feat(latepoint): add LatePoint booking notifications

[sadmansakibnadvi]

What this adds

LatePoint (wordpress.org, 10k+ installs) as a free realtime notification source feeding the existing conversions (Sales) Type. Confirmed appointments become social-proof popups — "Sarah C. just booked a Deep Tissue Massage".

This is NotificationX's first booking-plugin integration — there is currently no Amelia, Bookly or LatePoint source. Requested by a client using both plugins.

Free rather than Pro-gated: LatePoint is self-hosted with local hooks, so there are no API keys or SaaS account to gate. Same shape as Tutor LMS, GiveWP, SureCart and FluentCart.

Why it looks more defensive than a typical integration

LatePoint's hook coverage is incomplete and its creation path is racy, so correctness has to be defended rather than assumed. Every decision below exists for a verified upstream defect, not on principle:

Decision	The defect it defends
Buffered, order-anchored capture	latepoint_booking_created fires once per booking with no cap — a weekly-for-a-year recurrence is ~52 events in one request, a cart one per line item. Writing there would emit N popups for one customer. Flushed once on latepoint_order_created and latepoint_order_updated (LatePoint fires the latter when a booking is added to an existing order), plus a shutdown fallback because the bundle-scheduling branch never reaches an order hook at all.
Delete-then-reinsert on every write	nx_entries writes are INSERT-only with no unique constraint, so re-saving an entry_key duplicates rather than updates.
latepoint_booking_updated + local status diff	latepoint_booking_change_status fires from exactly one admin form and is skipped by cabinet cancellations, email-link cancellations, bulk actions and change_booking_status().
Retract on will_be_deleted, not deleted	Deleting an order fires the former for each booking but never the latter.
Daily reconciliation cron	Deleting a customer cascades to their bookings with no booking-specific hook, and the abilities/MCP-AI layer creates, changes and deletes bookings firing nothing at all. Also retracts popups for a service hidden after capture.
Capture-time status allowlist	LatePoint lets admins define arbitrary custom statuses, so anything unrecognised must not display. Defaults to Approved + Completed.
Hand-written DTO	$booking->get_data_vars() serializes customer email, phone, free-text customer_comment, and manage_booking_* URLs — which are bearer credentials granting no-login view/reschedule/cancel. Never called anywhere in this integration.
entry_key namespaced latepoint_{id}, delete_notification() always given both args	Works around #142 (the source predicate is commented out, so a bare entry_key deletes other sources' rows).

Privacy

Appointments are materially more sensitive than purchases — clinics, legal, counselling. LatePoint never exposes customer names publicly, so this popup is the first place that data becomes public. Names are masked to first name + last initial; a Hide Service Name toggle degrades the popup to "just booked an appointment" and suppresses the service image; hidden/inactive services and blank-name bookings are excluded outright; and the reconciliation cron honours erasure.

Testing

Automated: tests/test-latepoint.php — the suite goes 25 → 64 tests (843 → 891 assertions), all passing. Focused on check_booking_eligibility(), the gate that stops cancelled bookings and hidden services reaching a public page, including an explicit proof that it is an allowlist rather than a denylist. Two tests are skipped with stated reasons (they genuinely need the LatePoint plugin).

Live: 30 scenarios run against a real WordPress + LatePoint 5.6.9 install, 30/30 passing:

Scenario results

PASS | single booking -> exactly one popup
PASS | name masked to first + last initial
PASS | entry_key namespaced
PASS | service name captured
PASS | cart of 3 -> ONE popup not three
PASS | booking_count removed (unrenderable by design)
PASS | recurring x52 -> ONE popup not 52
PASS | pending booking is NOT shown
PASS | pending -> approved now appears
PASS | approved -> cancelled is retracted
PASS | double-fire of booking_updated -> still one row
PASS | order delete path (will_be_deleted) retracts
PASS | GDPR: silent customer-delete cascade cleaned by reconcile()
PASS | blank-name customer skipped, not blank popup
PASS | hidden service is NEVER advertised
PASS | midnight (00:00) booking renders
PASS | dedupe_hash removed (was never compared)
PASS | hide-service-name masks the title
PASS | toggle off leaves the real name
PASS | backfill respects display_last=5
PASS | PII: no manage_booking bearer URL stored
PASS | PII: no phone stored
PASS | PII: no customer_comment stored
PASS | FIX4 display_last=1 backfills exactly one (was zero)
PASS | FIX5 buffer not yet written before shutdown
PASS | FIX5 shutdown fallback flushes orphaned buffer
PASS | FIX9 buffered + updated + flushed in one request => ONE row
PASS | FIX3 hide-service-name suppresses the service image
PASS | FIX1 image filter preserves alt (a11y)
PASS | FIX8 link_type=none is respected

Live testing found a real bug that review had not: booking_link and mask_service_name were registered in init_fields(), which initialize() hooks to nx_before_metabox_load — fired only by GlobalFields::tabs() in the admin builder. Both are display-time filters, so on the public site the Hide Service Name toggle silently did nothing. Moved to public_actions(), matching WooCommerce.

Heads-up for a separate fix: SureCart has this same latent bug — SureCart.php:55 registers nx_notification_link_surecart in init_fields(), so its product link never applies on the frontend.

Scope

~1,450 lines across 10 files. No React, no webpack build, no new notification Type, no DB migration.

GlobalFields.php is purely additive (three fields, all gated with Rules::includes('source', ['latepoint'])) — no existing line touched, so there is no regression path to other sources. composer.json and vendor/autoload.php are deliberately untouched; only the two classmap files change.

Related issues

Found while building this, all filed separately and not fixed here:

• Bug: Extension::delete_notification() deletes entries across all sources (source predicate commented out) #142 — Extension::delete_notification() deletes across all sources (the source predicate is commented out). This PR works around it; the workaround can be simplified once Bug: Extension::delete_notification() deletes entries across all sources (source predicate commented out) #142 lands.
• No WordPress privacy exporters/erasers for personal data in nx_entries #143 — no WordPress privacy exporters/erasers for personal data in nx_entries. Affects every source; one exporter/eraser pair keyed on data.email would cover them all.
• Bug: Entries::count() memo is not keyed by $source/$col, so Limiter's cache_limit silently fails to apply #144 — Entries::count() memo is not keyed by $source/$col, so Limiter's cache_limit silently fails to apply.

Four defects in LatePoint 5.6.9 itself are being reported to that vendor privately rather than linked here, as one is an unauthenticated write path.

Reviewer notes

• The two is_pro fields adjacent to the new ones in GlobalFields.php (surecart_order_status, fluentcart_order_status) are Pro-gated; the LatePoint fields deliberately are not.
• Thumbnails are resolved at capture time and stored on the entry (as SureCart/FluentCart do). The tradeoff is that changing a service image needs a Regenerate to refresh existing entries — resolving at display time cost hundreds of uncached queries per pageview.
• Existing campaigns default to link_type = none, so they will not link until an owner selects Booking Page in the Link Type dropdown (this PR registers that option via nx_link_types).

🤖 Generated with Claude Code