The series-pass gate in register.post.js was checking `series.allowIndividualEventTickets` at the top level, but the field lives under `series.tickets.allowIndividualEventTickets` per the Series schema. Top-level access was always undefined, so `!undefined` always fired the pass check — blocking drop-in registration even when an admin enabled `(requiresSeriesTicket=true, allowIndividualEventTickets=true)`. The bug failed closed (overprotective), so no bypass was possible. The existing test mirrored the bug by mocking the field at the top level; updated the three mocks to nest it under `tickets` so the test shape matches the real schema. |
||
|---|---|---|
| .. | ||
| tickets | ||
| calendar.get.js | ||
| cancel-registration.post.js | ||
| check-registration.post.js | ||
| check-series-access.get.js | ||
| payment.post.js | ||
| register.post.js | ||
| waitlist.delete.js | ||
| waitlist.post.js | ||