Jennie Robinson Faber
f34b062f2a
Pre-launch P0 fixes surfaced by docs/specs/events-functional-test-matrix.md (Findings 1, 2, 3). 1. Series-pass bypass (Finding 1 / matrix S1 P3): register.post.js now loads the linked Series when tickets.requiresSeriesTicket is set and rejects drop-in registration unless series.allowIndividualEventTickets is true or the user has a valid pass. Data-integrity 500 if the referenced series is missing. 2. Hidden-event leak (Finding 2 / matrix E11): extract loadPublicEvent into server/utils/loadEvent.js. All five public event endpoints ([id].get, register, tickets/available, tickets/reserve, tickets/purchase) now go through the helper, which 404s when isVisible === false and the requester is not an admin. Admin detection uses a new non-throwing getOptionalMember() in server/utils/auth.js (extracted from the pattern already inlined in api/auth/status.get.js). 3. Deadline enforcement + legacy pricing retirement (Finding 3 / matrix E8): register.post.js and tickets/reserve.post.js delegate gating to validateTicketPurchase (which already covers deadline, cancelled, started, members-only, sold-out, and already-registered); tickets/available.get.js gets an explicit registrationDeadline check. Legacy pricing.paymentRequired 402 branch removed from register.post.js.
29 lines
792 B
JavaScript
29 lines
792 B
JavaScript
import { loadPublicEvent } from '../../utils/loadEvent.js'
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
try {
|
|
const identifier = getRouterParam(event, 'id')
|
|
const eventData = await loadPublicEvent(event, identifier, {
|
|
lean: true,
|
|
select: '-registrations.email'
|
|
})
|
|
|
|
return {
|
|
...eventData,
|
|
id: eventData._id.toString(),
|
|
registeredCount: eventData.registrations?.length || 0,
|
|
isFull: eventData.maxAttendees
|
|
? (eventData.registrations?.length || 0) >= eventData.maxAttendees
|
|
: false
|
|
}
|
|
} catch (error) {
|
|
if (error.statusCode) {
|
|
throw error
|
|
}
|
|
console.error('Error fetching event:', error)
|
|
throw createError({
|
|
statusCode: 500,
|
|
statusMessage: 'Failed to fetch event'
|
|
})
|
|
}
|
|
})
|