Add Tickets domain for the voucher-based ticket shop #8

2026-08-23T21:05:01Z

Paddy commented

2026-08-23 21:05:01 +00:00

No description provided.

Paddy added 2 commits 2026-08-23 21:05:02 +00:00

Add Tickets domain for the voucher-based ticket shop b6499eb7b3

New domain mirroring the Feedback module's conventions: single-use voucher
codes (wildcard + personalized), redemption with race-safe capacity and
deadline enforcement, admin CRUD for vouchers/redemptions/event settings
with an audit trail, and reuse of the existing Calendar session auth.

Backend pieces:
- Tickets domain (public redeem flow, admin vouchers/redemptions/events)
- Calendar events.service.ts: add getEventById
- Mailer: attachment/HTML support, fix a shared-mutable-state race
- Per-event capacity/deadline/address settings, with an "address
  required" option on top of "address collected"
- Email format validation on redeem and admin voucher/redemption input
- Docker Compose dev stack (MariaDB + seed data) for local testing

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Fix two security/data-integrity gaps found in code review 1de0cc6940

- Voucher generation (wildcard + personalized) now validates every
  eventId against the event_ticket_settings allow-list before minting
  codes. Previously a direct API call bypassing the admin picker could
  mint a fully-uncapped, no-deadline redeemable code for any Calendar
  event, including non-concert ones.
- Redemption now checks the Calendar event isn't DELETED (validateVoucher
  and redeemVoucher both). Previously a concert canceled/deleted after
  codes were issued stayed silently redeemable. DRAFT events remain
  eligible on purpose - vouchers are sometimes sent before a concert is
  publicly announced.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Paddy merged commit 3c4f3331d8 into master

2026-08-24 21:18:01 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Nachklang/API#8