From f47320dd8a236750442a60cb32829b04e99eb8df Mon Sep 17 00:00:00 2001
From: Hendrik Belitz <hendrik@innovation-through-understanding.de>
Date: Mon, 11 May 2026 11:17:51 +0200
Subject: [PATCH] Fix schedule endpoint so it only returns public channels

---
 .../api/tenants/[id]/calendar/+server.ts      |  4 +--
 .../api/tenants/[id]/schedule/+server.ts      | 36 ++++++++++---------
 2 files changed, 21 insertions(+), 19 deletions(-)

diff --git a/src/routes/api/tenants/[id]/calendar/+server.ts b/src/routes/api/tenants/[id]/calendar/+server.ts
index 6bb9169..c748967 100644
--- a/src/routes/api/tenants/[id]/calendar/+server.ts
+++ b/src/routes/api/tenants/[id]/calendar/+server.ts
@@ -10,8 +10,8 @@ import { checkPermission } from "$lib/server/utils/permissions";
 registerOpenAPIRoute("/tenants/{id}/calendar", "GET", {
   summary: "Get tenant calendar",
   description:
-    "Retrieves the appointment calendar for a specific tenant within a date range. Shows available time slots, existing appointments, and agent availability. This is a public endpoint that doesn't require authentication.",
-  tags: ["Calendar", "Public"],
+    "Retrieves the appointment calendar for a specific tenant within a date range. Shows available time slots, existing appointments, and agent availability. This is a private endpoint that requires authentication.",
+  tags: ["Calendar", "Private"],
   parameters: [
     {
       name: "id",
diff --git a/src/routes/api/tenants/[id]/schedule/+server.ts b/src/routes/api/tenants/[id]/schedule/+server.ts
index 1cb1564..98cae39 100644
--- a/src/routes/api/tenants/[id]/schedule/+server.ts
+++ b/src/routes/api/tenants/[id]/schedule/+server.ts
@@ -187,24 +187,26 @@ export const GET: RequestHandler = async ({ params, url }) => {
     const clientSchedule = schedule.schedule.map((daySchedule) => ({
       date: daySchedule.date,
       channels: Object.fromEntries(
-        Object.entries(daySchedule.channels).map(([channelId, channelData]) => [
-          channelId,
-          {
-            channel: {
-              id: channelData.channel.id,
-              names: channelData.channel.names,
-              descriptions: channelData.channel.descriptions,
-              requiresConfirmation: channelData.channel.requiresConfirmation,
-              pause: channelData.channel.pause,
+        Object.entries(daySchedule.channels)
+          .filter(([_, channelData]) => channelData.channel.isPublic)
+          .map(([channelId, channelData]) => [
+            channelId,
+            {
+              channel: {
+                id: channelData.channel.id,
+                names: channelData.channel.names,
+                descriptions: channelData.channel.descriptions,
+                requiresConfirmation: channelData.channel.requiresConfirmation,
+                pause: channelData.channel.pause,
+              },
+              availableSlots: channelData.availableSlots.map((slot) => ({
+                from: slot.from,
+                to: slot.to,
+                duration: slot.duration,
+                availableAgents: slot.availableAgents,
+              })),
             },
-            availableSlots: channelData.availableSlots.map((slot) => ({
-              from: slot.from,
-              to: slot.to,
-              duration: slot.duration,
-              availableAgents: slot.availableAgents,
-            })),
-          },
-        ]),
+          ]),
       ),
     }));