Public booking-status endpoint for guests

padreug commented

2026-09-15 21:21:11 +00:00

Owner

GET /api/v1/bookings/{id} requires a wallet invoice key, so a guest can't read back their own booking over HTTP. The webapp's booking dialog (aiolabs/webapp feat/chatelet-booking) works around it by polling LNbits core's anonymous GET /api/v1/payments/{hash}, which only says "paid", not "confirmed".

Proposal: GET /api/v1/public/bookings/{id} returning status, room_id, check_in, check_out, nights, deposit_sat and expires_at — no guest_contact or pubkey. The booking id is a 10-char short hash the guest received in the quote, which is the same trust level as the RPC door's chatelet_booking_get (there the sender_pubkey scopes it; over HTTP the id itself is the capability).

When it lands, the webapp swaps its poll target and can show hold-expired / declined states instead of inferring them.

GET /api/v1/bookings/{id} requires a wallet invoice key, so a guest can't read back their own booking over HTTP. The webapp's booking dialog (aiolabs/webapp feat/chatelet-booking) works around it by polling LNbits core's anonymous GET /api/v1/payments/{hash}, which only says "paid", not "confirmed". Proposal: GET /api/v1/public/bookings/{id} returning status, room_id, check_in, check_out, nights, deposit_sat and expires_at — no guest_contact or pubkey. The booking id is a 10-char short hash the guest received in the quote, which is the same trust level as the RPC door's chatelet_booking_get (there the sender_pubkey scopes it; over HTTP the id itself is the capability). When it lands, the webapp swaps its poll target and can show hold-expired / declined states instead of inferring them.

padreug referenced this issue from a commit

2026-09-15 21:43:24 +00:00

feat(api): keyless GET /api/v1/public/bookings/{id} for guests

padreug referenced this issue from a pull request that will close it,

2026-09-15 21:45:00 +00:00

feat(api): keyless public booking read-back for guests #19

padreug closed this issue

2026-09-15 21:51:50 +00:00

padreug referenced this issue from a commit

2026-09-15 21:53:19 +00:00

chore(release): v0.4.0