@bash-app/bash-common 30.232.0 → 30.234.0

package/prisma/schema.prisma

@@ -669,6 +669,8 @@ model BashEvent {
   subtitle                    String?
   isFeatured                  Boolean?
   featuredUntil               DateTime? // When paid feature expires (null = no expiry / super-user pinned)
+  /// Paid discovery — carousel impression counter
+  featuredImpressions         Int                    @default(0)
   isTrending                  Boolean?
   venueId                     String?
   averageRating               Float?                 @default(0)
@@ -2247,6 +2249,8 @@ model User {
   createdOn            DateTime    @default(now())
   stripeCustomerId     String?     @unique
   stripeAccountId      String?     @unique
+  /// Preferred processor for dual-rail onboarding (optional; legacy Stripe fields remain source of truth until fully migrated).
+  paymentProvider      PaymentProvider           @default(STRIPE)
   isSuperUser          Boolean     @default(false)
   isSuspended          Boolean     @default(false)
   intent               UserIntent?
@@ -2508,6 +2512,7 @@ model User {
   sponsorBookingRequestsAsHost   SponsorBookingRequest[]      @relation("SponsorBookingHost")
   sponsorships                   SponsoredEvent[]
   stripeAccounts                 StripeAccount[]
+  paymentProviderAccounts        PaymentProviderAccount[]
   ticketsISent                   Ticket[]                     @relation("TicketsISent")
   ticketsIOwn                    Ticket[]                     @relation("TicketsIOwn")
   bashEventDonations             BashEventDonation[]
@@ -3073,6 +3078,7 @@ model Service {
   serviceRating                      Float?                     @default(0)
   totalRatings                       Int?                       @default(0)
   stripeAccountId                    String?
+  paymentAccountId                   String?
   targetAudienceId                   String?                    @unique
   visibility                         VisibilityPreference       @default(Public)
   bashesNotInterestedIn              BashEventType[]
@@ -3113,6 +3119,7 @@ model Service {
   organization                       Organization?              @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   owner                              User?                      @relation("OwnedService", fields: [ownerId], references: [id])
   sponsor                            Sponsor?                   @relation(fields: [sponsorId], references: [id], onDelete: Cascade)
+  paymentAccount                     PaymentProviderAccount?    @relation(fields: [paymentAccountId], references: [id], onDelete: SetNull, onUpdate: Cascade)
   stripeAccount                      StripeAccount?             @relation(fields: [stripeAccountId], references: [id], onDelete: Restrict)
   targetAudience                     TargetAudience?            @relation(fields: [targetAudienceId], references: [id], onDelete: Cascade)
   vendor                             Vendor?                    @relation(fields: [vendorId], references: [id], onDelete: Cascade)
@@ -3140,6 +3147,7 @@ model Service {
   serviceBudgets                     Budget[]                   @relation("ServiceBudgets")
 
   @@index([serviceListingStripeSubscriptionId])
+  @@index([paymentAccountId])
   @@index([isFreeFirstListing])
   @@index([isVerified])
   @@index([isLicensed])
@@ -3161,6 +3169,32 @@ model StripeAccount {
   @@index([ownerId])
 }
 
+/// Connects a user to Stripe and/or Square rails for provider payouts (dual-processor layer).
+model PaymentProviderAccount {
+  id        String          @id @default(cuid())
+  userId    String
+  provider  PaymentProvider @default(STRIPE)
+  stripeAccountId           String? @unique
+  stripeCustomerId          String? @unique
+  squareMerchantId          String? @unique
+  squareLocationId          String?
+  squareAccessToken         String? @db.Text
+  squareRefreshToken        String? @db.Text
+  squareTokenExpiresAt      DateTime?
+  accountVerified           Boolean  @default(false)
+  payoutsEnabled            Boolean  @default(false)
+  accountStatus             String?
+  createdAt                 DateTime @default(now())
+  updatedAt                 DateTime @updatedAt
+  lastVerifiedAt            DateTime?
+  user                      User     @relation(fields: [userId], references: [id], onDelete: Restrict, onUpdate: Cascade)
+  services                  Service[]
+
+  @@unique([userId, provider])
+  @@index([userId])
+  @@index([provider])
+}
+
 model StripeWebhookEvent {
   id        String   @id
   createdAt DateTime @default(now())
@@ -3905,10 +3939,22 @@ model ServiceAddon {
   ServiceBookingAddOn       ServiceBookingAddOn[]
   convertedFromInclude      ServiceInclude[]         @relation("IncludeConvertedToAddon")
   convertedFromRequest      ServiceAddonRequest[]    @relation("RequestConvertedToAddon")
+  serviceMerchSquareFulfillments ServiceMerchSquareFulfillment[]
 
   @@index([imageUrl])
 }
 
+/// Idempotency ledger: one row per Square payment applied to service merch inventory (public hired-service SKUs).
+model ServiceMerchSquareFulfillment {
+  id              String       @id @default(cuid())
+  squarePaymentId String       @unique
+  serviceAddonId  String
+  createdAt       DateTime     @default(now())
+  serviceAddon    ServiceAddon @relation(fields: [serviceAddonId], references: [id], onDelete: Restrict, onUpdate: Cascade)
+
+  @@index([serviceAddonId])
+}
+
 model ServiceInclude {
   id                 String                  @id @default(cuid())
   serviceId          String
@@ -6728,6 +6774,11 @@ enum ServiceTypes {
   Volunteers
 }
 
+enum PaymentProvider {
+  STRIPE
+  SQUARE
+}
+
 enum PricingModel {
   FLAT_FEE // Fixed amount: "$500 for vendor booth"
   PER_ATTENDEE // Per person: "$50 per expected attendee"

package/src/definitions.ts

@@ -71,6 +71,67 @@ export const BASH_PASS_PRICE_ENV_KEYS: Record<BashPassTier, string> = {
   [BashPassTier.UNLIMITED]: "STRIPE_BASH_PASS_UNLIMITED_PRICE_ID",
 };
 
+// ─── Ticket.purchaseType values (string column; keep in sync with API writers) ───
+
+export const TICKET_PURCHASE_TYPE_USD = "USD" as const;
+export const TICKET_PURCHASE_TYPE_BASHPOINTS = "BashPoints" as const;
+export const TICKET_PURCHASE_TYPE_FREE = "Free" as const;
+export const TICKET_PURCHASE_TYPE_COMP = "Comp" as const;
+export const TICKET_PURCHASE_TYPE_BASHPASS = "BashPass" as const;
+/** Unpaid reservation — pay at venue (RSVP & Pay at Door). */
+export const TICKET_PURCHASE_TYPE_RSVP_AT_DOOR = "RSVPAtDoor" as const;
+/** Cash collected at door (staff-marked). */
+export const TICKET_PURCHASE_TYPE_CASH = "Cash" as const;
+
+export type TicketPurchaseTypeStored =
+  | typeof TICKET_PURCHASE_TYPE_USD
+  | typeof TICKET_PURCHASE_TYPE_BASHPOINTS
+  | typeof TICKET_PURCHASE_TYPE_FREE
+  | typeof TICKET_PURCHASE_TYPE_COMP
+  | typeof TICKET_PURCHASE_TYPE_BASHPASS
+  | typeof TICKET_PURCHASE_TYPE_RSVP_AT_DOOR
+  | typeof TICKET_PURCHASE_TYPE_CASH;
+
+/** Stripe Checkout metadata: settle an existing RSVP ticket after card pay. */
+export const CHECKOUT_PURPOSE_RSVP_DOOR_CHECKOUT = "rsvp_door_checkout" as const;
+
+/** Door scanner: ticket QR verification result. */
+export const DOOR_TICKET_SCAN_OUTCOMES = [
+  "paid_ok",
+  "payment_required",
+  "invalid_or_expired",
+  "wrong_event",
+  "already_checked_in",
+] as const;
+export type DoorTicketScanOutcome = (typeof DOOR_TICKET_SCAN_OUTCOMES)[number];
+
+/** Guest may enter without an additional payment step at the door. */
+export function ticketIsPaidForEventAdmission(
+  ticket: { purchaseType: string | null; paidOn: Date | string | null },
+  tierPriceCents: number
+): boolean {
+  if (tierPriceCents <= 0) {
+    return true;
+  }
+  if (ticket.purchaseType === TICKET_PURCHASE_TYPE_COMP) {
+    return true;
+  }
+  if (ticket.purchaseType === TICKET_PURCHASE_TYPE_RSVP_AT_DOOR) {
+    return ticket.paidOn != null;
+  }
+  return ticket.paidOn != null;
+}
+
+export function isUnpaidRsvpAtDoorTicket(ticket: {
+  purchaseType: string | null;
+  paidOn: Date | string | null;
+}): boolean {
+  return (
+    ticket.purchaseType === TICKET_PURCHASE_TYPE_RSVP_AT_DOOR &&
+    ticket.paidOn == null
+  );
+}
+
 export const URL_PARAMS_BASH_EVENT_ID = "bashEventId" as const;
 export const URL_PARAMS_BASH_EVENT_TITLE = "bashEventTitle" as const;
 export const URL_PARAMS_BASH_EVENT_DESC = "bashEventDesc" as const;

package/src/extendedSchemas.ts

@@ -201,6 +201,8 @@ export const FRONT_END_USER_DATA_TO_SELECT = {
 
 export const PRIVATE_USER_ACCOUNT_TO_SELECT = {
   ...FRONT_END_USER_DATA_TO_SELECT,
+  /** Self session only — preferred payment rail (Stripe vs Square). */
+  paymentProvider: true,
   // Self-only sensitive demographics — re-added so /me can populate edit forms.
   gender: true,
   genderIdentity: true,
@@ -263,22 +265,33 @@ export type BashEventMerchCatalog = {
   settings: BashEventHostMerchSettings;
 };
 
-/** Service profile merch modal purchase options (ServiceRatesAssociation.merchSettings JSON). */
+/**
+ * Service profile merch purchase options (ServiceRatesAssociation.merchSettings JSON).
+ *
+ * **Hired services → Square:** Only `showShipping` and `showPreOrder` produce checkout
+ * buttons. `showAddToCheckout` is for Stripe host/ticket-cart flows on the event (`BashMerchSection`);
+ * it is not used for Square Payment Links under hired services.
+ */
 export type ServiceMerchSettings = {
   showShipping: boolean;
   showPreOrder: boolean;
+  /** Stripe ticket-cart bundle option for host merch flows—not used for hired-service Square checkout. */
   showAddToCheckout: boolean;
   purchaseNote?: string | null;
 };
 
 /** Public bash detail: hired service bookings + merch SKUs for the event (GET /event/:id, /public-event/:id) */
-export interface BashEventHiredServicePublic {
+export type BashEventHiredServicePublic = {
   bookingId: string;
   serviceId: string;
   specificId: string;
   serviceName: string | null;
   serviceType: ServiceTypes;
   coverPhoto: string | null;
+  /** When true, standalone Square checkout is available for merchandise SKUs below. */
+  squareMerchCheckoutEnabled: boolean;
+  /** Merch options from provider profile—Square hired-service checkout reads ship + pickup only. */
+  merchSettings: ServiceMerchSettings | null;
   merchandiseAddons: Array<{
     id: string;
     name: string;
@@ -288,7 +301,7 @@ export interface BashEventHiredServicePublic {
     imageAlt: string | null;
     quantity: number;
   }>;
-}
+};
 
 export interface BashEventExt extends Omit<
   BashEvent,
@@ -320,7 +333,7 @@ export interface BashEventExt extends Omit<
     creator: PublicUser;
   })[];
   eventTasks: EventTask[];
-  tickets?: Ticket[]; // Only include tickets that the user has purchased and not all tickets (could be thousands + privacy)
+  tickets?: TicketFlexible[]; // Only include tickets that the user has purchased and not all tickets (could be thousands + privacy)
   // Do not include in fetch. Could be hundreds of these
   invitations: Partial<InvitationExt>[];
   venueServiceId?: string;
@@ -1248,6 +1261,23 @@ export interface TicketExt extends Ticket {
   > | null;
 }
 
+/**
+ * Ticket rows in attendee/event payloads where nested relations may be omitted
+ * (e.g. authenticated GET `/event/:id` may include `transferInvite` without
+ * `owner` / `forUser` selects).
+ */
+export type TicketFlexible = Ticket & {
+  owner?: PublicUser;
+  forUser?: PublicUser;
+  checkout?: Checkout;
+  transfers?: TicketTransfer[];
+  metadata?: TicketMetadata[];
+  transferInvite?: Pick<
+    TicketTransferInvite,
+    "status" | "expiresAt" | "token" | "toEmail" | "toUserId"
+  > | null;
+};
+
 export interface CheckoutExt extends Checkout {
   owner: PublicUser;
   tickets: Ticket[];

package/src/index.ts

@@ -7,6 +7,7 @@ export * from "./extendedSchemas.js";
 export * from "./partnerStoreTypes.js";
 export * from "./bashFeedTypes.js";
 export * from "./membershipDefinitions.js";
+export * from "./onSaleCapabilityRecommendations.js";
 export * from "./aiApproval.js";
 export * from "./userReportTypes.js";
 
@@ -148,6 +149,7 @@ export {
   PrizePaymentMethod,
   PrizePaymentStatus,
   PartnerTier,
+  PaymentProvider,
   PrizeType,
   ProjectorSetupFormat,
   PromoterFormat,

package/src/membershipDefinitions.ts

@@ -114,19 +114,30 @@ export const MEMBERSHIP_PRICING = {
  * When they exhaust free slots or want more, they pay these rates.
  */
 export const FEATURE_BOOST_DURATIONS = [
-  { id: "24h",  hours: 24,  label: "24 hours",  priceCents: 500  }, // $5
-  { id: "72h",  hours: 72,  label: "3 days",    priceCents: 1200 }, // $12
-  { id: "7d",   hours: 168, label: "7 days",    priceCents: 2500 }, // $25
+  { id: "24h",  hours: 24,   label: "24 hours",  priceCents: 500  }, // $5
+  { id: "72h",  hours: 72,   label: "3 days",    priceCents: 1200 }, // $12
+  { id: "7d",   hours: 168,  label: "7 days",    priceCents: 2500 }, // $25 — typical “best value” tier in UI
+  { id: "14d",  hours: 336,  label: "14 days",   priceCents: 4500 }, // $45
+  { id: "30d",  hours: 720,  label: "30 days",   priceCents: 8000 }, // $80
 ] as const;
 
 export type FeatureBoostDurationId = typeof FEATURE_BOOST_DURATIONS[number]["id"];
 
-/** Applies to both event and feed-post feature boosts */
+/** Applies to event, feed-post, and service profile feature boosts */
 export const FEATURE_BOOST_STRIPE_DESCRIPTION = {
   event: (durationLabel: string) => `Featured Event — ${durationLabel}`,
   feedPost: (durationLabel: string) => `Featured Feed Post — ${durationLabel}`,
+  service: (durationLabel: string) => `Featured Service — ${durationLabel}`,
 };
 
+/**
+ * Free “featured event” slots from membership (`featuredEventsPerMonth` in {@link MEMBERSHIP_LIMITS})
+ * are **not** tied to the calendar month. Usage is tracked in `User.membershipFeaturedEventsUsed` and
+ * reset when the membership subscription period renews (see Stripe `invoice.payment_succeeded` handling
+ * in the API — same path that can reset `membershipFeaturedEventsUsed`). Host UI should describe this as
+ * “resets when your membership renews,” not “resets on the 1st.”
+ */
+
 // Helper: Get monthly price in cents for a tier (for BashPoints calculations)
 export const MEMBERSHIP_MONTHLY_PRICE_CENTS: Record<MembershipTier, number> = {
   Basic: MEMBERSHIP_PRICING.Basic.monthly,

package/src/onSaleCapabilityRecommendations.ts

@@ -0,0 +1,131 @@
+/**
+ * Heuristic defaults for festival-style on-sale capabilities (wizard UI).
+ * Pure functions — safe for SSR/tests; no IO.
+ */
+
+export type CapabilityKey =
+  | "queue"
+  | "installments"
+  | "sms"
+  | "namedTickets";
+
+export interface CapabilitySignals {
+  expectedAttendance: number | null;
+  highestTicketPriceCents: number | null;
+  lowestTicketPriceCents: number | null;
+  multiDay: boolean;
+  ticketTierCount: number;
+  onSaleOpensAt: string | null;
+  /** ISO currency lowercase, e.g. "usd" */
+  currency: string;
+}
+
+export interface CapabilityRecommendation {
+  capability: CapabilityKey;
+  enabled: boolean;
+  /** Human-readable bullets for inline “Recommended because …”. */
+  rationale: string[];
+  suggestedConfig?: {
+    queueAdmitRatePerSecond?: number;
+  };
+}
+
+function admitRatePerSecond(attendance: number | null): number {
+  if (attendance == null) return 3;
+  if (attendance < 400) return 8;
+  if (attendance < 1500) return 5;
+  if (attendance < 5000) return 3;
+  return 2;
+}
+
+/**
+ * Inspect draft event signals and suggest which toggles to pre-check on first load.
+ * The UI always treats checkbox state as source of truth; this only informs defaults.
+ */
+export function computeCapabilityRecommendations(
+  signals: CapabilitySignals
+): CapabilityRecommendation[] {
+  const {
+    expectedAttendance,
+    highestTicketPriceCents,
+    ticketTierCount,
+    multiDay,
+    currency,
+  } = signals;
+
+  const attendance = expectedAttendance ?? 0;
+  const highCents = highestTicketPriceCents ?? 0;
+  const tierCount = ticketTierCount;
+
+  const queueRationale: string[] = [];
+  let queueOn = false;
+  if (attendance >= 350) {
+    queueOn = true;
+    queueRationale.push("Expected headcount is high enough that a waiting room reduces checkout failures.");
+  }
+  if (multiDay) {
+    queueOn = true;
+    queueRationale.push("Multi-day events often see concentrated on-sale traffic.");
+  }
+  if (tierCount >= 4) {
+    queueOn = true;
+    queueRationale.push("Several ticket tiers usually means more buyers hitting the page at once.");
+  }
+  if (highCents >= 8_000) {
+    queueOn = true;
+    queueRationale.push("Higher ticket prices tend to drive more simultaneous purchase attempts.");
+  }
+
+  const installmentsRationale: string[] = [];
+  let installmentsOn = false;
+  if (currency === "usd" && highCents >= 4_500) {
+    installmentsOn = true;
+    installmentsRationale.push("Installments help convert for tickets around $45+ in supported currencies.");
+  }
+
+  const smsRationale: string[] = [];
+  let smsOn = false;
+  if (attendance >= 500 || highCents >= 10_000) {
+    smsOn = true;
+    smsRationale.push("Larger or higher-stakes sales benefit from a clear confirmation channel.");
+  }
+
+  const namedRationale: string[] = [];
+  let namedOn = false;
+  if (tierCount >= 2 && highCents >= 6_000) {
+    namedOn = true;
+    namedRationale.push("Named tickets help groups and higher-value tiers stay organized at the door.");
+  }
+
+  const queue: CapabilityRecommendation = {
+    capability: "queue",
+    enabled: queueOn,
+    rationale: queueRationale,
+    ...(queueOn
+      ? {
+          suggestedConfig: {
+            queueAdmitRatePerSecond: admitRatePerSecond(expectedAttendance),
+          },
+        }
+      : {}),
+  };
+
+  return [
+    queue,
+    {
+      capability: "installments",
+      enabled: installmentsOn,
+      rationale: installmentsRationale,
+    },
+    {
+      capability: "sms",
+      enabled: smsOn,
+      rationale: smsRationale,
+    },
+    {
+      capability: "namedTickets",
+      enabled: namedOn,
+      rationale: namedRationale,
+    },
+  ];
+}

package/src/utils/__tests__/getBackendHost.test.ts

@@ -1,5 +1,5 @@
 /**
- * getBackendHost — chooses the API origin (api.bash.community vs localhost:3500
+ * getBackendHost — chooses the API origin (api.bash.community vs Vite dev same-origin
  * vs the bundled API_HOST for native Capacitor builds).
  *
  * This file pins the contract so a future "let's tidy up env handling" change
@@ -42,35 +42,79 @@ afterEach(() => {
   clearWindow();
 });
 
-describe("getBackendHost — local dev", () => {
-  it("returns http://localhost:3500 for localhost (does NOT reuse :3000 from the page)", () => {
+describe("getBackendHost — local dev (Vite NODE_ENV=development)", () => {
+  let origNodeEnv: string | undefined;
+
+  beforeAll(() => {
+    origNodeEnv = process.env.NODE_ENV;
+    process.env.NODE_ENV = "development";
+  });
+
+  afterAll(() => {
+    if (origNodeEnv === undefined) {
+      delete process.env.NODE_ENV;
+    } else {
+      process.env.NODE_ENV = origNodeEnv;
+    }
+  });
+
+  it("returns same origin as the page (Vite proxies /api to Express)", () => {
     setWindow({
       protocol: "http:",
       hostname: "localhost",
       host: "localhost:3000",
       port: "3000",
     });
-    expect(getBackendHost()).toBe("http://localhost:3500");
+    expect(getBackendHost()).toBe("http://localhost:3000");
   });
 
-  it("returns http://127.0.0.1:3500 for 127.0.0.1", () => {
+  it("returns 127.0.0.1 with the page port (not a hard-coded API port)", () => {
     setWindow({
       protocol: "http:",
       hostname: "127.0.0.1",
       host: "127.0.0.1:3000",
       port: "3000",
     });
-    expect(getBackendHost()).toBe("http://127.0.0.1:3500");
+    expect(getBackendHost()).toBe("http://127.0.0.1:3000");
   });
 
-  it("uses the LAN IP for 192.168.x.x (so a phone on the same wifi can hit the dev API)", () => {
+  it("uses the LAN host:port of the dev server (phone on same Wi‑Fi → same origin + proxy)", () => {
     setWindow({
       protocol: "http:",
       hostname: "192.168.1.42",
       host: "192.168.1.42:3000",
       port: "3000",
     });
-    expect(getBackendHost()).toBe("http://192.168.1.42:3500");
+    expect(getBackendHost()).toBe("http://192.168.1.42:3000");
+  });
+
+  it("matches page origin when Vite listens on PORT=3500 — set VITE_API_PROXY_TARGET so /api proxies to Express (not the same TCP port)", () => {
+    setWindow({
+      protocol: "http:",
+      hostname: "localhost",
+      host: "localhost:3500",
+      port: "3500",
+    });
+    expect(getBackendHost()).toBe("http://localhost:3500");
+  });
+});
+
+describe("getBackendHost — local non-dev (e.g. jest NODE_ENV=test)", () => {
+  it("falls back to canonical API port :3500 when not in Vite development bundle", () => {
+    const orig = process.env.NODE_ENV;
+    process.env.NODE_ENV = "test";
+    try {
+      setWindow({
+        protocol: "http:",
+        hostname: "localhost",
+        host: "localhost:3000",
+        port: "3000",
+      });
+      expect(getBackendHost()).toBe("http://localhost:3500");
+    } finally {
+      if (orig === undefined) delete process.env.NODE_ENV;
+      else process.env.NODE_ENV = orig;
+    }
   });
 });
 

package/src/utils/urlUtils.ts

@@ -56,21 +56,38 @@ export function getFrontendHost(): string {
 }
 
 export function getBackendHost(): string {
+  if (typeof window === "undefined") {
+    return API_HOST;
+  }
+
   // Capacitor loads the app from a bundled origin whose hostname is `localhost`; we must
   // still use the baked-in API URL (REACT_APP_API), not localhost:3500.
   if (isCapacitorNativePlatform()) {
     return API_HOST;
   }
 
-  // Browser: local dev uses API on :3500; deployed web uses API_HOST from env.
+  /**
+   * In Vite dev only (`NODE_ENV === "development"`), call `/api` on the same origin so
+   * `server.proxy['/api']` forwards to Express. Use port :3500 for local preview/tests
+   * where there's no proxy.
+   *
+   * Hard-coding `:3500` alone breaks when `PORT=3500` for Vite: fetches targeted Vite itself
+   * (404 on POST /public-event/…/door-qr instead of Express).
+   */
   const isLocalDev =
     window.location.hostname === "localhost" ||
     window.location.hostname === "127.0.0.1" ||
     window.location.hostname.includes("192.168");
 
-  return isLocalDev
-    ? `${window.location.protocol}//${window.location.hostname}:3500`
-    : API_HOST;
+  if (!isLocalDev) {
+    return API_HOST;
+  }
+
+  if (process.env.NODE_ENV === "development") {
+    return `${window.location.protocol}//${window.location.host}`;
+  }
+
+  return `${window.location.protocol}//${window.location.hostname}:3500`;
 }
 
 export function getSsrBashDetailUrl(bashEventId: string | undefined): string {