Signing in showed the "Welcome back!" toast but never left /login. The
session cookie was host-only on the API subdomain, so the Next middleware
guard on the site origin saw no cookie and bounced /dashboard straight
back to /login?redirect=/dashboard.
- Add AUTH_COOKIE_DOMAIN, wiring Better Auth's crossSubDomainCookies so
the cookie also reaches the site origin. Unset in dev, where localhost
is single-host and must stay host-only.
- Navigate after authentication with a full page load, via a shared
authRedirect helper: only a top-level request carries the httpOnly
cookie. Used by the login, register, magic-link and Google flows.
- Show "Redirecting..." on the login and register pages and keep the
submit button disabled until the browser replaces the page, instead of
re-enabling it mid-navigation.
- Guard against a redirect loop with a sessionStorage marker. A React ref
cannot do this: the full page load resets component state. If the
destination bounces back, explain it rather than navigating again.
- Middleware: accept any *.session_token cookie so a cookiePrefix change
cannot lock everyone out, and preserve the destination's query string.
- Trust any loopback port in dev, so reaching the dev server through a
forwarded port does not fail Better Auth's CSRF origin check.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace the hand-rolled JWT auth with Better Auth 1.6.25 httpOnly cookie
sessions, validated against the database on every request so revocation,
bans and role changes take effect immediately.
Backend:
- betterAuth.ts wires the Drizzle adapter, magic links, Google sign-in and
the admin plugin; auth-schema.ts maps Better Auth's models onto the
existing `users` table so user IDs and their foreign keys survive intact.
- routes/auth.ts is gone; Better Auth serves the standard endpoints and
authExt.ts carries the flows it doesn't cover.
- auth.ts shrinks to session resolution and helpers; sessions/revocation in
dashboard.ts now read and delete `auth_sessions` rows directly.
- Schema adds the Better Auth core + admin columns (email_verified, image,
banned, ban_reason, ban_expires), with migrations and tests.
- rateLimit.ts resolves client IPs spoof-resistantly: proxy headers are only
honoured from loopback/RFC1918 peers plus TRUSTED_PROXIES.
- passwordPolicy.ts centralises password validation.
- Bump drizzle-orm, drizzle-kit and better-sqlite3 to versions compatible
with Better Auth.
Frontend:
- auth-client.ts plus a reworked AuthContext and api/client.ts move to
cookie-based sessions; no more bearer tokens in requests or middleware.
photo-api:
- Validate Better Auth session cookies against the shared auth_sessions
table instead of verifying JWTs; JWT_SECRET is no longer needed for user
auth, and PHOTO_VIEW_SECRET now signs gallery view tokens.
BETTER_AUTH_SECRET and BETTER_AUTH_URL are required in production; the
deprecated JWT_SECRET stays only as the photo-api view-token fallback.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The modal only had "User marked as paid", which is absent for manual
payments the customer never confirmed — those opened with no timestamp
at all. Show the payment's createdAt unconditionally as "Booking made",
and give both lines a relative age suffix.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
<img> tags cannot send Authorization headers, so non-public gallery photos
were invisible even to authorized viewers. The server now mints short-lived
HMAC view tokens (gallery-scoped, hour-bucketed) and embeds them in every
file URL for non-public galleries. Access denials return distinct 403
messages per visibility mode, and the frontend renders a matching gate page
(private, link-only, ticket-holders, login prompt) with an inline login
modal so visitors never leave the gallery page.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Cover features added since the last README update: the standalone photo-api
Go service, the central payment provider registry (Lightning + manual
TPago/bank/card/cash), stable /next and /featured URLs, dashboard overview,
and the three-service dev/deploy setup (photo-api on 3003 dev / 3020 prod).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Render a horizontally scrollable strip of thumbnails below the image
that highlights and auto-centres the active photo and lets you jump
straight to any shot.
- Pass thumbUrl through from the public and admin galleries, falling
back to previewUrl when no thumbnail exists.
- Restructure the overlay into a flex column (image area + strip) and
require a clearly horizontal gesture before treating a touch as a
prev/next swipe, so vertical scrolls no longer trigger navigation.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Replace the three Attendees-tab modals (Manual Ticket / Add at Door /
Invite Guest) with a single Add Ticket modal: Paid/Unpaid/Guest segmented
control, shared fields, "Check in now" for all types, and a live
"what happens" preview, backed by one POST /api/tickets/admin/add.
- Add tickets.payment_status (paid | unpaid | comp) with a backfill
migration; keep it in sync on every payment-settlement path (mark-paid,
admin approval, Lightning, free bookings, hold recovery).
- Show Paid/Unpaid/Comp badges in the attendee list, count only paid
tickets toward revenue, let unpaid tickets be resolved via Mark Paid,
and flag unpaid tickets with their balance due in the door scanner.
- Replace the per-page useStatsPrivacy hook with an admin-wide
PrivacyContext + SensitiveValue mask, toggled from the admin layout.
- Add server-side pagination with page-size options to the users page.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Locks no longer fail open: an unreachable backend throws
LockUnavailableError and withLock skips the run (or opts into running
unlocked, as template seeding does). The lnbits payment poller keeps
polling through an outage, made safe by only sending confirmation
emails when a row actually transitioned.
- Rate limiter INCR+PEXPIRE now runs as one Lua script, self-healing
counters stranded without a TTL.
- Per-email login lockout moves to a Redis-backed store shared across
replicas (in-memory fallback preserved), case-insensitive on email.
- Graceful shutdown on SIGTERM/SIGINT: stop periodic jobs, close the
server, force-close lingering SSE sockets, close Redis.
- Active PING probe backs the health flag; /health reports last ping.
SSE payment streams also poll the DB as a pub/sub-gap fallback.
- Scale compose gains requirepass, maxmemory 256mb with noeviction, and
an authenticated healthcheck; .env.example documents passwords, TLS
(rediss://), and DB-index selection.
- First tests in the repo: vitest + ioredis-mock covering the lock,
rate limiter, and login lockout stores (27 tests).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Replace manualProviders.ts with a paymentProviders.ts registry
(automatic vs manual settlement) and move all seat counting into
capacity.ts as the single source of truth: only paid/checked-in tickets
and pending_approval payments hold a seat, so abandoned checkouts never
block sales. Admins can now knowingly approve a payment over capacity
(allowOverCapacity), with the booking and admin UIs updated to match.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Introduces the Go photo-api service, nginx/systemd deploy wiring, and Next.js gallery/lightbox pages so event photos can be managed and browsed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Exclude manual providers from booking cleanup, hold them via the 72h sweep instead, and let admins reopen failed payments to pending.
Co-authored-by: Cursor <cursoragent@cursor.com>
Accept dashed or digits-only RUC input on the backend, store a canonical dashed form, and display it consistently in booking and admin UIs.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add reusable Skeleton components and route-level loading files across public pages and admin lists so layouts stay stable while data loads.
Co-authored-by: Cursor <cursoragent@cursor.com>
Require an explicit payment method on booking, hide stale release banners for past or inactive events, open event editing in place on the detail page, and auto-reject unconfirmed payments after events end without sending email.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use moment-timezone in parseEventDatetime so naive America/Asuncion wall-clock times convert correctly regardless of the host Node tz database. Also normalize user registration date filters with toDbDate for Postgres.
Co-authored-by: Cursor <cursoragent@cursor.com>
Store LNbits invoice data on payments, add an invoice endpoint that reuses valid invoices or regenerates expired ones, and wire the booking payment page to fetch and display invoices via a shared watcher hook.
Co-authored-by: Cursor <cursoragent@cursor.com>
Adds app/error.tsx (client error boundary, reuses Header/Footer/Button)
and app/global-error.tsx (root layout crash fallback with self-contained
html/body and manually replicated styling), both bilingual (ES/EN) and
matching the brand's colors, fonts, and tone.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Consolidate profile and security into AccountTab, add shared dashboard components, and move awaiting-approval payment messages to translations.
Co-authored-by: Cursor <cursoragent@cursor.com>
These short links always resolve to the latest upcoming or featured event so they can be shared without updating when events rotate.
Co-authored-by: Cursor <cursoragent@cursor.com>
Split oversized frontend API client, email service, and admin/booking pages into focused modules while preserving import surfaces, and add Redis-backed queues, stale booking cleanup, stronger auth, and scale deployment configs.
Co-authored-by: Cursor <cursoragent@cursor.com>
Ensure the booking page receives payment confirmation via a streaming SSE proxy, parallel status polling, and more reliable backend event delivery.
Co-authored-by: Cursor <cursoragent@cursor.com>
Close exploitable gaps in booking/payment flows, enforce token versioning and account checks, gate sensitive payment data, and add middleware plus input validation across admin routes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Store unique slugs on events, backfill existing records, redirect old UUID and alias URLs to canonical slug pages, and expose slug editing plus alias management in the admin event modal.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wire legal pages to LanguageContext, pass locale on footer/booking links,
translate layout chrome, and restore SSR content when switching back to English.
Postgres is_guest column is integer; passing JS boolean true caused
"invalid input syntax for type integer" 500 on POST /api/tickets/admin/guest.
Made-with: Cursor
Michilis
