jennie/ghostguild-org
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(events): enforce series-pass, hidden, and deadline gates

Browse source 
Pre-launch P0 fixes surfaced by docs/specs/events-functional-test-matrix.md
(Findings 1, 2, 3).

1. Series-pass bypass (Finding 1 / matrix S1 P3): register.post.js now
   loads the linked Series when tickets.requiresSeriesTicket is set and
   rejects drop-in registration unless series.allowIndividualEventTickets
   is true or the user has a valid pass. Data-integrity 500 if the
   referenced series is missing.

2. Hidden-event leak (Finding 2 / matrix E11): extract loadPublicEvent
   into server/utils/loadEvent.js. All five public event endpoints
   ([id].get, register, tickets/available, tickets/reserve,
   tickets/purchase) now go through the helper, which 404s when
   isVisible === false and the requester is not an admin. Admin detection
   uses a new non-throwing getOptionalMember() in server/utils/auth.js
   (extracted from the pattern already inlined in api/auth/status.get.js).

3. Deadline enforcement + legacy pricing retirement (Finding 3 / matrix
   E8): register.post.js and tickets/reserve.post.js delegate gating to
   validateTicketPurchase (which already covers deadline, cancelled,
   started, members-only, sold-out, and already-registered);
   tickets/available.get.js gets an explicit registrationDeadline check.
   Legacy pricing.paymentRequired 402 branch removed from register.post.js.
This commit is contained in:
Jennie Robinson Faber 2026-04-20 19:03:34 +01:00
parent 6a6c567fd5
commit f34b062f2a
11 changed files with 746 additions and 247 deletions
Download patch file Download diff file Expand all files Collapse all files

60
server/api/events/[id].get.js
View file

@ -1,65 +1,29 @@
import Event from '../../models/event.js'
import { connectDB } from '../../utils/mongoose.js'
import mongoose from 'mongoose'
import { loadPublicEvent } from '../../utils/loadEvent.js'
export default defineEventHandler(async (event) => {
try {
// Ensure database connection
await connectDB()
const identifier = getRouterParam(event, 'id')
if (!identifier) {
throw createError({
statusCode: 400,
statusMessage: 'Event identifier is required'
})
}
// Fetch event from database - try by slug first, then by ID
let eventData
// Check if identifier is a valid MongoDB ObjectId
if (mongoose.Types.ObjectId.isValid(identifier)) {
eventData = await Event.findById(identifier)
.select('-registrations.email') // Hide emails for privacy
.lean()
}
// If not found by ID or not a valid ObjectId, try by slug
if (!eventData) {
eventData = await Event.findOne({ slug: identifier })
.select('-registrations.email') // Hide emails for privacy
.lean()
}
if (!eventData) {
throw createError({
statusCode: 404,
statusMessage: 'Event not found'
})
}
// Add computed fields
const eventWithMeta = {
const eventData = await loadPublicEvent(event, identifier, {
lean: true,
select: '-registrations.email'
})
return {
...eventData,
id: eventData._id.toString(),
registeredCount: eventData.registrations?.length || 0,
isFull: eventData.maxAttendees ?
(eventData.registrations?.length || 0) >= eventData.maxAttendees :
false
isFull: eventData.maxAttendees
? (eventData.registrations?.length || 0) >= eventData.maxAttendees
: false
}
return eventWithMeta
} catch (error) {
console.error('Error fetching event:', error)
if (error.statusCode) {
throw error
}
console.error('Error fetching event:', error)
throw createError({
statusCode: 500,
statusMessage: 'Failed to fetch event'
})
}
})
})

127
server/api/events/[id]/register.post.js
View file

@ -1,97 +1,70 @@
import Event from "../../../models/event.js";
import Member from "../../../models/member.js";
import { connectDB } from "../../../utils/mongoose.js";
import Series from "../../../models/series.js";
import Event from "../../../models/event.js";
import { sendEventRegistrationEmail } from "../../../utils/resend.js";
import { validateBody } from "../../../utils/validateBody.js";
import { eventRegistrationSchema } from "../../../utils/schemas.js";
import { hasMemberAccess } from "../../../utils/tickets.js";
import mongoose from "mongoose";
import { loadPublicEvent } from "../../../utils/loadEvent.js";
import {
hasMemberAccess,
validateTicketPurchase,
checkUserSeriesPass,
} from "../../../utils/tickets.js";
export default defineEventHandler(async (event) => {
try {
// Ensure database connection
await connectDB();
const identifier = getRouterParam(event, "id");
const body = await validateBody(event, eventRegistrationSchema);
if (!identifier) {
throw createError({
statusCode: 400,
statusMessage: "Event identifier is required",
});
}
const eventData = await loadPublicEvent(event, identifier);
// Fetch the event - try by slug first, then by ID
let eventData;
// Check if identifier is a valid MongoDB ObjectId
if (mongoose.Types.ObjectId.isValid(identifier)) {
eventData = await Event.findById(identifier);
}
// If not found by ID or not a valid ObjectId, try by slug
if (!eventData) {
eventData = await Event.findOne({ slug: identifier });
}
if (!eventData) {
throw createError({
statusCode: 404,
statusMessage: "Event not found",
});
}
// Check if event is full
// Series-pass gate: when an event is linked to a series and that series
// requires a pass, reject drop-in registration unless the series
// explicitly allows individual event tickets.
if (
eventData.maxAttendees &&
eventData.registrations.length >= eventData.maxAttendees
eventData.tickets?.requiresSeriesTicket &&
eventData.tickets?.seriesTicketReference
) {
throw createError({
statusCode: 400,
statusMessage: "Event is full",
});
const series = await Series.findById(
eventData.tickets.seriesTicketReference,
);
if (!series) {
throw createError({
statusCode: 500,
statusMessage: "Series referenced by this event could not be found",
});
}
if (!series.allowIndividualEventTickets) {
const { hasPass } = checkUserSeriesPass(series, body.email);
if (!hasPass) {
throw createError({
statusCode: 403,
statusMessage:
"This event requires a series pass. See the series page to purchase.",
data: { seriesSlug: series.slug },
});
}
}
}
// Check if already registered
const alreadyRegistered = eventData.registrations.some(
(reg) => reg.email.toLowerCase() === body.email.toLowerCase(),
);
if (alreadyRegistered) {
throw createError({
statusCode: 400,
statusMessage: "You are already registered for this event",
});
}
// Check member status and handle different registration scenarios.
// Member access is decoupled from payment status: active and pending_payment
// both confer access; guest, suspended, and cancelled do not.
// Look up member for pricing/access purposes. hasMemberAccess treats
// guest/suspended/cancelled as non-members.
const member = await Member.findOne({ email: body.email.toLowerCase() });
// Single gate: validateTicketPurchase covers deadline, cancelled, already
// started, already-registered, members-only, and sold-out.
const validation = validateTicketPurchase(eventData, {
email: body.email,
name: body.name,
member: hasMemberAccess(member) ? member : null,
});
if (!validation.valid) {
const statusCode = /members only/i.test(validation.reason) ? 403 : 400;
throw createError({ statusCode, statusMessage: validation.reason });
}
const memberHasAccess = hasMemberAccess(member);
if (eventData.membersOnly && !memberHasAccess) {
throw createError({
statusCode: 403,
statusMessage:
"This event is for members only. Please become a member to register.",
});
}
// If event requires payment and user is not a member, redirect to payment flow
if (
eventData.pricing?.paymentRequired &&
!eventData.pricing?.isFree &&
!memberHasAccess
) {
throw createError({
statusCode: 402, // Payment Required
statusMessage:
"This event requires payment. Please use the payment registration endpoint.",
});
}
// Set member status and membership level
let isMember = false;
let membershipLevel = "non-member";

70
server/api/events/[id]/tickets/available.get.js
View file

@ -1,12 +1,10 @@
import Event from "../../../../models/event.js";
import Member from "../../../../models/member.js";
import { connectDB } from "../../../../utils/mongoose.js";
import { loadPublicEvent } from "../../../../utils/loadEvent.js";
import {
calculateTicketPrice,
checkTicketAvailability,
formatPrice,
} from "../../../../utils/tickets.js";
import mongoose from "mongoose";
/**
* GET /api/events/[id]/tickets/available
@ -15,56 +13,32 @@ import mongoose from "mongoose";
*/
export default defineEventHandler(async (event) => {
try {
await connectDB();
const identifier = getRouterParam(event, "id");
const query = getQuery(event);
const userEmail = query.email;
if (!identifier) {
throw createError({
statusCode: 400,
statusMessage: "Event identifier is required",
});
}
const eventData = await loadPublicEvent(event, identifier);
// Fetch the event
let eventData;
if (mongoose.Types.ObjectId.isValid(identifier)) {
eventData = await Event.findById(identifier);
}
if (!eventData) {
eventData = await Event.findOne({ slug: identifier });
}
if (!eventData) {
throw createError({
statusCode: 404,
statusMessage: "Event not found",
});
}
// Check if event is cancelled or past
if (eventData.isCancelled) {
return {
available: false,
reason: "Event has been cancelled",
};
return { available: false, reason: "Event has been cancelled" };
}
if (new Date(eventData.startDate) < new Date()) {
return {
available: false,
reason: "Event has already started",
};
return { available: false, reason: "Event has already started" };
}
if (
eventData.registrationDeadline &&
new Date(eventData.registrationDeadline) < new Date()
) {
return { available: false, reason: "Registration deadline has passed" };
}
// Check if user is a member (if email provided)
let member = null;
if (userEmail) {
member = await Member.findOne({ email: userEmail.toLowerCase() });
}
// Calculate ticket pricing for this user
const ticketInfo = calculateTicketPrice(eventData, member);
if (!ticketInfo) {
@ -77,13 +51,11 @@ export default defineEventHandler(async (event) => {
};
}
// Check availability
const availability = checkTicketAvailability(
eventData,
ticketInfo.ticketType
ticketInfo.ticketType,
);
// Build response
const response = {
available: availability.available,
ticketType: ticketInfo.ticketType,
@ -98,38 +70,32 @@ export default defineEventHandler(async (event) => {
waitlistAvailable: availability.waitlistAvailable,
};
// Add early bird deadline if applicable
if (
ticketInfo.isEarlyBird &&
eventData.tickets?.public?.earlyBirdDeadline
) {
if (ticketInfo.isEarlyBird && eventData.tickets?.public?.earlyBirdDeadline) {
response.earlyBirdDeadline = eventData.tickets.public.earlyBirdDeadline;
response.regularPrice = eventData.tickets.public.price;
response.formattedRegularPrice = formatPrice(
eventData.tickets.public.price,
ticketInfo.currency
ticketInfo.currency,
);
}
// Add member vs public comparison for transparency
if (member && eventData.tickets?.public?.available) {
response.publicTicket = {
price: eventData.tickets.public.price,
formattedPrice: formatPrice(
eventData.tickets.public.price,
eventData.tickets.currency
eventData.tickets.currency,
),
};
response.memberSavings =
eventData.tickets.public.price - ticketInfo.price;
}
// Check if user is already registered
if (userEmail) {
const alreadyRegistered = eventData.registrations?.some(
(reg) =>
reg.email.toLowerCase() === userEmail.toLowerCase() &&
!reg.cancelledAt
!reg.cancelledAt,
);
if (alreadyRegistered) {
@ -141,12 +107,10 @@ export default defineEventHandler(async (event) => {
return response;
} catch (error) {
console.error("Error checking ticket availability:", error);
if (error.statusCode) {
throw error;
}
console.error("Error checking ticket availability:", error);
throw createError({
statusCode: 500,
statusMessage: "Failed to check ticket availability",

31
server/api/events/[id]/tickets/purchase.post.js
View file

@ -1,14 +1,13 @@
import Event from "../../../../models/event.js";
import Member from "../../../../models/member.js";
import { connectDB } from "../../../../utils/mongoose.js";
import { loadPublicEvent } from "../../../../utils/loadEvent.js";
import { validateBody } from "../../../../utils/validateBody.js";
import { ticketPurchaseSchema } from "../../../../utils/schemas.js";
import {
validateTicketPurchase,
calculateTicketPrice,
completeTicketPurchase,
hasMemberAccess,
} from "../../../../utils/tickets.js";
import { sendEventRegistrationEmail } from "../../../../utils/resend.js";
import mongoose from "mongoose";
/**
* POST /api/events/[id]/tickets/purchase
@ -17,32 +16,10 @@ import mongoose from "mongoose";
*/
export default defineEventHandler(async (event) => {
try {
await connectDB();
const identifier = getRouterParam(event, "id");
const body = await validateBody(event, ticketPurchaseSchema);
if (!identifier) {
throw createError({
statusCode: 400,
statusMessage: "Event identifier is required",
});
}
// Fetch the event
let eventData;
if (mongoose.Types.ObjectId.isValid(identifier)) {
eventData = await Event.findById(identifier);
}
if (!eventData) {
eventData = await Event.findOne({ slug: identifier });
}
if (!eventData) {
throw createError({
statusCode: 404,
statusMessage: "Event not found",
});
}
const eventData = await loadPublicEvent(event, identifier);
// Check if user is a member. Only members with access (active or
// pending_payment) count for pricing/validation; guest, suspended,

57
server/api/events/[id]/tickets/reserve.post.js
View file

@ -1,11 +1,13 @@
import Event from "../../../../models/event.js";
import Member from "../../../../models/member.js";
import { connectDB } from "../../../../utils/mongoose.js";
import { loadPublicEvent } from "../../../../utils/loadEvent.js";
import { validateBody } from "../../../../utils/validateBody.js";
import { ticketReserveSchema } from "../../../../utils/schemas.js";
import {
calculateTicketPrice,
hasMemberAccess,
reserveTicket,
validateTicketPurchase,
} from "../../../../utils/tickets.js";
import mongoose from "mongoose";
/**
* POST /api/events/[id]/tickets/reserve
@ -14,47 +16,28 @@ import mongoose from "mongoose";
*/
export default defineEventHandler(async (event) => {
try {
await connectDB();
const identifier = getRouterParam(event, "id");
const body = await validateBody(event, ticketReserveSchema);
if (!identifier) {
throw createError({
statusCode: 400,
statusMessage: "Event identifier is required",
});
}
const eventData = await loadPublicEvent(event, identifier);
// Fetch the event
let eventData;
if (mongoose.Types.ObjectId.isValid(identifier)) {
eventData = await Event.findById(identifier);
}
if (!eventData) {
eventData = await Event.findOne({ slug: identifier });
}
if (!eventData) {
throw createError({
statusCode: 404,
statusMessage: "Event not found",
});
}
// Check if user is a member
const member = await Member.findOne({ email: body.email.toLowerCase() });
// Calculate ticket type
const ticketInfo = calculateTicketPrice(eventData, member);
// Gate on deadline, cancellation, start, members-only, sold-out, and
// already-registered before reserving.
const validation = validateTicketPurchase(eventData, {
email: body.email,
member: hasMemberAccess(member) ? member : null,
});
if (!ticketInfo) {
throw createError({
statusCode: 400,
statusMessage: "No tickets available for your membership status",
});
if (!validation.valid) {
const statusCode = /members only/i.test(validation.reason) ? 403 : 400;
throw createError({ statusCode, statusMessage: validation.reason });
}
// Reserve the ticket
const ticketInfo =
validation.ticketInfo || calculateTicketPrice(eventData, member);
const reservation = await reserveTicket(eventData, ticketInfo.ticketType);
if (!reservation.success) {
@ -73,12 +56,10 @@ export default defineEventHandler(async (event) => {
},
};
} catch (error) {
console.error("Error reserving ticket:", error);
if (error.statusCode) {
throw error;
}
console.error("Error reserving ticket:", error);
throw createError({
statusCode: 500,
statusMessage: "Failed to reserve ticket",

26
server/utils/auth.js
View file

@ -75,6 +75,32 @@ export async function requireAuth(event) {
return member
}
/**
* Return the signed-in Member without throwing.
* Returns null when no cookie, invalid token, or member not found/inactive.
* Mirrors the non-throwing JWT check in api/auth/status.get.js.
*/
export async function getOptionalMember(event) {
await connectDB()
const token = getCookie(event, 'auth-token')
if (!token) return null
let decoded
try {
decoded = jwt.verify(token, useRuntimeConfig(event).jwtSecret)
} catch {
return null
}
const member = await Member.findById(decoded.memberId)
if (!member) return null
if (member.status === 'suspended' || member.status === 'cancelled') return null
if (decoded.tv !== member.tokenVersion) return null
return member
}
/**
* Verify JWT and require admin role.
* Throws 401 if not authenticated, 403 if not admin.

55
server/utils/loadEvent.js Normal file
View file

@ -0,0 +1,55 @@
import mongoose from 'mongoose'
import Event from '../models/event.js'
import { connectDB } from './mongoose.js'
import { getOptionalMember } from './auth.js'
/**
* Load an event by ObjectId or slug for public (non-admin) endpoints.
* Enforces the isVisible gate: hidden events 404 for everyone except admins.
*
* @param {Object} reqEvent - h3 event (for auth/cookie access)
* @param {String} identifier - ObjectId string or slug
* @param {Object} [options]
* @param {Boolean} [options.lean] - apply .lean() to the query
* @param {String} [options.select] - apply .select() to the query
* @returns {Promise<Object>} the event document
*/
export async function loadPublicEvent(reqEvent, identifier, options = {}) {
if (!identifier) {
throw createError({
statusCode: 400,
statusMessage: 'Event identifier is required'
})
}
await connectDB()
const { lean = false, select = null } = options
const applyOptions = (query) => {
if (select) query = query.select(select)
if (lean) query = query.lean()
return query
}
let eventDoc
if (mongoose.Types.ObjectId.isValid(identifier)) {
eventDoc = await applyOptions(Event.findById(identifier))
}
if (!eventDoc) {
eventDoc = await applyOptions(Event.findOne({ slug: identifier }))
}
if (!eventDoc) {
throw createError({ statusCode: 404, statusMessage: 'Event not found' })
}
if (eventDoc.isVisible === false) {
const requester = await getOptionalMember(reqEvent)
if (requester?.role !== 'admin') {
throw createError({ statusCode: 404, statusMessage: 'Event not found' })
}
}
return eventDoc
}