Merge branch 'feat/bulk-actions'

Manage registrations: tick registrations (or all shown) and message
them (email/WhatsApp event update), mark them paid (the balance, by
method), move them to another ticket (same tickets and QR codes,
repriced, places checked), put their people in a room or group, export
to Excel, or cancel. Each runs the same handlers as doing it one at a
time, with a result per registration. POST /api/registrations/bulk,
campus-checked per id. Migration 20261028170000_registrations_bulk.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,30 @@ and this project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [1.49.1] - 2026-10-28
+
+### Added
+
+- **Bulk actions on registrations** (Admin → Manage registrations): tick registrations, or "Select
+  all shown" after filtering, and act on them at once —
+  - **Send a message** by email or WhatsApp, as an event update to the person who registered
+    (placeholders as on Email attendees);
+  - **Mark paid** — records what each still owes, by cash, EFT, card or other; paid registrations get
+    their tickets by email, as with a single payment;
+  - **Move to another ticket** (one event) — the same lines, issued tickets and QR codes move with
+    them, repriced at the new ticket's current price, so the difference shows as owing or overpaid;
+    places on the new ticket are checked first;
+  - **Put in a room or group** (one event) — their named people, with the group's capacity and
+    gender rules;
+  - **Export to Excel** (recorded in the access log, like other exports);
+  - **Cancel** — coupon uses released and the waitlist offered the places; no refund (record refunds
+    on the Payments page).
+  Each runs the same code as doing it one at a time (closed events, payment caps, coupons,
+  waitlist, privacy rules on messages), with a result per registration. Up to 500 at a time.
+- `POST /api/registrations/bulk` (campus-checked for every registration; payments and ticket moves
+  refused in licence read-only mode); `registrationIds` filter on the email and WhatsApp attendee
+  endpoints. Audit action `registrations_bulk` (migration `20261028170000_registrations_bulk`).
+
 ## [1.49.0] - 2026-10-28
 
 ### Added

FEATURES.md

@@ -476,7 +476,11 @@ logout controls. Disconnected sessions are recovered automatically.
   [Privacy](#privacy-popia)).
 - **Registrations** — all registrations, with filters (event, status, text),
   status counts, revenue and outstanding totals, and per-registration options,
-  form answers and payments (with who recorded each one).
+  form answers and payments (with who recorded each one). **Bulk actions** on
+  ticked registrations (or all shown): message (email/WhatsApp), mark paid
+  (records the balance by method), move to another ticket (same tickets and QR
+  codes, repriced), put in a room or group, export to Excel, cancel — each
+  through the same rules as one at a time, with a result per registration.
 - **Cashup** — see below.
 - **Audit log** (`/dashboard/admin/audit-log`) — who did what and when for
   refunds, donation assign/unassign, manual registrations, staff

WHATS-NEW.md

@@ -12,6 +12,15 @@ Write for church admins, not developers: no environment variables, endpoints or
 developer log is CHANGELOG.md. A tagged version without a section here shows "No details given".
 -->
 
+## 1.49.1
+
+- **Do many at once.** On Manage registrations, tick the people you want (or select everyone
+  shown after filtering) and send them a message, mark them paid, move them to another ticket, put
+  them in a room or group, export them to Excel, or cancel them.
+- Moving people to another ticket keeps their tickets and QR codes; the price follows the new
+  ticket, so any difference shows as owing.
+- You see what happened to each one, and anything that couldn't be done says why.
+
 ## 1.49.0
 
 - **Today, at a glance.** The dashboard now starts with what's on today: each event with how many

backend/API_DOCUMENTATION.md

@@ -933,6 +933,19 @@ Allergies, medical and custody notes are stored encrypted. Staff routes are camp
 Since 1.46.0 board rooms also carry `rostered: [{ userId, name, checkedIn }]` (volunteers on a serving
 role linked to the room); checked-in ones are counted in `leaders`.
 
+## Bulk actions on registrations
+
+`POST /api/registrations/bulk` (supervisor+): `{ action, registrationIds: [...] (≤ 500), ...params }` →
+`{ action, done, skipped, failed, results: [{ id, ok, skipped?, message }] }`. Every id is campus-checked.
+
+| action | params | What happens |
+|--------|--------|--------------|
+| `markPaid` | `method`: cash/eft/card/other, `paidAt?` | A payment for what's still owed (as `POST /api/payments`); refused in licence read-only mode |
+| `cancel` | — | As cancelling one registration (coupons released, waitlist offered); no refund |
+| `moveOption` | `fromOptionId`, `toOptionId` (same event) | The lines, tickets and attendees move to the new ticket, repriced; status recalculated; places checked; refused in read-only mode |
+| `allocate` | `setId`, `groupId` | Each named person placed, as `PUT /api/allocations/sets/:id/assignments` |
+| `message` | `channel`: email/whatsapp, `subject` (email), `text` | Per event, as `POST /api/events/:id/email-attendees` / `whatsapp-attendees` with `filter.registrationIds`, kind "update" |
+
 ## Dashboard and command palette
 
 | Method | Path | Auth | Description |

backend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "event-management-backend",
-  "version": "1.49.0",
+  "version": "1.49.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "event-management-backend",
-      "version": "1.49.0",
+      "version": "1.49.1",
       "hasInstallScript": true,
       "dependencies": {
         "@prisma/adapter-pg": "^7.10.1",

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "event-management-backend",
-  "version": "1.49.0",
+  "version": "1.49.1",
   "description": "Event Management System Backend",
   "main": "src/index.js",
   "scripts": {

backend/prisma/migrations/20261028170000_registrations_bulk/migration.sql

@@ -0,0 +1,3 @@
+-- AlterEnum
+ALTER TYPE "AdminAuditAction" ADD VALUE 'registrations_bulk';
+

backend/prisma/schema.prisma

@@ -818,6 +818,7 @@ enum AdminAuditAction {
   series_deleted
   season_pass_changed
   webhook_endpoint_changed
+  registrations_bulk
 }
 
 // Append-only audit trail for admin/supervisor-initiated actions with money or

backend/src/controllers/eventController.js

@@ -1602,6 +1602,9 @@ const emailEventAttendees = async (req, res) => {
       // Prefer server-side filtering when possible
       where.userId = { in: attendeeIds };
     }
+    // Bulk actions (1.49.1): exactly the registrations ticked on the registrations list.
+    const registrationIds = Array.isArray(filter?.registrationIds) ? filter.registrationIds.filter((x) => typeof x === 'string' && x.trim()).slice(0, 2000) : [];
+    if (registrationIds.length > 0) where.id = { in: registrationIds };
 
     // Name/email substring filter (kept for backward compatibility)
     const nameQ = (filter && filter.name) ? String(filter.name).trim() : '';
@@ -1870,6 +1873,9 @@ const whatsappEventAttendees = async (req, res) => {
     if (attendeeIds.length > 0) {
       where.userId = { in: attendeeIds };
     }
+    // Bulk actions (1.49.1): exactly the registrations ticked on the registrations list.
+    const registrationIds = Array.isArray(filter?.registrationIds) ? filter.registrationIds.filter((x) => typeof x === 'string' && x.trim()).slice(0, 2000) : [];
+    if (registrationIds.length > 0) where.id = { in: registrationIds };
 
     const nameQ = (filter && filter.name) ? String(filter.name).trim() : '';
     const phoneQ = (filter && filter.phone) ? String(filter.phone).trim() : '';

backend/src/index.js

@@ -682,6 +682,8 @@ app.get('/docs', async (req, res) => {
         request:{ body:{ attendees:[{ id:'att-uuid-...', eventOptionId:'opt-uuid-...', name:'Sam Smith', email:'sam@example.com' },{ eventOptionId:'opt-uuid-...', name:'Alex Smith' }], ticketDelivery:'each' }},
         responses:[{ status:200, desc:'Saved', body:{ id:'reg-uuid-...', ticketDelivery:'each', attendees:[{ id:'att-uuid-...', name:'Sam Smith', ticket:{ id:'tkt-uuid-...', isUsed:false }}] }}]},
       { method:'POST', path:'/api/registrations/:id/attendees/:attendeeId/send-form-link', auth:'user+', desc:'Email/WhatsApp a named attendee the link to fill in their own attendee form' },
+      { method:'POST', path:'/api/registrations/bulk', auth:'supervisor+', desc:'Bulk actions on ticked registrations (up to 500), each run through the same code as doing it one at a time: action "markPaid" { method: cash|eft|card|other, paidAt? } records the balance; "cancel"; "moveOption" { fromOptionId, toOptionId } (same event); "allocate" { setId, groupId } places their named people; "message" { channel: email|whatsapp, subject?, text } sends an event update. Answers { action, done, skipped, failed, results: [{ id, ok, skipped?, message }] }. Campus-checked for every id; payments and ticket changes refused in licence read-only mode. Audited as registrations_bulk',
+        request:{ body:{ action:'markPaid', registrationIds:['reg-uuid-1','reg-uuid-2'], method:'cash' } } },
       { method:'POST', path:'/api/registrations/manual', auth:'supervisor+', desc:'Manually create a registration (at-the-door / walk-in). Resolves early-bird tier pricing (including per-variant tiers) and stores priceSnapshot + appliedTierId on each option. Creates or finds a matching user by email/phone. If a matching user is found, updates their notificationPreference and backfills a missing phone number or guest placeholder email with the newly supplied value (without overwriting existing contact info). Generates a Yoco checkout link for unpaid registrations to include in the self-service notification email.',
         request:{ body:{ eventId:'ev-uuid-...', user:{ name:'Jane Doe', email:'jane@example.com', phoneNumber:'0821234567' }, options:[{ eventOptionId:'opt-uuid-...', quantity:1, variantId:'var-uuid-...' }], notificationPreference:'email' }},
         responses:[{ status:201, desc:'Created', body:{ id:'reg-uuid-new', status:'pending' }}]},

backend/src/routes/registrationRoutes.js

@@ -17,7 +17,7 @@ const {
   updateAttendees, sendAttendeeFormLink,
 } = require('../controllers/registrationController');
 const { protect, supervisor, staff, optionalAuth } = require('../middleware/authMiddleware');
-const { scopeEvent, scopeList } = require('../utils/campusScope');
+const { scopeEvent, scopeList, scopeBody } = require('../utils/campusScope');
 const { notOnSeasonPass } = require('../utils/seasonPass');
 
 // Campus-scoped staff (utils/campusScope.js). Routes open to the registration's owner as well
@@ -46,5 +46,9 @@ router.get('/', protect, staff, scopeList, getRegistrations);
 router.put('/:id', protect, staff, scopeEvent({ resolve: 'registration' }), updateRegistrationStatus);
 router.get('/event/:eventId', protect, staff, scopeEvent(), getRegistrationsByEvent);
 router.post('/manual', protect, supervisor, scopeEvent({ from: req => req.body?.eventId }), createManualRegistration);
+// Bulk actions (1.49.1): every ticked registration must be one this person may manage.
+router.post('/bulk', protect, supervisor, scopeBody([['registrationIds', 'registration']], { orphan: 'deny' }), async (req, res) => {
+  try { res.json(await require('../utils/bulkRegistrations').runBulk(req, req.body || {})); } catch (e) { res.status(e.statusCode || 400).json({ message: e.message }); }
+});
 
 module.exports = router;

backend/src/utils/bulkRegistrations.js

@@ -0,0 +1,192 @@
+/**
+ * Bulk actions on registrations (1.49.1): the registrations list lets a supervisor or admin tick
+ * many and act on them at once — mark paid, cancel, move to another ticket, put in a room or
+ * group, or send a message.
+ *
+ * Each action runs the same code as doing it one at a time (the controllers' own handlers, called
+ * in-process), so every rule still applies: closed events, payment caps and overpayments becoming
+ * donations, tickets and emails on payment, coupons released and the waitlist offered on
+ * cancelling, pricing on a ticket change, room capacity and gender, and the privacy rules and
+ * footers on messages. Results come back per registration; one failing doesn't stop the rest.
+ */
+
+const prisma = require('../config/db');
+
+const MAX = 500;
+const ACTIONS = ['markPaid', 'cancel', 'moveOption', 'allocate', 'message'];
+const METHODS = ['cash', 'eft', 'card', 'other'];
+
+function bulkError(message, statusCode = 400) {
+  const err = new Error(message);
+  err.statusCode = statusCode;
+  return err;
+}
+
+/** Calls an Express handler in-process; resolves to { ok, status, body }. */
+function call(handler, req) {
+  return new Promise((resolve) => {
+    const res = {
+      statusCode: 200,
+      status(code) { this.statusCode = code; return this; },
+      json(body) { resolve({ ok: this.statusCode < 400, status: this.statusCode, body }); return this; },
+      send(body) { resolve({ ok: this.statusCode < 400, status: this.statusCode, body }); return this; },
+    };
+    Promise.resolve(handler({ query: {}, params: {}, body: {}, headers: {}, ip: req.ip, ...req }, res))
+      .catch(e => resolve({ ok: false, status: 500, body: { message: e?.message || String(e) } }));
+  });
+}
+
+/** Who is asking, with their request's headers and socket (so audit entries keep the real IP). */
+const from = req => ({ user: req.user, headers: req.headers || {}, socket: req.socket });
+
+const messageOf = r => r.body?.message || (r.ok ? 'Done' : `Failed (${r.status})`);
+
+async function markPaid(req, regs, { method, paidAt }) {
+  if (!METHODS.includes(method)) throw bulkError('Choose how it was paid (cash, EFT, card or other)');
+  const { createPayment } = require('../controllers/paymentController');
+  const { refreshPricingForRegistration, computeRegistrationTotalDue } = require('./pricing');
+  const out = [];
+  for (const r of regs) {
+    if (r.status === 'cancelled') { out.push({ id: r.id, ok: false, message: 'Cancelled — not paid' }); continue; }
+    try { await refreshPricingForRegistration(r.id); } catch { /* the payment code refreshes too */ }
+    const fresh = await prisma.registration.findUnique({ where: { id: r.id }, include: { registrationOptions: { include: { eventOption: { include: { earlyBirdTiers: true } }, tranches: true } }, payments: true } });
+    const owed = Math.round((computeRegistrationTotalDue(fresh, new Date()) - fresh.payments.reduce((s, p) => s + p.amount, 0)) * 100) / 100;
+    if (owed <= 0) { out.push({ id: r.id, ok: true, skipped: true, message: 'Already paid' }); continue; }
+    const res = await call(createPayment, { ...from(req), body: { amount: owed, method, registrationId: r.id, userId: r.userId, ...(paidAt ? { paidAt } : {}) } });
+    out.push({ id: r.id, ok: res.ok, message: res.ok ? `R${owed.toFixed(2)} recorded` : messageOf(res) });
+  }
+  return out;
+}
+
+async function cancel(req, regs) {
+  const { cancelRegistration } = require('../controllers/registrationController');
+  const out = [];
+  for (const r of regs) {
+    if (r.status === 'cancelled') { out.push({ id: r.id, ok: true, skipped: true, message: 'Already cancelled' }); continue; }
+    const res = await call(cancelRegistration, { ...from(req), params: { id: r.id } });
+    out.push({ id: r.id, ok: res.ok, message: res.ok ? 'Cancelled' : messageOf(res) });
+  }
+  return out;
+}
+
+/**
+ * Moves every place on `fromOptionId` to `toOptionId`, keeping the same lines, tickets (and their
+ * QR codes) and named people — the editing screen can't take issued tickets away, but a move
+ * doesn't need to. Each moved line is repriced at the new ticket's current price (early birds and
+ * staff prices as for a new registration); the status follows what's now paid against owed, so
+ * moving up shows the difference owing and moving down shows the overpayment. Places on the new
+ * ticket are checked first.
+ */
+async function moveOption(req, regs, { fromOptionId, toOptionId }) {
+  if (!fromOptionId || !toOptionId || fromOptionId === toOptionId) throw bulkError('Choose the ticket to move from and the one to move to');
+  const options = await prisma.eventOption.findMany({ where: { id: { in: [fromOptionId, toOptionId] } }, include: { earlyBirdTiers: true, event: { select: { id: true, cashupStatus: true, kidsOptionId: true, volunteerOptionId: true } } } });
+  if (options.length !== 2 || options[0].eventId !== options[1].eventId) throw bulkError('Both tickets must belong to the same event');
+  const target = options.find(o => o.id === toOptionId);
+  const event = target.event;
+  if (event.cashupStatus === 'closed') throw bulkError('This event is closed. Reopen it (admin only) before making changes.');
+  if ([event.kidsOptionId, event.volunteerOptionId].includes(toOptionId)) throw bulkError('The kids and volunteer tickets are handed out by staff, not moved to');
+  const { resolveOptionPrice } = require('./pricing');
+  const { remainingFor } = require('./stock');
+  const { updateRegistrationStatus } = require('../payments/webhook');
+  const out = [];
+  for (const r of regs) {
+    if (r.eventId !== event.id) { out.push({ id: r.id, ok: false, message: 'Not for this event' }); continue; }
+    if (r.status === 'cancelled') { out.push({ id: r.id, ok: false, message: 'Cancelled' }); continue; }
+    if (r.seasonPassPurchaseId) { out.push({ id: r.id, ok: false, message: 'Part of a season pass — tickets can\'t be changed' }); continue; }
+    const lines = await prisma.registrationOption.findMany({ where: { registrationId: r.id, eventOptionId: fromOptionId, sessionId: null }, select: { id: true, quantity: true } });
+    if (!lines.length) { out.push({ id: r.id, ok: true, skipped: true, message: 'No such ticket to move' }); continue; }
+    const qty = lines.reduce((s, l) => s + l.quantity, 0);
+    const left = await remainingFor(target, null);
+    if (left !== null && left < qty) { out.push({ id: r.id, ok: false, message: `Only ${left} place${left === 1 ? '' : 's'} left on ${target.name}` }); continue; }
+    try {
+      const owner = await prisma.user.findUnique({ where: { id: r.userId }, select: { role: true } });
+      const { price, tierId } = await resolveOptionPrice(target, qty, owner);
+      await prisma.$transaction(async tx => {
+        for (const line of lines) {
+          await tx.registrationOption.update({ where: { id: line.id }, data: { eventOptionId: toOptionId, variantId: null, priceSnapshot: price, appliedTierId: tierId || null } });
+          await tx.registrationOptionTranche.deleteMany({ where: { registrationOptionId: line.id } });
+          await tx.registrationOptionTranche.create({ data: { registrationOptionId: line.id, quantity: line.quantity, priceSnapshot: price, appliedTierId: tierId || null } });
+          await tx.attendee.updateMany({ where: { registrationOptionId: line.id }, data: { eventOptionId: toOptionId, variantId: null } });
+        }
+      });
+      const updated = await updateRegistrationStatus(r.id);
+      const diff = Math.round(((updated.totalDue || 0) - (updated.totalPaid || 0)) * 100) / 100;
+      out.push({ id: r.id, ok: true, message: diff > 0 ? `Moved — R${diff.toFixed(2)} now owing` : diff < 0 ? `Moved — R${(-diff).toFixed(2)} overpaid` : 'Moved' });
+    } catch (e) {
+      out.push({ id: r.id, ok: false, message: e?.message || 'Couldn\'t move' });
+    }
+  }
+  return out;
+}
+
+async function allocate(req, regs, { setId, groupId }) {
+  if (!setId || !groupId) throw bulkError('Choose the group to put them in');
+  const { assign } = require('../controllers/allocationController');
+  const out = [];
+  for (const r of regs) {
+    const people = await prisma.attendee.findMany({ where: { registrationId: r.id }, select: { id: true, name: true } });
+    if (!people.length) { out.push({ id: r.id, ok: false, message: 'No named people on this registration to place' }); continue; }
+    const fails = [];
+    for (const a of people) {
+      const res = await call(assign, { ...from(req), params: { id: setId }, body: { attendeeId: a.id, groupId } });
+      if (!res.ok) fails.push(`${a.name}: ${messageOf(res)}`);
+    }
+    out.push({ id: r.id, ok: fails.length === 0, message: fails.length ? fails.join('; ') : `${people.length} placed` });
+  }
+  return out;
+}
+
+async function message(req, regs, { channel, subject, text }) {
+  if (!['email', 'whatsapp'].includes(channel)) throw bulkError('Choose email or WhatsApp');
+  if (!String(text || '').trim()) throw bulkError('Write the message');
+  if (channel === 'email' && !String(subject || '').trim()) throw bulkError('Give the email a subject');
+  const { emailEventAttendees, whatsappEventAttendees } = require('../controllers/eventController');
+  const byEvent = new Map();
+  for (const r of regs) byEvent.set(r.eventId, [...(byEvent.get(r.eventId) || []), r.id]);
+  const out = [];
+  for (const [eventId, ids] of byEvent) {
+    // An event update to the people ticked (they registered, so it goes even to those who opted out of news).
+    const body = channel === 'email'
+      ? { subject, text, kind: 'update', filter: { registrationIds: ids } }
+      : { message: text, kind: 'update', filter: { registrationIds: ids } };
+    const res = await call(channel === 'email' ? emailEventAttendees : whatsappEventAttendees, { ...from(req), params: { id: eventId }, body });
+    for (const id of ids) out.push({ id, ok: res.ok, message: res.ok ? `Sent with ${res.body?.sent ?? res.body?.matched ?? ids.length} for this event` : messageOf(res) });
+  }
+  return out;
+}
+
+/**
+ * Runs one bulk action. Returns { action, done, skipped, failed, results: [{ id, ok, skipped?, message }] }.
+ */
+async function runBulk(req, { action, registrationIds, ...params }) {
+  if (!ACTIONS.includes(action)) throw bulkError('Unknown bulk action');
+  const ids = [...new Set((Array.isArray(registrationIds) ? registrationIds : []).map(String))];
+  if (!ids.length) throw bulkError('Tick at least one registration');
+  if (ids.length > MAX) throw bulkError(`At most ${MAX} at a time`);
+  // Read-only licence: no new payments or ticket changes (cancelling and messaging still work).
+  if (['markPaid', 'moveOption'].includes(action)) {
+    const { licenceStatus } = require('../hub/licence');
+    const status = await licenceStatus().catch(() => null);
+    if (status?.readOnly) throw bulkError('This site is read-only (licence), so payments and ticket changes can\'t be recorded.', 403);
+  }
+  const regs = await prisma.registration.findMany({ where: { id: { in: ids } }, include: { registrationOptions: { select: { eventOptionId: true, variantId: true, quantity: true, sessionId: true } } } });
+  const missing = ids.filter(id => !regs.some(r => r.id === id)).map(id => ({ id, ok: false, message: 'Not found' }));
+  const run = { markPaid, cancel, moveOption, allocate, message }[action];
+  const results = [...missing, ...(await run(req, regs, params))];
+  const { logAdminAction } = require('./adminAudit');
+  const { getClientIp } = require('./requestUtils');
+  logAdminAction({
+    actorId: req.user.id, actorRole: req.user.role, action: 'registrations_bulk', targetType: 'Registration',
+    metadata: { bulk: action, registrations: ids.length, done: results.filter(r => r.ok && !r.skipped).length, failed: results.filter(r => !r.ok).length },
+    ip: getClientIp({ headers: {}, ...req }),
+  });
+  return {
+    action,
+    done: results.filter(r => r.ok && !r.skipped).length,
+    skipped: results.filter(r => r.skipped).length,
+    failed: results.filter(r => !r.ok).length,
+    results,
+  };
+}
+
+module.exports = { runBulk, ACTIONS, MAX };

backend/tests/bulkRegistrations.test.js

@@ -0,0 +1,95 @@
+const mockDb = {
+  registration: { findMany: jest.fn(), findUnique: jest.fn() },
+  eventOption: { findMany: jest.fn() },
+  attendee: { findMany: jest.fn(), updateMany: jest.fn() },
+  registrationOption: { findMany: jest.fn(), update: jest.fn() },
+  registrationOptionTranche: { deleteMany: jest.fn(), create: jest.fn() },
+  user: { findUnique: jest.fn().mockResolvedValue({ role: "user" }) },
+  $transaction: jest.fn(fn => fn(mockDb)),
+};
+const mockLeft = jest.fn().mockResolvedValue(null);
+jest.mock("../src/utils/stock", () => ({ remainingFor: (...a) => mockLeft(...a) }));
+jest.mock("../src/utils/pricing", () => ({ resolveOptionPrice: jest.fn().mockResolvedValue({ price: 150, tierId: null }) }));
+const mockStatus = jest.fn();
+jest.mock("../src/payments/webhook", () => ({ updateRegistrationStatus: (...a) => mockStatus(...a) }));
+jest.mock('../src/config/db', () => mockDb);
+jest.mock('../src/utils/adminAudit', () => ({ logAdminAction: jest.fn() }));
+const mockLicence = jest.fn().mockResolvedValue({ readOnly: false });
+jest.mock('../src/hub/licence', () => ({ licenceStatus: (...a) => mockLicence(...a) }));
+const mockCancel = jest.fn();
+const mockUpdate = jest.fn();
+jest.mock('../src/controllers/registrationController', () => ({
+  cancelRegistration: (req, res) => mockCancel(req, res),
+  updateRegistrationOptions: (req, res) => mockUpdate(req, res),
+}));
+const mockAssign = jest.fn();
+jest.mock('../src/controllers/allocationController', () => ({ assign: (req, res) => mockAssign(req, res) }));
+const mockEmail = jest.fn();
+jest.mock('../src/controllers/eventController', () => ({ emailEventAttendees: (req, res) => mockEmail(req, res), whatsappEventAttendees: jest.fn() }));
+
+const bulk = require('../src/utils/bulkRegistrations');
+const { isBlocked } = require('../src/hub/readOnly');
+
+const req = { user: { id: 'sup', role: 'supervisor' } };
+const reg = (id, extra = {}) => ({ id, userId: `u-${id}`, eventId: 'ev1', status: 'pending', seasonPassPurchaseId: null, registrationOptions: [{ eventOptionId: 'adult', variantId: null, quantity: 1, sessionId: null }], ...extra });
+
+beforeEach(() => jest.clearAllMocks());
+
+test('the input is checked before anything runs', async () => {
+  await expect(bulk.runBulk(req, { action: 'explode', registrationIds: ['a'] })).rejects.toThrow('Unknown');
+  await expect(bulk.runBulk(req, { action: 'cancel', registrationIds: [] })).rejects.toThrow('Tick at least one');
+  await expect(bulk.runBulk(req, { action: 'cancel', registrationIds: Array.from({ length: 501 }, (_, i) => `r${i}`) })).rejects.toThrow('At most 500');
+});
+
+test('cancelling runs the normal cancel for each; already-cancelled ones are skipped; a refusal is reported', async () => {
+  mockDb.registration.findMany.mockResolvedValue([reg('a'), reg('b', { status: 'cancelled' }), reg('c')]);
+  mockCancel.mockImplementation((r, res) => (r.params.id === 'c' ? res.status(403).json({ message: 'has payments' }) : res.json({ message: 'Registration cancelled' })));
+  const out = await bulk.runBulk(req, { action: 'cancel', registrationIds: ['a', 'b', 'c', 'gone'] });
+  expect(out).toMatchObject({ done: 1, skipped: 1, failed: 2 });
+  expect(out.results.find(r => r.id === 'c')).toMatchObject({ ok: false, message: 'has payments' });
+  expect(out.results.find(r => r.id === 'gone')).toMatchObject({ ok: false, message: 'Not found' });
+  expect(mockCancel).toHaveBeenCalledTimes(2);
+  expect(mockCancel.mock.calls[0][0].user).toBe(req.user);
+});
+
+test('moving keeps the same lines and tickets, repriced; checks places; not other events or season passes', async () => {
+  mockDb.eventOption.findMany.mockResolvedValue([
+    { id: 'adult', eventId: 'ev1', name: 'Adult', event: { id: 'ev1', cashupStatus: 'open' } },
+    { id: 'vip', eventId: 'ev1', name: 'VIP', event: { id: 'ev1', cashupStatus: 'open' } },
+  ]);
+  mockDb.registration.findMany.mockResolvedValue([reg('a'), reg('b', { eventId: 'ev2' }), reg('c', { seasonPassPurchaseId: 'p1' }), reg('d')]);
+  mockDb.registrationOption.findMany.mockResolvedValue([{ id: 'line1', quantity: 1 }]);
+  mockLeft.mockResolvedValueOnce(null).mockResolvedValueOnce(0);
+  mockStatus.mockResolvedValue({ totalDue: 150, totalPaid: 100 });
+  const out = await bulk.runBulk(req, { action: 'moveOption', registrationIds: ['a', 'b', 'c', 'd'], fromOptionId: 'adult', toOptionId: 'vip' });
+  expect(out.results.find(r => r.id === 'a')).toMatchObject({ ok: true, message: 'Moved — R50.00 now owing' });
+  expect(mockDb.registrationOption.update).toHaveBeenCalledWith({ where: { id: 'line1' }, data: { eventOptionId: 'vip', variantId: null, priceSnapshot: 150, appliedTierId: null } });
+  expect(mockDb.attendee.updateMany).toHaveBeenCalledWith({ where: { registrationOptionId: 'line1' }, data: { eventOptionId: 'vip', variantId: null } });
+  expect(out.results.find(r => r.id === 'b').message).toBe('Not for this event');
+  expect(out.results.find(r => r.id === 'c').message).toMatch(/season pass/);
+  expect(out.results.find(r => r.id === 'd')).toMatchObject({ ok: false, message: 'Only 0 places left on VIP' });
+});
+
+test('payments and ticket changes are refused in licence read-only mode; cancelling is not', async () => {
+  mockLicence.mockResolvedValueOnce({ readOnly: true });
+  await expect(bulk.runBulk(req, { action: 'markPaid', registrationIds: ['a'], method: 'cash' })).rejects.toMatchObject({ statusCode: 403 });
+  expect(isBlocked('POST', '/api/registrations/bulk')).toBe(false);
+});
+
+test('allocating places each named person; a registration without names says so', async () => {
+  mockDb.registration.findMany.mockResolvedValue([reg('a'), reg('b')]);
+  mockDb.attendee.findMany.mockImplementation(({ where }) => Promise.resolve(where.registrationId === 'a' ? [{ id: 'p1', name: 'Amy' }, { id: 'p2', name: 'Ben' }] : []));
+  mockAssign.mockImplementation((r, res) => (r.body.attendeeId === 'p2' ? res.status(400).json({ message: 'Cabin 3 is full' }) : res.json({})));
+  const out = await bulk.runBulk(req, { action: 'allocate', registrationIds: ['a', 'b'], setId: 's1', groupId: 'g1' });
+  expect(out.results.find(r => r.id === 'a')).toMatchObject({ ok: false, message: 'Ben: Cabin 3 is full' });
+  expect(out.results.find(r => r.id === 'b').message).toMatch(/No named people/);
+});
+
+test('messages go per event as an event update to exactly the ticked registrations', async () => {
+  mockDb.registration.findMany.mockResolvedValue([reg('a'), reg('b'), reg('c', { eventId: 'ev2' })]);
+  mockEmail.mockImplementation((r, res) => res.json({ sent: r.body.filter.registrationIds.length }));
+  const out = await bulk.runBulk(req, { action: 'message', registrationIds: ['a', 'b', 'c'], channel: 'email', subject: 'Bus times', text: 'The bus leaves at 7:30.' });
+  expect(out.done).toBe(3);
+  expect(mockEmail.mock.calls.map(c => [c[0].params.id, c[0].body.filter.registrationIds, c[0].body.kind])).toEqual([['ev1', ['a', 'b'], 'update'], ['ev2', ['c'], 'update']]);
+  await expect(bulk.runBulk(req, { action: 'message', registrationIds: ['a'], channel: 'email', text: 'x' })).rejects.toThrow('subject');
+});

docs/HANDOVER.md

@@ -1,6 +1,6 @@
 # Handover — where things stand and how to carry on
 
-Last updated: 2026-10-28, after **1.49.0** (and Hub 1.5.0). The plan itself is in
+Last updated: 2026-10-28, after **1.49.1** (and Hub 1.5.0). The plan itself is in
 [ROADMAP-v2.md](./ROADMAP-v2.md) (decisions table at the end); the previous round of
 features is in [FEATURES-ROUND-1.md](./FEATURES-ROUND-1.md).
 
@@ -14,6 +14,7 @@ encrypted settings unreadable or break existing installs.
 
 | Version | What |
 |---------|------|
+| 1.49.1 | **Bulk actions** on Manage registrations (§9 part 2): message, mark paid, move ticket, allocate, export, cancel (`POST /api/registrations/bulk`, `utils/bulkRegistrations.js`). Migration `20261028170000_registrations_bulk` |
 | 1.49.0 | **Dashboard and command palette** (§9 part 1): Today and Waiting for you on the staff/supervisor/admin dashboards (`GET /api/dashboard/today`), Ctrl+K palette (`GET /api/dashboard/search`, pages in `lib/commandPages.ts`), deep links on events/registrations/users |
 | 1.48.2 | Four demo seeds (`npm run demo:small|events|ministry|multicampus`, `demo:list`); fixes `set-demo`, broken since 1.43.0 by TRUNCATE CASCADE through `User.homeCampusId` |
 | 1.48.1 | Built-in privacy notice updated (rosters, series, season passes, webhooks, acceptance); editor shows built-in changes to sites with their own version; activation asks for agreement; never-accepted users asked once after login |
@@ -56,8 +57,7 @@ encrypted settings unreadable or break existing installs.
 Hub 1.1.0 is deployed with update requests rolled out, and `scripts/install.sh` has been tried on
 a test server (both done 2026-10-28).
 
-1. **1.49.1 — bulk actions** on registration/attendee lists (message, export, mark paid, move option,
-   cancel, allocate), **1.49.2 — saved filters** (§9), then 1.50.0 Afrikaans and 1.51.0 accessibility.
+1. **1.49.2 — saved filters** per user on list pages (§9), then 1.50.0 Afrikaans and 1.51.0 accessibility.
 
 ## Working on this repo
 
@@ -390,6 +390,21 @@ a test server (both done 2026-10-28).
 - Deep links read `window.location.search` once on load (no Suspense needed).
 - Tests: `tests/dashboard.test.js`, e2e `dashboard.spec.ts`.
 
+## Where bulk actions live (1.49.1)
+
+- `backend/src/utils/bulkRegistrations.js` — `runBulk` checks the input (≤ 500, licence read-only for
+  payments and moves) and runs one action per registration, collecting a result for each. Most
+  actions **call the existing Express handlers in-process** (`call(handler, req)`, with the original
+  request's user, headers and socket so audits keep the IP): `createPayment`, `cancelRegistration`,
+  `allocationController.assign`, `emailEventAttendees` / `whatsappEventAttendees` (new
+  `filter.registrationIds`). **Change a rule in those handlers and bulk follows.**
+- Moving tickets is its own code (`moveOption`): the edit handler refuses to remove issued tickets,
+  so the lines are re-pointed in place (tickets and QR codes kept), repriced with `resolveOptionPrice`,
+  attendees moved, then `updateRegistrationStatus`.
+- Frontend: `components/admin/RegistrationBulkBar.tsx` on `app/dashboard/admin/registrations`. Export
+  goes through `/api/reports/excel` (access-logged). Tests: `tests/bulkRegistrations.test.js`, e2e
+  `bulk.spec.ts`.
+
 ## Known gaps / follow-ups
 
 - WhatsApp STOP only works once someone pastes the webhook URL from Site settings → WhatsApp

docs/ROADMAP-v2.md

@@ -36,7 +36,7 @@ ratios, offline desk). 1.46.0 **volunteer rosters** shipped (roles per event or
 assigning, swaps on accept, QR self check-in, kids-room roles on duty, optional volunteer ticket).
 Event series and cloning ships as 1.47.0–1.47.3 (2026-10-28); 1.47.0 **copy an event** and 1.47.1 **event series** (series page, Next in this series, follow) 1.47.2 **year-on-year
 report** and 1.47.3 **season passes** shipped — §6 is done. 1.48.0 **outbound webhooks** shipped. 1.49.0 **dashboard (Today, Waiting for you) and Ctrl+K palette**
-shipped. **Next: 1.49.1 bulk actions, then 1.49.2 saved filters.**
+shipped; 1.49.1 **bulk actions** shipped. **Next: 1.49.2 saved filters.**
 
 **Repositories:**
 
@@ -518,7 +518,7 @@ register; deliveries kept 30 days.)
 ## 9. Admin dashboard, command palette, bulk actions
 
 Three releases (2026-10-28): **1.49.0** dashboard (Today, Waiting for you) and the Ctrl+K command
-palette ✅; **1.49.1** bulk actions; **1.49.2** saved filters.
+palette ✅; **1.49.1** bulk actions ✅; **1.49.2** saved filters.
 
 - **Dashboard** as supervisors' home: today's events/sessions, check-ins so
   far, money in (today/week), pending items (unreconciled payments, consent

e2e/bulk.spec.ts

@@ -0,0 +1,86 @@
+import { test, expect, loginAs, api } from "./fixtures";
+
+// Bulk actions on the registrations list (1.49.1): tick several, mark them paid, move them to
+// another ticket, cancel — each through the same rules as one at a time.
+type Ev = { id: string; eventOptions?: { id: string; name: string; isMainTicket?: boolean }[] };
+type Reg = { id: string; status: string; registrationOptions?: { eventOptionId: string; quantity: number }[]; payments?: { amount: number; method: string }[] };
+
+test.describe.serial("bulk actions on registrations", () => {
+  let event: Ev;
+  let main: string;
+  let vip: string;
+  const regs: string[] = [];
+
+  test.beforeAll(async ({ browser }) => {
+    const page = await browser.newPage();
+    const start = new Date(Date.now() + 20 * 864e5);
+    event = await api<Ev>(page, "admin", "POST", "/api/events", {
+      title: "E2E Bulk Night", startDate: start.toISOString(), endDate: new Date(start.getTime() + 3 * 3600e3).toISOString(),
+      price: 100, location: "Church hall",
+    });
+    const full = await api<Ev>(page, "admin", "GET", `/api/events/${event.id}`);
+    main = full.eventOptions!.find(o => o.isMainTicket)!.id;
+    vip = (await api<{ id: string }>(page, "admin", "POST", `/api/events/${event.id}/options`, { name: "VIP", price: 150, isMainTicket: true })).id;
+    for (const role of ["staff", "supervisor", "user"] as const) {
+      regs.push((await api<{ id: string }>(page, role, "POST", "/api/registrations", { eventId: event.id, options: [{ eventOptionId: main, quantity: 1 }] })).id);
+    }
+    await page.close();
+  });
+
+  const openList = async (page: import("@playwright/test").Page) => {
+    await loginAs(page, "admin");
+    await page.goto(`/dashboard/admin/registrations?event=${event.id}`);
+    await expect(page.getByText("3 of", { exact: false })).toBeVisible();
+  };
+
+  test("tick all and mark them paid in cash", async ({ page }) => {
+    await openList(page);
+    await page.getByLabel("Select all shown").check();
+    const bar = page.getByTestId("bulk-bar");
+    await expect(bar).toContainText("3 selected");
+    await bar.getByLabel("Bulk action").selectOption("markPaid");
+    await bar.getByLabel("Paid by").selectOption("cash");
+    page.once("dialog", d => d.accept());
+    await bar.getByRole("button", { name: /Mark paid/ }).click();
+    await expect(page.getByTestId("bulk-result")).toContainText("3 done");
+
+    for (const id of regs) {
+      const r = await api<Reg>(page, "admin", "GET", `/api/registrations/${id}`);
+      expect(r.status).toBe("paid");
+      expect(r.payments?.map(p => [p.amount, p.method])).toEqual([[100, "cash"]]);
+    }
+  });
+
+  test("move two to the VIP ticket; cancel the third", async ({ page }) => {
+    await openList(page);
+    const rows = page.locator("li").filter({ has: page.getByRole("checkbox", { name: /^Select / }) });
+    await rows.nth(0).getByRole("checkbox").check();
+    await rows.nth(1).getByRole("checkbox").check();
+    const bar = page.getByTestId("bulk-bar");
+    await bar.getByLabel("Bulk action").selectOption("moveOption");
+    await bar.getByLabel("Move from").selectOption(main);
+    await bar.getByLabel("Move to").selectOption(vip);
+    page.once("dialog", d => d.accept());
+    await bar.getByRole("button", { name: /Move to another ticket/ }).click();
+    await expect(page.getByTestId("bulk-result")).toContainText("2 done");
+
+    const moved = await Promise.all(regs.map(id => api<Reg>(page, "admin", "GET", `/api/registrations/${id}`)));
+    const onVip = moved.filter(r => r.registrationOptions?.some(o => o.eventOptionId === vip));
+    expect(onVip).toHaveLength(2);
+    // R150 now, R100 paid: they owe the difference.
+    expect(onVip.every(r => r.status === "partial_paid")).toBe(true);
+
+    await bar.getByRole("button", { name: "Clear selection" }).click();
+    const left = moved.find(r => !r.registrationOptions?.some(o => o.eventOptionId === vip))!;
+    await page.getByRole("checkbox", { name: /^Select / }).nth(2).check();
+    const selectedId = (await api<Reg>(page, "admin", "GET", `/api/registrations/${left.id}`)).id;
+    expect(selectedId).toBe(left.id);
+    const bar2 = page.getByTestId("bulk-bar");
+    await bar2.getByLabel("Bulk action").selectOption("cancel");
+    page.once("dialog", d => d.accept());
+    await bar2.getByRole("button", { name: /Cancel — 1/ }).click();
+    await expect(page.getByTestId("bulk-result")).toContainText("1 done");
+    const cancelled = (await Promise.all(regs.map(id => api<Reg>(page, "admin", "GET", `/api/registrations/${id}`)))).filter(r => r.status === "cancelled");
+    expect(cancelled).toHaveLength(1);
+  });
+});

frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.49.0",
+  "version": "1.49.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hope-events-frontend",
-      "version": "1.49.0",
+      "version": "1.49.1",
       "dependencies": {
         "@dnd-kit/core": "^6.3.1",
         "@hookform/resolvers": "^5.2.1",

frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.49.0",
+  "version": "1.49.1",
   "private": true,
   "scripts": {
     "dev": "next dev --turbopack",

frontend/src/app/dashboard/admin/audit-log/page.tsx

@@ -121,6 +121,7 @@ const ACTION_LABELS: Record<string, string> = {
   series_updated: "Event series changed",
   series_deleted: "Event series deleted",
   season_pass_changed: "Season pass created, changed or deleted",
+  registrations_bulk: "Bulk action on registrations",
 };
 
 interface AuditLogEntry {

frontend/src/app/dashboard/admin/registrations/page.tsx

@@ -9,6 +9,7 @@ import { ClipboardList } from "lucide-react";
 import { errorMessage } from "@/lib/utils";
 import type { Event, FormResponse, Registration } from "@/types";
 import { BackLink } from "@/components/shared/BackLink";
+import { RegistrationBulkBar } from "@/components/admin/RegistrationBulkBar";
 
 const STATUS_OPTIONS = ["pending", "confirmed", "partial_paid", "paid", "cancelled"] as const;
 
@@ -64,6 +65,10 @@ export default function AdminRegistrationsPage() {
     if (params.get("event")) setEventFilter(params.get("event") || "");
   }, []);
 
+  // Ticked for a bulk action (1.49.1).
+  const [selected, setSelected] = useState<Set<string>>(new Set());
+  const toggleSelected = (id: string) => setSelected(prev => { const s = new Set(prev); if (s.has(id)) s.delete(id); else s.add(id); return s; });
+
   // Expanded rows + form responses cache
   const [expanded, setExpanded] = useState<Set<string>>(new Set());
   const [formResponses, setFormResponses] = useState<Record<string, FormResponse[]>>({});
@@ -173,6 +178,10 @@ export default function AdminRegistrationsPage() {
     });
   }, [registrations, query, eventFilter, statusFilter, eventIds]);
 
+  // Only ticked registrations still shown by the filters are acted on.
+  const selectedRegs = useMemo(() => filtered.filter(r => selected.has(r.id)), [filtered, selected]);
+  const allShownSelected = filtered.length > 0 && filtered.every(r => selected.has(r.id));
+
   const statusColor = (s: string) => {
     if (s === "paid") return "text-green-700 bg-green-50";
     if (s === "confirmed") return "text-blue-700 bg-blue-50";
@@ -287,7 +296,17 @@ export default function AdminRegistrationsPage() {
         <div className="mt-2 text-xs text-gray-500">{filtered.length} of {registrations.length} registrations</div>
       </div>
 
+      {token && selectedRegs.length > 0 && (
+        <RegistrationBulkBar selected={selectedRegs} events={events} token={token} onClear={() => setSelected(new Set())} onDone={loadRegistrations} />
+      )}
+
       <div className="border rounded-xl bg-white shadow-sm">
+        {filtered.length > 0 && (
+          <label className="flex items-center gap-2 px-3 py-2 border-b text-xs text-gray-600 cursor-pointer">
+            <input type="checkbox" aria-label="Select all shown" checked={allShownSelected} onChange={e => setSelected(e.target.checked ? new Set(filtered.map(r => r.id)) : new Set())} />
+            Select all {filtered.length} shown
+          </label>
+        )}
         <ul className="divide-y text-sm">
           {filtered.map((r) => {
             const totalDue = totalDueFor(r);
@@ -301,6 +320,10 @@ export default function AdminRegistrationsPage() {
               <li key={r.id} className="hover:bg-gray-50">
                 <div className="p-3 cursor-pointer" onClick={() => toggleExpand(r)}>
                   <div className="flex items-start justify-between gap-2">
+                    <input
+                      type="checkbox" className="mt-1 shrink-0" aria-label={`Select ${r.user?.name || r.userId}`}
+                      checked={selected.has(r.id)} onClick={e => e.stopPropagation()} onChange={() => toggleSelected(r.id)}
+                    />
                     <div className="flex-1 min-w-0">
                       <div className="flex items-center gap-2 flex-wrap">
                         <span className="font-medium">{r.user?.name || r.userId}</span>

frontend/src/components/admin/RegistrationBulkBar.tsx

@@ -0,0 +1,198 @@
+"use client";
+
+import React, { useEffect, useMemo, useState } from "react";
+import { CheckSquare, X, Download } from "lucide-react";
+import { apiFetch, API_BASE } from "@/lib/api";
+import { errorMessage } from "@/lib/utils";
+import { downloadReportExcel } from "@/lib/export";
+import type { Event, Registration } from "@/types";
+
+type Action = "" | "message" | "markPaid" | "moveOption" | "allocate" | "cancel" | "export";
+type Result = { id: string; ok: boolean; skipped?: boolean; message: string };
+type BulkResponse = { action: string; done: number; skipped: number; failed: number; results: Result[] };
+type AllocationSet = { id: string; name: string; groups: { id: string; name: string }[] };
+
+const ACTIONS: [Action, string][] = [
+  ["message", "Send a message"],
+  ["markPaid", "Mark paid (record the balance)"],
+  ["moveOption", "Move to another ticket"],
+  ["allocate", "Put in a room or group"],
+  ["export", "Export to Excel"],
+  ["cancel", "Cancel"],
+];
+
+const owing = (r: Registration) => {
+  const due = Number(r.totalDueComputed ?? 0);
+  const paid = (r.payments || []).reduce((s, p) => s + (p.amount || 0), 0);
+  return Math.max(0, due - paid);
+};
+
+/**
+ * The bar above the registrations list while some are ticked (1.49.1): one action for all of
+ * them, run through the same rules as doing it one at a time, with a result per registration.
+ */
+export function RegistrationBulkBar({ selected, events, token, onClear, onDone }: {
+  selected: Registration[]; events: Event[]; token: string; onClear: () => void; onDone: () => void;
+}) {
+  const [action, setAction] = useState<Action>("");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [result, setResult] = useState<BulkResponse | null>(null);
+  // Per-action inputs.
+  const [channel, setChannel] = useState<"email" | "whatsapp">("email");
+  const [subject, setSubject] = useState("");
+  const [text, setText] = useState("");
+  const [method, setMethod] = useState("cash");
+  const [fromOptionId, setFromOptionId] = useState("");
+  const [toOptionId, setToOptionId] = useState("");
+  const [sets, setSets] = useState<AllocationSet[]>([]);
+  const [groupKey, setGroupKey] = useState("");
+
+  const eventIds = useMemo(() => [...new Set(selected.map(r => r.eventId))], [selected]);
+  const oneEvent = eventIds.length === 1 ? events.find(e => e.id === eventIds[0]) || null : null;
+  const options = useMemo(() => (oneEvent?.eventOptions || []).filter(o => o.id !== oneEvent?.kidsOptionId && o.id !== oneEvent?.volunteerOptionId), [oneEvent]);
+  const totalOwing = useMemo(() => selected.filter(r => r.status !== "cancelled").reduce((s, r) => s + owing(r), 0), [selected]);
+
+  useEffect(() => {
+    if (action !== "allocate" || !oneEvent) { setSets([]); return; }
+    apiFetch<{ sets?: AllocationSet[] }>(`/api/allocations/event/${oneEvent.id}`, { authToken: token })
+      .then(b => setSets((b.sets || []).filter(s => s.groups.length)))
+      .catch(() => setSets([]));
+  }, [action, oneEvent, token]);
+
+  const needsOneEvent = (action === "moveOption" || action === "allocate") && !oneEvent;
+
+  const exportSelected = async () => {
+    await downloadReportExcel(API_BASE, token, {
+      title: "Registrations", subtitle: `${selected.length} selected · ${new Date().toLocaleString()}`, kind: "table", orientation: "landscape",
+      table: {
+        columns: ["Reference", "Name", "Email", "Phone", "Event", "Status", "Total", "Paid", "Owing", "Tickets"],
+        rows: selected.map(r => {
+          const paid = (r.payments || []).reduce((s, p) => s + (p.amount || 0), 0);
+          return [
+            String(r.id).slice(0, 8), r.user?.name || "", r.user?.email || "", r.user?.phoneNumber || "", r.event?.title || "", r.status,
+            `R ${Number(r.totalDueComputed ?? 0).toFixed(2)}`, `R ${paid.toFixed(2)}`, `R ${owing(r).toFixed(2)}`,
+            (r.registrationOptions || []).map(o => `${o.quantity} × ${o.eventOption?.name || ""}${o.variant?.name ? ` (${o.variant.name})` : ""}`).join(", "),
+          ];
+        }),
+      },
+    });
+  };
+
+  const run = async () => {
+    setError(null); setResult(null);
+    if (action === "export") {
+      setBusy(true);
+      try { await exportSelected(); } catch (e) { setError(errorMessage(e) || "Couldn't export"); } finally { setBusy(false); }
+      return;
+    }
+    const confirmText: Record<string, string> = {
+      cancel: `Cancel ${selected.length} registration(s)? Cancelling doesn't refund — record refunds on the Payments page. Coupon uses are released and the waitlist is offered the places.`,
+      markPaid: `Record ${method.toUpperCase()} payments for what ${selected.length} registration(s) still owe (about R ${totalOwing.toFixed(2)})? Paid registrations get their tickets by email.`,
+      moveOption: `Move ${selected.length} registration(s) to the other ticket? Tickets already issued move with them (same QR code). The price follows the new ticket, so anything now owing or overpaid shows on each registration.`,
+      message: `Send this ${channel === "email" ? "email" : "WhatsApp"} to the people on ${selected.length} registration(s)?`,
+      allocate: `Put the named people on ${selected.length} registration(s) in this group?`,
+    };
+    if (!confirm(confirmText[action])) return;
+    const [setId, groupId] = groupKey.split("::");
+    const params = action === "message" ? { channel, subject, text }
+      : action === "markPaid" ? { method }
+      : action === "moveOption" ? { fromOptionId, toOptionId }
+      : action === "allocate" ? { setId, groupId }
+      : {};
+    setBusy(true);
+    try {
+      const res = await apiFetch<BulkResponse>("/api/registrations/bulk", { method: "POST", authToken: token, body: { action, registrationIds: selected.map(r => r.id), ...params } });
+      setResult(res);
+      onDone();
+    } catch (e) {
+      setError(errorMessage(e) || "Couldn't do that");
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const ready = !busy && !needsOneEvent && (
+    action === "export" || action === "cancel"
+    || (action === "markPaid" && !!method)
+    || (action === "message" && text.trim() && (channel === "whatsapp" || subject.trim()))
+    || (action === "moveOption" && fromOptionId && toOptionId && fromOptionId !== toOptionId)
+    || (action === "allocate" && !!groupKey)
+  );
+  const nameOf = (id: string) => selected.find(r => r.id === id)?.user?.name || id.slice(0, 8);
+
+  return (
+    <div className="border border-brand-200 bg-brand-50/60 rounded-xl p-3 mb-3 space-y-3" data-testid="bulk-bar">
+      <div className="flex flex-wrap items-center gap-2">
+        <CheckSquare className="w-4 h-4 text-brand-700" />
+        <span className="text-sm font-medium text-brand-900">{selected.length} selected</span>
+        <select aria-label="Bulk action" className="border rounded px-2 py-1.5 text-sm bg-white" value={action} onChange={e => { setAction(e.target.value as Action); setResult(null); setError(null); }}>
+          <option value="">Choose an action…</option>
+          {ACTIONS.map(([v, l]) => <option key={v} value={v}>{l}</option>)}
+        </select>
+        <button type="button" onClick={onClear} className="ml-auto inline-flex items-center gap-1 text-xs text-gray-600 hover:text-gray-900"><X className="w-3.5 h-3.5" /> Clear selection</button>
+      </div>
+
+      {needsOneEvent && <p className="text-xs text-amber-800">Tick registrations from one event only (filter by event) to {action === "moveOption" ? "move tickets" : "put people in a group"}.</p>}
+
+      {action === "message" && (
+        <div className="space-y-2">
+          <div className="flex gap-3 text-sm">
+            <label className="flex items-center gap-1"><input type="radio" checked={channel === "email"} onChange={() => setChannel("email")} /> Email</label>
+            <label className="flex items-center gap-1"><input type="radio" checked={channel === "whatsapp"} onChange={() => setChannel("whatsapp")} /> WhatsApp</label>
+          </div>
+          {channel === "email" && <input aria-label="Subject" className="w-full border rounded px-3 py-1.5 text-sm" placeholder="Subject" value={subject} onChange={e => setSubject(e.target.value)} />}
+          <textarea aria-label="Message" rows={4} className="w-full border rounded px-3 py-1.5 text-sm" placeholder="Hi {name}, …" value={text} onChange={e => setText(e.target.value)} />
+          <p className="text-[11px] text-gray-500">Sent as an event update to the person who registered. You can use {"{name}"}, {"{eventTitle}"} and {"{eventStart}"}.</p>
+        </div>
+      )}
+      {action === "markPaid" && (
+        <label className="text-sm flex items-center gap-2">Paid by
+          <select aria-label="Paid by" className="border rounded px-2 py-1.5 text-sm bg-white" value={method} onChange={e => setMethod(e.target.value)}>
+            <option value="cash">Cash</option><option value="eft">EFT</option><option value="card">Card (card machine)</option><option value="other">Other</option>
+          </select>
+          <span className="text-xs text-gray-500">Records what each still owes (about R {totalOwing.toFixed(2)} in all).</span>
+        </label>
+      )}
+      {action === "moveOption" && oneEvent && (
+        <div className="flex flex-wrap gap-2 items-center text-sm">
+          <select aria-label="Move from" className="border rounded px-2 py-1.5 bg-white" value={fromOptionId} onChange={e => setFromOptionId(e.target.value)}>
+            <option value="">From ticket…</option>{options.map(o => <option key={o.id} value={o.id}>{o.name}</option>)}
+          </select>
+          →
+          <select aria-label="Move to" className="border rounded px-2 py-1.5 bg-white" value={toOptionId} onChange={e => setToOptionId(e.target.value)}>
+            <option value="">To ticket…</option>{options.filter(o => o.id !== fromOptionId).map(o => <option key={o.id} value={o.id}>{o.name} (R{Number(o.price).toFixed(0)})</option>)}
+          </select>
+        </div>
+      )}
+      {action === "allocate" && oneEvent && (
+        sets.length === 0 ? <p className="text-xs text-gray-600">This event has no rooms or groups yet — set them up under Rooms &amp; groups.</p> : (
+          <select aria-label="Group" className="border rounded px-2 py-1.5 text-sm bg-white" value={groupKey} onChange={e => setGroupKey(e.target.value)}>
+            <option value="">Choose a group…</option>
+            {sets.map(s => <optgroup key={s.id} label={s.name}>{s.groups.map(g => <option key={g.id} value={`${s.id}::${g.id}`}>{g.name}</option>)}</optgroup>)}
+          </select>
+        )
+      )}
+      {action === "cancel" && <p className="text-xs text-gray-700">Cancelling doesn&apos;t refund anyone — record refunds on the Payments page.</p>}
+
+      {action && (
+        <button type="button" disabled={!ready} onClick={run} className={`inline-flex items-center gap-1.5 px-4 py-1.5 text-sm rounded font-medium disabled:opacity-50 ${action === "cancel" ? "bg-red-600 text-white hover:bg-red-700" : "bg-brand-600 text-white hover:bg-brand-700"}`}>
+          {action === "export" && <Download className="w-4 h-4" />}
+          {busy ? "Working…" : `${ACTIONS.find(a => a[0] === action)?.[1]} — ${selected.length}`}
+        </button>
+      )}
+
+      {error && <div className="p-2 border rounded bg-red-50 text-red-700 text-sm">{error}</div>}
+      {result && (
+        <div className="p-2 border rounded bg-white text-sm" role="status" data-testid="bulk-result">
+          <div><strong>{result.done}</strong> done{result.skipped ? `, ${result.skipped} skipped` : ""}{result.failed ? `, ${result.failed} not done` : ""}.</div>
+          {result.results.filter(r => !r.ok || r.skipped).length > 0 && (
+            <ul className="mt-1 text-xs text-gray-700 max-h-40 overflow-auto">
+              {result.results.filter(r => !r.ok || r.skipped).map(r => <li key={r.id}><span className={r.ok ? "text-gray-500" : "text-red-700"}>{nameOf(r.id)}</span>: {r.message}</li>)}
+            </ul>
+          )}
+        </div>
+      )}
+    </div>
+  );
+}

frontend/src/content/help/dashboard-admin-registrations.tsx

@@ -1,5 +1,5 @@
 import React from "react";
-import { ClipboardList, Filter, Ban } from "lucide-react";
+import { ClipboardList, Filter, Ban, CheckSquare } from "lucide-react";
 import { GuideItem } from "@/components/shared/GuideItem";
 import type { HelpContent } from "./types";
 
@@ -26,6 +26,9 @@ export const dashboardAdminRegistrationsHelpContent: HelpContent = {
         <div className="space-y-4">
           <p>Click a row to expand it and see ticket options (with early-bird flags where applied), the payment history, and any submitted form responses.</p>
           <div className="space-y-4">
+            <GuideItem icon={CheckSquare} title="Doing many at once" tone="violet">
+              Tick registrations (or &quot;Select all shown&quot; after filtering) and choose an action: send a message (email or WhatsApp, as an event update), mark paid (records what each still owes, in cash, EFT, card or other — tickets go out by email), move to another ticket (their tickets and QR codes stay the same; the price follows the new ticket), put their named people in a room or group, export to Excel, or cancel. Each one follows the same rules as doing it one at a time, and you see what happened to each. Moving tickets and groups need registrations from one event.
+            </GuideItem>
             <GuideItem icon={ClipboardList} title="Changing status" tone="brand">
               Use the status dropdown inside the expanded row to move a registration between pending, confirmed, partially paid, paid, or cancelled.
             </GuideItem>

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "hope-events",
-  "version": "1.49.0",
+  "version": "1.49.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hope-events",
-      "version": "1.49.0",
+      "version": "1.49.1",
       "license": "ISC",
       "devDependencies": {
         "@playwright/test": "^1.64.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "hope-events",
-  "version": "1.49.0",
+  "version": "1.49.1",
   "main": "index.js",
   "scripts": {
     "dev:backend": "cd backend && npm run dev",