jennie/ghostguild-org
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(events): read allowIndividualEventTickets from series.tickets
Some checks failed
Test / Notify on failure (push) Blocked by required conditions
Details
Test / visual (push) Blocked by required conditions
Details
Test / vitest (push) Successful in 10m59s
Details
Test / playwright (push) Has been cancelled
Details

Browse source 
The series-pass gate in register.post.js was checking
`series.allowIndividualEventTickets` at the top level, but the field
lives under `series.tickets.allowIndividualEventTickets` per the
Series schema. Top-level access was always undefined, so `!undefined`
always fired the pass check — blocking drop-in registration even when
an admin enabled `(requiresSeriesTicket=true, allowIndividualEventTickets=true)`.

The bug failed closed (overprotective), so no bypass was possible.
The existing test mirrored the bug by mocking the field at the top
level; updated the three mocks to nest it under `tickets` so the test
shape matches the real schema.
This commit is contained in:
Jennie Robinson Faber 2026-04-20 19:25:24 +01:00
parent f34b062f2a
commit 4e1888ae8e
2 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
server/api/events/[id]/register.post.js
View file

@ -34,7 +34,7 @@ export default defineEventHandler(async (event) => {
statusMessage: "Series referenced by this event could not be found", statusMessage: "Series referenced by this event could not be found",
}); });
} }
if (!series.allowIndividualEventTickets) { if (!series.tickets?.allowIndividualEventTickets) {
const { hasPass } = checkUserSeriesPass(series, body.email); const { hasPass } = checkUserSeriesPass(series, body.email);
if (!hasPass) { if (!hasPass) {
throw createError({ throw createError({

6
tests/server/api/events/register-series.test.js
View file

@ -109,7 +109,7 @@ describe('POST /api/events/[id]/register — series-pass enforcement', () => {
mockSeriesFindById.mockResolvedValue({ mockSeriesFindById.mockResolvedValue({
_id: seriesId, _id: seriesId,
slug: 'series-slug', slug: 'series-slug',
allowIndividualEventTickets: false, tickets: { allowIndividualEventTickets: false },
registrations: [] registrations: []
}) })
mockCheckUserSeriesPass.mockReturnValue({ hasPass: false, registration: null }) mockCheckUserSeriesPass.mockReturnValue({ hasPass: false, registration: null })
@ -138,7 +138,7 @@ describe('POST /api/events/[id]/register — series-pass enforcement', () => {
mockSeriesFindById.mockResolvedValue({ mockSeriesFindById.mockResolvedValue({
_id: seriesId, _id: seriesId,
slug: 'series-slug', slug: 'series-slug',
allowIndividualEventTickets: false, tickets: { allowIndividualEventTickets: false },
registrations: [] registrations: []
}) })
mockCheckUserSeriesPass.mockReturnValue({ mockCheckUserSeriesPass.mockReturnValue({
@ -166,7 +166,7 @@ describe('POST /api/events/[id]/register — series-pass enforcement', () => {
mockSeriesFindById.mockResolvedValue({ mockSeriesFindById.mockResolvedValue({
_id: seriesId, _id: seriesId,
slug: 'series-dropin', slug: 'series-dropin',
allowIndividualEventTickets: true, tickets: { allowIndividualEventTickets: true },
registrations: [] registrations: []
}) })
mockCheckUserSeriesPass.mockReturnValue({ hasPass: false, registration: null }) mockCheckUserSeriesPass.mockReturnValue({ hasPass: false, registration: null })