fix: use private helcimApiToken for all server-side Helcim API calls

server/api/events/[id]/cancel-registration.post.js

@@ -3,12 +3,15 @@ import {
   sendEventCancellationEmail,
   sendWaitlistNotificationEmail,
 } from "../../../utils/resend.js";
+import { connectDB } from "../../../utils/mongoose.js";
 
 export default defineEventHandler(async (event) => {
   const id = getRouterParam(event, "id");
   const body = await validateBody(event, cancelRegistrationSchema);
   const { email } = body;
 
+  await connectDB();
+
   try {
     // Check if id is a valid ObjectId or treat as slug
     const isObjectId = /^[0-9a-fA-F]{24}$/.test(id);
@@ -46,13 +49,15 @@ export default defineEventHandler(async (event) => {
         eventDoc.registrations[registrationIndex].membershipLevel,
     };
 
-    // Remove the registration
-    eventDoc.registrations.splice(registrationIndex, 1);
-
-    // Update registered count
-    eventDoc.registeredCount = eventDoc.registrations.length;
-
-    await eventDoc.save();
+    // Use $pull to avoid re-validating the whole document (e.g. legacy location formats)
+    await Event.findByIdAndUpdate(
+      eventDoc._id,
+      {
+        $pull: { registrations: { email: registration.email } },
+        $inc: { registeredCount: -1 },
+      },
+      { runValidators: false }
+    );
 
     // Send cancellation confirmation email
     try {
@@ -90,9 +95,13 @@ export default defineEventHandler(async (event) => {
         if (waitlistEntry) {
           await sendWaitlistNotificationEmail(waitlistEntry, eventData);
 
-          // Mark as notified
-          waitlistEntry.notified = true;
-          await eventDoc.save();
+          // Mark as notified using findByIdAndUpdate to avoid re-validating the document
+          const entryIndex = eventDoc.tickets.waitlist.entries.indexOf(waitlistEntry);
+          await Event.findByIdAndUpdate(
+            eventDoc._id,
+            { $set: { [`tickets.waitlist.entries.${entryIndex}.notified`]: true } },
+            { runValidators: false }
+          );
         }
       } catch (waitlistError) {
         // Log error but don't fail the cancellation