omnibase/office

Booking

The model

The whole office closed is a closed special day of omnibase's opening hours, not an absence.

Free slots

$slots = $slotFinder->find($member, $type, $from, $to);       // list<Slot>: start, end, office
$slotFinder->isFree($member, $type, $start);
$slotFinder->next($member, $type, 3);

Schedules, less absences, less closed days, less the appointments held and the buffer after each, less what is closer than min_notice or further than horizon (clients only, not the staff). compute() is the same on plain arrays, without a database. Times are walked in seconds from the schedule's start written in the office's timezone: the night the clocks go back, a schedule from 1:00 to 4:00 lasts four hours and has its 2:00 slot twice. One member at a time: it is not a table planner.

Booking

$appointment = $booker->book($type, $member, $start, $client, AppointmentSource::ONLINE, $reason);
$booker->request($type, $member, $client, $message);          // no time: the office fixes it
$booker->confirm($appointment, $start);
$booker->move($appointment, $newStart);
$booker->cancel($appointment);                                // BookingException too_late within cancel_until
$booker->series($type, $member, $first, 10, new \DateInterval('P1D'), $client, $address);

A slot is taken under a symfony/lock lock on the member's day, after asking the SlotFinder again; Appointment::$slotKey ("member|start", emptied when the appointment no longer holds its slot) has a unique index, which is the last word if two servers race. A refusal is a BookingException whose key is a translation (booking.error.slot_taken, too_late, not_bookable, overlap…).

The reason is sealed by Base\Office\Share\Cipher before it is stored: without a key, a booking with a reason fails rather than store it clear.

What the client is told

AppointmentEvent (BOOKED, REQUESTED, CONFIRMED, MOVED, CANCELLED, REMINDER). BookingMailer listens: when, with whom, where, how (the channel), the .ics (omnibase's Calendar\Ics) and the Google Calendar link, the link to cancel (a token mailed, only its hash kept). Never the reason, never the type's name. Add a listener of your own for a push or an SMS.

A regime that lets clients book for someone else implements BeneficiaryProviderInterface.

Cron

*/15 * * * *  bin/console office:booking:remind        # each reminder of office.booking.reminders, once
55 23 * * *   bin/console office:booking:close-day     # past: done; a video one never joined: no-show; closed rooms purged

The agenda (/admin/agenda, ROLE_STAFF)

A day (a column a member) or a week (one member), drawn on a grid: the schedules in white, absences hatched, appointments in the member's colour. Each opens to: done, absent, cancel, move. Below: the quick booking taken on the phone - an existing account by its e-mail, or someone new who is then invited -, and the requests waiting for a time. A member reads the reason of their own appointments; anyone else only sees that the time is taken.

Share

What is stored, and how

A Document belongs to a recipient (whose document it is) and has a sender. Its file is encrypted on a private Flysystem storage:

• libsodium crypto_secretstream_xchacha20poly1305, in 64 KiB chunks, each authenticated: a byte changed, a chunk missing or the last one cut off, and it does not decrypt (CorruptedException);
• a random key per file, kept in the row wrapped (crypto_secretbox) by a key derived from the master key (crypto_kdf);
• the title and the file name sealed the same way; the SHA-256 of the clear file is kept and checked again after each decryption.

What stays readable in the database: who it is for, who sent it, its kind, size, type and dates.

Fail closed. The master key (office.share.master_key: base64 of 32 bytes, from the secrets vault) missing or unusable, every call of Cipher throws KeyMissingException: nothing is stored clear as a fallback, nothing is read. Cipher::generateKey() makes one.

$document = $vault->deposit($uploadedFile, $recipient, $sender, 'Compte rendu', DocumentKind::REPORT);
$stream = $vault->open($document);     // decrypted to a temporary stream, checked, then handed out
$vault->revoke($document, $by);
$vault->destroy($document);            // the file too; the log stays

deposit() refuses an empty file, one above max_size, a type outside mime_types (ShareException).

Who may read

Base\Office\Security\Voter\DocumentVoter, three attributes:

The recipient and the sender see and read theirs. Nobody else - not the site's administrators either - unless a regime's AudienceResolverInterface (autoconfigured, tag office.share_audience) grants it; a resolver's false wins over any grant:

final class PartnersAudience implements AudienceResolverInterface
{
    public function decide(string $attribute, Document $document, UserInterface $user): ?bool
    {
        return self::READ === $attribute && $this->isPartner($user) ? true : null;
    }
}

How a file leaves

Only through ShareController::download: signed in, allowed by the voter, logged, sent with Cache-Control: no-store, X-Content-Type-Options: nosniff, a sandboxing Content-Security-Policy, and as an attachment (application/octet-stream). An image may be shown inline (?inline=1) in a conversation. Someone else's document answers 404, and the refusal is logged.

The access log

AccessLog: document id, recipient id, who (and their name at the time), the action (view, download, upload, share, revoke, denied), IP, user agent, when. Rows are never edited and outlive the document. /admin/access-log shows it to ROLE_ADMIN.

What the recipient is told

DocumentEvent::DEPOSITED → ShareMailer: "a new document awaits you in your space", with a link to office.share.space_route - where one signs in. Neither the document, nor its title, nor a link that would open it.

Visio

A Room belongs to a subject (RoomSubjectInterface: a host, a guest, a start, an end, a key - an Appointment is one). Rooms::forSubject($appointment) makes it the first time it is asked for and keeps its times in step; it opens open_before minutes before the start and closes close_after minutes after the end. Its address is a random token; only its two participants get anything, and only while it is open.

The room is office's, the call a gateway's

What carries the call is a gateway of glitchr/omnimeet:

• Rooms::forSubject() opens the room on office.visio.gateway and keeps its reference.
• The page asks Rooms::access($room, $user) - the gateway's Join - and renders the Access: omnimeet/direct's engine on the room's own endpoints, a provider's frame, or a button to its address.
• Who may enter, who is there, the waiting room, the end are judged here, on the Room, whatever the gateway. The guest's frame is not even loaded before the host is there.
• A gateway is told as little as it needs: the room's token for a key (never the subject, never a title), a role, u<id>, and the member's name as the team page gives it (names: none to withhold it). The client's name is never given.
• A room nobody has entered follows the configured gateway (change gateway, and the appointments to come change with it); a room someone has been in stays on the one it was opened on.

The direct gateway (the default)

The media go from browser to browser (WebRTC, DTLS-SRTP: encrypted end to end between the two). The room only relays their handshake, over plain HTTP - no WebSocket server to run:

The engine has no dependency: the host offers, the guest answers; mute, camera off, screen sharing, a chat on a data channel (never stored). Its markup and its rules are documented with omnimeet/direct.

TURN

When a network forbids the direct way, the media go through your own relay - still encrypted, never through a third party. The direct gateway issues the "TURN REST API" credentials coturn checks with use-auth-secret; nothing is stored, they lapse after turn_ttl.

# config/packages/omnimeet.yaml
omnimeet:
    gateways:
        direct:
            factory: direct
            options: { turn_secret: '%env(default::TURN_SECRET)%', turn_urls: '%env(default::TURN_URLS)%' }

# docker-compose.yml
coturn:
    image: coturn/coturn:4.6
    ports: ["3478:3478/udp", "3478:3478/tcp", "21080-21099:21080-21099/udp"]
    command: [-n, --listening-port=3478, --min-port=21080, --max-port=21099, --use-auth-secret,
              "--static-auth-secret=${TURN_SECRET}", "--realm=${TURN_REALM}", --no-cli, --no-tls, --no-dtls,
              --no-multicast-peers, --denied-peer-ip=10.0.0.0-10.255.255.255, ...]

The relay ports (--min-port/--max-port, published as they are) sit below 32768: coturn's default 49152-65535 is the host's ephemeral range (macOS from 49152, Linux 32768-60999), where an outgoing socket of the host may hold a port when the container starts, and publishing it fails. Give each site on a machine a range of its own.

/visio/{token}?relay=1 forces every packet through the relay: the way to check the relay itself. No STUN server is configured by default (stun_urls): none of a third party's is asked. The compliance check "TURN relay" reads the direct gateway's options (Visio\Gateways::turn()); with another gateway there is no relay of yours to check.

Another gateway

composer require omnimeet/jitsi

# config/packages/omnimeet.yaml (Omnimeet\Bridge\Symfony\OmnimeetBundle registered)
omnimeet:
    gateways:
        jitsi:
            factory: jitsi
            options: { domain: meet.example.org, app_id: '%env(JITSI_APP_ID)%', app_secret: '%env(JITSI_APP_SECRET)%' }

# config/packages/office.yaml
office:
    visio:
        gateway: jitsi

The room's page then shows the provider's frame, driven by the gateway's script, with the same buttons, the same waiting room and the same end (public/js/visio-frame.js):

• the third party is named before anything is loaded from it (visio.provider.notice), and nothing is loaded before the visitor enters;
• with omnibase/consent on the site, it waits for the visitor's yes: the page declares the feature VISIO in the consent panel (Consent.use('VISIO', ...)), and entering is refused until it is on;
• the response's Permissions-Policy lets the provider's origin use the camera and the microphone; your Content-Security-Policy must allow it in frame-src and script-src;
• the host's "end" closes the room here whatever the provider does - the pages are told at their next "I am here" and drop the frame - and asks the provider's interface to end the conference where it can.

A gateway that only gives an address (Access of kind link) is rendered as a button, shown to the guest once the host is there.

Without glitchr/omnimeet's bundle

An application that does not register Omnimeet\Bridge\Symfony\OmnimeetBundle keeps its video room: DependencyInjection\Compiler\VisioGatewayPass makes the registry with the direct gateway alone, its relay read from office.visio.{turn_secret, turn_urls, stun_urls, turn_ttl} - the former place of these options, still read for this version (a deprecation notice says where they go). Base\Office\Visio\TurnCredentials and Base\Office\Visio\Signaling remain as deprecated names for Omnimeet\Direct\TurnCredentials and Omnimeet\Direct\Signaling.

Migration

office_visio_room gets two nullable columns, gateway and reference, and an index on reference (doctrine:migrations:diff). A room made before them is opened on the configured gateway the first time it is asked for.

The waiting room

The guest who is there while the host is not shows in the agenda (the appointment is outlined) and in the dashboard widget office_waiting_room - whatever the gateway: it is the room's presence.

What it is not

A recording, a group call (the direct gateway takes two), or a teleconsultation solution listed by a health authority - a regime says what its trade requires (omnibase/health says the built-in video is not ANS-listed); such a solution would be one more gateway.

What a regime builds on

A regime - omnibase/notary, omnibase/lawyer, omnibase/health - is the profession's own rules on top of omnibase/office. What two regimes need is written here once; a regime keeps what is its alone (its texts, its compliance checks, its table names).

Fields of practice: Area

Base\Office\Entity\Area is a mapped superclass: the name, the slug, a summary, the page's text, whether it is shown and where, who of the team follows it, and the methods around them (getParagraphs(), getPublicText() for the wording check, getItemsText() / setItemsText() for a form that edits the list one a line). A regime's entity extends it, names its table and maps the two things whose names are its own - the list of what is done in the field, and the join table of the members:

namespace Base\Notary\Entity;

#[ORM\Entity(repositoryClass: AreaRepository::class)]
#[ORM\Table(name: 'notary_area')]
class Area extends \Base\Office\Entity\Area
{
    #[ORM\Column(type: 'json')]
    protected array $deeds = [];                        // a lawyer's: $matters

    #[ORM\ManyToMany(targetEntity: Member::class)]
    #[ORM\JoinTable(name: 'notary_area_member')]
    protected Collection $members;

    public function getItems(): array { return $this->deeds; }
    public function setItems(?array $items): static { $this->deeds = self::lines($items); return $this; }
}

Its repository extends Base\Office\Repository\AreaRepository (findActive(), findOneActiveBySlug(), findForMember()) and names the entity in its constructor.

Base\Notary\Entity\Area and Base\Lawyer\Entity\Area were two copies of that class; they extend it since 2026-10-05 with the same tables, columns and methods (getDeeds(), getMatters()...): no migration, nothing to change in an application.

The wording guard: Wording

Base\Office\Guard\Wording::scan($text, $extra, $patterns) finds what the communication of a regulated practice must not carry - comparison with colleagues, disparagement, advertising's superlatives ("le meilleur", "numéro 1", "moins cher", "nos concurrents", "résultat garanti"...) - on the text lowered and stripped of its accents and tags (Wording::plain()).

• $extra: expressions of the site's own, matched as they are written;
• $patterns: a regime's own, label => regular expression, after the common ones. The lawyers add the mention of former judicial functions.

A regime keeps its own Wording (Base\Notary\Guard\Wording, Base\Lawyer\Guard\Wording: the same scan(), isClean(), plain() as before) citing its texts, and delegates here. A list of expressions helps the person who writes; it judges nothing.

A first appointment asked without an account

A practice's clients are invited, and the booking pages ask to sign in: someone new has no way in. Base\Office\Booking\AppointmentRequests is that way - what can be asked for (offer(): the appointment types in request mode open to everyone, and who offers them), the form as it opens (prepare(): the member a link named with ?avec=their-slug, the only type), and send(), which registers an appointment in request mode through Booker::request() under the name, the e-mail and the phone given - the few words encrypted, the e-mails those of any request.

The form is Base\Office\Form\AppointmentRequestType on Base\Office\Form\Model\AppointmentRequest: the type, with whom, name, e-mail, phone, a message, a field that only robots fill, and omnibase's PrivacyType (the data-protection notice and its box). Its labels are keys under label_prefix (@office.appointment_request).

• The bundle's own page: office.booking.public_request: true opens /rendez-vous/demande (office_request, @Office/client/request.html.twig, or office.templates.request). Off by default.
• A regime's page extends AbstractRequestController and answers with respond(): its route, its template, its words.

class RequestController extends \Base\Office\Controller\Client\AbstractRequestController
{
    #[Route('/rendez-vous/demande', name: 'notary_request', methods: ['GET', 'POST'], priority: 10)]
    public function request(Request $request): Response
    {
        return $this->respond($request, '@Notary/client/request.html.twig', 'notary', '@notary.request');
    }
}

The template receives form, sent, available and office. omnibase/notary and omnibase/lawyer each had the form, its model and the whole action; they keep their route (notary_request, lawyer_request), their page and their translations.

The practice's name

office.vocabulary.practice (Configuration) gives every text {the_practice}, {at_the_practice}, {of_the_practice}...: a regime's own translations may use them rather than write "le cabinet" or "l’étude".

Configuration reference

The office tree

Dumped with Symfony's YamlReferenceDumper from Base\Office\DependencyInjection\OfficeConfiguration. The keys are explained where they act: the practice's words and templates in omnibase/office, the booking in Booking, the vault in Share, the video room and its gateway in Visio.

office:

    # The office's timezone: schedules are written in it, slots are given in it.
    timezone:             Europe/Paris

    # Where a contact request is sent.
    recipient:            '%env(MAILER_CONTACT)%'

    # The From of the e-mails the office sends (confirmations, reminders, "a document awaits").
    sender:               '%env(MAILER_TECHNICAL)%'

    # How the practice is named in the bundle's texts ({the_practice}, {at_the_practice}, {of_the_practice}...). practice: cabinet | etude | office | maison_de_sante, or its forms: {practice: {name: centre de soins, the: le centre de soins, at: au centre de soins, of: du centre de soins}}.
    vocabulary:

        # Default:
        practice:            cabinet
    contact:

        # The warning above the contact form, a translation key: the regime chooses it (health: no medical data here, use your space).
        notice:               '@office.contact.notice'
        retention_months:     12

    # The public pages, a regime may give its own.
    templates:
        team:                 '@Office/client/team.html.twig'
        member:               '@Office/client/member.html.twig'
        hours:                '@Office/client/hours.html.twig'
        contact:              '@Office/client/contact.html.twig'

        # The page of a first appointment asked without an account (booking.public_request).
        request:              '@Office/client/request.html.twig'

        # A partial included at the top of the client's pages (appointments, documents): the regime's menu of the space.
        space_nav:            null

        # The template the pages extend.
        layout:               base.html.twig
    booking:
        enabled:              true

        # Opens /rendez-vous/demande (office_request): a first appointment asked without an account, registered in request mode. A regime with its own page (notary, lawyer) does not need it.
        public_request:       false

        # Minutes: a slot closer than this cannot be booked online.
        min_notice:           120

        # Days ahead a slot can be booked online.
        horizon:              60

        # Hours before the appointment the client may still cancel online.
        cancel_until:         24

        # Minutes between two slot starts; 0: the appointment type's duration plus its buffer.
        step:                 0

        # When reminders are sent: hours before the appointment.
        reminders:

            # Defaults:
            - 24
            - 2

        # The client's list of appointments, linked from the e-mails.
        space_route:          office_space_appointments
    share:
        enabled:              true

        # The Flysystem storage the encrypted files are written to: private, never under public/.
        storage:              local.share

        # Base64 of 32 bytes, from the secrets vault. Missing: nothing is stored or read (fail closed).
        master_key:           '%env(default::SHARE_MASTER_KEY)%'
        max_size:             20971520
        mime_types:

            # Defaults:
            - application/pdf
            - image/jpeg
            - image/png
            - image/webp
            - image/heic
            - text/plain

        # Where the "a document awaits" e-mail sends the recipient (sign-in required).
        space_route:          office_space_documents
    visio:
        enabled:              true

        # Minutes before the appointment the room opens.
        open_before:          10

        # Minutes after its planned end the room closes.
        close_after:          30

        # What carries the calls: the name of a glitchr/omnimeet gateway (omnimeet.gateways.<name>). "direct" - from browser to browser, omnimeet/direct - is declared for you.
        gateway:              direct

        # Whose name a gateway is given, to show the other: the host's - the member's, already public on the site - or none. The client's is never given: a provider would learn who consults.
        names:                host # One of "host"; "none"

        # Deprecated alias of omnimeet.gateways.direct.options.turn_secret - coturn's static-auth-secret: the temporary TURN credentials are signed with it.
        turn_secret:          '%env(default::TURN_SECRET)%'

        # Deprecated alias of omnimeet.gateways.direct.options.turn_urls.
        turn_urls:            []

        # Deprecated alias of omnimeet.gateways.direct.options.stun_urls.
        stun_urls:            []

        # Deprecated alias of omnimeet.gateways.direct.options.turn_ttl.
        turn_ttl:             3600

        # host:port the compliance check asks instead of the first TURN URL, when the server does not reach the relay by the address browsers use (a container's service name).
        turn_probe:           null

Each key is a container parameter (%office.timezone%, %office.templates.layout%, %office.booking.space_route%...).

Reference

Routes

The video room's token is 43 characters ([A-Za-z0-9_-]). The member CRUD has an action registry (/{entityId}/registry) a regime fills in (the Annuaire Santé for health).

Twig functions and filters

Events

A regime adds its listeners at a higher priority (omnibase/health names the appointment after the patient's profile on BOOKED and REQUESTED).

Commands

Enums

Extension points

Testing

Running the suite

vendor/bin/phpunit

Inside a host application:

php vendor/bin/phpunit -c vendor/omnibase/office/phpunit.xml.dist

omnisense/omnibase-harness installs neither omnibase/office nor omnisense/omnimeet. Run there without a kernel, with this checkout and omnisense/omnimeet's (core, direct, jitsi) on the autoloader, the suite gives:

OK (61 tests, 190 assertions)

What the tests check