- Voucher generation (wildcard + personalized) now validates every
eventId against the event_ticket_settings allow-list before minting
codes. Previously a direct API call bypassing the admin picker could
mint a fully-uncapped, no-deadline redeemable code for any Calendar
event, including non-concert ones.
- Redemption now checks the Calendar event isn't DELETED (validateVoucher
and redeemVoucher both). Previously a concert canceled/deleted after
codes were issued stayed silently redeemable. DRAFT events remain
eligible on purpose - vouchers are sometimes sent before a concert is
publicly announced.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
New domain mirroring the Feedback module's conventions: single-use voucher
codes (wildcard + personalized), redemption with race-safe capacity and
deadline enforcement, admin CRUD for vouchers/redemptions/event settings
with an audit trail, and reuse of the existing Calendar session auth.
Backend pieces:
- Tickets domain (public redeem flow, admin vouchers/redemptions/events)
- Calendar events.service.ts: add getEventById
- Mailer: attachment/HTML support, fix a shared-mutable-state race
- Per-event capacity/deadline/address settings, with an "address
required" option on top of "address collected"
- Email format validation on redeem and admin voucher/redemption input
- Docker Compose dev stack (MariaDB + seed data) for local testing
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Paddy
