fix(events): enforce series-pass, hidden, and deadline gates

Pre-launch P0 fixes surfaced by docs/specs/events-functional-test-matrix.md (Findings 1, 2, 3). 1. Series-pass bypass (Finding 1 / matrix S1 P3): register.post.js now loads the linked Series when tickets.requiresSeriesTicket is set and rejects drop-in registration unless series.allowIndividualEventTickets is true or the user has a valid pass. Data-integrity 500 if the referenced series is missing. 2. Hidden-event leak (Finding 2 / matrix E11): extract loadPublicEvent into server/utils/loadEvent.js. All five public event endpoints ([id].get, register, tickets/available, tickets/reserve, tickets/purchase) now go through the helper, which 404s when isVisible === false and the requester is not an admin. Admin detection uses a new non-throwing getOptionalMember() in server/utils/auth.js (extracted from the pattern already inlined in api/auth/status.get.js). 3. Deadline enforcement + legacy pricing retirement (Finding 3 / matrix E8): register.post.js and tickets/reserve.post.js delegate gating to validateTicketPurchase (which already covers deadline, cancelled, started, members-only, sold-out, and already-registered); tickets/available.get.js gets an explicit registrationDeadline check. Legacy pricing.paymentRequired 402 branch removed from register.post.js.
2026-04-20 19:03:34 +01:00 · 2026-04-20 19:03:34 +01:00 · f34b062f2a
commit f34b062f2a
parent 6a6c567fd5
11 changed files with 746 additions and 247 deletions
--- a/tests/server/api/events/deadline.test.js
+++ b/tests/server/api/events/deadline.test.js
@ -0,0 +1,226 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+import registerHandler from '../../../../server/api/events/[id]/register.post.js'
+import reserveHandler from '../../../../server/api/events/[id]/tickets/reserve.post.js'
+import availableHandler from '../../../../server/api/events/[id]/tickets/available.get.js'
+import { createMockEvent } from '../../helpers/createMockEvent.js'
+
+const {
+  mockLoadPublicEvent,
+  mockMemberFindOne,
+  mockFindByIdAndUpdate,
+  mockReserveTicket
+} = vi.hoisted(() => ({
+  mockLoadPublicEvent: vi.fn(),
+  mockMemberFindOne: vi.fn(),
+  mockFindByIdAndUpdate: vi.fn(),
+  mockReserveTicket: vi.fn()
+}))
+
+vi.mock('../../../../server/models/event.js', () => ({
+  default: { findByIdAndUpdate: mockFindByIdAndUpdate }
+}))
+
+vi.mock('../../../../server/models/member.js', () => ({
+  default: { findOne: mockMemberFindOne }
+}))
+
+vi.mock('../../../../server/utils/mongoose.js', () => ({
+  connectDB: vi.fn()
+}))
+
+vi.mock('../../../../server/utils/loadEvent.js', () => ({
+  loadPublicEvent: mockLoadPublicEvent
+}))
+
+vi.mock('../../../../server/utils/resend.js', () => ({
+  sendEventRegistrationEmail: vi.fn().mockResolvedValue(null)
+}))
+
+vi.mock('../../../../server/utils/tickets.js', async () => {
+  const actual = await vi.importActual('../../../../server/utils/tickets.js')
+  return {
+    ...actual,
+    reserveTicket: mockReserveTicket
+  }
+})
+
+const future = (ms) => new Date(Date.now() + ms)
+const past = (ms) => new Date(Date.now() - ms)
+
+function baseFreeEvent(overrides = {}) {
+  return {
+    _id: 'event-1',
+    slug: 'deadline-event',
+    title: 'Deadline Test',
+    startDate: future(3 * 86400000),
+    isCancelled: false,
+    registrations: [],
+    tickets: { enabled: false },
+    isVisible: true,
+    ...overrides
+  }
+}
+
+function baseTicketedEvent(overrides = {}) {
+  return {
+    _id: 'event-ticketed',
+    slug: 'ticketed-event',
+    title: 'Ticketed',
+    startDate: future(3 * 86400000),
+    isCancelled: false,
+    registrations: [],
+    tickets: {
+      enabled: true,
+      currency: 'CAD',
+      capacity: { total: 50 },
+      member: { available: true, price: 0, isFree: true, name: 'Member' },
+      public: { available: true, price: 15, quantity: 50, sold: 0, reserved: 0, name: 'GA' },
+      waitlist: { enabled: false }
+    },
+    isVisible: true,
+    ...overrides
+  }
+}
+
+function mkReq({ method = 'POST', path = '/', body, query = '', id = 'event-slug' } = {}) {
+  const req = createMockEvent({ method, path: path + (query ? `?${query}` : ''), body })
+  req.context = { params: { id } }
+  return req
+}
+
+describe('Registration deadline — register.post.js', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockMemberFindOne.mockResolvedValue(null)
+    mockFindByIdAndUpdate.mockImplementation((id, update) =>
+      Promise.resolve({ registrations: [{ ...update.$push.registrations, _id: 'r1' }] })
+    )
+  })
+
+  it('returns 400 with deadline reason when registrationDeadline has passed', async () => {
+    mockLoadPublicEvent.mockResolvedValue(
+      baseFreeEvent({ registrationDeadline: past(86400000) })
+    )
+
+    const req = mkReq({
+      path: '/api/events/deadline-event/register',
+      body: { email: 'a@example.com', name: 'A' }
+    })
+
+    await expect(registerHandler(req)).rejects.toMatchObject({
+      statusCode: 400,
+      statusMessage: expect.stringMatching(/deadline/i)
+    })
+    expect(mockFindByIdAndUpdate).not.toHaveBeenCalled()
+  })
+
+  it('succeeds on happy path when deadline is in the future', async () => {
+    mockLoadPublicEvent.mockResolvedValue(
+      baseFreeEvent({ registrationDeadline: future(86400000) })
+    )
+
+    const req = mkReq({
+      path: '/api/events/deadline-event/register',
+      body: { email: 'a@example.com', name: 'A' }
+    })
+
+    const result = await registerHandler(req)
+    expect(result.success).toBe(true)
+  })
+
+  it('no longer routes tickets.enabled events through legacy pricing 402', async () => {
+    mockLoadPublicEvent.mockResolvedValue(
+      baseTicketedEvent({
+        pricing: { paymentRequired: true, isFree: false }
+      })
+    )
+
+    const req = mkReq({
+      path: '/api/events/ticketed-event/register',
+      body: { email: 'a@example.com', name: 'A' }
+    })
+
+    const result = await registerHandler(req)
+    expect(result.success).toBe(true)
+  })
+})
+
+describe('Registration deadline — reserve.post.js', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockMemberFindOne.mockResolvedValue(null)
+    mockReserveTicket.mockResolvedValue({
+      success: true,
+      reservationId: 'res-1',
+      expiresAt: new Date(Date.now() + 600000)
+    })
+  })
+
+  it('returns 400 with deadline reason when registrationDeadline has passed', async () => {
+    mockLoadPublicEvent.mockResolvedValue(
+      baseTicketedEvent({ registrationDeadline: past(86400000) })
+    )
+
+    const req = mkReq({
+      path: '/api/events/ticketed-event/tickets/reserve',
+      body: { email: 'a@example.com' }
+    })
+
+    await expect(reserveHandler(req)).rejects.toMatchObject({
+      statusCode: 400,
+      statusMessage: expect.stringMatching(/deadline/i)
+    })
+    expect(mockReserveTicket).not.toHaveBeenCalled()
+  })
+
+  it('succeeds when deadline is in the future', async () => {
+    mockLoadPublicEvent.mockResolvedValue(
+      baseTicketedEvent({ registrationDeadline: future(86400000) })
+    )
+
+    const req = mkReq({
+      path: '/api/events/ticketed-event/tickets/reserve',
+      body: { email: 'a@example.com' }
+    })
+
+    const result = await reserveHandler(req)
+    expect(result.success).toBe(true)
+  })
+})
+
+describe('Registration deadline — available.get.js', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockMemberFindOne.mockResolvedValue(null)
+  })
+
+  it('returns available:false with deadline reason when deadline has passed', async () => {
+    mockLoadPublicEvent.mockResolvedValue(
+      baseTicketedEvent({ registrationDeadline: past(86400000) })
+    )
+
+    const req = mkReq({
+      method: 'GET',
+      path: '/api/events/ticketed-event/tickets/available'
+    })
+
+    const result = await availableHandler(req)
+    expect(result.available).toBe(false)
+    expect(result.reason).toMatch(/deadline/i)
+  })
+
+  it('returns availability normally when deadline is in the future', async () => {
+    mockLoadPublicEvent.mockResolvedValue(
+      baseTicketedEvent({ registrationDeadline: future(86400000) })
+    )
+
+    const req = mkReq({
+      method: 'GET',
+      path: '/api/events/ticketed-event/tickets/available'
+    })
+
+    const result = await availableHandler(req)
+    expect(result.available).toBe(true)
+  })
+})