Booking flow: required terms and privacy checkbox with i18n

Also includes admin, dashboard, and API updates; PWA icon assets; and
assorted layout and utility changes on dev.

backend/src/routes/admin.ts

@@ -1,6 +1,6 @@
 import { Hono } from 'hono';
 import { db, dbGet, dbAll, users, events, tickets, payments, contacts, emailSubscribers } from '../db/index.js';
-import { eq, and, gte, sql, desc, inArray } from 'drizzle-orm';
+import { eq, and, ne, gte, sql, desc, inArray } from 'drizzle-orm';
 import { requireAuth } from '../lib/auth.js';
 import { getNow } from '../lib/utils.js';
 
@@ -129,7 +129,8 @@ adminRouter.get('/analytics', requireAuth(['admin']), async (c) => {
           .where(
             and(
               eq((tickets as any).eventId, event.id),
-              eq((tickets as any).status, 'confirmed')
+              eq((tickets as any).status, 'confirmed'),
+              ne((tickets as any).isGuest, 1)
             )
           )
       );
@@ -141,7 +142,8 @@ adminRouter.get('/analytics', requireAuth(['admin']), async (c) => {
           .where(
             and(
               eq((tickets as any).eventId, event.id),
-              eq((tickets as any).status, 'checked_in')
+              eq((tickets as any).status, 'checked_in'),
+              ne((tickets as any).isGuest, 1)
             )
           )
       );

backend/src/routes/events.ts

@@ -4,7 +4,7 @@ import { z } from 'zod';
 import { db, dbGet, dbAll, events, tickets, payments, eventPaymentOverrides, emailLogs, invoices, siteSettings } from '../db/index.js';
 import { eq, desc, and, gte, sql } from 'drizzle-orm';
 import { requireAuth, getAuthUser } from '../lib/auth.js';
-import { generateId, getNow, convertBooleansForDb, toDbDate, calculateAvailableSeats } from '../lib/utils.js';
+import { generateId, getNow, convertBooleansForDb, toDbDate, toDbDateTz, calculateAvailableSeats } from '../lib/utils.js';
 import { revalidateFrontendCache } from '../lib/revalidate.js';
 
 interface UserContext {
@@ -201,6 +201,13 @@ eventsRouter.get('/:id', async (c) => {
   });
 });
 
+async function getSiteTimezone(): Promise<string> {
+  const settings = await dbGet<any>(
+    (db as any).select().from(siteSettings).limit(1)
+  );
+  return settings?.timezone || 'America/Asuncion';
+}
+
 // Helper function to get ticket count for an event
 async function getEventTicketCount(eventId: string): Promise<number> {
   const ticketCount = await dbGet<any>(
@@ -316,6 +323,7 @@ eventsRouter.post('/', requireAuth(['admin', 'organizer']), zValidator('json', c
   const user = c.get('user');
   const now = getNow();
   const id = generateId();
+  const tz = await getSiteTimezone();
   
   // Convert data for database compatibility
   const dbData = convertBooleansForDb(data);
@@ -323,8 +331,8 @@ eventsRouter.post('/', requireAuth(['admin', 'organizer']), zValidator('json', c
   const newEvent = {
     id,
     ...dbData,
-    startDatetime: toDbDate(data.startDatetime),
-    endDatetime: data.endDatetime ? toDbDate(data.endDatetime) : null,
+    startDatetime: toDbDateTz(data.startDatetime, tz),
+    endDatetime: data.endDatetime ? toDbDateTz(data.endDatetime, tz) : null,
     createdAt: now,
     updatedAt: now,
   };
@@ -351,14 +359,15 @@ eventsRouter.put('/:id', requireAuth(['admin', 'organizer']), zValidator('json',
   }
   
   const now = getNow();
+  const tz = await getSiteTimezone();
   // Convert data for database compatibility
   const updateData: Record<string, any> = { ...convertBooleansForDb(data), updatedAt: now };
   // Convert datetime fields if present
   if (data.startDatetime) {
-    updateData.startDatetime = toDbDate(data.startDatetime);
+    updateData.startDatetime = toDbDateTz(data.startDatetime, tz);
   }
   if (data.endDatetime !== undefined) {
-    updateData.endDatetime = data.endDatetime ? toDbDate(data.endDatetime) : null;
+    updateData.endDatetime = data.endDatetime ? toDbDateTz(data.endDatetime, tz) : null;
   }
   
   await (db as any)

backend/src/routes/tickets.ts

@@ -1394,6 +1394,142 @@ ticketsRouter.post('/admin/manual', requireAuth(['admin', 'organizer', 'staff'])
   }, 201);
 });
 
+// Admin invite guest ticket (free, confirmed, not counted in revenue)
+ticketsRouter.post('/admin/guest', requireAuth(['admin', 'organizer', 'staff']), zValidator('json', z.object({
+  eventId: z.string(),
+  firstName: z.string().min(1),
+  lastName: z.string().optional().or(z.literal('')),
+  email: z.string().email().optional().or(z.literal('')),
+  phone: z.string().optional().or(z.literal('')),
+  preferredLanguage: z.enum(['en', 'es']).optional(),
+  adminNote: z.string().max(1000).optional(),
+})), async (c) => {
+  const data = c.req.valid('json');
+
+  const event = await dbGet<any>(
+    (db as any).select().from(events).where(eq((events as any).id, data.eventId))
+  );
+  if (!event) {
+    return c.json({ error: 'Event not found' }, 404);
+  }
+
+  const now = getNow();
+  const adminUser = (c as any).get('user');
+
+  // Find or create user (use placeholder email if none provided)
+  const attendeeEmail = data.email && data.email.trim()
+    ? data.email.trim()
+    : `guest-${generateId()}@guestinvite.local`;
+
+  const fullName = data.lastName && data.lastName.trim()
+    ? `${data.firstName} ${data.lastName}`.trim()
+    : data.firstName;
+
+  let user = await dbGet<any>(
+    (db as any).select().from(users).where(eq((users as any).email, attendeeEmail))
+  );
+
+  if (!user) {
+    const userId = generateId();
+    user = {
+      id: userId,
+      email: attendeeEmail,
+      password: '',
+      name: fullName,
+      phone: data.phone || null,
+      role: 'user',
+      languagePreference: null,
+      createdAt: now,
+      updatedAt: now,
+    };
+    await (db as any).insert(users).values(user);
+  }
+
+  // Check for existing active ticket (only for real emails, not placeholder)
+  if (data.email && data.email.trim()) {
+    const existingTicket = await dbGet<any>(
+      (db as any)
+        .select()
+        .from(tickets)
+        .where(
+          and(
+            eq((tickets as any).userId, user.id),
+            eq((tickets as any).eventId, data.eventId)
+          )
+        )
+    );
+    if (existingTicket && existingTicket.status !== 'cancelled') {
+      return c.json({ error: 'This person already has a ticket for this event' }, 400);
+    }
+  }
+
+  const ticketId = generateId();
+  const qrCode = generateTicketCode();
+
+  const newTicket = {
+    id: ticketId,
+    userId: user.id,
+    eventId: data.eventId,
+    attendeeFirstName: data.firstName,
+    attendeeLastName: data.lastName && data.lastName.trim() ? data.lastName.trim() : null,
+    attendeeEmail: data.email && data.email.trim() ? data.email.trim() : null,
+    attendeePhone: data.phone && data.phone.trim() ? data.phone.trim() : null,
+    preferredLanguage: data.preferredLanguage || null,
+    status: 'confirmed',
+    isGuest: true,
+    qrCode,
+    checkinAt: null,
+    adminNote: data.adminNote || null,
+    createdAt: now,
+  };
+
+  await (db as any).insert(tickets).values(newTicket);
+
+  // Create a $0 payment record to track the invite
+  const paymentId = generateId();
+  const newPayment = {
+    id: paymentId,
+    ticketId,
+    provider: 'cash',
+    amount: 0,
+    currency: event.currency,
+    status: 'paid',
+    reference: 'Guest invite',
+    paidAt: now,
+    paidByAdminId: adminUser?.id || null,
+    createdAt: now,
+    updatedAt: now,
+  };
+
+  await (db as any).insert(payments).values(newPayment);
+
+  // Send booking confirmation email if a real email was provided
+  if (data.email && data.email.trim()) {
+    emailService.sendBookingConfirmation(ticketId).then(result => {
+      if (result.success) {
+        console.log(`[Email] Booking confirmation sent for guest ticket ${ticketId}`);
+      } else {
+        console.error(`[Email] Failed to send booking confirmation for guest ticket ${ticketId}:`, result.error);
+      }
+    }).catch(err => {
+      console.error('[Email] Exception sending booking confirmation for guest ticket:', err);
+    });
+  }
+
+  return c.json({
+    ticket: {
+      ...newTicket,
+      event: {
+        title: event.title,
+        startDatetime: event.startDatetime,
+        location: event.location,
+      },
+    },
+    payment: newPayment,
+    message: 'Guest ticket created successfully',
+  }, 201);
+});
+
 // Get all tickets (admin) - includes payment for each ticket
 ticketsRouter.get('/', requireAuth(['admin', 'organizer']), async (c) => {
   const eventId = c.req.query('eventId');