@frigear-nu/events 0.1.1 → 0.1.3

package/dist/runtime/server/routes/admin/ticket-cancel.post.js

@@ -1,14 +1,13 @@
 import { db, schema } from "@nuxthub/db";
 import { and, eq, inArray } from "drizzle-orm";
+import { conflict, idParams, notFound } from "@frigear-nu/module-kit/server";
 export default defineEventHandler(async (event) => {
-  await requireEventsManager(event);
-  const id = getRouterParam(event, "id");
+  await eventsStaff.require(event);
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
   const [ticket] = await db.select().from(schema.eventTickets).where(eq(schema.eventTickets.id, id)).limit(1);
-  if (!ticket) throw createError({ statusCode: 404, statusMessage: "Ticket not found." });
-  if (ticket.status === "paid" && ticket.amount > 0) {
-    throw createError({ statusCode: 409, statusMessage: "This ticket was paid for. Refund it instead." });
-  }
+  if (!ticket) throw notFound("Ticket not found.");
+  if (ticket.status === "paid" && ticket.amount > 0) throw conflict("This ticket was paid for. Refund it instead.");
   const [updated] = await db.update(schema.eventTickets).set({ status: "cancelled" }).where(and(eq(schema.eventTickets.id, id), inArray(schema.eventTickets.status, ["pending", "paid"]))).returning();
-  if (!updated) throw createError({ statusCode: 409, statusMessage: `Ticket is already ${ticket.status}.` });
-  return { ok: true };
+  if (!updated) throw conflict(`Ticket is already ${ticket.status}.`, { status: ticket.status });
+  return toAttendeeDto(updated, await ticketHolder(updated.userId));
 });

package/dist/runtime/server/routes/admin/ticket-refund.post.js

@@ -1,10 +1,12 @@
 import { db, schema } from "@nuxthub/db";
 import { eq } from "drizzle-orm";
+import { conflict, idParams, notFound } from "@frigear-nu/module-kit/server";
 export default defineEventHandler(async (event) => {
-  await requireEventsManager(event);
-  const [ticket] = await db.select().from(schema.eventTickets).where(eq(schema.eventTickets.id, getRouterParam(event, "id"))).limit(1);
-  if (!ticket) throw createError({ statusCode: 404, statusMessage: "Ticket not found." });
-  if (ticket.status !== "paid" || !ticket.paymentId) throw createError({ statusCode: 409, statusMessage: "Only paid tickets with a payment can be refunded." });
+  await eventsStaff.require(event, { sessionOnly: true });
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
+  const [ticket] = await db.select().from(schema.eventTickets).where(eq(schema.eventTickets.id, id)).limit(1);
+  if (!ticket) throw notFound("Ticket not found.");
+  if (ticket.status !== "paid" || !ticket.paymentId) throw conflict("Only paid tickets with a payment can be refunded.", { status: ticket.status });
   await refundPayment(ticket.paymentId);
-  return { ok: true };
+  return toAttendeeDto(ticket, await ticketHolder(ticket.userId));
 });

package/dist/runtime/server/routes/admin/ticket-type.delete.js

@@ -1,10 +1,13 @@
 import { db, schema } from "@nuxthub/db";
 import { and, eq, inArray, sql } from "drizzle-orm";
+import { conflict, idParams, noContent, notFound } from "@frigear-nu/module-kit/server";
 export default defineEventHandler(async (event) => {
-  await requireEventsManager(event);
-  const id = getRouterParam(event, "id");
+  await eventsStaff.require(event);
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
+  const [existing] = await db.select({ id: schema.eventTicketTypes.id }).from(schema.eventTicketTypes).where(eq(schema.eventTicketTypes.id, id)).limit(1);
+  if (!existing) throw notFound("Ticket type not found.");
   const [sold] = await db.select({ count: sql`count(*)` }).from(schema.eventTickets).where(and(eq(schema.eventTickets.ticketTypeId, id), inArray(schema.eventTickets.status, ["paid", "pending"])));
-  if (Number(sold?.count ?? 0) > 0) throw createError({ statusCode: 409, statusMessage: "This ticket type has tickets. Cancel them first." });
+  if (Number(sold?.count ?? 0) > 0) throw conflict("This ticket type has tickets. Cancel them first.");
   await db.delete(schema.eventTicketTypes).where(eq(schema.eventTicketTypes.id, id));
-  return { ok: true };
+  return noContent(event);
 });

package/dist/runtime/server/routes/admin/ticket-type.patch.js

@@ -1,6 +1,8 @@
+import { idParams } from "@frigear-nu/module-kit/server";
 import { patchTicketTypeRow, ticketTypePatchSchema } from "../../utils/admin.js";
 export default defineEventHandler(async (event) => {
-  await requireEventsManager(event);
+  await eventsStaff.require(event);
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
   const patch = await readValidatedBody(event, ticketTypePatchSchema.parse);
-  return patchTicketTypeRow(getRouterParam(event, "id"), patch);
+  return toAdminTicketTypeDto(await patchTicketTypeRow(id, patch));
 });

package/dist/runtime/server/routes/admin/ticket-types.post.js

@@ -1,12 +1,15 @@
-import { assertMembershipAvailable, insertTicketType } from "../../utils/admin.js";
+import { db, schema } from "@nuxthub/db";
+import { eq } from "drizzle-orm";
+import { created, idParams, notFound } from "@frigear-nu/module-kit/server";
+import { assertMembershipAvailable, assertTicketTypeKeyFree, insertTicketType } from "../../utils/admin.js";
 import { ticketTypeInput } from "../../utils/admin-schemas.js";
 export default defineEventHandler(async (event) => {
-  await requireEventsManager(event);
+  await eventsStaff.require(event);
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
   const input = await readValidatedBody(event, ticketTypeInput.parse);
+  const [parent] = await db.select({ id: schema.events.id }).from(schema.events).where(eq(schema.events.id, id)).limit(1);
+  if (!parent) throw notFound("Event not found.");
   await assertMembershipAvailable(input);
-  const row = await insertTicketType(getRouterParam(event, "id"), input).catch((error) => {
-    throw createError({ statusCode: 409, statusMessage: "Could not create the ticket type (unknown event, or the key is taken).", cause: error });
-  });
-  setResponseStatus(event, 201);
-  return row;
+  await assertTicketTypeKeyFree(id, input.key);
+  return created(event, toAdminTicketTypeDto(await insertTicketType(id, input)));
 });

package/dist/runtime/server/routes/admin/upcoming.get.js

@@ -1,10 +1,11 @@
 import { db, schema } from "@nuxthub/db";
 import { and, asc, count, eq, gte } from "drizzle-orm";
+import { isoDate } from "@frigear-nu/module-kit/server";
 const LIMIT = 5;
 export default defineEventHandler(async (event) => {
-  await requireEventsManager(event);
+  await eventsStaff.require(event);
   const upcoming = and(eq(schema.events.status, "published"), gte(schema.events.startsAt, /* @__PURE__ */ new Date()));
-  const [[total], items] = await Promise.all([
+  const [[total], rows] = await Promise.all([
     db.select({ value: count() }).from(schema.events).where(upcoming),
     db.select({
       id: schema.events.id,
@@ -13,5 +14,8 @@ export default defineEventHandler(async (event) => {
       startsAt: schema.events.startsAt
     }).from(schema.events).where(upcoming).orderBy(asc(schema.events.startsAt)).limit(LIMIT)
   ]);
-  return { total: total?.value ?? 0, items };
+  return {
+    total: total?.value ?? 0,
+    items: rows.map((row) => ({ id: row.id, name: row.name, location: row.location ?? null, startsAt: isoDate(row.startsAt) }))
+  };
 });

package/dist/runtime/server/routes/me/ticket-pay.post.js

@@ -0,0 +1,13 @@
+import { db, schema } from "@nuxthub/db";
+import { and, eq } from "drizzle-orm";
+import { conflict, idParams, notFound } from "@frigear-nu/module-kit/server";
+export default defineEventHandler(async (event) => {
+  const user = await requireUser(event, { scopes: ["tickets:write"] });
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
+  const [ticket] = await db.select().from(schema.eventTickets).where(and(eq(schema.eventTickets.id, id), eq(schema.eventTickets.userId, user.id))).limit(1);
+  if (!ticket) throw notFound("Ticket not found.");
+  if (ticket.status === "paid") throw conflict("This ticket is already paid.", { status: ticket.status });
+  if (ticket.status !== "pending" || !ticket.paymentId) throw conflict("This ticket can no longer be paid. Buy a new one.", { status: ticket.status });
+  const { url } = await resumePayment(ticket.paymentId, user.id, event);
+  return { url };
+});

package/dist/runtime/server/routes/me/ticket.get.js

@@ -0,0 +1,6 @@
+import { idParams } from "@frigear-nu/module-kit/server";
+export default defineEventHandler(async (event) => {
+  const user = await requireUser(event, { scopes: ["tickets:read"] });
+  const { id } = await getValidatedRouterParams(event, idParams().parse);
+  return getUserTicket(user.id, id);
+});

package/dist/runtime/server/routes/me/tickets.get.js

@@ -0,0 +1,2 @@
+import myTickets from "../../bootstrap/my-tickets.js";
+export default defineEventHandler(myTickets);

package/dist/runtime/server/routes/public/event.get.js

@@ -1,7 +1,10 @@
+import { z } from "zod";
+import { notFound } from "@frigear-nu/module-kit/server";
+const paramsSchema = z.object({ slug: z.string().trim().min(1).max(128) });
 export default defineEventHandler(async (event) => {
-  const slug = getRouterParam(event, "slug");
+  const { slug } = await getValidatedRouterParams(event, paramsSchema.parse);
   const row = await getPublishedEventRow(slug);
-  if (!row) throw createError({ statusCode: 404, statusMessage: "Event not found." });
+  if (!row) throw notFound("Event not found.");
   const user = await getUser(event, { scopes: ["tickets:read"] });
   return getEventDetail(row, user?.id);
 });

package/dist/runtime/server/routes/public/purchase.post.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+const paramsSchema = z.object({ slug: z.string().trim().min(1).max(128) });
 const bodySchema = z.object({
   ticketTypeId: z.string().min(1),
   addonIds: z.array(z.string().min(1)).max(50).optional(),
@@ -8,6 +9,7 @@ const bodySchema = z.object({
 });
 export default defineEventHandler(async (event) => {
   const user = await requireUser(event, { scopes: ["tickets:write"] });
+  const { slug } = await getValidatedRouterParams(event, paramsSchema.parse);
   const body = await readValidatedBody(event, bodySchema.parse);
-  return purchaseTicket(event, user.id, getRouterParam(event, "slug"), body);
+  return purchaseTicket(event, user.id, slug, body);
 });

package/dist/runtime/server/utils/admin-dto.d.ts

@@ -0,0 +1,30 @@
+import { schema } from '@nuxthub/db';
+import type { AdminAddonDto, AdminAddonGroupDto, AdminEventDetailDto, AdminEventDto, AdminTicketTypeDto, AttendeeDto } from '../../../types.js';
+type EventRow = typeof schema.events.$inferSelect;
+type TicketTypeRow = typeof schema.eventTicketTypes.$inferSelect;
+type AddonGroupRow = typeof schema.eventAddonGroups.$inferSelect;
+type AddonRow = typeof schema.eventAddons.$inferSelect;
+type TicketRow = typeof schema.eventTickets.$inferSelect;
+export declare function toAdminEventDto(row: EventRow): AdminEventDto;
+export declare function toAdminTicketTypeDto(row: TicketTypeRow): AdminTicketTypeDto;
+export declare function toAdminAddonGroupDto(row: AddonGroupRow): AdminAddonGroupDto;
+export declare function toAdminAddonDto(row: AddonRow): AdminAddonDto;
+/** The result of `getEventWithTicketTypes` as a DTO. */
+export declare function toAdminEventDetailDto(row: EventRow & {
+    ticketTypes: Array<TicketTypeRow & {
+        addonGroups: Array<AddonGroupRow & {
+            addons: AddonRow[];
+        }>;
+    }>;
+}): AdminEventDetailDto;
+/** A ticket with its holder, for staff. Keeps the QR `code` (staff check tickets in with it). */
+export declare function toAttendeeDto(row: TicketRow, holder: {
+    name: string | null;
+    email: string | null;
+}): AttendeeDto;
+/** The name and email of a ticket's holder, for `toAttendeeDto`. */
+export declare function ticketHolder(userId: number): Promise<{
+    name: string | null;
+    email: string | null;
+}>;
+export {};

package/dist/runtime/server/utils/admin-dto.js

@@ -0,0 +1,101 @@
+import { db, schema } from "@nuxthub/db";
+import { eq } from "drizzle-orm";
+import { isoDate } from "@frigear-nu/module-kit/server";
+import { normalizeMembership } from "../../utils/index.js";
+export function toAdminEventDto(row) {
+  return {
+    id: row.id,
+    slug: row.slug,
+    name: row.name,
+    description: row.description ?? null,
+    body: row.body ?? null,
+    image: row.image ?? null,
+    location: row.location ?? null,
+    locationUrl: row.locationUrl ?? null,
+    startsAt: isoDate(row.startsAt),
+    endsAt: isoDate(row.endsAt),
+    status: row.status,
+    requiresMembership: normalizeMembership(row.requiresMembership ?? void 0),
+    createdAt: isoDate(row.createdAt),
+    updatedAt: isoDate(row.updatedAt)
+  };
+}
+export function toAdminTicketTypeDto(row) {
+  return {
+    id: row.id,
+    eventId: row.eventId,
+    key: row.key,
+    name: row.name,
+    description: row.description ?? null,
+    price: row.price,
+    currency: row.currency,
+    hidePrice: row.hidePrice,
+    capacity: row.capacity ?? null,
+    saleStartsAt: isoDate(row.saleStartsAt),
+    saleEndsAt: isoDate(row.saleEndsAt),
+    saleSchedule: row.saleSchedule ?? null,
+    maxPerUser: row.maxPerUser,
+    requiresMembership: normalizeMembership(row.requiresMembership ?? void 0),
+    excludesMembership: normalizeMembership(row.excludesMembership ?? void 0),
+    isDefault: row.isDefault,
+    sortOrder: row.sortOrder,
+    createdAt: isoDate(row.createdAt),
+    updatedAt: isoDate(row.updatedAt)
+  };
+}
+export function toAdminAddonGroupDto(row) {
+  return {
+    id: row.id,
+    ticketTypeId: row.ticketTypeId,
+    title: row.title,
+    required: row.required,
+    multiple: row.multiple,
+    sortOrder: row.sortOrder
+  };
+}
+export function toAdminAddonDto(row) {
+  return {
+    id: row.id,
+    groupId: row.groupId,
+    label: row.label,
+    description: row.description ?? null,
+    price: row.price,
+    capacity: row.capacity ?? null,
+    sortOrder: row.sortOrder
+  };
+}
+export function toAdminEventDetailDto(row) {
+  return {
+    ...toAdminEventDto(row),
+    ticketTypes: row.ticketTypes.map((type) => ({
+      ...toAdminTicketTypeDto(type),
+      addonGroups: type.addonGroups.map((group) => ({
+        ...toAdminAddonGroupDto(group),
+        addons: group.addons.map(toAdminAddonDto)
+      }))
+    }))
+  };
+}
+export function toAttendeeDto(row, holder) {
+  return {
+    id: row.id,
+    eventId: row.eventId,
+    ticketTypeId: row.ticketTypeId,
+    userId: row.userId,
+    status: row.status,
+    addons: row.addons,
+    amount: row.amount,
+    currency: row.currency,
+    paymentId: row.paymentId ?? null,
+    code: row.code,
+    locale: row.locale ?? null,
+    checkedInAt: isoDate(row.checkedInAt),
+    createdAt: isoDate(row.createdAt),
+    userName: holder.name,
+    userEmail: holder.email
+  };
+}
+export async function ticketHolder(userId) {
+  const [user] = await db.select({ name: schema.users.name, email: schema.users.email }).from(schema.users).where(eq(schema.users.id, userId)).limit(1);
+  return { name: user?.name ?? null, email: user?.email ?? null };
+}

package/dist/runtime/server/utils/admin-schemas.js

@@ -39,7 +39,8 @@ export const ticketTypeInput = z.object({
   addonGroups: z.array(addonGroupInput).optional()
 });
 export const eventInput = z.object({
-  slug: z.string().min(1).max(128).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "Use lowercase letters, numbers and dashes."),
+  // `me` is the static segment of `/api/events/me/...`: h3's router never falls back to `:slug` past it.
+  slug: z.string().min(1).max(128).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "Use lowercase letters, numbers and dashes.").refine((slug) => slug !== "me", "This URL name is reserved."),
   name: translated,
   description: translated.nullish(),
   body: translated.nullish(),

package/dist/runtime/server/utils/admin.d.ts

@@ -4,6 +4,8 @@ import type { addonGroupInput } from './admin-schemas.js';
 type TicketTypeInput = z.output<typeof ticketTypeInput>;
 type AddonGroupInput = z.output<typeof addonGroupInput>;
 export declare function insertAddonGroup(ticketTypeId: string, input: AddonGroupInput): Promise<any>;
+/** 409 when another ticket type of `eventId` already uses `key` (keys are unique per event). */
+export declare function assertTicketTypeKeyFree(eventId: string, key: string, exceptId?: string): Promise<void>;
 export declare function insertTicketType(eventId: string, input: TicketTypeInput): Promise<any>;
 /**
  * Membership rules only make sense with a membership provider (`@frigear-nu/subscriptions`): without one a
@@ -37,8 +39,8 @@ export declare const eventPatchSchema: z.ZodObject<{
     location: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodPipe<z.ZodRecord<z.ZodString, z.ZodString>, z.ZodTransform<{
         [k: string]: string;
     }, Record<string, string>>>]>>>>;
-    endsAt: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodCoercedDate<unknown>>>>;
     locationUrl: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+    endsAt: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodCoercedDate<unknown>>>>;
     requiresMembership: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodLiteral<"any">, z.ZodArray<z.ZodString>]>>>>;
 }, z.core.$strip>;
 export declare function patchEventRow(id: string, patch: z.output<typeof eventPatchSchema>): Promise<any>;

package/dist/runtime/server/utils/admin.js

@@ -1,6 +1,7 @@
 import { db, schema } from "@nuxthub/db";
 import { newId } from "../../utils/index.js";
-import { asc, eq } from "drizzle-orm";
+import { and, asc, eq } from "drizzle-orm";
+import { badRequest, conflict, notFound } from "@frigear-nu/module-kit/server";
 import { loadCatalog } from "./catalog.js";
 import { eventInput, ticketTypeInput } from "./admin-schemas.js";
 export async function insertAddonGroup(ticketTypeId, input) {
@@ -11,6 +12,10 @@ export async function insertAddonGroup(ticketTypeId, input) {
   }
   return row;
 }
+export async function assertTicketTypeKeyFree(eventId, key, exceptId) {
+  const [taken] = await db.select({ id: schema.eventTicketTypes.id }).from(schema.eventTicketTypes).where(and(eq(schema.eventTicketTypes.eventId, eventId), eq(schema.eventTicketTypes.key, key))).limit(1);
+  if (taken && taken.id !== exceptId) throw conflict("A ticket type with this key already exists on the event.", { field: "key" });
+}
 export async function insertTicketType(eventId, input) {
   const { addonGroups, ...type } = input;
   const [row] = await db.insert(schema.eventTicketTypes).values({
@@ -30,13 +35,13 @@ export async function insertTicketType(eventId, input) {
 export async function assertMembershipAvailable(...inputs) {
   if (!inputs.some((input) => input?.requiresMembership || input?.excludesMembership)) return;
   if ((await getMembershipOptions()).available) return;
-  throw createError({ statusCode: 400, statusMessage: "Membership rules need a membership provider such as @frigear-nu/subscriptions." });
+  throw badRequest("Membership rules need a membership provider such as @frigear-nu/subscriptions.");
 }
 export async function createEventWithCatalog(raw) {
   const { ticketTypes, ...input } = raw;
   await assertMembershipAvailable(input, ...ticketTypes ?? []);
   const [taken] = await db.select({ id: schema.events.id }).from(schema.events).where(eq(schema.events.slug, input.slug)).limit(1);
-  if (taken) throw createError({ statusCode: 409, statusMessage: "An event with this slug already exists." });
+  if (taken) throw conflict("An event with this slug already exists.", { field: "slug" });
   const [row] = await db.insert(schema.events).values({
     id: newId("evn"),
     ...input,
@@ -48,20 +53,29 @@ export async function createEventWithCatalog(raw) {
 export const eventPatchSchema = eventInput.omit({ ticketTypes: true }).partial();
 export async function patchEventRow(id, patch) {
   await assertMembershipAvailable(patch);
+  if (patch.slug) {
+    const [taken] = await db.select({ id: schema.events.id }).from(schema.events).where(eq(schema.events.slug, patch.slug)).limit(1);
+    if (taken && taken.id !== id) throw conflict("An event with this slug already exists.", { field: "slug" });
+  }
   const [row] = await db.update(schema.events).set(patch).where(eq(schema.events.id, id)).returning();
-  if (!row) throw createError({ statusCode: 404, statusMessage: "Event not found." });
+  if (!row) throw notFound("Event not found.");
   return row;
 }
 export const ticketTypePatchSchema = ticketTypeInput.omit({ addonGroups: true }).partial();
 export async function patchTicketTypeRow(id, patch) {
   await assertMembershipAvailable(patch);
+  if (patch.key) {
+    const [current] = await db.select({ eventId: schema.eventTicketTypes.eventId }).from(schema.eventTicketTypes).where(eq(schema.eventTicketTypes.id, id)).limit(1);
+    if (!current) throw notFound("Ticket type not found.");
+    await assertTicketTypeKeyFree(current.eventId, patch.key, id);
+  }
   const [row] = await db.update(schema.eventTicketTypes).set(patch).where(eq(schema.eventTicketTypes.id, id)).returning();
-  if (!row) throw createError({ statusCode: 404, statusMessage: "Ticket type not found." });
+  if (!row) throw notFound("Ticket type not found.");
   return row;
 }
 export async function getEventWithTicketTypes(id) {
   const [row] = await db.select().from(schema.events).where(eq(schema.events.id, id)).limit(1);
-  if (!row) throw createError({ statusCode: 404, statusMessage: "Event not found." });
+  if (!row) throw notFound("Event not found.");
   const ticketTypes = await db.select().from(schema.eventTicketTypes).where(eq(schema.eventTicketTypes.eventId, id)).orderBy(asc(schema.eventTicketTypes.sortOrder));
   const { groups, addons } = await loadCatalog(id);
   return {

package/dist/runtime/server/utils/auth.d.ts

@@ -1,8 +1,9 @@
 import type { H3Event } from 'h3';
-/** Gate for staff routes (event/ticket management, check-in). */
-export declare function requireEventsManager(event: H3Event): Promise<{
-    userId: number;
-}>;
+/**
+ * The staff gate of every `/api/admin/events` route (event and ticket management, check-in). The host decides who is
+ * staff through the `events:authorize` Nitro hook; denied by default. Bearer tokens need the `events:manage` scope.
+ */
+export declare const eventsStaff: any;
 /** Non-throwing form of the `events:authorize` policy for the caller of an already-authenticated request (MCP). */
 export declare const canManageEvents: (event: H3Event, principal: {
     user: {

package/dist/runtime/server/utils/auth.js

@@ -1,7 +1,6 @@
-const gate = definePolicyGate("events:authorize");
-export async function requireEventsManager(event) {
-  const user = await requireUser(event, { scopes: ["events:manage"] });
-  await gate.assert(event, user.id, "You are not allowed to manage events.");
-  return { userId: user.id };
-}
-export const canManageEvents = (event, principal) => gate.isAllowed(event, principal.user.id);
+export const eventsStaff = defineStaffGuard({
+  hook: "events:authorize",
+  scope: "events:manage",
+  message: "You are not allowed to manage events."
+});
+export const canManageEvents = (event, principal) => eventsStaff.can(event, principal.user.id);

package/dist/runtime/server/utils/tickets.js

@@ -1,23 +1,18 @@
 import { db, schema } from "@nuxthub/db";
 import { and, eq, sql } from "drizzle-orm";
-import { resolveSameOriginUrl } from "@frigear-nu/stripe/utils";
+import { apiError, resolveSameOriginUrl } from "@frigear-nu/module-kit/server";
 import { newId, newTicketCode, normalizeMembership, translate } from "../../utils/index.js";
 import { countAddonSeats, countSeats, getPublishedEventRow, holdsSeat, loadCatalog, toTicketDtos } from "./catalog.js";
 import { meetsMembership, passesExclusion } from "./membership.js";
-const fail = (statusCode, statusMessage) => createError({ statusCode, statusMessage });
+const CODES = { 400: "bad_request", 403: "forbidden", 404: "not_found", 409: "conflict" };
+const fail = (statusCode, message) => apiError(statusCode, CODES[statusCode], message);
 function returnUrls(event, slug, ticketId, body) {
-  const origin = getRequestURL(event).origin;
   const pages = useRuntimeConfig().public.events?.pages ?? {};
   const eventPath = (pages.event || "/events/:slug").replace(":slug", encodeURIComponent(slug));
-  const resolve = (input, status, name) => {
-    if (input) {
-      const safe = resolveSameOriginUrl(input, origin);
-      if (!safe) throw fail(400, `${name} must be a relative path or an URL on the same origin.`);
-      return safe;
-    }
-    return `${origin}${eventPath}?ticket=${ticketId}&payment=${status}`;
+  return {
+    successUrl: resolveSameOriginUrl(event, body.successUrl, { fallback: `${eventPath}?ticket=${ticketId}&payment=success`, name: "successUrl" }),
+    cancelUrl: resolveSameOriginUrl(event, body.cancelUrl, { fallback: `${eventPath}?ticket=${ticketId}&payment=cancel`, name: "cancelUrl" })
   };
-  return { successUrl: resolve(body.successUrl, "success", "successUrl"), cancelUrl: resolve(body.cancelUrl, "cancel", "cancelUrl") };
 }
 async function release(ticketId, status = "cancelled") {
   await db.update(schema.eventTickets).set({ status }).where(eq(schema.eventTickets.id, ticketId));

package/dist/runtime/utils/api.d.ts

@@ -0,0 +1,48 @@
+export declare const eventsApi: {
+    /** `GET` the published events. */
+    readonly list: "/api/events";
+    /** `GET` one published event with its ticket types (personalised when signed in). */
+    readonly event: (slug: string) => string;
+    /** `POST` a ticket purchase. */
+    readonly purchase: (slug: string) => string;
+    readonly me: {
+        /** `GET` the caller's tickets (also the account bootstrap's `events:tickets:mine`). */
+        readonly tickets: "/api/events/me/tickets";
+        /** `GET` one of the caller's tickets. */
+        readonly ticket: (id: string) => string;
+        /** `POST` to resume paying for one of the caller's pending tickets. */
+        readonly pay: (id: string) => string;
+    };
+    readonly admin: {
+        /** `GET` (paginated) / `POST` events. */
+        readonly events: "/api/admin/events";
+        /** `GET` / `PATCH` / `DELETE` one event. */
+        readonly event: (id: string) => string;
+        /** `POST` a copy of an event as a new draft. */
+        readonly clone: (id: string) => string;
+        /** `GET` an event's tickets with their holders (paginated). */
+        readonly attendees: (id: string) => string;
+        /** `POST` a ticket type to an event. */
+        readonly ticketTypes: (eventId: string) => string;
+        /** `PATCH` / `DELETE` one ticket type. */
+        readonly ticketType: (id: string) => string;
+        /** `POST` an add-on group to a ticket type. */
+        readonly addonGroups: (ticketTypeId: string) => string;
+        /** `PATCH` / `DELETE` one add-on group. */
+        readonly addonGroup: (id: string) => string;
+        /** `POST` an add-on to a group. */
+        readonly addons: (groupId: string) => string;
+        /** `PATCH` / `DELETE` one add-on. */
+        readonly addon: (id: string) => string;
+        /** `POST` to cancel an unpaid or free ticket. */
+        readonly cancelTicket: (id: string) => string;
+        /** `POST` to refund a paid ticket (session only). */
+        readonly refundTicket: (id: string) => string;
+        /** `GET` the memberships a ticket type can require or exclude. */
+        readonly membershipOptions: "/api/admin/events/membership-options";
+        /** `GET` the next published events and how many there are (admin dashboard). */
+        readonly upcoming: "/api/admin/events/upcoming";
+        /** `POST` a scanned ticket code. */
+        readonly checkIn: "/api/admin/events/check-in";
+    };
+};

package/dist/runtime/utils/api.js

@@ -0,0 +1,51 @@
+const enc = encodeURIComponent;
+const PUBLIC_BASE = "/api/events";
+const ADMIN_BASE = "/api/admin/events";
+export const eventsApi = {
+  /** `GET` the published events. */
+  list: PUBLIC_BASE,
+  /** `GET` one published event with its ticket types (personalised when signed in). */
+  event: (slug) => `${PUBLIC_BASE}/${enc(slug)}`,
+  /** `POST` a ticket purchase. */
+  purchase: (slug) => `${PUBLIC_BASE}/${enc(slug)}/purchase`,
+  me: {
+    /** `GET` the caller's tickets (also the account bootstrap's `events:tickets:mine`). */
+    tickets: `${PUBLIC_BASE}/me/tickets`,
+    /** `GET` one of the caller's tickets. */
+    ticket: (id) => `${PUBLIC_BASE}/me/tickets/${enc(id)}`,
+    /** `POST` to resume paying for one of the caller's pending tickets. */
+    pay: (id) => `${PUBLIC_BASE}/me/tickets/${enc(id)}/pay`
+  },
+  admin: {
+    /** `GET` (paginated) / `POST` events. */
+    events: ADMIN_BASE,
+    /** `GET` / `PATCH` / `DELETE` one event. */
+    event: (id) => `${ADMIN_BASE}/${enc(id)}`,
+    /** `POST` a copy of an event as a new draft. */
+    clone: (id) => `${ADMIN_BASE}/${enc(id)}/clone`,
+    /** `GET` an event's tickets with their holders (paginated). */
+    attendees: (id) => `${ADMIN_BASE}/${enc(id)}/tickets`,
+    /** `POST` a ticket type to an event. */
+    ticketTypes: (eventId) => `${ADMIN_BASE}/${enc(eventId)}/ticket-types`,
+    /** `PATCH` / `DELETE` one ticket type. */
+    ticketType: (id) => `${ADMIN_BASE}/ticket-types/${enc(id)}`,
+    /** `POST` an add-on group to a ticket type. */
+    addonGroups: (ticketTypeId) => `${ADMIN_BASE}/ticket-types/${enc(ticketTypeId)}/addon-groups`,
+    /** `PATCH` / `DELETE` one add-on group. */
+    addonGroup: (id) => `${ADMIN_BASE}/addon-groups/${enc(id)}`,
+    /** `POST` an add-on to a group. */
+    addons: (groupId) => `${ADMIN_BASE}/addon-groups/${enc(groupId)}/addons`,
+    /** `PATCH` / `DELETE` one add-on. */
+    addon: (id) => `${ADMIN_BASE}/addons/${enc(id)}`,
+    /** `POST` to cancel an unpaid or free ticket. */
+    cancelTicket: (id) => `${ADMIN_BASE}/tickets/${enc(id)}/cancel`,
+    /** `POST` to refund a paid ticket (session only). */
+    refundTicket: (id) => `${ADMIN_BASE}/tickets/${enc(id)}/refund`,
+    /** `GET` the memberships a ticket type can require or exclude. */
+    membershipOptions: `${ADMIN_BASE}/membership-options`,
+    /** `GET` the next published events and how many there are (admin dashboard). */
+    upcoming: `${ADMIN_BASE}/upcoming`,
+    /** `POST` a scanned ticket code. */
+    checkIn: `${ADMIN_BASE}/check-in`
+  }
+};

package/dist/runtime/utils/index.d.ts

@@ -2,7 +2,8 @@ import { translate } from '@frigear-nu/ui/translated';
 import type { MembershipRequirement } from '../types.js';
 export { translate };
 export * from './links.js';
-export type { AddonDto, AddonGroupDto, AuthorizeContext, CheckInResponse, EventDetailDto, EventStatus, EventSummaryDto, MembershipRequirement, ModuleOptions, PurchaseBeforeContext, PurchaseBody, PurchaseResponse, TicketDto, TicketHookContext, TicketStatus, TicketTypeDto, Translated, } from '../types.js';
+export * from './api.js';
+export type { AddonDto, AdminAddonDto, AdminAddonGroupDto, AdminEventDetailDto, AdminEventDto, AdminTicketTypeDto, AttendeeDto, AddonGroupDto, AuthorizeContext, CheckInResponse, EventDetailDto, EventStatus, EventSummaryDto, MembershipOptionsDto, MembershipRequirement, ModuleOptions, PurchaseBeforeContext, PurchaseBody, PurchaseResponse, TicketDto, TicketHookContext, TicketStatus, TicketTypeDto, Translated, UpcomingEventsDto, } from '../types.js';
 /** The currency tickets and add-ons are sold in unless they say otherwise (the column default). */
 export declare const DEFAULT_CURRENCY = "DKK";
 /** Normalises a stored requirement: empty plan lists mean "any active subscription". */

package/dist/runtime/utils/index.js

@@ -2,6 +2,7 @@ import { translate } from "@frigear-nu/ui/translated";
 import { formatMoney as formatPrice } from "@frigear-nu/ui/money";
 export { translate };
 export * from "./links.js";
+export * from "./api.js";
 export const DEFAULT_CURRENCY = "DKK";
 export function normalizeMembership(value) {
   if (value === "any") return "any";

package/dist/types.d.mts

@@ -2,4 +2,4 @@ export { type Translated } from '@frigear-nu/ui/translated'
 
 export { default } from './module.mjs'
 
-export { type AddonDto, type AddonGroupDto, type AuthorizeContext, type CheckInResponse, type EventDetailDto, type EventStatus, type EventSummaryDto, type EventsRuntimeConfig, type MembershipCheckContext, type MembershipOption, type MembershipOptionsContext, type MembershipRequirement, type ModuleOptions, type PublicModuleOptions, type PurchaseBeforeContext, type PurchaseBody, type PurchaseResponse, type TicketDto, type TicketHookContext, type TicketStatus, type TicketTypeDto } from './module.mjs'
+export { type AddonDto, type AddonGroupDto, type AdminAddonDto, type AdminAddonGroupDto, type AdminEventDetailDto, type AdminEventDto, type AdminTicketTypeDto, type AttendeeDto, type AuthorizeContext, type CheckInResponse, type EventDetailDto, type EventStatus, type EventSummaryDto, type EventsRuntimeConfig, type MembershipCheckContext, type MembershipOption, type MembershipOptionsContext, type MembershipOptionsDto, type MembershipRequirement, type ModuleOptions, type PublicModuleOptions, type PurchaseBeforeContext, type PurchaseBody, type PurchaseResponse, type TicketDto, type TicketHookContext, type TicketStatus, type TicketTypeDto, type UpcomingEventsDto } from './module.mjs'