Paddy
1de0cc6940
- Voucher generation (wildcard + personalized) now validates every eventId against the event_ticket_settings allow-list before minting codes. Previously a direct API call bypassing the admin picker could mint a fully-uncapped, no-deadline redeemable code for any Calendar event, including non-concert ones. - Redemption now checks the Calendar event isn't DELETED (validateVoucher and redeemVoucher both). Previously a concert canceled/deleted after codes were issued stayed silently redeemable. DRAFT events remain eligible on purpose - vouchers are sometimes sent before a concert is publicly announced. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>