seatschart 0.2.0 → 0.3.0

data/lib/seatschart/api/embed_api.rb

@@ -108,7 +108,7 @@ module SeatsChart
     end
 
     # Mint a short-lived designer/manager embed token
-    # HS256 audience `embed`, max TTL 30 minutes. Never put the workspace API secret in the browser. See docs/SEATSIO_PARITY.md.
+    # HS256 audience `embed`, max TTL 30 minutes. Never put the workspace API secret in the browser. A designer token carries its `mode` (`normal`, `safe` or `readOnly`), which the API enforces on every write: the embedded designer's own `mode` only adapts the UI. Tokens minted without a mode are `normal`. See docs/SEATSIO_PARITY.md.
     # @param post_api_embed_tokens_request [PostApiEmbedTokensRequest] 
     # @param [Hash] opts the optional parameters
     # @option opts [String] :idempotency_key Required on transactional routes. Reuse the same key for every retry of one logical operation; the API replays the stored outcome.
@@ -119,7 +119,7 @@ module SeatsChart
     end
 
     # Mint a short-lived designer/manager embed token
-    # HS256 audience `embed`, max TTL 30 minutes. Never put the workspace API secret in the browser. See docs/SEATSIO_PARITY.md.
+    # HS256 audience `embed`, max TTL 30 minutes. Never put the workspace API secret in the browser. A designer token carries its `mode` (`normal`, `safe` or `readOnly`), which the API enforces on every write: the embedded designer's own `mode` only adapts the UI. Tokens minted without a mode are `normal`. See docs/SEATSIO_PARITY.md.
     # @param post_api_embed_tokens_request [PostApiEmbedTokensRequest] 
     # @param [Hash] opts the optional parameters
     # @option opts [String] :idempotency_key Required on transactional routes. Reuse the same key for every retry of one logical operation; the API replays the stored outcome.
@@ -339,7 +339,7 @@ module SeatsChart
     end
 
     # Mint a short-lived buyer (viewer) token with the partner API key
-    # Server-to-server only (`x-api-key`, `holds` scope). Returns an HS256 buyer JWT bound to the API key's workspace (`tenant_id` claim) for the viewer `?token=` / `token` prop or `Authorization: Bearer` on consumer routes. Partners never need the platform `JWT_SECRET`. Mint one per buyer session from your server; never expose the API key in the browser. Lifetime 60-3600 seconds (default 900). Buyer tokens cannot mint tokens (403). Optional `ticketBuyerId` binds the token to a ticket buyer: holds made with it carry that id. With the workspace setting **ticket buyer validation** on, `ticketBuyerId` is required (400 `ticket_buyer_id_required`) and must be registered (`POST /ticket-buyers`; 403 `ticket_buyer_not_registered`); buyer holds then refuse a different id (403 `ticket_buyer_mismatch`) and tokens without one (403 `ticket_buyer_required`). Response: `{ token, tokenType: \"Bearer\", expiresInSeconds, expiresAt, ticketBuyerId? }`.
+    # Server-to-server only (`x-api-key`, `holds` scope). A dashboard session (Bearer of a workspace member) may also mint one: the web viewer page does so for a signed-in organizer instead of handing the session to the viewer; buyer tokens never can. Returns an HS256 buyer JWT bound to the API key's workspace (`tenant_id` claim) for the viewer `?token=` / `token` prop or `Authorization: Bearer` on consumer routes. Partners never need the platform `JWT_SECRET`. Mint one per buyer session from your server; never expose the API key in the browser. Lifetime 60-3600 seconds (default 900). Buyer tokens cannot mint tokens (403). Optional `ticketBuyerId` binds the token to a ticket buyer: holds made with it carry that id. With the workspace setting **ticket buyer validation** on, `ticketBuyerId` is required (400 `ticket_buyer_id_required`) and must be registered (`POST /ticket-buyers`; 403 `ticket_buyer_not_registered`); buyer holds then refuse a different id (403 `ticket_buyer_mismatch`) and tokens without one (403 `ticket_buyer_required`). Response: `{ token, tokenType: \"Bearer\", expiresInSeconds, expiresAt, ticketBuyerId? }`.
     # @param post_api_viewer_tokens_request [PostApiViewerTokensRequest] 
     # @param [Hash] opts the optional parameters
     # @option opts [String] :idempotency_key Required on transactional routes. Reuse the same key for every retry of one logical operation; the API replays the stored outcome.
@@ -350,7 +350,7 @@ module SeatsChart
     end
 
     # Mint a short-lived buyer (viewer) token with the partner API key
-    # Server-to-server only (`x-api-key`, `holds` scope). Returns an HS256 buyer JWT bound to the API key's workspace (`tenant_id` claim) for the viewer `?token=` / `token` prop or `Authorization: Bearer` on consumer routes. Partners never need the platform `JWT_SECRET`. Mint one per buyer session from your server; never expose the API key in the browser. Lifetime 60-3600 seconds (default 900). Buyer tokens cannot mint tokens (403). Optional `ticketBuyerId` binds the token to a ticket buyer: holds made with it carry that id. With the workspace setting **ticket buyer validation** on, `ticketBuyerId` is required (400 `ticket_buyer_id_required`) and must be registered (`POST /ticket-buyers`; 403 `ticket_buyer_not_registered`); buyer holds then refuse a different id (403 `ticket_buyer_mismatch`) and tokens without one (403 `ticket_buyer_required`). Response: `{ token, tokenType: \"Bearer\", expiresInSeconds, expiresAt, ticketBuyerId? }`.
+    # Server-to-server only (`x-api-key`, `holds` scope). A dashboard session (Bearer of a workspace member) may also mint one: the web viewer page does so for a signed-in organizer instead of handing the session to the viewer; buyer tokens never can. Returns an HS256 buyer JWT bound to the API key's workspace (`tenant_id` claim) for the viewer `?token=` / `token` prop or `Authorization: Bearer` on consumer routes. Partners never need the platform `JWT_SECRET`. Mint one per buyer session from your server; never expose the API key in the browser. Lifetime 60-3600 seconds (default 900). Buyer tokens cannot mint tokens (403). Optional `ticketBuyerId` binds the token to a ticket buyer: holds made with it carry that id. With the workspace setting **ticket buyer validation** on, `ticketBuyerId` is required (400 `ticket_buyer_id_required`) and must be registered (`POST /ticket-buyers`; 403 `ticket_buyer_not_registered`); buyer holds then refuse a different id (403 `ticket_buyer_mismatch`) and tokens without one (403 `ticket_buyer_required`). Response: `{ token, tokenType: \"Bearer\", expiresInSeconds, expiresAt, ticketBuyerId? }`.
     # @param post_api_viewer_tokens_request [PostApiViewerTokensRequest] 
     # @param [Hash] opts the optional parameters
     # @option opts [String] :idempotency_key Required on transactional routes. Reuse the same key for every retry of one logical operation; the API replays the stored outcome.
@@ -396,7 +396,7 @@ module SeatsChart
       return_type = opts[:debug_return_type]
 
       # auth_names
-      auth_names = opts[:debug_auth_names] || ['ApiKeyAuth']
+      auth_names = opts[:debug_auth_names] || ['ApiKeyAuth', 'BearerAuth']
 
       new_options = opts.merge(
         :operation => :"EmbedApi.post_api_viewer_tokens",

data/lib/seatschart/api/embed_origins_api.rb

@@ -143,7 +143,7 @@ module SeatsChart
     end
 
     # Resolve tenant embed origins for an event
-    # Public read used by the Next.js viewer to build CSP frame-ancestors and validate parent_origin. Also returns `publicKey` (`pub_…`) so `?workspaceKey=` can be allowlisted. Also returns `event` (`name`, `startsAt` ISO-8601 or null when the date was never set) for the buyer page header. Returns origins, public key and the event name/date only (no tenant id). Does not require authentication.
+    # Public read used by the Next.js viewer to build CSP frame-ancestors and validate parent_origin. Also returns `publicKey` (`pub_…`) so `?workspaceKey=` can be allowlisted. Also returns `event` (`name`, `startsAt` ISO-8601 or null when the date was never set) for the buyer page header. Also returns `extraData`: true when the workspace publishes allow-listed extraData keys to buyers (the viewer then reads `GET /api/public/{publicKey}/events/{eventId}/extra-data`). Also returns `rendererDefaults`: the default renderer settings of the workspace (only the options it sets: `multiSelectEnabled`, `showFullScreenButton`, `companionSeatValidationEnabled`, `holdOnSelectForGAs`; see `GET /api/workspace/defaults`), from the cached workspace config (no query). An explicit embed / host option wins over them. Also returns `maxSeatsPerHoldToken`, the seats one hold token may hold (workspace setting, default 64; above 64 the workspace opts into large group holds and the viewer lets buyers select and hold up to that many seats in one atomic call). Returns origins, public key and the event name/date only (no tenant id). Does not require authentication.
     # @param event_id [String] 
     # @param [Hash] opts the optional parameters
     # @return [nil]
@@ -153,7 +153,7 @@ module SeatsChart
     end
 
     # Resolve tenant embed origins for an event
-    # Public read used by the Next.js viewer to build CSP frame-ancestors and validate parent_origin. Also returns `publicKey` (`pub_…`) so `?workspaceKey=` can be allowlisted. Also returns `event` (`name`, `startsAt` ISO-8601 or null when the date was never set) for the buyer page header. Returns origins, public key and the event name/date only (no tenant id). Does not require authentication.
+    # Public read used by the Next.js viewer to build CSP frame-ancestors and validate parent_origin. Also returns `publicKey` (`pub_…`) so `?workspaceKey=` can be allowlisted. Also returns `event` (`name`, `startsAt` ISO-8601 or null when the date was never set) for the buyer page header. Also returns `extraData`: true when the workspace publishes allow-listed extraData keys to buyers (the viewer then reads `GET /api/public/{publicKey}/events/{eventId}/extra-data`). Also returns `rendererDefaults`: the default renderer settings of the workspace (only the options it sets: `multiSelectEnabled`, `showFullScreenButton`, `companionSeatValidationEnabled`, `holdOnSelectForGAs`; see `GET /api/workspace/defaults`), from the cached workspace config (no query). An explicit embed / host option wins over them. Also returns `maxSeatsPerHoldToken`, the seats one hold token may hold (workspace setting, default 64; above 64 the workspace opts into large group holds and the viewer lets buyers select and hold up to that many seats in one atomic call). Returns origins, public key and the event name/date only (no tenant id). Does not require authentication.
     # @param event_id [String] 
     # @param [Hash] opts the optional parameters
     # @return [Array<(nil, Integer, Hash)>] nil, response status code and response headers
@@ -203,6 +203,67 @@ module SeatsChart
       return data, status_code, headers
     end
 
+    # Resolve tenant embed origins for a season
+    # Public read used by the Next.js season viewer (`/viewer/season/{seasonId}`) to build CSP frame-ancestors from the season workspace's embed origins and to validate `parent_origin` and `?workspaceKey=`, like the event embed policy. Also returns `rendererDefaults`: the default renderer settings of the workspace (only the options it sets: `multiSelectEnabled`, `showFullScreenButton`, `companionSeatValidationEnabled`, `holdOnSelectForGAs`; see `GET /api/workspace/defaults`), from the cached workspace config (no query). An explicit embed / host option wins over them. Also returns `maxSeatsPerHoldToken`, the seats one hold token may hold (workspace setting, default 64; above 64 the workspace opts into large group holds and the viewer lets buyers select and hold up to that many seats in one atomic call). Returns origins, the public key and the renderer defaults only (no tenant id). Unknown seasons return 404 (the viewer then allows only `ALLOWED_ORIGINS`). Does not require authentication.
+    # @param season_id [String] 
+    # @param [Hash] opts the optional parameters
+    # @return [nil]
+    def get_api_seasons_by_season_id_embed_policy(season_id, opts = {})
+      get_api_seasons_by_season_id_embed_policy_with_http_info(season_id, opts)
+      nil
+    end
+
+    # Resolve tenant embed origins for a season
+    # Public read used by the Next.js season viewer (&#x60;/viewer/season/{seasonId}&#x60;) to build CSP frame-ancestors from the season workspace&#39;s embed origins and to validate &#x60;parent_origin&#x60; and &#x60;?workspaceKey&#x3D;&#x60;, like the event embed policy. Also returns &#x60;rendererDefaults&#x60;: the default renderer settings of the workspace (only the options it sets: &#x60;multiSelectEnabled&#x60;, &#x60;showFullScreenButton&#x60;, &#x60;companionSeatValidationEnabled&#x60;, &#x60;holdOnSelectForGAs&#x60;; see &#x60;GET /api/workspace/defaults&#x60;), from the cached workspace config (no query). An explicit embed / host option wins over them. Also returns &#x60;maxSeatsPerHoldToken&#x60;, the seats one hold token may hold (workspace setting, default 64; above 64 the workspace opts into large group holds and the viewer lets buyers select and hold up to that many seats in one atomic call). Returns origins, the public key and the renderer defaults only (no tenant id). Unknown seasons return 404 (the viewer then allows only &#x60;ALLOWED_ORIGINS&#x60;). Does not require authentication.
+    # @param season_id [String] 
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(nil, Integer, Hash)>] nil, response status code and response headers
+    def get_api_seasons_by_season_id_embed_policy_with_http_info(season_id, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: EmbedOriginsApi.get_api_seasons_by_season_id_embed_policy ...'
+      end
+      # verify the required parameter 'season_id' is set
+      if @api_client.config.client_side_validation && season_id.nil?
+        fail ArgumentError, "Missing the required parameter 'season_id' when calling EmbedOriginsApi.get_api_seasons_by_season_id_embed_policy"
+      end
+      # resource path
+      local_var_path = '/api/seasons/{seasonId}/embed-policy'.sub('{' + 'seasonId' + '}', CGI.escape(season_id.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type]
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || []
+
+      new_options = opts.merge(
+        :operation => :"EmbedOriginsApi.get_api_seasons_by_season_id_embed_policy",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: EmbedOriginsApi#get_api_seasons_by_season_id_embed_policy\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
     # Register an allowed embed origin
     # @param post_api_embed_origins_request [PostApiEmbedOriginsRequest] 
     # @param [Hash] opts the optional parameters

data/lib/seatschart/api/event_log_api.rb

@@ -20,7 +20,7 @@ module SeatsChart
       @api_client = api_client
     end
     # Event log: admin changes of charts and events (cursor-paginated)
-    # Newest first, from the workspace audit log. Types: `chart.created`, `chart.published`, `chart.draft_discarded`, `chart.version_restored`, `chart.archived`, `chart.unarchived`, `chart.deleted`, `chart.tags_updated`, `chart.categories_updated`, `event.created`, `event.updated`, `event.deleted`, `event.map_published`, `event.for_sale_changed`, `event.channels_updated`, `event.categories_updated`, `event.table_booking_changed`, `event.sales_rules_updated`, `event.pricing_synced`, `event.moved_to_chart_copy`, `event.season_status_changed`, `event.listings_updated`. Filter with `types` (comma-separated), `from` (inclusive) / `to` (exclusive) ISO-8601 instants and `resourceId` (chart or event id). Pass `nextCursor` back as `cursor` with the same filters until it is null; pages are stable while new entries arrive. `data` carries the change details (never the actor e-mail). The admin types `chart.created`, `event.for_sale_changed`, `event.channels_updated`, `event.categories_updated` and `event.table_booking_changed` are also delivered as webhooks whose items carry `log_id` = the entry `id`. API key, or a dashboard member with the integrations permission (admin).
+    # Newest first, from the workspace audit log. Types: `chart.created`, `chart.published`, `chart.draft_discarded`, `chart.version_restored`, `chart.archived`, `chart.unarchived`, `chart.deleted`, `chart.tags_updated`, `chart.categories_updated`, `event.created`, `event.updated`, `event.deleted`, `event.map_published`, `event.for_sale_changed`, `event.channels_updated`, `event.categories_updated`, `event.table_booking_changed`, `event.sales_rules_updated`, `event.pricing_synced`, `event.moved_to_chart_copy`, `event.season_status_changed`, `event.listings_updated`. Filter with `types` (comma-separated), `from` (inclusive) / `to` (exclusive) ISO-8601 instants and `resourceId` (chart or event id). Pass `nextCursor` back as `cursor` with the same filters until it is null; pages are stable while new entries arrive. `data` carries the change details (never the actor e-mail). The admin types `chart.created`, `event.for_sale_changed`, `event.channels_updated`, `event.categories_updated` and `event.table_booking_changed` are also delivered as webhooks whose items carry `log_id` = the entry `id`. **Retention**: entries are kept for `EVENT_LOG_RETENTION_DAYS` days (default 365, at least 30; seats.io keeps 14) and then deleted with the workspace audit log they come from. API key, or a dashboard member with the integrations permission (admin).
     # @param [Hash] opts the optional parameters
     # @option opts [Float] :limit Page size (1..100, default 20).
     # @option opts [String] :cursor Opaque `nextCursor` value from the previous page.
@@ -35,7 +35,7 @@ module SeatsChart
     end
 
     # Event log: admin changes of charts and events (cursor-paginated)
-    # Newest first, from the workspace audit log. Types: `chart.created`, `chart.published`, `chart.draft_discarded`, `chart.version_restored`, `chart.archived`, `chart.unarchived`, `chart.deleted`, `chart.tags_updated`, `chart.categories_updated`, `event.created`, `event.updated`, `event.deleted`, `event.map_published`, `event.for_sale_changed`, `event.channels_updated`, `event.categories_updated`, `event.table_booking_changed`, `event.sales_rules_updated`, `event.pricing_synced`, `event.moved_to_chart_copy`, `event.season_status_changed`, `event.listings_updated`. Filter with `types` (comma-separated), `from` (inclusive) / `to` (exclusive) ISO-8601 instants and `resourceId` (chart or event id). Pass `nextCursor` back as `cursor` with the same filters until it is null; pages are stable while new entries arrive. `data` carries the change details (never the actor e-mail). The admin types `chart.created`, `event.for_sale_changed`, `event.channels_updated`, `event.categories_updated` and `event.table_booking_changed` are also delivered as webhooks whose items carry `log_id` = the entry `id`. API key, or a dashboard member with the integrations permission (admin).
+    # Newest first, from the workspace audit log. Types: `chart.created`, `chart.published`, `chart.draft_discarded`, `chart.version_restored`, `chart.archived`, `chart.unarchived`, `chart.deleted`, `chart.tags_updated`, `chart.categories_updated`, `event.created`, `event.updated`, `event.deleted`, `event.map_published`, `event.for_sale_changed`, `event.channels_updated`, `event.categories_updated`, `event.table_booking_changed`, `event.sales_rules_updated`, `event.pricing_synced`, `event.moved_to_chart_copy`, `event.season_status_changed`, `event.listings_updated`. Filter with `types` (comma-separated), `from` (inclusive) / `to` (exclusive) ISO-8601 instants and `resourceId` (chart or event id). Pass `nextCursor` back as `cursor` with the same filters until it is null; pages are stable while new entries arrive. `data` carries the change details (never the actor e-mail). The admin types `chart.created`, `event.for_sale_changed`, `event.channels_updated`, `event.categories_updated` and `event.table_booking_changed` are also delivered as webhooks whose items carry `log_id` = the entry `id`. **Retention**: entries are kept for `EVENT_LOG_RETENTION_DAYS` days (default 365, at least 30; seats.io keeps 14) and then deleted with the workspace audit log they come from. API key, or a dashboard member with the integrations permission (admin).
     # @param [Hash] opts the optional parameters
     # @option opts [Float] :limit Page size (1..100, default 20).
     # @option opts [String] :cursor Opaque `nextCursor` value from the previous page.