No description
Jennie Robinson Faber
f34b062f2a
Pre-launch P0 fixes surfaced by docs/specs/events-functional-test-matrix.md (Findings 1, 2, 3). 1. Series-pass bypass (Finding 1 / matrix S1 P3): register.post.js now loads the linked Series when tickets.requiresSeriesTicket is set and rejects drop-in registration unless series.allowIndividualEventTickets is true or the user has a valid pass. Data-integrity 500 if the referenced series is missing. 2. Hidden-event leak (Finding 2 / matrix E11): extract loadPublicEvent into server/utils/loadEvent.js. All five public event endpoints ([id].get, register, tickets/available, tickets/reserve, tickets/purchase) now go through the helper, which 404s when isVisible === false and the requester is not an admin. Admin detection uses a new non-throwing getOptionalMember() in server/utils/auth.js (extracted from the pattern already inlined in api/auth/status.get.js). 3. Deadline enforcement + legacy pricing retirement (Finding 3 / matrix E8): register.post.js and tickets/reserve.post.js delegate gating to validateTicketPurchase (which already covers deadline, cancelled, started, members-only, sold-out, and already-registered); tickets/available.get.js gets an explicit registrationDeadline check. Legacy pricing.paymentRequired 402 branch removed from register.post.js. |
||
|---|---|---|
| .claude | ||
| .forgejo/workflows | ||
| .husky | ||
| .serena | ||
| app | ||
| assets/css | ||
| docs | ||
| e2e | ||
| plugins | ||
| public | ||
| scripts | ||
| server | ||
| tests | ||
| .cursorignore | ||
| .cursorindexingignore | ||
| .dockerignore | ||
| .env.example | ||
| .gitignore | ||
| debug-token.js | ||
| Dockerfile | ||
| eslint.config.mjs | ||
| nuxt.config.ts | ||
| package-lock.json | ||
| package.json | ||
| playwright.config.js | ||
| slack-app-manifest.yaml | ||
| test-helcim-direct.js | ||
| TESTING.md | ||
| tsconfig.json | ||
| vitest.config.js | ||