GetEntitlements(ctx, membership.Tenant.ID)
+		if err == nil && entitlements.MaxStaff >= 0 {
+			staff, err := s.repo.ListStaffByTenant(ctx, membership.Tenant.ID)
+			if err == nil && len(staff) >= entitlements.MaxStaff {
+				return domain.StaffMember{}, fmt.Errorf("%w: staff limit reached (%d/%d). Upgrade your plan to add more staff.", ErrPlanLimitReached, len(staff), entitlements.MaxStaff)
+			}
+		}
+	}
+
+	name := strings.TrimSpace(req.DisplayName)
+	if err := validateStaffName(name); err != nil {
+		return domain.StaffMember{}, err
+	}
+	locationID, err := s.validateStaffLocation(ctx, membership.Tenant.ID, req.LocationID)
+	if err != nil {
+		return domain.StaffMember{}, err
+	}
+
+	active := true
+	if req.Active != nil {
+		active = *req.Active
+	}
+
+	rec, err := s.repo.CreateStaff(ctx, db.CreateStaffParams{
+		TenantID:    membership.Tenant.ID,
+		LocationID:  locationID,
+		DisplayName: name,
+		Active:      active,
+	})
+	if err != nil {
+		return domain.StaffMember{}, err
+	}
+	return staffToDomain(rec), nil
+}
+
+func (s *Service) UpdateStaff(ctx context.Context, principal domain.Principal, staffID string, req domain.UpdateStaffRequest) (domain.StaffMember, error) {
+	membership, err := s.repo.GetTenantMembershipBySubject(ctx, principal.Subject)
+	if err != nil {
+		return domain.StaffMember{}, ErrTenantMembership
+	}
+
+	existing, err := s.repo.GetStaffByID(ctx, staffID)
+	if err != nil || existing.TenantID != membership.Tenant.ID {
+		return domain.StaffMember{}, ErrStaffNotFound
+	}
+
+	params := db.UpdateStaffParams{Active: req.Active}
+	if req.DisplayName != nil {
+		name := strings.TrimSpace(*req.DisplayName)
+		if err := validateStaffName(name); err != nil {
+			return domain.StaffMember{}, err
+		}
+		params.DisplayName = &name
+	}
+	if req.LocationID != nil {
+		locationID, err := s.validateStaffLocation(ctx, membership.Tenant.ID, req.LocationID)
+		if err != nil {
+			return domain.StaffMember{}, err
+		}
+		// Keep the tri-state: an explicit empty string must clear the value.
+		if locationID == nil {
+			empty := ""
+			params.LocationID = &empty
+		} else {
+			params.LocationID = locationID
+		}
+	}
+
+	rec, err := s.repo.UpdateStaff(ctx, staffID, params)
+	if err != nil {
+		return domain.StaffMember{}, err
+	}
+	return staffToDomain(rec), nil
+}
+
+func (s *Service) DeleteStaff(ctx context.Context, principal domain.Principal, staffID string) error {
+	membership, err := s.repo.GetTenantMembershipBySubject(ctx, principal.Subject)
+	if err != nil {
+		return ErrTenantMembership
+	}
+
+	existing, err := s.repo.GetStaffByID(ctx, staffID)
+	if err != nil || existing.TenantID != membership.Tenant.ID {
+		return ErrStaffNotFound
+	}
+
+	return s.repo.DeleteStaff(ctx, staffID)
+}
+
 // ============================================
 // BLOCKED DAYS MANAGEMENT
 // ============================================

apps/backend/internal/catalog/service_test.go

@@ -0,0 +1,261 @@
+package catalog
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"bookra/apps/backend/internal/db"
+	"bookra/apps/backend/internal/domain"
+)
+
+var owner = domain.Principal{Subject: "demo-owner", Email: "[email protected]", Role: "owner"}
+
+type stubBilling struct {
+	entitlements domain.PlanEntitlements
+}
+
+func (s stubBilling) GetEntitlements(_ context.Context, _ string) (domain.PlanEntitlements, error) {
+	return s.entitlements, nil
+}
+
+func newCatalogService(repo db.Repository) *Service {
+	return NewService(repo, stubBilling{entitlements: domain.PlanEntitlements{MaxStaff: -1}}, nil)
+}
+
+func TestListServicesReturnsSeededService(t *testing.T) {
+	repo := db.NewMemoryRepository()
+	svc := newCatalogService(repo)
+
+	services, err := svc.ListServices(context.Background(), owner)
+	if err != nil {
+		t.Fatalf("list services: %v", err)
+	}
+	if len(services) != 1 {
+		t.Fatalf("expected 1 seeded service, got %d", len(services))
+	}
+	if services[0].Name != "Signature treatment" {
+		t.Fatalf("unexpected service name %q", services[0].Name)
+	}
+}
+
+func TestServiceCRUDLifecycle(t *testing.T) {
+	repo := db.NewMemoryRepository()
+	svc := newCatalogService(repo)
+	ctx := context.Background()
+
+	created, err := svc.CreateService(ctx, owner, domain.CreateServiceRequest{
+		Name:                "  Haircut  ",
+		DurationMinutes:     45,
+		BufferBeforeMinutes: 5,
+		BufferAfterMinutes:  10,
+		PriceCents:          90000,
+	})
+	if err != nil {
+		t.Fatalf("create service: %v", err)
+	}
+	if created.Name != "Haircut" {
+		t.Fatalf("expected trimmed name, got %q", created.Name)
+	}
+	if created.TenantID == "" {
+		t.Fatal("expected tenant id on created service")
+	}
+
+	services, err := svc.ListServices(ctx, owner)
+	if err != nil {
+		t.Fatalf("list services: %v", err)
+	}
+	if len(services) != 2 {
+		t.Fatalf("expected 2 services, got %d", len(services))
+	}
+
+	zero := 0
+	if _, err := svc.UpdateService(ctx, owner, created.ID, domain.UpdateServiceRequest{DurationMinutes: &zero}); !errors.Is(err, ErrInvalidInput) {
+		t.Fatalf("expected ErrInvalidInput for zero duration, got %v", err)
+	}
+
+	name := "Deluxe haircut"
+	price := 110000
+	updated, err := svc.UpdateService(ctx, owner, created.ID, domain.UpdateServiceRequest{Name: &name, PriceCents: &price})
+	if err != nil {
+		t.Fatalf("update service: %v", err)
+	}
+	if updated.Name != "Deluxe haircut" || updated.PriceCents != 110000 {
+		t.Fatalf("unexpected update result %+v", updated)
+	}
+	if updated.DurationMinutes != 45 || updated.BufferAfterMinutes != 10 {
+		t.Fatalf("partial update clobbered untouched fields %+v", updated)
+	}
+
+	if err := svc.DeleteService(ctx, owner, created.ID); err != nil {
+		t.Fatalf("delete service: %v", err)
+	}
+	services, err = svc.ListServices(ctx, owner)
+	if err != nil {
+		t.Fatalf("list services: %v", err)
+	}
+	if len(services) != 1 {
+		t.Fatalf("expected 1 service after delete, got %d", len(services))
+	}
+}
+
+func TestServiceValidation(t *testing.T) {
+	repo := db.NewMemoryRepository()
+	svc := newCatalogService(repo)
+	ctx := context.Background()
+
+	cases := []struct {
+		name string
+		req  domain.CreateServiceRequest
+	}{
+		{"empty name", domain.CreateServiceRequest{Name: "   ", DurationMinutes: 30}},
+		{"zero duration", domain.CreateServiceRequest{Name: "Cut", DurationMinutes: 0}},
+		{"huge duration", domain.CreateServiceRequest{Name: "Cut", DurationMinutes: 2000}},
+		{"negative buffer", domain.CreateServiceRequest{Name: "Cut", DurationMinutes: 30, BufferBeforeMinutes: -1}},
+		{"negative price", domain.CreateServiceRequest{Name: "Cut", DurationMinutes: 30, PriceCents: -5}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if _, err := svc.CreateService(ctx, owner, tc.req); !errors.Is(err, ErrInvalidInput) {
+				t.Fatalf("expected ErrInvalidInput, got %v", err)
+			}
+		})
+	}
+}
+
+func TestServiceNotFoundAndMembership(t *testing.T) {
+	repo := db.NewMemoryRepository()
+	svc := newCatalogService(repo)
+	ctx := context.Background()
+
+	missingID := "00000000-0000-0000-0000-000000000001"
+	if _, err := svc.UpdateService(ctx, owner, missingID, domain.UpdateServiceRequest{}); !errors.Is(err, ErrServiceNotFound) {
+		t.Fatalf("expected ErrServiceNotFound, got %v", err)
+	}
+	if err := svc.DeleteService(ctx, owner, missingID); !errors.Is(err, ErrServiceNotFound) {
+		t.Fatalf("expected ErrServiceNotFound, got %v", err)
+	}
+
+	stranger := domain.Principal{Subject: "someone-else", Role: "owner"}
+	if _, err := svc.ListServices(ctx, stranger); !errors.Is(err, ErrTenantMembership) {
+		t.Fatalf("expected ErrTenantMembership, got %v", err)
+	}
+	if _, err := svc.CreateService(ctx, stranger, domain.CreateServiceRequest{Name: "Cut", DurationMinutes: 30}); !errors.Is(err, ErrTenantMembership) {
+		t.Fatalf("expected ErrTenantMembership, got %v", err)
+	}
+}
+
+func TestStaffCRUDLifecycle(t *testing.T) {
+	repo := db.NewMemoryRepository()
+	svc := newCatalogService(repo)
+	ctx := context.Background()
+
+	locations, err := svc.ListLocations(ctx, owner)
+	if err != nil || len(locations) == 0 {
+		t.Fatalf("expected seeded location, got %v err=%v", locations, err)
+	}
+	locationID := locations[0].ID
+
+	created, err := svc.CreateStaff(ctx, owner, domain.CreateStaffRequest{
+		DisplayName: "  Anna Novak  ",
+		LocationID:  &locationID,
+	})
+	if err != nil {
+		t.Fatalf("create staff: %v", err)
+	}
+	if created.DisplayName != "Anna Novak" {
+		t.Fatalf("expected trimmed name, got %q", created.DisplayName)
+	}
+	if !created.Active {
+		t.Fatal("new staff member should default to active")
+	}
+	if created.LocationID == nil || *created.LocationID != locationID {
+		t.Fatalf("expected location assignment %s, got %+v", locationID, created.LocationID)
+	}
+
+	staff, err := svc.ListStaff(ctx, owner)
+	if err != nil {
+		t.Fatalf("list staff: %v", err)
+	}
+	if len(staff) != 2 {
+		t.Fatalf("expected seeded member + new member, got %d", len(staff))
+	}
+
+	inactive := false
+	cleared := ""
+	updated, err := svc.UpdateStaff(ctx, owner, created.ID, domain.UpdateStaffRequest{
+		Active:     &inactive,
+		LocationID: &cleared,
+	})
+	if err != nil {
+		t.Fatalf("update staff: %v", err)
+	}
+	if updated.Active {
+		t.Fatal("expected staff member to be deactivated")
+	}
+	if updated.LocationID != nil {
+		t.Fatalf("expected cleared location, got %+v", updated.LocationID)
+	}
+	if updated.DisplayName != "Anna Novak" {
+		t.Fatalf("name should be untouched, got %q", updated.DisplayName)
+	}
+
+	if err := svc.DeleteStaff(ctx, owner, created.ID); err != nil {
+		t.Fatalf("delete staff: %v", err)
+	}
+	staff, err = svc.ListStaff(ctx, owner)
+	if err != nil {
+		t.Fatalf("list staff: %v", err)
+	}
+	if len(staff) != 1 {
+		t.Fatalf("expected 1 staff member after delete, got %d", len(staff))
+	}
+}
+
+func TestCreateStaffEnforcesPlanLimit(t *testing.T) {
+	repo := db.NewMemoryRepository()
+	// Demo tenant seeds one member; a limit of 1 must reject a second.
+	svc := NewService(repo, stubBilling{entitlements: domain.PlanEntitlements{MaxStaff: 1}}, nil)
+
+	_, err := svc.CreateStaff(context.Background(), owner, domain.CreateStaffRequest{DisplayName: "Second"})
+	if !errors.Is(err, ErrPlanLimitReached) {
+		t.Fatalf("expected ErrPlanLimitReached, got %v", err)
+	}
+}
+
+func TestCreateStaffRejectsForeignLocation(t *testing.T) {
+	repo := db.NewMemoryRepository()
+	svc := newCatalogService(repo)
+
+	foreign := "00000000-0000-0000-0000-000000000099"
+	_, err := svc.CreateStaff(context.Background(), owner, domain.CreateStaffRequest{
+		DisplayName: "Anna",
+		LocationID:  &foreign,
+	})
+	if !errors.Is(err, ErrInvalidInput) {
+		t.Fatalf("expected ErrInvalidInput, got %v", err)
+	}
+}
+
+func TestStaffNotFoundAndValidation(t *testing.T) {
+	repo := db.NewMemoryRepository()
+	svc := newCatalogService(repo)
+	ctx := context.Background()
+
+	if _, err := svc.CreateStaff(ctx, owner, domain.CreateStaffRequest{DisplayName: "  "}); !errors.Is(err, ErrInvalidInput) {
+		t.Fatalf("expected ErrInvalidInput for blank name, got %v", err)
+	}
+
+	missingID := "00000000-0000-0000-0000-000000000001"
+	if _, err := svc.UpdateStaff(ctx, owner, missingID, domain.UpdateStaffRequest{}); !errors.Is(err, ErrStaffNotFound) {
+		t.Fatalf("expected ErrStaffNotFound, got %v", err)
+	}
+	if err := svc.DeleteStaff(ctx, owner, missingID); !errors.Is(err, ErrStaffNotFound) {
+		t.Fatalf("expected ErrStaffNotFound, got %v", err)
+	}
+
+	stranger := domain.Principal{Subject: "someone-else", Role: "staff"}
+	if _, err := svc.ListStaff(ctx, stranger); !errors.Is(err, ErrTenantMembership) {
+		t.Fatalf("expected ErrTenantMembership, got %v", err)
+	}
+}