joshuaandClaude Opus 5.5
9012ec64b6
- v2: auth/signup, auth/login (+ code step, rate limited), PATCH /me; check-in look-up and scan returning an outcome for every normal result. Campus rule as v1. - Sign up/login/2FA/profile moved to src/services/auth.ts; scan preview and scan to src/services/checkin.ts. v1 answers unchanged (ServiceError v1Status). - Login, 2FA step, sign up and profile/password pages use v2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ls1vMdg2GYqbnKZmPaX1ot
925 lines
39 KiB
JavaScript
925 lines
39 KiB
JavaScript
const prisma = require('../config/db');
|
||
const { safeErrorMessage } = require('../utils/errorUtils');
|
||
const { generateTicketsForRegistration } = require('../utils/ticketUtils');
|
||
const { assertRegistrationEventOpen } = require('../utils/cashupUtils');
|
||
// Scanning, shared with /api/v2/checkin (TypeScript, 1.51.2).
|
||
const checkin = require('../services/checkin');
|
||
|
||
// @desc Generate tickets for a registration
|
||
// @route POST /api/tickets/generate
|
||
// @access Private/Admin
|
||
const generateTickets = async (req, res) => {
|
||
try {
|
||
const { registrationId } = req.body;
|
||
|
||
if (!registrationId) {
|
||
res.status(400);
|
||
throw new Error('registrationId is required');
|
||
}
|
||
|
||
await assertRegistrationEventOpen(registrationId, res);
|
||
|
||
// Delegate fully to the shared utility which handles deduplication/consolidation
|
||
const newTickets = await generateTicketsForRegistration(registrationId);
|
||
|
||
// Fetch the final canonical ticket set (one per option)
|
||
const options = await prisma.registrationOption.findMany({ where: { registrationId } });
|
||
const tickets = await prisma.ticket.findMany({
|
||
where: { registrationOptionId: { in: options.map(o => o.id) } },
|
||
include: {
|
||
registrationOption: { include: { eventOption: true } },
|
||
user: true,
|
||
event: true
|
||
},
|
||
orderBy: { createdAt: 'asc' }
|
||
});
|
||
|
||
res.status(201).json({
|
||
message: `${newTickets.length} ticket(s) generated, ${tickets.length} total`,
|
||
tickets
|
||
});
|
||
} catch (error) {
|
||
res.status(res.statusCode === 200 ? 400 : res.statusCode).json({ message: safeErrorMessage(error) });
|
||
}
|
||
};
|
||
|
||
// @desc Get all tickets
|
||
// @route GET /api/tickets
|
||
// @access Private/Admin
|
||
const getTickets = async (req, res) => {
|
||
try {
|
||
const page = Math.max(1, parseInt(req.query.page) || 1);
|
||
const limit = Math.min(200, Math.max(1, parseInt(req.query.limit) || 100));
|
||
const skip = (page - 1) * limit;
|
||
// Campus-scoped supervisors: tickets for events they can see.
|
||
const scopeW = await require('../utils/campusScope').listWhere(req, 'event');
|
||
|
||
const include = {
|
||
registrationOption: {
|
||
include: {
|
||
eventOption: true,
|
||
registration: {
|
||
include: { user: { select: { id: true, name: true, email: true, phoneNumber: true } } }
|
||
}
|
||
}
|
||
},
|
||
event: true,
|
||
user: { select: { id: true, name: true, email: true, phoneNumber: true } },
|
||
usages: { include: { scannedBy: { select: { id: true, name: true, email: true } } } }
|
||
};
|
||
|
||
const [tickets, total] = await prisma.$transaction([
|
||
prisma.ticket.findMany({ where: scopeW, include, orderBy: { createdAt: 'desc' }, skip, take: limit }),
|
||
prisma.ticket.count({ where: scopeW })
|
||
]);
|
||
|
||
res.json({ data: tickets, total, page, limit, pages: Math.ceil(total / limit) });
|
||
} catch (error) {
|
||
res.status(res.statusCode === 200 ? 400 : res.statusCode).json({ message: safeErrorMessage(error) });
|
||
}
|
||
};
|
||
|
||
// @desc Get user tickets
|
||
// @route GET /api/tickets/mytickets
|
||
// @access Private
|
||
const getUserTickets = async (req, res) => {
|
||
try {
|
||
// Tickets this user paid for, plus named tickets someone else bought for them.
|
||
const tickets = await prisma.ticket.findMany({
|
||
where: {
|
||
OR: [{ userId: req.user.id }, { holderUserId: req.user.id }],
|
||
registrationOption: { registration: { status: { not: 'cancelled' } } }
|
||
},
|
||
include: {
|
||
registrationOption: {
|
||
include: {
|
||
eventOption: true,
|
||
variant: true,
|
||
session: true,
|
||
registration: true
|
||
}
|
||
},
|
||
attendee: {
|
||
select: {
|
||
id: true, name: true,
|
||
allocations: { where: { set: { showOnTicket: true } }, select: { group: { select: { name: true } }, set: { select: { name: true, order: true } } } },
|
||
},
|
||
},
|
||
user: { select: { id: true, name: true } },
|
||
event: { include: { sessions: { where: { cancelledAt: null }, orderBy: { startsAt: 'asc' } }, campus: { select: { name: true, slug: true } } } },
|
||
transferRequests: { where: { status: 'pending' }, select: { id: true, toName: true, expiresAt: true } },
|
||
usages: {
|
||
include: {
|
||
scannedBy: {
|
||
select: {
|
||
id: true,
|
||
name: true,
|
||
email: true
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
});
|
||
|
||
res.json(tickets);
|
||
} catch (error) {
|
||
res.status(res.statusCode === 200 ? 400 : res.statusCode).json({ message: safeErrorMessage(error) });
|
||
}
|
||
};
|
||
|
||
// @desc Get ticket by ID
|
||
// @route GET /api/tickets/:id
|
||
// @access Private
|
||
const getTicketById = async (req, res) => {
|
||
try {
|
||
const ticket = await prisma.ticket.findUnique({
|
||
where: { id: req.params.id },
|
||
include: {
|
||
registrationOption: {
|
||
include: {
|
||
eventOption: true,
|
||
registration: {
|
||
include: {
|
||
user: {
|
||
select: {
|
||
id: true,
|
||
name: true,
|
||
email: true,
|
||
phoneNumber: true
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
},
|
||
event: true,
|
||
user: {
|
||
select: {
|
||
id: true,
|
||
name: true,
|
||
email: true,
|
||
phoneNumber: true
|
||
}
|
||
},
|
||
usages: {
|
||
include: {
|
||
scannedBy: {
|
||
select: {
|
||
id: true,
|
||
name: true,
|
||
email: true
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
});
|
||
|
||
if (!ticket) {
|
||
res.status(404);
|
||
throw new Error('Ticket not found');
|
||
}
|
||
|
||
// Check if user is authorized to view this ticket
|
||
if (ticket.userId !== req.user.id && req.user.role !== 'admin' && req.user.role !== 'supervisor' && req.user.role !== 'staff') {
|
||
res.status(403);
|
||
throw new Error('Not authorized to view this ticket');
|
||
}
|
||
|
||
res.json(ticket);
|
||
} catch (error) {
|
||
res.status(res.statusCode === 200 ? 400 : res.statusCode).json({ message: safeErrorMessage(error) });
|
||
}
|
||
};
|
||
|
||
// @desc Get ticket by QR code
|
||
// @route GET /api/tickets/qr/:qrCode
|
||
// @access Private/Staff
|
||
const getTicketByQrCode = async (req, res) => {
|
||
try {
|
||
const ticket = await prisma.ticket.findUnique({
|
||
where: { qrCode: req.params.qrCode },
|
||
include: {
|
||
registrationOption: {
|
||
include: {
|
||
eventOption: true,
|
||
registration: {
|
||
include: {
|
||
user: {
|
||
select: {
|
||
id: true,
|
||
name: true,
|
||
email: true,
|
||
phoneNumber: true
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
},
|
||
event: true,
|
||
user: {
|
||
select: {
|
||
id: true,
|
||
name: true,
|
||
email: true,
|
||
phoneNumber: true
|
||
}
|
||
},
|
||
usages: {
|
||
include: {
|
||
scannedBy: {
|
||
select: {
|
||
id: true,
|
||
name: true,
|
||
email: true
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
});
|
||
|
||
if (!ticket) {
|
||
res.status(404);
|
||
throw new Error('Ticket not found');
|
||
}
|
||
|
||
res.json(ticket);
|
||
} catch (error) {
|
||
res.status(res.statusCode === 200 ? 400 : res.statusCode).json({ message: safeErrorMessage(error) });
|
||
}
|
||
};
|
||
|
||
// @desc Lightweight ticket preview for the scan-confirm flow (only fields the confirm modal needs)
|
||
// @route GET /api/tickets/scan-preview/:qrCode
|
||
// @access Private/Staff
|
||
const getScanPreview = async (req, res) => {
|
||
try {
|
||
const result = await checkin.previewScan(req.params.qrCode, { sessionId: req.query.sessionId || null });
|
||
if (result.outcome === 'transferred') return res.status(410).json({ message: result.message, code: 'TICKET_TRANSFERRED' });
|
||
res.json(result.ticket);
|
||
} catch (error) {
|
||
res.status(error.statusCode || (res.statusCode === 200 ? 400 : res.statusCode)).json({ message: safeErrorMessage(error) });
|
||
}
|
||
};
|
||
|
||
// @desc Scan ticket (mark as used, with optional partial quantity redemption)
|
||
// @route POST /api/tickets/scan/:qrCode
|
||
// @access Private/Staff
|
||
const scanTicket = async (req, res) => {
|
||
try {
|
||
const { getClientIp } = require('../utils/requestUtils');
|
||
const result = await checkin.scanTicket(req.params.qrCode, req.user, {
|
||
eventId: req.query?.eventId || req.body?.eventId || null,
|
||
sectionId: req.query?.sectionId || req.body?.sectionId || null,
|
||
sessionId: req.body?.sessionId || req.query?.sessionId || null,
|
||
deviceId: req.body?.deviceId || null,
|
||
qty: parseInt(req.body?.qty || req.body?.quantity) || null,
|
||
overrideConsent: req.body?.overrideConsent === true,
|
||
}, getClientIp(req));
|
||
const { status, body } = checkin.v1ScanResponse(result);
|
||
res.status(status).json(body);
|
||
} catch (error) {
|
||
res.status(error.statusCode || (res.statusCode === 200 ? 400 : res.statusCode)).json({ message: safeErrorMessage(error) });
|
||
}
|
||
};
|
||
|
||
// @desc Get tickets by event
|
||
// @route GET /api/tickets/event/:eventId
|
||
// @access Private/Staff
|
||
const getTicketsByEvent = async (req, res) => {
|
||
try {
|
||
const limit = Math.min(1000, Math.max(1, parseInt(req.query.limit) || 1000));
|
||
|
||
const tickets = await prisma.ticket.findMany({
|
||
where: { eventId: req.params.eventId },
|
||
include: {
|
||
registrationOption: { include: { eventOption: true, variant: true, session: true, registration: { select: { id: true } } } },
|
||
user: { select: { id: true, name: true, email: true, phoneNumber: true } },
|
||
attendee: { select: { id: true, name: true, email: true, phone: true } },
|
||
event: { select: { id: true, title: true, startDate: true, requiresParentalConsent: true, allowTicketTransfer: true, collectGender: true, scheduleType: true, sessions: { where: { cancelledAt: null }, orderBy: { startsAt: 'asc' }, select: { id: true, label: true, startsAt: true, endsAt: true } } } },
|
||
usages: { include: { scannedBy: { select: { id: true, name: true, email: true } } } }
|
||
},
|
||
orderBy: { createdAt: 'desc' },
|
||
take: limit
|
||
});
|
||
|
||
res.json(tickets);
|
||
} catch (error) {
|
||
res.status(res.statusCode === 200 ? 400 : res.statusCode).json({ message: safeErrorMessage(error) });
|
||
}
|
||
};
|
||
|
||
// @desc Mark tickets as email sent
|
||
// @route PUT /api/tickets/email-sent
|
||
// @access Private/Admin
|
||
const markTicketsAsEmailSent = async (req, res) => {
|
||
try {
|
||
const { ticketIds } = req.body;
|
||
|
||
if (!ticketIds || !Array.isArray(ticketIds) || ticketIds.length === 0) {
|
||
res.status(400);
|
||
throw new Error('Ticket IDs are required');
|
||
}
|
||
|
||
// Update tickets
|
||
await prisma.ticket.updateMany({
|
||
where: {
|
||
id: {
|
||
in: ticketIds
|
||
}
|
||
},
|
||
data: {
|
||
emailSent: true,
|
||
updatedAt: new Date()
|
||
}
|
||
});
|
||
|
||
res.json({ message: `${ticketIds.length} tickets marked as email sent` });
|
||
} catch (error) {
|
||
res.status(res.statusCode === 200 ? 400 : res.statusCode).json({ message: safeErrorMessage(error) });
|
||
}
|
||
};
|
||
|
||
// @desc Email (and WhatsApp if preference set) tickets to user
|
||
// @route POST /api/tickets/email
|
||
// @access Private
|
||
// Optional body param: channel ('email'|'whatsapp'|'both') — overrides user's notification preference for this request
|
||
const emailTickets = async (req, res) => {
|
||
try {
|
||
// If caller specifies an explicit channel, build a minimal userOverride that forces that preference
|
||
const { channel } = req.body || {};
|
||
let userOverride = null;
|
||
if (channel && ['email', 'whatsapp', 'both'].includes(channel)) {
|
||
// Load base user data then override the preference
|
||
const userId = req.user?.id;
|
||
if (userId) {
|
||
const baseUser = await prisma.user.findUnique({
|
||
where: { id: userId },
|
||
select: { id: true, email: true, name: true, phoneNumber: true, notificationPreference: true }
|
||
});
|
||
if (baseUser) {
|
||
userOverride = { ...baseUser, notificationPreference: channel };
|
||
}
|
||
}
|
||
}
|
||
return await emailTicketsInternal(req, res, userOverride);
|
||
} catch (error) {
|
||
console.error('Error emailing tickets:', error);
|
||
res.status(error.statusCode || 400).json({ message: error.message });
|
||
}
|
||
};
|
||
|
||
// @desc Get recent ticket scans
|
||
// @route GET /api/tickets/scans/recent
|
||
// @access Private/Staff
|
||
const getRecentScans = async (req, res) => {
|
||
try {
|
||
const limit = Math.max(1, Math.min(parseInt(req.query.limit) || 10, 100));
|
||
const eventId = req.query.eventId || undefined;
|
||
// Campus-scoped staff: scans of tickets for events they can see.
|
||
const scopeEv = (await require('../utils/campusScope').listWhere(req, 'event')).event;
|
||
|
||
const scans = await prisma.ticketUsage.findMany({
|
||
where: eventId || scopeEv ? { ticket: { ...(eventId ? { eventId } : {}), ...(scopeEv ? { event: scopeEv } : {}) } } : undefined,
|
||
orderBy: { scannedAt: 'desc' },
|
||
take: limit,
|
||
select: {
|
||
id: true,
|
||
scannedAt: true,
|
||
quantityRedeemed: true,
|
||
scannedBy: { select: { id: true, name: true } },
|
||
ticket: {
|
||
select: {
|
||
id: true,
|
||
event: { select: { title: true } },
|
||
registrationOption: { select: { eventOption: { select: { name: true } } } }
|
||
}
|
||
}
|
||
}
|
||
});
|
||
|
||
res.json(scans);
|
||
} catch (error) {
|
||
res.status(res.statusCode === 200 ? 400 : res.statusCode).json({ message: safeErrorMessage(error) });
|
||
}
|
||
};
|
||
|
||
// @desc Get scan statistics
|
||
// @route GET /api/tickets/scans/stats
|
||
// @access Private/Staff
|
||
const getScanStats = async (req, res) => {
|
||
try {
|
||
const eventId = req.query.eventId || undefined;
|
||
const startOfDay = new Date();
|
||
startOfDay.setHours(0, 0, 0, 0);
|
||
// Campus-scoped staff: scans of tickets for events they can see.
|
||
const scopeEv = (await require('../utils/campusScope').listWhere(req, 'event')).event;
|
||
const ticketWhere = eventId || scopeEv ? { ticket: { ...(eventId ? { eventId } : {}), ...(scopeEv ? { event: scopeEv } : {}) } } : {};
|
||
|
||
// Total scans today (optionally by event)
|
||
const whereBase = {
|
||
scannedAt: { gte: startOfDay },
|
||
...ticketWhere
|
||
};
|
||
|
||
const [totalToday, myToday, lastHour] = await Promise.all([
|
||
prisma.ticketUsage.count({ where: whereBase }),
|
||
prisma.ticketUsage.count({ where: { ...whereBase, scannedById: req.user.id } }),
|
||
prisma.ticketUsage.count({
|
||
where: {
|
||
...ticketWhere,
|
||
scannedAt: { gte: new Date(Date.now() - 60 * 60 * 1000) }
|
||
}
|
||
})
|
||
]);
|
||
|
||
// Per-scanner breakdown today
|
||
const byStaff = await prisma.ticketUsage.groupBy({
|
||
by: ['scannedById'],
|
||
where: whereBase,
|
||
_count: { _all: true }
|
||
});
|
||
const staffIds = byStaff.map(b => b.scannedById);
|
||
const staffUsers = staffIds.length > 0 ? await prisma.user.findMany({
|
||
where: { id: { in: staffIds } },
|
||
select: { id: true, name: true }
|
||
}) : [];
|
||
const nameMap = Object.fromEntries(staffUsers.map(u => [u.id, u.name]));
|
||
|
||
res.json({
|
||
totalToday,
|
||
myToday,
|
||
lastHour,
|
||
byStaff: byStaff.map(b => ({ scannedById: b.scannedById, name: nameMap[b.scannedById] || 'Staff', count: b._count._all }))
|
||
});
|
||
} catch (error) {
|
||
res.status(res.statusCode === 200 ? 400 : res.statusCode).json({ message: safeErrorMessage(error) });
|
||
}
|
||
};
|
||
|
||
// @desc Send tickets to a specific phone/email (staff override for at-the-door)
|
||
// @route POST /api/tickets/send-to
|
||
// @access Private/Staff
|
||
const sendTicketsTo = async (req, res) => {
|
||
try {
|
||
const { registrationId, ticketIds, channel, overridePhone, overrideEmail } = req.body;
|
||
if (!registrationId && (!ticketIds || !Array.isArray(ticketIds) || ticketIds.length === 0)) {
|
||
res.status(400); throw new Error('registrationId or ticketIds required');
|
||
}
|
||
if (!channel || !['email','whatsapp','both'].includes(channel)) {
|
||
res.status(400); throw new Error('channel must be email, whatsapp, or both');
|
||
}
|
||
|
||
// Determine which user owns the tickets to get their default contact info
|
||
let ownerUserId;
|
||
if (registrationId) {
|
||
const reg = await prisma.registration.findUnique({ where: { id: registrationId }, select: { userId: true } });
|
||
if (!reg) { res.status(404); throw new Error('Registration not found'); }
|
||
ownerUserId = reg.userId;
|
||
} else {
|
||
const firstTicket = await prisma.ticket.findUnique({ where: { id: ticketIds[0] }, select: { userId: true } });
|
||
if (!firstTicket) { res.status(404); throw new Error('Ticket not found'); }
|
||
ownerUserId = firstTicket.userId;
|
||
}
|
||
|
||
// Use a mock req that targets the ticket owner; override contact details in user object via closure
|
||
const originalUser = await prisma.user.findUnique({
|
||
where: { id: ownerUserId },
|
||
select: { id: true, email: true, name: true, phoneNumber: true, notificationPreference: true }
|
||
});
|
||
if (!originalUser) { res.status(404); throw new Error('Ticket owner not found'); }
|
||
|
||
// Build a virtual user with override contact details
|
||
const virtualUser = {
|
||
...originalUser,
|
||
email: overrideEmail || originalUser.email,
|
||
phoneNumber: overridePhone || originalUser.phoneNumber,
|
||
// Force the preference to match the requested channel
|
||
notificationPreference: channel,
|
||
};
|
||
|
||
// Reuse emailTickets logic via mock request but with virtual user
|
||
// We build a minimal mock and call the internal flow directly
|
||
const mockBody = registrationId ? { registrationId } : { ticketIds };
|
||
const mockReq = { user: { id: ownerUserId }, body: mockBody, _virtualUser: virtualUser };
|
||
const mockRes = { status: () => mockRes, json: (body) => { res.json(body); } };
|
||
|
||
// Call emailTickets with the virtual user override
|
||
await emailTicketsInternal(mockReq, mockRes, virtualUser);
|
||
} catch (error) {
|
||
res.status(res.statusCode === 200 ? 400 : res.statusCode).json({ message: safeErrorMessage(error) });
|
||
}
|
||
};
|
||
|
||
// @desc Offer a ticket to someone else: sends them a link to accept (nothing changes until they do)
|
||
// @route POST /api/tickets/:id/transfer { name, email?, phone?, dateOfBirth?, gender?, parentName?, parentEmail?, parentPhone? }
|
||
// @access Private (payer or holder; supervisors always)
|
||
const transferTicketHandler = async (req, res) => {
|
||
try {
|
||
const { requestTransfer } = require('../utils/ticketTransfer');
|
||
const { name, email, phone, dateOfBirth, gender, parentName, parentEmail, parentPhone } = req.body || {};
|
||
const { request, sent } = await requestTransfer({ ticketId: req.params.id, actor: req.user, name, email, phone, dateOfBirth, gender, parentName, parentEmail, parentPhone });
|
||
res.status(201).json({
|
||
message: sent.length
|
||
? `We've sent ${request.toName} a link by ${sent.join(' and ')} to accept the ticket. It moves to them once they accept — until then it's still yours.`
|
||
: `The transfer is waiting for ${request.toName} to accept, but the link couldn't be sent. Check the email or phone number.`,
|
||
requestId: request.id,
|
||
expiresAt: request.expiresAt,
|
||
});
|
||
} catch (error) {
|
||
res.status(error.statusCode || (res.statusCode === 200 ? 400 : res.statusCode)).json({ message: safeErrorMessage(error) });
|
||
}
|
||
};
|
||
|
||
// @desc Withdraw a transfer that hasn't been accepted yet
|
||
// @route DELETE /api/tickets/:id/transfer
|
||
// @access Private (payer or holder; supervisors)
|
||
const cancelTransferHandler = async (req, res) => {
|
||
try {
|
||
const { cancelTransfer } = require('../utils/ticketTransfer');
|
||
await cancelTransfer(req.params.id, req.user);
|
||
res.json({ message: 'Transfer cancelled — the ticket is still yours.' });
|
||
} catch (error) {
|
||
res.status(error.statusCode || 400).json({ message: safeErrorMessage(error) });
|
||
}
|
||
};
|
||
|
||
// @desc What's on offer behind a transfer link
|
||
// @route GET /api/tickets/transfer-offer/:token
|
||
// @access Public (link holder)
|
||
const getTransferOffer = async (req, res) => {
|
||
try {
|
||
const { findRequestByToken } = require('../utils/ticketTransfer');
|
||
const r = await findRequestByToken(req.params.token);
|
||
if (!r) return res.status(404).json({ message: 'This transfer link isn’t valid.' });
|
||
const t = r.ticket;
|
||
res.json({
|
||
status: r.status, toName: r.toName, expiresAt: r.expiresAt,
|
||
fromName: (t.attendee?.name || t.user?.name || r.requestedBy.name || '').split(' ')[0],
|
||
event: t.event,
|
||
option: t.registrationOption.variant ? `${t.registrationOption.eventOption.name} — ${t.registrationOption.variant.name}` : t.registrationOption.eventOption.name,
|
||
});
|
||
} catch (error) {
|
||
res.status(400).json({ message: safeErrorMessage(error) });
|
||
}
|
||
};
|
||
|
||
// @route POST /api/tickets/transfer-offer/:token/decline
|
||
const declineTransferOffer = async (req, res) => {
|
||
try {
|
||
const { declineTransfer } = require('../utils/ticketTransfer');
|
||
await declineTransfer(req.params.token);
|
||
res.json({ message: 'You declined the ticket. Nothing else will happen.' });
|
||
} catch (error) {
|
||
res.status(error.statusCode || 400).json({ message: safeErrorMessage(error) });
|
||
}
|
||
};
|
||
|
||
// @desc Accept a transferred ticket — the transfer happens now
|
||
// @route POST /api/tickets/transfer-offer/:token/accept
|
||
// @access Public (link holder)
|
||
const acceptTransferOffer = async (req, res) => {
|
||
try {
|
||
const { acceptTransfer } = require('../utils/ticketTransfer');
|
||
const r = await acceptTransfer(req.params.token);
|
||
const actor = r.request.requestedBy;
|
||
|
||
const { logAdminAction } = require('../utils/adminAudit');
|
||
const { getClientIp } = require('../utils/requestUtils');
|
||
logAdminAction({
|
||
actorId: actor.id, actorRole: actor.role, action: 'ticket_transferred', targetType: 'Ticket', targetId: r.target.id,
|
||
metadata: { eventId: r.event.id, registrationId: r.registrationId, from: r.fromHolderName, to: r.attendee.name, toUserId: r.toUser.id, split: !r.transfer.oldQrCode, acceptedVia: 'link' },
|
||
ip: getClientIp(req),
|
||
});
|
||
|
||
// Tell the new holder: activation link for a new account, their ticket, and
|
||
// anything they need to do themselves (consent, attendee form).
|
||
if (r.accountCreated) {
|
||
const { sendActivationLink } = require('./userController');
|
||
sendActivationLink(r.toUser);
|
||
}
|
||
const a = r.attendee;
|
||
const hasEmail = !!(a.email && a.email.includes('@'));
|
||
const recipient = { id: r.toUser.id, name: a.name, email: hasEmail ? a.email : null, phoneNumber: a.phone || null, notificationPreference: hasEmail && a.phone ? 'both' : hasEmail ? 'email' : 'whatsapp' };
|
||
const silent = { status: () => silent, json: () => silent };
|
||
emailTicketsInternal({ user: { id: r.target.userId }, body: { ticketIds: [r.target.id] }, _noSplit: true }, silent, recipient)
|
||
.catch(e => console.error('[transfer] ticket delivery failed:', e?.message || e));
|
||
if (r.needsConsent) {
|
||
const { createConsentRequest } = require('../utils/consent');
|
||
createConsentRequest(a, r.event).catch(e => console.error('[transfer] consent request failed:', e?.message || e));
|
||
}
|
||
const form = await prisma.eventForm.findUnique({ where: { eventId: r.event.id }, include: { fields: { select: { id: true } } } });
|
||
if (form && form.fields.length > 0) {
|
||
const { sendAttendeeFormLinkMessage } = require('../utils/notifications');
|
||
const full = await prisma.attendee.findUnique({ where: { id: a.id }, include: { registration: { include: { event: true, user: { select: { id: true, name: true } } } } } });
|
||
sendAttendeeFormLinkMessage(full).catch(() => {});
|
||
}
|
||
|
||
res.json({
|
||
message: `The ticket is yours! We've sent it to you${r.needsConsent ? ', and asked your parent or guardian for consent' : ''}.${r.accountCreated ? ' We have also sent you a link to activate your account, where you can see your tickets.' : ''}`,
|
||
ticketId: r.target.id,
|
||
});
|
||
} catch (error) {
|
||
res.status(error.statusCode || (res.statusCode === 200 ? 400 : res.statusCode)).json({ message: safeErrorMessage(error) });
|
||
}
|
||
};
|
||
|
||
// @desc Transfer history of a ticket
|
||
// @route GET /api/tickets/:id/transfers
|
||
// @access Private (payer or holder; staff)
|
||
const getTicketTransfers = async (req, res) => {
|
||
try {
|
||
const ticket = await prisma.ticket.findUnique({ where: { id: req.params.id }, select: { userId: true, holderUserId: true } });
|
||
if (!ticket) { res.status(404); throw new Error('Ticket not found'); }
|
||
const staffRole = ['admin', 'supervisor', 'staff'].includes(req.user.role);
|
||
if (!staffRole && ticket.userId !== req.user.id && ticket.holderUserId !== req.user.id) { res.status(403); throw new Error('Not authorized'); }
|
||
const transfers = await prisma.ticketTransfer.findMany({
|
||
where: { ticketId: req.params.id },
|
||
select: { id: true, fromHolderName: true, toName: true, createdAt: true, byUser: { select: { name: true } } },
|
||
orderBy: { createdAt: 'desc' },
|
||
});
|
||
res.json(transfers);
|
||
} catch (error) {
|
||
res.status(res.statusCode === 200 ? 400 : res.statusCode).json({ message: safeErrorMessage(error) });
|
||
}
|
||
};
|
||
|
||
/** "Room: Cabin 3 · Bus: Bus 2" for the sets shown on tickets, or ''. */
|
||
function allocationLabel(attendee) {
|
||
return [...(attendee?.allocations || [])]
|
||
.sort((a, b) => (a.set?.order || 0) - (b.set?.order || 0))
|
||
.map(a => `${a.set.name}: ${a.group.name}`)
|
||
.join(' · ');
|
||
}
|
||
|
||
// One ticket card on the PDF, matching the printed design in frontend/src/lib/ticketPrint.ts.
|
||
function drawTicketCard(doc, { x, y, w, h }, ticket, qrDataUrl, buyerName) {
|
||
const pad = 12; const radius = 9;
|
||
const innerW = w - pad * 2;
|
||
const gray700 = '#374151'; const gray500 = '#6b7280';
|
||
|
||
doc.save();
|
||
doc.roundedRect(x, y + 1.5, w, h, radius).fillOpacity(0.06).fill('#000000');
|
||
doc.restore();
|
||
doc.save();
|
||
doc.roundedRect(x, y, w, h, radius).lineWidth(0.75).fillAndStroke('#ffffff', '#e5e7eb');
|
||
doc.restore();
|
||
|
||
// Event title, with the date on the right of the same line
|
||
let cy = y + pad;
|
||
const eventDate = ticket.event.startDate ? new Date(ticket.event.startDate) : null;
|
||
const dateStr = require('../utils/sessions').ticketDateText(ticket.event, 'short', ticket.registrationOption.session, null, ticket.registrationOption.sessionIds)
|
||
|| (eventDate ? new Intl.DateTimeFormat('en-GB', { day: '2-digit', month: 'long', year: 'numeric' }).format(eventDate) : '');
|
||
doc.font('Helvetica').fontSize(9);
|
||
const dateW = dateStr ? doc.widthOfString(dateStr) : 0;
|
||
if (dateStr) doc.fillColor(gray500).text(dateStr, x + w - pad - dateW, cy + 1, { width: dateW, lineBreak: false });
|
||
const titleW = innerW - (dateStr ? dateW + 8 : 0);
|
||
doc.font('Helvetica-Bold').fontSize(11).fillColor('#111827');
|
||
doc.text(ticket.event.title, x + pad, cy, { width: titleW });
|
||
cy += doc.heightOfString(ticket.event.title, { width: titleW }) + 4;
|
||
|
||
// Campus (only included while campuses are on)
|
||
if (ticket.event.campus?.name) {
|
||
doc.font('Helvetica').fontSize(9).fillColor(gray500).text(ticket.event.campus.name, x + pad, cy, { width: innerW });
|
||
cy += doc.heightOfString(ticket.event.campus.name, { width: innerW }) + 2;
|
||
}
|
||
|
||
// Ticket type
|
||
const variantSuffix = ticket.registrationOption.variant ? ` — ${ticket.registrationOption.variant.name}` : '';
|
||
const type = `${ticket.registrationOption.eventOption.name}${variantSuffix}`;
|
||
doc.font('Helvetica').fontSize(10).fillColor(gray700).text(type, x + pad, cy, { width: innerW });
|
||
cy += doc.heightOfString(type, { width: innerW }) + 2;
|
||
|
||
// Name (named ticket) or quantity, value in bold
|
||
doc.font('Helvetica').fontSize(9).fillColor(gray700)
|
||
.text(ticket.attendee ? 'Name: ' : 'Qty: ', x + pad, cy, { continued: true })
|
||
.font('Helvetica-Bold').text(ticket.attendee ? ticket.attendee.name : String(ticket.quantity || 1));
|
||
cy += 12;
|
||
const groupLabel = allocationLabel(ticket.attendee);
|
||
if (groupLabel) {
|
||
doc.font('Helvetica').fontSize(9).fillColor(gray500).text(groupLabel, x + pad, cy, { width: innerW });
|
||
cy += doc.heightOfString(groupLabel, { width: innerW }) + 2;
|
||
}
|
||
|
||
// Footer lines are measured first so the QR code takes the remaining space
|
||
const footer = [`Ticket ID: ${ticket.id}`, ...(buyerName ? [`Purchased by: ${buyerName}`] : [])];
|
||
doc.font('Helvetica').fontSize(8.5);
|
||
const footerH = footer.reduce((sum, line) => sum + doc.heightOfString(line, { width: innerW }) + 2, 0);
|
||
const qrSpace = (y + h - pad - footerH) - (cy + 6) - 6;
|
||
const qrSize = Math.max(60, Math.min(130, qrSpace));
|
||
const qrY = cy + 6 + Math.max(0, (qrSpace - qrSize) / 2);
|
||
doc.image(qrDataUrl, x + (w - qrSize) / 2, qrY, { width: qrSize, height: qrSize });
|
||
|
||
let fy = y + h - pad - footerH;
|
||
doc.fillColor(gray500);
|
||
for (const line of footer) {
|
||
doc.text(line, x + pad, fy, { width: innerW, align: 'center' });
|
||
fy += doc.heightOfString(line, { width: innerW }) + 2;
|
||
}
|
||
doc.fillColor('#000000');
|
||
}
|
||
|
||
// Internal helper used by both emailTickets and sendTicketsTo
|
||
async function emailTicketsInternal(req, res, userOverride) {
|
||
const { ticketIds, registrationId } = req.body;
|
||
const userId = req.user.id;
|
||
|
||
const user = userOverride || await prisma.user.findUnique({
|
||
where: { id: userId },
|
||
select: { email: true, name: true, phoneNumber: true, notificationPreference: true }
|
||
});
|
||
if (!user) { res.status(404); throw new Error('User not found'); }
|
||
const pref = user.notificationPreference || 'email';
|
||
const noValidEmail = !user.email || user.email.endsWith('@guest.local');
|
||
// For users without a valid email, WhatsApp is used as fallback regardless of preference
|
||
const canSendWA = !!user.phoneNumber && ((pref === 'whatsapp' || pref === 'both') || noValidEmail);
|
||
// Only block if neither channel can deliver
|
||
if (noValidEmail && !canSendWA) {
|
||
return res.json({ message: 'No valid contact details on file — ticket delivery skipped.' });
|
||
}
|
||
|
||
const showCampus = await require('../utils/campuses').campusesEnabled();
|
||
const ticketInclude = {
|
||
event: { include: { sessions: { where: { cancelledAt: null }, orderBy: { startsAt: 'asc' } }, ...(showCampus ? { campus: { select: { name: true } } } : {}) } },
|
||
registrationOption: { include: { eventOption: true, variant: true, session: true, registration: { select: { ticketDelivery: true } } } },
|
||
attendee: { include: { allocations: { where: { set: { showOnTicket: true } }, include: { group: { select: { name: true } }, set: { select: { name: true, order: true } } } } } },
|
||
user: { select: { name: true } },
|
||
usages: true,
|
||
};
|
||
let tickets;
|
||
if (registrationId) {
|
||
const registration = await prisma.registration.findUnique({
|
||
where: { id: registrationId, userId }
|
||
});
|
||
if (!registration) { res.status(404); throw new Error('Registration not found or does not belong to you'); }
|
||
const registrationOptions = await prisma.registrationOption.findMany({ where: { registrationId } });
|
||
tickets = await prisma.ticket.findMany({
|
||
where: { registrationOptionId: { in: registrationOptions.map(o => o.id) }, userId },
|
||
include: ticketInclude,
|
||
orderBy: { createdAt: 'asc' }
|
||
});
|
||
} else {
|
||
// The payer, or the named holder of a group ticket, can have it sent.
|
||
tickets = await prisma.ticket.findMany({
|
||
where: { id: { in: ticketIds }, OR: [{ userId }, { holderUserId: userId }] },
|
||
include: ticketInclude,
|
||
orderBy: { createdAt: 'asc' }
|
||
});
|
||
}
|
||
|
||
// Group tickets set to "send each person their own": attendees with contact details
|
||
// get theirs directly; the rest (and attendees without contact details) go to the
|
||
// payer below. Not when the caller asked for a specific recipient or channel.
|
||
if (!userOverride && !req._noSplit) {
|
||
const own = tickets.filter(t => t.attendee && (t.attendee.email || t.attendee.phone)
|
||
&& t.registrationOption?.registration?.ticketDelivery === 'each');
|
||
for (const t of own) {
|
||
const a = t.attendee;
|
||
const hasEmail = !!(a.email && a.email.includes('@'));
|
||
const recipient = {
|
||
id: a.userId || null,
|
||
name: a.name,
|
||
email: hasEmail ? a.email : null,
|
||
phoneNumber: a.phone || null,
|
||
notificationPreference: hasEmail && a.phone ? 'both' : hasEmail ? 'email' : 'whatsapp',
|
||
};
|
||
const silent = { status: () => silent, json: () => silent };
|
||
try {
|
||
await emailTicketsInternal({ user: { id: userId }, body: { ticketIds: [t.id] }, _noSplit: true }, silent, recipient);
|
||
} catch (e) {
|
||
console.error(`[tickets] Failed to send ${a.name}'s ticket:`, e?.message || e);
|
||
}
|
||
}
|
||
const sentIds = new Set(own.map(t => t.id));
|
||
tickets = tickets.filter(t => !sentIds.has(t.id));
|
||
if (tickets.length === 0 && own.length > 0) {
|
||
return res.json({ message: `${own.length} ticket(s) sent to the people they're for`, ticketIds: own.map(t => t.id) });
|
||
}
|
||
}
|
||
|
||
// Dedup by registrationOptionId — except named tickets, which are one per person.
|
||
{
|
||
const seen = new Map(); const deduped = [];
|
||
for (const t of tickets) {
|
||
const key = t.attendeeId ? `attendee:${t.attendeeId}` : t.registrationOptionId;
|
||
if (!seen.has(key)) { seen.set(key, t); deduped.push(t); }
|
||
else {
|
||
const existing = seen.get(key);
|
||
if ((existing.usages||[]).length === 0 && (t.usages||[]).length > 0) {
|
||
seen.set(key, t); deduped[deduped.indexOf(existing)] = t;
|
||
}
|
||
}
|
||
}
|
||
tickets = deduped;
|
||
}
|
||
if (tickets.length === 0) { res.status(404); throw new Error('No valid tickets found'); }
|
||
|
||
// Generate PDF
|
||
const PDFDocument = require('pdfkit');
|
||
const QRCode = require('qrcode');
|
||
const fs = require('fs');
|
||
const path = require('path');
|
||
const tempFilePath = path.join(__dirname, '..', '..', 'temp', `tickets-${userId}-${Date.now()}.pdf`);
|
||
const tempDir = path.join(__dirname, '..', '..', 'temp');
|
||
if (!fs.existsSync(tempDir)) fs.mkdirSync(tempDir, { recursive: true });
|
||
|
||
const doc = new PDFDocument({ size: 'A4', margin: 20 });
|
||
const writeStream = fs.createWriteStream(tempFilePath);
|
||
doc.pipe(writeStream);
|
||
// Same card design as the printed tickets (frontend/src/lib/ticketPrint.ts): rounded white
|
||
// cards with a light border and soft shadow, two columns, three rows per page.
|
||
const margin = 20; const gap = 12;
|
||
const ticketsPerRow = 2; const ticketsPerColumn = 3;
|
||
const ticketWidth = (doc.page.width - margin * 2 - gap * (ticketsPerRow - 1)) / ticketsPerRow;
|
||
const ticketHeight = (doc.page.height - margin * 2 - gap * (ticketsPerColumn - 1)) / ticketsPerColumn;
|
||
const qrCodes = await Promise.all(tickets.map(ticket => new Promise((resolve, reject) => {
|
||
QRCode.toDataURL(ticket.qrCode, { margin: 1, width: 400 }, (err, url) => err ? reject(err) : resolve({ ticketId: ticket.id, qrDataUrl: url }));
|
||
})));
|
||
const qrCodeMap = qrCodes.reduce((map, item) => { map[item.ticketId] = item.qrDataUrl; return map; }, {});
|
||
let ticketIndex = 0;
|
||
for (const ticket of tickets) {
|
||
const slot = ticketIndex % (ticketsPerRow * ticketsPerColumn);
|
||
const x = margin + (slot % ticketsPerRow) * (ticketWidth + gap);
|
||
const y = margin + Math.floor(slot / ticketsPerRow) * (ticketHeight + gap);
|
||
drawTicketCard(doc, { x, y, w: ticketWidth, h: ticketHeight }, ticket, qrCodeMap[ticket.id], ticket.user?.name || user.name);
|
||
ticketIndex++;
|
||
if (ticketIndex % (ticketsPerRow * ticketsPerColumn) === 0 && ticketIndex < tickets.length) doc.addPage();
|
||
}
|
||
doc.end();
|
||
await new Promise((resolve, reject) => { writeStream.on('finish', resolve); writeStream.on('error', reject); });
|
||
|
||
const eventTitle = tickets[0].event.title;
|
||
const pinnedSessions = tickets.map(t => t.registrationOption?.session).filter(Boolean);
|
||
// All-sessions tickets with the same sessions ticked: those sessions.
|
||
const chosenKeys = new Set(tickets.map(t => (t.registrationOption?.sessionIds || []).join(',')));
|
||
const chosenIds = chosenKeys.size === 1 && !pinnedSessions.length ? tickets[0].registrationOption?.sessionIds : null;
|
||
const eventDate = require('../utils/sessions').ticketDateText(tickets[0].event, 'long', pinnedSessions.length === tickets.length && pinnedSessions.length === 1 ? pinnedSessions[0] : null, pinnedSessions.length === tickets.length ? pinnedSessions : null, chosenIds) || (tickets[0].event.startDate
|
||
? new Date(tickets[0].event.startDate).toLocaleDateString('en-GB', { weekday: 'long', day: 'numeric', month: 'long', year: 'numeric' })
|
||
: '');
|
||
const pdfFilename = `tickets-${eventTitle.replace(/[^a-z0-9]/gi, '_').toLowerCase()}.pdf`;
|
||
const sentChannels = [];
|
||
|
||
const { sendMail, emailWrapper } = require('../utils/email');
|
||
const { canWhatsApp, waPdf } = require('../utils/notify');
|
||
const { buildWATicketCaption } = require('../utils/waMessages');
|
||
const orgUrl = (process.env.FRONTEND_URL || process.env.APP_BASE_URL || 'http://localhost:3001').replace(/\/$/, '');
|
||
const ff = `-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif`;
|
||
const ticketHtml = emailWrapper(`
|
||
<p style="font-size:22px;font-weight:800;color:#0f172a;margin:0 0 8px 0">🎟️ Your tickets are here!</p>
|
||
<p style="margin:0 0 8px 0;color:#374151;font-family:${ff}">Hi <strong>${user.name}</strong>,</p>
|
||
<p style="margin:0 0 24px 0;color:#374151;font-family:${ff}">Your tickets for <strong>${eventTitle}</strong>${eventDate ? ` on <strong>${eventDate}</strong>` : ''} are attached.</p>
|
||
<p style="font-size:13px;color:#64748b;font-family:${ff}">Questions? Visit <a href="${orgUrl}" style="color:#2563eb">${orgUrl}</a>.</p>
|
||
`, { preheader: `Your tickets for ${eventTitle} are attached!` });
|
||
|
||
// Send email unless preference is whatsapp-only
|
||
if (pref !== 'whatsapp' && user.email && !user.email.endsWith('@deleted.invalid') && !user.email.endsWith('@guest.local')) {
|
||
await sendMail({
|
||
to: user.email,
|
||
subject: `Your tickets for ${eventTitle}`,
|
||
html: ticketHtml,
|
||
text: `Hi ${user.name},\n\nYour tickets for ${eventTitle}${eventDate ? ' on ' + eventDate : ''} are attached.\n\nSee you there!`,
|
||
attachments: [{ filename: pdfFilename, path: tempFilePath, contentType: 'application/pdf' }],
|
||
});
|
||
sentChannels.push('email');
|
||
}
|
||
|
||
// Send WhatsApp if preference includes it, or as fallback when email isn't available
|
||
if (pref === 'whatsapp' || pref === 'both' || noValidEmail) {
|
||
const { normalizeZAPhone } = require('../utils/whatsapp');
|
||
const normalizedPhone = normalizeZAPhone(user.phoneNumber);
|
||
if (normalizedPhone) {
|
||
const caption = buildWATicketCaption({ name: user.name, eventTitle, eventDate });
|
||
await waPdf({ ...user, phoneNumber: normalizedPhone, notificationPreference: 'both' }, tempFilePath, pdfFilename, caption).catch(() => {});
|
||
sentChannels.push('whatsapp');
|
||
}
|
||
}
|
||
|
||
try { require('fs').unlinkSync(tempFilePath); } catch {}
|
||
await prisma.ticket.updateMany({ where: { id: { in: tickets.map(t => t.id) } }, data: { emailSent: true, updatedAt: new Date() } });
|
||
res.json({ message: `${tickets.length} ticket(s) sent via ${sentChannels.join(' & ') || 'no channel'}`, ticketIds: tickets.map(t => t.id) });
|
||
}
|
||
|
||
module.exports = {
|
||
generateTickets,
|
||
getTickets,
|
||
getUserTickets,
|
||
getTicketById,
|
||
getTicketByQrCode,
|
||
getScanPreview,
|
||
scanTicket,
|
||
getTicketsByEvent,
|
||
markTicketsAsEmailSent,
|
||
emailTickets,
|
||
sendTicketsTo,
|
||
getRecentScans,
|
||
getScanStats,
|
||
transferTicketHandler,
|
||
cancelTransferHandler,
|
||
getTransferOffer,
|
||
acceptTransferOffer,
|
||
declineTransferOffer,
|
||
getTicketTransfers
|
||
}; |