From 34fbc2f3de71873e15358a9fcc3aaefdb8225b29 Mon Sep 17 00:00:00 2001
From: Antoine Pelletier <antoine.pelletier@epfl.ch>
Date: Mon, 24 Aug 2026 13:02:01 +0200
Subject: [PATCH] feat: public calendar

---
 .cargo/config.toml                            |   12 +
 .gitignore                                    |    3 +-
 .../src/components/admin/ReservationCard.vue  |    4 +-
 .../{admin => reservation}/BikeCalendar.vue   |   40 +-
 .../reservation/ReservationDetails.vue        |   10 +-
 frontend/src/lib/api.d.ts                     | 1803 +++++++++--------
 frontend/src/locales/en.yml                   |   28 +-
 frontend/src/locales/fr.yml                   |   28 +-
 frontend/src/services/api/reservations.ts     |   19 +
 frontend/src/utils/types.ts                   |   10 +
 frontend/src/views/AdminView.vue              |    2 +-
 frontend/src/views/CalendarView.vue           |   26 +-
 src/api/reservations.rs                       |   37 +-
 src/core/controller/reservations.rs           |   24 +-
 src/core/models/reservation.rs                |   27 +
 15 files changed, 1135 insertions(+), 938 deletions(-)
 create mode 100644 .cargo/config.toml
 rename frontend/src/components/{admin => reservation}/BikeCalendar.vue (86%)

diff --git a/.cargo/config.toml b/.cargo/config.toml
new file mode 100644
index 0000000..39e7df8
--- /dev/null
+++ b/.cargo/config.toml
@@ -0,0 +1,12 @@
+# Development overrides for the app configuration. `cargo run` and `cargo test`
+# inject these into the process environment; the `config` crate reads them last,
+# so they win over `config.yml` without it having to be edited.
+#
+# The `cargagep` client exists on Hydra but has no matching redirect uri, so we
+# borrow the one registered for `trust`. Drop this file once `cargagep` is
+# properly registered and `config.yml` takes over again.
+#
+# `force = false`: a value given on the command line still takes precedence,
+#   APP__OIDC__CLIENT_ID=other cargo run
+[env]
+APP__OIDC__CLIENT_ID = { value = "trust", force = false }
diff --git a/.gitignore b/.gitignore
index d2ecd1b..e16256e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,5 @@
 /target
 config.yml
 config.yaml
-/LEGACY
\ No newline at end of file
+/LEGACY
+summary.ai
\ No newline at end of file
diff --git a/frontend/src/components/admin/ReservationCard.vue b/frontend/src/components/admin/ReservationCard.vue
index 1b16225..25e714e 100644
--- a/frontend/src/components/admin/ReservationCard.vue
+++ b/frontend/src/components/admin/ReservationCard.vue
@@ -24,7 +24,9 @@ const setStatus = useSetReservationStatus()
 /** Kept in step with the state machine drawn on the backend enum */
 const TRANSITIONS: Record<ReservationStatus, ReservationStatus[]> = {
   requested: ['approved', 'refused'],
-  approved: ['ongoing', 'cancelled'],
+  // No "start" here on purpose: a reservation becomes `ongoing` on its own, not
+  // by an admin pressing a button. The backend still allows the transition.
+  approved: ['cancelled'],
   ongoing: ['archived', 'cancelled'],
   refused: [],
   cancelled: [],
diff --git a/frontend/src/components/admin/BikeCalendar.vue b/frontend/src/components/reservation/BikeCalendar.vue
similarity index 86%
rename from frontend/src/components/admin/BikeCalendar.vue
rename to frontend/src/components/reservation/BikeCalendar.vue
index 17e19df..c0969d0 100644
--- a/frontend/src/components/admin/BikeCalendar.vue
+++ b/frontend/src/components/reservation/BikeCalendar.vue
@@ -21,15 +21,19 @@ import {
   DialogTitle,
 } from '@/components/ui/dialog'
 import { Badge } from '@/components/ui/badge'
-import { unitLabel, type Bike, type Reservation } from '@/utils/types'
+import { unitLabel, type Bike, type CalendarReservation } from '@/utils/types'
 
-const props = defineProps<{ reservations: Reservation[]; bikes: Bike[] }>()
+// Takes the narrow shape the public calendar receives; a full `Reservation`
+// satisfies it too, so the admin page keeps passing its own list unchanged.
+const props = defineProps<{ reservations: CalendarReservation[]; bikes: Bike[] }>()
 
 const { locale } = useI18n()
 
-const FIRST_HOUR = 7
-const LAST_HOUR = 20
-const HOUR_HEIGHT = 44
+// The whole day, 00:00 to 23:59. 24 rows at 44px would make the card very tall,
+// hence the shorter row.
+const FIRST_HOUR = 0
+const LAST_HOUR = 24
+const HOUR_HEIGHT = 32
 
 const weekStart = ref(startOfWeek(new Date()))
 const selectedBike = ref<string>('all')
@@ -140,18 +144,18 @@ function blocksFor(day: Date, bike: Bike): Block[] {
     <CardHeader class="gap-3">
       <div class="flex flex-wrap items-start justify-between gap-3">
         <div>
-          <CardTitle>{{ $t('admin.calendar.title') }}</CardTitle>
-          <CardDescription>{{ $t('admin.calendar.intro') }}</CardDescription>
+          <CardTitle>{{ $t('calendar.title') }}</CardTitle>
+          <CardDescription>{{ $t('calendar.intro') }}</CardDescription>
         </div>
 
         <div class="flex items-center gap-2">
-          <span class="text-muted-foreground text-sm">{{ $t('admin.calendar.bike') }}</span>
+          <span class="text-muted-foreground text-sm">{{ $t('calendar.bike') }}</span>
           <Select v-model="selectedBike">
             <SelectTrigger class="w-32">
               <SelectValue />
             </SelectTrigger>
             <SelectContent>
-              <SelectItem value="all">{{ $t('admin.calendar.all-bikes') }}</SelectItem>
+              <SelectItem value="all">{{ $t('calendar.all-bikes') }}</SelectItem>
               <SelectItem v-for="bike in bikes" :key="bike.id" :value="String(bike.id)">
                 {{ bike.name }}
               </SelectItem>
@@ -163,13 +167,13 @@ function blocksFor(day: Date, bike: Bike): Block[] {
       <div class="flex flex-wrap items-center gap-2">
         <Button variant="outline" size="sm" @click="shiftWeek(-1)">
           <ChevronLeft class="size-4" />
-          {{ $t('admin.calendar.previous') }}
+          {{ $t('calendar.previous') }}
         </Button>
         <Button variant="secondary" size="sm" @click="weekStart = startOfWeek(new Date())">
-          {{ $t('admin.calendar.today') }}
+          {{ $t('calendar.today') }}
         </Button>
         <Button variant="outline" size="sm" @click="shiftWeek(1)">
-          {{ $t('admin.calendar.next') }}
+          {{ $t('calendar.next') }}
           <ChevronRight class="size-4" />
         </Button>
         <span class="text-muted-foreground text-sm">{{ range }}</span>
@@ -178,7 +182,7 @@ function blocksFor(day: Date, bike: Bike): Block[] {
 
     <CardContent>
       <p v-if="!lanes.length" class="text-muted-foreground text-sm">
-        {{ $t('admin.calendar.no-bike') }}
+        {{ $t('calendar.no-bike') }}
       </p>
 
       <!-- The grid is wide: it scrolls on its own rather than the page -->
@@ -186,7 +190,7 @@ function blocksFor(day: Date, bike: Bike): Block[] {
         <div class="min-w-[52rem]">
           <div class="flex border-b">
             <div class="text-muted-foreground w-12 shrink-0 py-2 text-xs">
-              {{ $t('admin.calendar.hour') }}
+              {{ $t('calendar.hour') }}
             </div>
             <div
               v-for="day in days"
@@ -241,8 +245,8 @@ function blocksFor(day: Date, bike: Bike): Block[] {
                     type="button"
                     class="bg-primary hover:bg-primary/80 focus-visible:ring-ring absolute inset-x-0 rounded-sm transition-colors focus-visible:ring-2 focus-visible:outline-none"
                     :style="{ top: `${block.top}px`, height: `${block.height}px` }"
-                    :title="$t('admin.calendar.open', { id: block.id })"
-                    :aria-label="$t('admin.calendar.open', { id: block.id })"
+                    :title="$t('calendar.open', { id: block.id })"
+                    :aria-label="$t('calendar.open', { id: block.id })"
                     @click="opened = block.id"
                   />
                 </div>
@@ -252,13 +256,13 @@ function blocksFor(day: Date, bike: Bike): Block[] {
         </div>
       </div>
 
-      <p class="text-muted-foreground mt-3 text-xs">{{ $t('admin.calendar.legend') }}</p>
+      <p class="text-muted-foreground mt-3 text-xs">{{ $t('calendar.legend') }}</p>
 
       <Dialog v-model:open="dialogOpen">
         <DialogScrollContent v-if="openedReservation" class="sm:max-w-lg">
           <DialogHeader>
             <DialogTitle class="flex flex-wrap items-center gap-2">
-              {{ $t('admin.calendar.reservation', { id: openedReservation.id }) }}
+              {{ $t('calendar.reservation', { id: openedReservation.id }) }}
               <Badge variant="secondary">
                 {{ $t(`reservation.status.${openedReservation.status}`) }}
               </Badge>
diff --git a/frontend/src/components/reservation/ReservationDetails.vue b/frontend/src/components/reservation/ReservationDetails.vue
index 941f2b9..b50d143 100644
--- a/frontend/src/components/reservation/ReservationDetails.vue
+++ b/frontend/src/components/reservation/ReservationDetails.vue
@@ -6,13 +6,13 @@
 import { computed } from 'vue'
 import { useI18n } from 'vue-i18n'
 
-import type { Bike, Reservation } from '@/utils/types'
+import type { Bike, ReservationLike } from '@/utils/types'
 
 type Field = 'period' | 'bikes' | 'telegram' | 'people' | 'linka' | 'reason'
 
 const props = withDefaults(
   defineProps<{
-    reservation: Reservation
+    reservation: ReservationLike
     bikes: Bike[]
     /** Fields the caller renders itself — the edit dialog omits what it edits */
     omit?: Field[]
@@ -55,17 +55,17 @@ function format(iso: string) {
       <dt class="text-muted-foreground shrink-0">{{ $t('reservation.details.bikes') }}</dt>
       <dd>{{ bikeNames }}</dd>
     </div>
-    <div v-if="shows('telegram')" class="flex gap-2">
+    <div v-if="shows('telegram') && reservation.telegram" class="flex gap-2">
       <dt class="text-muted-foreground shrink-0">{{ $t('reservation.details.telegram') }}</dt>
       <dd class="truncate">{{ reservation.telegram }}</dd>
     </div>
-    <div v-if="shows('people')" class="flex gap-2">
+    <div v-if="shows('people') && reservation.users?.length" class="flex gap-2">
       <dt class="text-muted-foreground shrink-0">{{ $t('reservation.details.people') }}</dt>
       <dd class="min-w-0 break-words">
         {{ reservation.users.map((u) => `${u.firstname} ${u.name} <${u.email}>`).join(', ') }}
       </dd>
     </div>
-    <div v-if="shows('linka') && reservation.linka_emails.length" class="flex gap-2">
+    <div v-if="shows('linka') && reservation.linka_emails?.length" class="flex gap-2">
       <dt class="text-muted-foreground shrink-0">{{ $t('reservation.details.linka') }}</dt>
       <dd class="min-w-0 break-words">{{ reservation.linka_emails.join(', ') }}</dd>
     </div>
diff --git a/frontend/src/lib/api.d.ts b/frontend/src/lib/api.d.ts
index f7e9ce8..af4ace9 100644
--- a/frontend/src/lib/api.d.ts
+++ b/frontend/src/lib/api.d.ts
@@ -4,878 +4,937 @@
  */
 
 export interface paths {
-    "/api/version": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** Get app version */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": string;
-                    };
-                };
-            };
-        };
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/me": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * Get the logged in user
-         * @description Answers `null` when nobody is logged in.
-         */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["User"] | null;
-                    };
-                };
-            };
-        };
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/logout": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /** Log the user out */
-        post: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description no content */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description Unauthenticated - a session is required */
-                401: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/whiskey/authorize": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** Whiskey - Get the authorization url */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["GetAuthorizeResponse"];
-                    };
-                };
-                /** @description no content */
-                400: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-            };
-        };
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/whiskey/callback": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /** Whiskey - Complete the login */
-        post: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody: {
-                content: {
-                    "application/json": components["schemas"]["PostCallbackParams"];
-                };
-            };
-            responses: {
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["User"];
-                    };
-                };
-                /** @description no content */
-                400: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description no content */
-                403: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/login": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Log in as a dev user
-         * @description Debug builds only. Takes the email of one of the `dev_users` of the configuration, creates the row if needed, and opens a session.
-         */
-        post: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody: {
-                content: {
-                    "application/json": components["schemas"]["LoginDevForm"];
-                };
-            };
-            responses: {
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["User"];
-                    };
-                };
-                /** @description no content */
-                404: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/login/dev-users": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * List the dev users
-         * @description Debug builds only.
-         */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["DevUser"][];
-                    };
-                };
-            };
-        };
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/bikes": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** Get the fleet */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["Bike"][];
-                    };
-                };
-            };
-        };
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/bikes/{id}/status": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        /** Put a bike in or out of service */
-        put: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    id: number;
-                };
-                cookie?: never;
-            };
-            requestBody: {
-                content: {
-                    "application/json": components["schemas"]["SetStatusForm"];
-                };
-            };
-            responses: {
-                /** @description no content */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description Unauthenticated - a session is required */
-                401: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description Forbidden - the user must be an admin */
-                403: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description no content */
-                404: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-            };
-        };
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/reservations": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** Get every reservation */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["Reservation"][];
-                    };
-                };
-                /** @description Unauthenticated - a session is required */
-                401: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description Forbidden - the user must be an admin */
-                403: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-            };
-        };
-        put?: never;
-        /**
-         * File a reservation request
-         * @description The requester is the session user and the status starts at `requested`; neither is taken from the body.
-         */
-        post: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody: {
-                content: {
-                    "application/json": components["schemas"]["NewReservation"];
-                };
-            };
-            responses: {
-                /** @description The reservation, as stored */
-                201: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["Reservation"];
-                    };
-                };
-                /** @description The reservation is malformed */
-                400: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description Unauthenticated - a session is required */
-                401: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description The requester does not belong to the unit named */
-                403: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description One of the bikes is out of service */
-                409: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description The unit or one of the bikes does not exist */
-                422: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/reservations/mine": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * Get the reservations the session user is part of
-         * @description An address listed among the Linka Go accounts is enough, which is how somebody added before they ever logged in finds the reservation waiting for them.
-         */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["Reservation"][];
-                    };
-                };
-                /** @description Unauthenticated - a session is required */
-                401: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-            };
-        };
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/reservations/{id}": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        /**
-         * Edit the period, the bikes and the Linka Go accounts
-         * @description Everything else is left as stored. A manager may change all three until the reservation is final; anybody else on it may do so only while it is still a request, and afterwards only the Linka Go accounts.
-         */
-        put: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    id: number;
-                };
-                cookie?: never;
-            };
-            /**
-             * @description Only what the admin page lets somebody change. The unit, the requester, the
-             *      telegram handle and the reason are shown but not editable, so they are not
-             *      in the body at all: the handler reads them back from the stored reservation
-             *      rather than trusting a client to send them unchanged.
-             */
-            requestBody: {
-                content: {
-                    "application/json": components["schemas"]["ReservationEditForm"];
-                };
-            };
-            responses: {
-                /** @description no content */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description The reservation would become malformed */
-                400: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description Unauthenticated - a session is required */
-                401: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description The user is not on the reservation, or tried to change more than the Linka Go accounts on one that is already approved */
-                403: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description no content */
-                404: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description A newly added bike is out of service, or the reservation is final */
-                409: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description One of the bikes does not exist */
-                422: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-            };
-        };
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/reservations/{id}/status": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        /**
-         * Move a reservation through its state machine
-         * @description Refuses a transition the state machine does not allow, with a 409.
-         */
-        put: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    id: number;
-                };
-                cookie?: never;
-            };
-            requestBody: {
-                content: {
-                    "application/json": components["schemas"]["SetStatusForm2"];
-                };
-            };
-            responses: {
-                /** @description no content */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description Unauthenticated - a session is required */
-                401: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description Forbidden - the user must be part of the unit, or an admin when the reservation names no known unit */
-                403: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description no content */
-                404: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description no content */
-                409: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-            };
-        };
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
+  '/api/version': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    /** Get app version */
+    get: {
+      parameters: {
+        query?: never
+        header?: never
+        path?: never
+        cookie?: never
+      }
+      requestBody?: never
+      responses: {
+        200: {
+          headers: {
+            [name: string]: unknown
+          }
+          content: {
+            'application/json': string
+          }
+        }
+      }
+    }
+    put?: never
+    post?: never
+    delete?: never
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
+  '/api/me': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    /**
+     * Get the logged in user
+     * @description Answers `null` when nobody is logged in.
+     */
+    get: {
+      parameters: {
+        query?: never
+        header?: never
+        path?: never
+        cookie?: never
+      }
+      requestBody?: never
+      responses: {
+        200: {
+          headers: {
+            [name: string]: unknown
+          }
+          content: {
+            'application/json': components['schemas']['User'] | null
+          }
+        }
+      }
+    }
+    put?: never
+    post?: never
+    delete?: never
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
+  '/api/logout': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    get?: never
+    put?: never
+    /** Log the user out */
+    post: {
+      parameters: {
+        query?: never
+        header?: never
+        path?: never
+        cookie?: never
+      }
+      requestBody?: never
+      responses: {
+        /** @description no content */
+        200: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+        /** @description Unauthenticated - a session is required */
+        401: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+      }
+    }
+    delete?: never
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
+  '/api/whiskey/authorize': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    /** Whiskey - Get the authorization url */
+    get: {
+      parameters: {
+        query?: never
+        header?: never
+        path?: never
+        cookie?: never
+      }
+      requestBody?: never
+      responses: {
+        200: {
+          headers: {
+            [name: string]: unknown
+          }
+          content: {
+            'application/json': components['schemas']['GetAuthorizeResponse']
+          }
+        }
+        /** @description no content */
+        400: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+      }
+    }
+    put?: never
+    post?: never
+    delete?: never
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
+  '/api/whiskey/callback': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    get?: never
+    put?: never
+    /** Whiskey - Complete the login */
+    post: {
+      parameters: {
+        query?: never
+        header?: never
+        path?: never
+        cookie?: never
+      }
+      requestBody: {
+        content: {
+          'application/json': components['schemas']['PostCallbackParams']
+        }
+      }
+      responses: {
+        200: {
+          headers: {
+            [name: string]: unknown
+          }
+          content: {
+            'application/json': components['schemas']['User']
+          }
+        }
+        /** @description no content */
+        400: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+        /** @description no content */
+        403: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+      }
+    }
+    delete?: never
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
+  '/api/login': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    get?: never
+    put?: never
+    /**
+     * Log in as a dev user
+     * @description Debug builds only. Takes the email of one of the `dev_users` of the configuration, creates the row if needed, and opens a session.
+     */
+    post: {
+      parameters: {
+        query?: never
+        header?: never
+        path?: never
+        cookie?: never
+      }
+      requestBody: {
+        content: {
+          'application/json': components['schemas']['LoginDevForm']
+        }
+      }
+      responses: {
+        200: {
+          headers: {
+            [name: string]: unknown
+          }
+          content: {
+            'application/json': components['schemas']['User']
+          }
+        }
+        /** @description no content */
+        404: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+      }
+    }
+    delete?: never
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
+  '/api/login/dev-users': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    /**
+     * List the dev users
+     * @description Debug builds only.
+     */
+    get: {
+      parameters: {
+        query?: never
+        header?: never
+        path?: never
+        cookie?: never
+      }
+      requestBody?: never
+      responses: {
+        200: {
+          headers: {
+            [name: string]: unknown
+          }
+          content: {
+            'application/json': components['schemas']['DevUser'][]
+          }
+        }
+      }
+    }
+    put?: never
+    post?: never
+    delete?: never
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
+  '/api/bikes': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    /** Get the fleet */
+    get: {
+      parameters: {
+        query?: never
+        header?: never
+        path?: never
+        cookie?: never
+      }
+      requestBody?: never
+      responses: {
+        200: {
+          headers: {
+            [name: string]: unknown
+          }
+          content: {
+            'application/json': components['schemas']['Bike'][]
+          }
+        }
+      }
+    }
+    put?: never
+    post?: never
+    delete?: never
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
+  '/api/bikes/{id}/status': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    get?: never
+    /** Put a bike in or out of service */
+    put: {
+      parameters: {
+        query?: never
+        header?: never
+        path: {
+          id: number
+        }
+        cookie?: never
+      }
+      requestBody: {
+        content: {
+          'application/json': components['schemas']['SetStatusForm']
+        }
+      }
+      responses: {
+        /** @description no content */
+        200: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+        /** @description Unauthenticated - a session is required */
+        401: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+        /** @description Forbidden - the user must be an admin */
+        403: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+        /** @description no content */
+        404: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+      }
+    }
+    post?: never
+    delete?: never
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
+  '/api/reservations': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    /** Get every reservation */
+    get: {
+      parameters: {
+        query?: never
+        header?: never
+        path?: never
+        cookie?: never
+      }
+      requestBody?: never
+      responses: {
+        200: {
+          headers: {
+            [name: string]: unknown
+          }
+          content: {
+            'application/json': components['schemas']['Reservation'][]
+          }
+        }
+        /** @description Unauthenticated - a session is required */
+        401: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+        /** @description Forbidden - the user must be an admin */
+        403: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+      }
+    }
+    put?: never
+    /**
+     * File a reservation request
+     * @description The requester is the session user and the status starts at `requested`; neither is taken from the body.
+     */
+    post: {
+      parameters: {
+        query?: never
+        header?: never
+        path?: never
+        cookie?: never
+      }
+      requestBody: {
+        content: {
+          'application/json': components['schemas']['NewReservation']
+        }
+      }
+      responses: {
+        /** @description The reservation, as stored */
+        201: {
+          headers: {
+            [name: string]: unknown
+          }
+          content: {
+            'application/json': components['schemas']['Reservation']
+          }
+        }
+        /** @description The reservation is malformed */
+        400: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+        /** @description Unauthenticated - a session is required */
+        401: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+        /** @description The requester does not belong to the unit named */
+        403: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+        /** @description One of the bikes is out of service */
+        409: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+        /** @description The unit or one of the bikes does not exist */
+        422: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+      }
+    }
+    delete?: never
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
+  '/api/reservations/mine': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    /**
+     * Get the reservations the session user is part of
+     * @description An address listed among the Linka Go accounts is enough, which is how somebody added before they ever logged in finds the reservation waiting for them.
+     */
+    get: {
+      parameters: {
+        query?: never
+        header?: never
+        path?: never
+        cookie?: never
+      }
+      requestBody?: never
+      responses: {
+        200: {
+          headers: {
+            [name: string]: unknown
+          }
+          content: {
+            'application/json': components['schemas']['Reservation'][]
+          }
+        }
+        /** @description Unauthenticated - a session is required */
+        401: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+      }
+    }
+    put?: never
+    post?: never
+    delete?: never
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
+  '/api/reservations/calendar': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    /**
+     * Get the approved and ongoing reservations, for the public calendar
+     * @description No session needed, and no personal field travels: the telegram handle, the people, the Linka Go addresses and the reason are left out.
+     */
+    get: {
+      parameters: {
+        query?: never
+        header?: never
+        path?: never
+        cookie?: never
+      }
+      requestBody?: never
+      responses: {
+        200: {
+          headers: {
+            [name: string]: unknown
+          }
+          content: {
+            'application/json': components['schemas']['CalendarReservation'][]
+          }
+        }
+      }
+    }
+    put?: never
+    post?: never
+    delete?: never
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
+  '/api/reservations/{id}': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    get?: never
+    /**
+     * Edit the period, the bikes and the Linka Go accounts
+     * @description Everything else is left as stored. A manager may change all three until the reservation is final; anybody else on it may do so only while it is still a request, and afterwards only the Linka Go accounts.
+     */
+    put: {
+      parameters: {
+        query?: never
+        header?: never
+        path: {
+          id: number
+        }
+        cookie?: never
+      }
+      /**
+       * @description Only what the admin page lets somebody change. The unit, the requester, the
+       *      telegram handle and the reason are shown but not editable, so they are not
+       *      in the body at all: the handler reads them back from the stored reservation
+       *      rather than trusting a client to send them unchanged.
+       */
+      requestBody: {
+        content: {
+          'application/json': components['schemas']['ReservationEditForm']
+        }
+      }
+      responses: {
+        /** @description no content */
+        200: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+        /** @description The reservation would become malformed */
+        400: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+        /** @description Unauthenticated - a session is required */
+        401: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+        /** @description The user is not on the reservation, or tried to change more than the Linka Go accounts on one that is already approved */
+        403: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+        /** @description no content */
+        404: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+        /** @description A newly added bike is out of service, or the reservation is final */
+        409: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+        /** @description One of the bikes does not exist */
+        422: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+      }
+    }
+    post?: never
+    delete?: never
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
+  '/api/reservations/{id}/status': {
+    parameters: {
+      query?: never
+      header?: never
+      path?: never
+      cookie?: never
+    }
+    get?: never
+    /**
+     * Move a reservation through its state machine
+     * @description Refuses a transition the state machine does not allow, with a 409.
+     */
+    put: {
+      parameters: {
+        query?: never
+        header?: never
+        path: {
+          id: number
+        }
+        cookie?: never
+      }
+      requestBody: {
+        content: {
+          'application/json': components['schemas']['SetStatusForm2']
+        }
+      }
+      responses: {
+        /** @description no content */
+        200: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+        /** @description Unauthenticated - a session is required */
+        401: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+        /** @description Forbidden - the user must be part of the unit, or an admin when the reservation names no known unit */
+        403: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+        /** @description no content */
+        404: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+        /** @description no content */
+        409: {
+          headers: {
+            [name: string]: unknown
+          }
+          content?: never
+        }
+      }
+    }
+    post?: never
+    delete?: never
+    options?: never
+    head?: never
+    patch?: never
+    trace?: never
+  }
 }
-export type webhooks = Record<string, never>;
+export type webhooks = Record<string, never>
 export interface components {
-    schemas: {
-        Bike: {
-            battery?: string | null;
-            drivetrain?: string | null;
-            /** Format: int32 */
-            id: number;
-            key_number?: string | null;
-            /** Format: int32 */
-            key_quantity: number;
-            name: string;
-            size: components["schemas"]["BikeSize"];
-            status: components["schemas"]["BikeStatus"];
-        };
-        /**
-         * @description Frame size. The reservation form lets a requester ask for one kind or the
-         *      other, so it is part of the bike rather than being read off its name.
-         * @enum {string}
-         */
-        BikeSize: "large" | "small";
-        /** @enum {string} */
-        BikeStatus: "in_service" | "out_of_service";
-        DevUser: {
-            admin: boolean;
-            email: string;
-            firstname: string;
-            name: string;
-        };
-        GetAuthorizeResponse: {
-            redirect_to: string;
-        };
-        IdPath: {
-            /** Format: int32 */
-            id: number;
-        };
-        LoginDevForm: {
-            /** @description Email of one of the `dev_users` of the configuration */
-            user: string;
-        };
-        NewReservation: {
-            description: string;
-            bikes: number[];
-            /** Format: date-time */
-            end_time: string;
-            linka_emails: string[];
-            /** Format: date-time */
-            start_time: string;
-            telegram: string;
-            unit: components["schemas"]["NewReservationUnit"];
-            users: number[];
-        };
-        /** @description The same choice, as the client sends it: only the id travels for a known unit. */
-        NewReservationUnit: {
-            /** Format: int32 */
-            id: number;
-            /** @constant */
-            kind: "known";
-        } | {
-            /** @constant */
-            kind: "free";
-            name: string;
-        };
-        PostCallbackParams: {
-            code: string;
-            state: string;
-        };
-        Reservation: {
-            description: string;
-            bikes: number[];
-            /** Format: date-time */
-            end_time: string;
-            /** Format: int32 */
-            id: number;
-            /**
-             * @description Linka Go accounts allowed to unlock the bikes. Plain addresses: they
-             *      need not belong to anybody who ever logs into this app.
-             */
-            linka_emails: string[];
-            /** Format: int32 */
-            requester: number;
-            /** Format: date-time */
-            start_time: string;
-            status: components["schemas"]["ReservationStatus"];
-            telegram: string;
-            /** @description The one unit the bikes are lent to */
-            unit: components["schemas"]["ReservationUnit"];
-            users: components["schemas"]["UserSummary"][];
-        };
-        /**
-         * @description Only what the admin page lets somebody change. The unit, the requester, the
-         *      telegram handle and the reason are shown but not editable, so they are not
-         *      in the body at all: the handler reads them back from the stored reservation
-         *      rather than trusting a client to send them unchanged.
-         */
-        ReservationEditForm: {
-            bikes: number[];
-            /** Format: date-time */
-            end_time: string;
-            linka_emails: string[];
-            /** Format: date-time */
-            start_time: string;
-        };
-        /** @enum {string} */
-        ReservationStatus: "requested" | "refused" | "approved" | "cancelled" | "ongoing" | "archived";
-        /**
-         * @description The unit a reservation is filed for.
-         *
-         *      Either one we know — a Whiskey group, with its row — or a plain name the
-         *      requester typed. Typing a name must never create a unit, so the two are
-         *      exclusive by construction rather than "a name that may or may not resolve".
-         */
-        ReservationUnit: {
-            /** @constant */
-            kind: "known";
-            unit: components["schemas"]["Unit"];
-        } | {
-            /** @constant */
-            kind: "free";
-            name: string;
-        };
-        SetStatusForm: {
-            status: components["schemas"]["BikeStatus"];
-        };
-        SetStatusForm2: {
-            status: components["schemas"]["ReservationStatus"];
-        };
-        Unit: {
-            /** Format: int32 */
-            id: number;
-            /** @description The Whiskey group name */
-            name: string;
-        };
-        User: {
-            admin: boolean;
-            email: string;
-            external_id?: string | null;
-            firstname: string;
-            /** Format: int32 */
-            id: number;
-            name: string;
-            oidc_sub: string;
-            units: components["schemas"]["Unit"][];
-        };
-        /**
-         * @description A user as they appear inside another object (a reservation, ...): enough to
-         *      show who they are, without dragging their units along.
-         */
-        UserSummary: {
-            email: string;
-            firstname: string;
-            /** Format: int32 */
-            id: number;
-            name: string;
-        };
-    };
-    responses: never;
-    parameters: never;
-    requestBodies: never;
-    headers: never;
-    pathItems: never;
+  schemas: {
+    Bike: {
+      battery?: string | null
+      drivetrain?: string | null
+      /** Format: int32 */
+      id: number
+      key_number?: string | null
+      /** Format: int32 */
+      key_quantity: number
+      name: string
+      size: components['schemas']['BikeSize']
+      status: components['schemas']['BikeStatus']
+    }
+    /**
+     * @description Frame size. The reservation form lets a requester ask for one kind or the
+     *      other, so it is part of the bike rather than being read off its name.
+     * @enum {string}
+     */
+    BikeSize: 'large' | 'small'
+    /** @enum {string} */
+    BikeStatus: 'in_service' | 'out_of_service'
+    /**
+     * @description A reservation as the public availability calendar sees it: when the bikes are
+     *      taken and by which association, and nothing else. The telegram handle, the
+     *      people, the Linka Go addresses and the reason are deliberately absent — this
+     *      travels to anybody, signed in or not.
+     */
+    CalendarReservation: {
+      bikes: number[]
+      /** Format: date-time */
+      end_time: string
+      /** Format: int32 */
+      id: number
+      /** Format: date-time */
+      start_time: string
+      status: components['schemas']['ReservationStatus']
+      unit: components['schemas']['ReservationUnit']
+    }
+    DevUser: {
+      admin: boolean
+      email: string
+      firstname: string
+      name: string
+    }
+    GetAuthorizeResponse: {
+      redirect_to: string
+    }
+    IdPath: {
+      /** Format: int32 */
+      id: number
+    }
+    LoginDevForm: {
+      /** @description Email of one of the `dev_users` of the configuration */
+      user: string
+    }
+    NewReservation: {
+      description: string
+      bikes: number[]
+      /** Format: date-time */
+      end_time: string
+      linka_emails: string[]
+      /** Format: date-time */
+      start_time: string
+      telegram: string
+      unit: components['schemas']['NewReservationUnit']
+      users: number[]
+    }
+    /** @description The same choice, as the client sends it: only the id travels for a known unit. */
+    NewReservationUnit:
+      | {
+          /** Format: int32 */
+          id: number
+          /** @constant */
+          kind: 'known'
+        }
+      | {
+          /** @constant */
+          kind: 'free'
+          name: string
+        }
+    PostCallbackParams: {
+      code: string
+      state: string
+    }
+    Reservation: {
+      description: string
+      bikes: number[]
+      /** Format: date-time */
+      end_time: string
+      /** Format: int32 */
+      id: number
+      /**
+       * @description Linka Go accounts allowed to unlock the bikes. Plain addresses: they
+       *      need not belong to anybody who ever logs into this app.
+       */
+      linka_emails: string[]
+      /** Format: int32 */
+      requester: number
+      /** Format: date-time */
+      start_time: string
+      status: components['schemas']['ReservationStatus']
+      telegram: string
+      /** @description The one unit the bikes are lent to */
+      unit: components['schemas']['ReservationUnit']
+      users: components['schemas']['UserSummary'][]
+    }
+    /**
+     * @description Only what the admin page lets somebody change. The unit, the requester, the
+     *      telegram handle and the reason are shown but not editable, so they are not
+     *      in the body at all: the handler reads them back from the stored reservation
+     *      rather than trusting a client to send them unchanged.
+     */
+    ReservationEditForm: {
+      bikes: number[]
+      /** Format: date-time */
+      end_time: string
+      linka_emails: string[]
+      /** Format: date-time */
+      start_time: string
+    }
+    /** @enum {string} */
+    ReservationStatus: 'requested' | 'refused' | 'approved' | 'cancelled' | 'ongoing' | 'archived'
+    /**
+     * @description The unit a reservation is filed for.
+     *
+     *      Either one we know — a Whiskey group, with its row — or a plain name the
+     *      requester typed. Typing a name must never create a unit, so the two are
+     *      exclusive by construction rather than "a name that may or may not resolve".
+     */
+    ReservationUnit:
+      | {
+          /** @constant */
+          kind: 'known'
+          unit: components['schemas']['Unit']
+        }
+      | {
+          /** @constant */
+          kind: 'free'
+          name: string
+        }
+    SetStatusForm: {
+      status: components['schemas']['BikeStatus']
+    }
+    SetStatusForm2: {
+      status: components['schemas']['ReservationStatus']
+    }
+    Unit: {
+      /** Format: int32 */
+      id: number
+      /** @description The Whiskey group name */
+      name: string
+    }
+    User: {
+      admin: boolean
+      email: string
+      external_id?: string | null
+      firstname: string
+      /** Format: int32 */
+      id: number
+      name: string
+      oidc_sub: string
+      units: components['schemas']['Unit'][]
+    }
+    /**
+     * @description A user as they appear inside another object (a reservation, ...): enough to
+     *      show who they are, without dragging their units along.
+     */
+    UserSummary: {
+      email: string
+      firstname: string
+      /** Format: int32 */
+      id: number
+      name: string
+    }
+  }
+  responses: never
+  parameters: never
+  requestBodies: never
+  headers: never
+  pathItems: never
 }
-export type $defs = Record<string, never>;
-export type operations = Record<string, never>;
+export type $defs = Record<string, never>
+export type operations = Record<string, never>
diff --git a/frontend/src/locales/en.yml b/frontend/src/locales/en.yml
index b8d6859..65fe550 100644
--- a/frontend/src/locales/en.yml
+++ b/frontend/src/locales/en.yml
@@ -107,8 +107,19 @@ login:
   not-allowed: Your account is not allowed to use this application.
   error: The login failed.
 calendar:
-  title: Calendar
-  todo: This page is not built yet.
+  load-error: Unable to load the calendar.
+  title: Calendar per cargobike
+  intro: Approved and ongoing reservations are shown in the calendar.
+  bike: Cargobike
+  all-bikes: All
+  previous: Week
+  next: Week
+  today: Today
+  hour: H
+  no-bike: No cargobike to show.
+  legend: One bar per booked cargobike, split by day. Click one for the details.
+  open: 'Open reservation #{id}'
+  reservation: 'Reservation #{id}'
 admin:
   title: Reservation administration
   intro: Approve, refuse and follow the reservations, and see the planning of each cargobike.
@@ -144,16 +155,3 @@ admin:
       cancelled: Cancel
       ongoing: Start
       archived: Archive
-  calendar:
-    title: Calendar per cargobike
-    intro: Approved and ongoing reservations are shown in the calendar.
-    bike: Cargobike
-    all-bikes: All
-    previous: Week
-    next: Week
-    today: Today
-    hour: H
-    no-bike: No cargobike to show.
-    legend: One bar per booked cargobike, split by day. Click one for the details.
-    open: 'Open reservation #{id}'
-    reservation: 'Reservation #{id}'
diff --git a/frontend/src/locales/fr.yml b/frontend/src/locales/fr.yml
index add63b6..9d39d8c 100644
--- a/frontend/src/locales/fr.yml
+++ b/frontend/src/locales/fr.yml
@@ -108,8 +108,19 @@ login:
   not-allowed: Votre compte n'est pas autorisé à accéder à cette application.
   error: La connexion a échoué.
 calendar:
-  title: Calendrier
-  todo: Cette page n'est pas encore construite.
+  load-error: Impossible de charger le calendrier.
+  title: Calendrier par cargobike
+  intro: Les réservations validées et en cours sont affichées dans le calendrier.
+  bike: Cargobike
+  all-bikes: Tous
+  previous: Sem.
+  next: Sem.
+  today: Aujourd'hui
+  hour: H
+  no-bike: Aucun cargobike à afficher.
+  legend: Une barre par cargobike réservé, découpée par jour. Cliquez pour voir le détail.
+  open: 'Voir la réservation #{id}'
+  reservation: 'Réservation #{id}'
 admin:
   title: Administration des réservations
   intro: Validez, refusez et suivez les réservations, et visualisez les plannings par cargobike.
@@ -145,16 +156,3 @@ admin:
       cancelled: Annuler
       ongoing: Démarrer
       archived: Archiver
-  calendar:
-    title: Calendrier par cargobike
-    intro: Les réservations validées et en cours sont affichées dans le calendrier.
-    bike: Cargobike
-    all-bikes: Tous
-    previous: Sem.
-    next: Sem.
-    today: Aujourd'hui
-    hour: H
-    no-bike: Aucun cargobike à afficher.
-    legend: Une barre par cargobike réservé, découpée par jour. Cliquez pour voir le détail.
-    open: 'Voir la réservation #{id}'
-    reservation: 'Réservation #{id}'
diff --git a/frontend/src/services/api/reservations.ts b/frontend/src/services/api/reservations.ts
index f780784..edc98ec 100644
--- a/frontend/src/services/api/reservations.ts
+++ b/frontend/src/services/api/reservations.ts
@@ -10,6 +10,7 @@ import { getClient } from './client'
 
 export const RESERVATIONS_KEY = ['reservations']
 export const MY_RESERVATIONS_KEY = ['reservations', 'mine']
+export const CALENDAR_KEY = ['reservations', 'calendar']
 
 export function useReservations() {
   return useQuery({
@@ -52,6 +53,24 @@ export function useSetReservationStatus() {
   })
 }
 
+/**
+ * The public availability calendar: the approved and ongoing reservations,
+ * without any personal field. No session needed.
+ */
+export function useCalendarReservations() {
+  return useQuery({
+    queryKey: CALENDAR_KEY,
+    staleTime: 30 * 1000,
+    queryFn: async () => {
+      const { data, response } = await getClient().GET('/api/reservations/calendar')
+      if (response.status !== HttpStatus.OK) {
+        throw new Error(`Unexpected status code received: ${response.status}`)
+      }
+      return data ?? []
+    },
+  })
+}
+
 /**
  * Everything the session user is part of: what they filed, what they were added
  * to, and what lists their address among the Linka Go accounts — which is how a
diff --git a/frontend/src/utils/types.ts b/frontend/src/utils/types.ts
index 1a1c510..62d65e4 100644
--- a/frontend/src/utils/types.ts
+++ b/frontend/src/utils/types.ts
@@ -29,6 +29,16 @@ export type UserSummary = components['schemas']['UserSummary']
 export type ReservationUnit = components['schemas']['ReservationUnit']
 export type NewReservation = components['schemas']['NewReservation']
 export type ReservationEdit = components['schemas']['ReservationEditForm']
+export type CalendarReservation = components['schemas']['CalendarReservation']
+
+/**
+ * What the details block can render: the fields the public calendar carries,
+ * plus whatever personal ones the caller was entitled to receive. A full
+ * `Reservation` satisfies it; a `CalendarReservation` satisfies it with the
+ * personal half missing, and the block simply leaves those rows out.
+ */
+export type ReservationLike = CalendarReservation &
+  Partial<Pick<Reservation, 'telegram' | 'users' | 'linka_emails' | 'description'>>
 
 /**
  * What to display for a reservation's unit: the name of the unit it points at,
diff --git a/frontend/src/views/AdminView.vue b/frontend/src/views/AdminView.vue
index a20c4e2..6200073 100644
--- a/frontend/src/views/AdminView.vue
+++ b/frontend/src/views/AdminView.vue
@@ -6,7 +6,7 @@
 import { computed } from 'vue'
 import { RefreshCw } from '@lucide/vue'
 
-import BikeCalendar from '@/components/admin/BikeCalendar.vue'
+import BikeCalendar from '@/components/reservation/BikeCalendar.vue'
 import BikeFleet from '@/components/admin/BikeFleet.vue'
 import ReservationAdmin from '@/components/admin/ReservationAdmin.vue'
 import { Button } from '@/components/ui/button'
diff --git a/frontend/src/views/CalendarView.vue b/frontend/src/views/CalendarView.vue
index 8eb7d01..1f6074f 100644
--- a/frontend/src/views/CalendarView.vue
+++ b/frontend/src/views/CalendarView.vue
@@ -1,13 +1,29 @@
 <script setup lang="ts">
 /**
- * Placeholder: the header links here, and a dead link would be worse than an
- * explicit "not built yet". Replace with the real availability calendar.
+ * The public availability calendar: the same grid as the admin page, fed by the
+ * endpoint that carries no personal field. Anybody can look up when the bikes
+ * are taken without being signed in.
  */
+import BikeCalendar from '@/components/reservation/BikeCalendar.vue'
+import { Skeleton } from '@/components/ui/skeleton'
+import { useBikes } from '@/services/api/bikes'
+import { useCalendarReservations } from '@/services/api/reservations'
+
+const { data: reservations, isPending, isError } = useCalendarReservations()
+const { data: bikes, isPending: bikesPending } = useBikes()
 </script>
 
 <template>
-  <div class="mx-auto w-full max-w-2xl">
-    <h1 class="text-xl font-semibold">{{ $t('calendar.title') }}</h1>
-    <p class="text-muted-foreground mt-2 text-sm">{{ $t('calendar.todo') }}</p>
+  <div class="mx-auto w-full max-w-6xl">
+    <div v-if="isPending || bikesPending" class="grid gap-3">
+      <Skeleton class="h-24 w-full" />
+      <Skeleton class="h-[40rem] w-full" />
+    </div>
+
+    <p v-else-if="isError" class="text-destructive text-sm">
+      {{ $t('calendar.load-error') }}
+    </p>
+
+    <BikeCalendar v-else :reservations="reservations ?? []" :bikes="bikes ?? []" />
   </div>
 </template>
diff --git a/src/api/reservations.rs b/src/api/reservations.rs
index 3804dc6..2010023 100644
--- a/src/api/reservations.rs
+++ b/src/api/reservations.rs
@@ -21,10 +21,16 @@ use serde::Deserialize;
 use crate::{
     api::helpers::{IdPath, admin, admin_desc, desc, manager, manager_desc, unexpected_error},
     core::{
-        controller::{AppController, ControllerError, reservations::ReservationsControllerError},
+        controller::{
+            AnonAppController, AppController, ControllerError,
+            reservations::ReservationsControllerError,
+        },
         models::{
             bike::BikeId,
-            reservation::{NewReservation, Reservation, ReservationEdit, ReservationStatus},
+            reservation::{
+                CalendarReservation, NewReservation, Reservation, ReservationEdit,
+                ReservationStatus,
+            },
         },
     },
 };
@@ -36,11 +42,15 @@ pub fn routes() -> ApiRouter {
             get_with(get_reservations, get_reservations_docs)
                 .post_with(create_reservation, create_reservation_docs),
         )
-        // Before `/{id}`, which would otherwise be a candidate for "mine"
+        // Before `/{id}`, which would otherwise be a candidate for these
         .api_route(
             "/mine",
             get_with(get_my_reservations, get_my_reservations_docs),
         )
+        .api_route(
+            "/calendar",
+            get_with(get_calendar_reservations, get_calendar_reservations_docs),
+        )
         .api_route(
             "/{id}",
             put_with(update_reservation, update_reservation_docs),
@@ -105,6 +115,27 @@ fn create_reservation_docs(op: TransformOperation) -> TransformOperation {
         .response_with::<422, (), _>(desc("The unit or one of the bikes does not exist"))
 }
 
+/// The availability calendar, open to everybody: when the bikes are taken and by
+/// which association, with nothing personal attached.
+#[axum::debug_handler]
+async fn get_calendar_reservations(
+    aac: AnonAppController,
+) -> Result<Json<Vec<CalendarReservation>>, (StatusCode, String)> {
+    match aac.get_calendar_reservations().await {
+        Ok(reservations) => Ok(Json(reservations)),
+        Err(err) => unexpected_error("get_calendar_reservations", err),
+    }
+}
+
+fn get_calendar_reservations_docs(op: TransformOperation) -> TransformOperation {
+    op.tag("Reservations")
+        .summary("Get the approved and ongoing reservations, for the public calendar")
+        .description(
+            "No session needed, and no personal field travels: the telegram handle, \
+             the people, the Linka Go addresses and the reason are left out.",
+        )
+}
+
 /// Everything the session user is part of: what they filed, what they were
 /// added to, and what lists their address among the Linka Go accounts.
 #[axum::debug_handler]
diff --git a/src/core/controller/reservations.rs b/src/core/controller/reservations.rs
index 2404e45..09a8016 100644
--- a/src/core/controller/reservations.rs
+++ b/src/core/controller/reservations.rs
@@ -5,8 +5,8 @@ use crate::core::{
     models::{
         bike::BikeStatus,
         reservation::{
-            NewReservation, NewReservationUnit, Reservation, ReservationEdit, ReservationId,
-            ReservationStatus,
+            CalendarReservation, NewReservation, NewReservationUnit, Reservation, ReservationEdit,
+            ReservationId, ReservationStatus,
         },
         unit::UnitId,
     },
@@ -32,6 +32,26 @@ impl AnonAppController {
     pub async fn get_reservation(&self, id: ReservationId) -> Result<Reservation, ControllerError> {
         self.db.get_reservation(id).await.map_err(Into::into)
     }
+
+    /// What the availability calendar shows: the reservations that actually hold
+    /// a bike, stripped of everything personal. Reading it needs no session.
+    pub async fn get_calendar_reservations(
+        &self,
+    ) -> Result<Vec<CalendarReservation>, ControllerError> {
+        Ok(self
+            .db
+            .get_reservations()
+            .await?
+            .into_iter()
+            .filter(|reservation| {
+                matches!(
+                    reservation.status,
+                    ReservationStatus::Approved | ReservationStatus::Ongoing
+                )
+            })
+            .map(Into::into)
+            .collect())
+    }
 }
 
 /// Filing a request is done in one's own name: the requester is the session
diff --git a/src/core/models/reservation.rs b/src/core/models/reservation.rs
index deab292..201e250 100644
--- a/src/core/models/reservation.rs
+++ b/src/core/models/reservation.rs
@@ -121,6 +121,33 @@ pub struct Reservation {
     pub status: ReservationStatus,
 }
 
+/// A reservation as the public availability calendar sees it: when the bikes are
+/// taken and by which association, and nothing else. The telegram handle, the
+/// people, the Linka Go addresses and the reason are deliberately absent — this
+/// travels to anybody, signed in or not.
+#[derive(Debug, Serialize, Deserialize, Clone, JsonSchema, PartialEq, Eq)]
+pub struct CalendarReservation {
+    pub id: ReservationId,
+    pub unit: ReservationUnit,
+    pub start_time: DateTime<Utc>,
+    pub end_time: DateTime<Utc>,
+    pub bikes: Vec<BikeId>,
+    pub status: ReservationStatus,
+}
+
+impl From<Reservation> for CalendarReservation {
+    fn from(value: Reservation) -> Self {
+        CalendarReservation {
+            id: value.id,
+            unit: value.unit,
+            start_time: value.start_time,
+            end_time: value.end_time,
+            bikes: value.bikes,
+            status: value.status,
+        }
+    }
+}
+
 #[derive(Debug, Serialize, Deserialize, Clone, JsonSchema, PartialEq, Eq)]
 pub struct NewReservation {
     pub unit: NewReservationUnit,