[Satelink-Protocol]

Summary of M6 Deliverables

This pull request delivers Milestone 6 (M6) — Organiser Workspace, Event Staff Roles & Secure QR Check-in on top of the verified M5 baseline (43cf05a).

1. Organiser Workspace

• Overview & Readiness Dashboard: High-level attendance stats, real-time ticket sales & inventory metrics, revenue tracking, readiness checklist (basics, description, venue, tiers, published, gate), and operational quick actions.
• Ticket Inventory & Capacity Management: Real-time visibility into per-tier allocations, sold seats, active holds, remaining inventory, and capacity protection (cannot lower capacity below confirmed seats).
• Attendee & Guest-List Lookup: Filterable, paginated attendee list with search by name/alias/reference, status filters, and approval/decline/cancellation workflows.
• Event Announcements: Broadcast operational updates to confirmed attendees with pinned update support and notification outbox integration.
• Financial Boundary Integrity: Refund status visibility provided without granting unauthorised monetary or live payment mutation permissions.

2. Event-Scoped Staff Roles & Permissions

• Granular Scoped Roles: Implemented organiser, event_manager, door_staff, guest_list_manager, and assistant scoped strictly to individual events via event_team and event_staff_invites.
• Tokenized Invitations: Secure cryptographically random invite tokens with configurable TTL and Telegram onboarding routing.
• Fail-Closed RBAC: Non-members receive HTTP 404 (zero leakage of private resources), while team members with insufficient roles receive HTTP 403.
• Immediate Revocation: Staff removal takes effect immediately on active sessions and is fully audited in audit_log.

3. Server-Authoritative Cryptographic QR Ticket Engine

• HMAC-SHA256 Payload Architecture: Format NLZ1:<ticketCode>:<HMAC-SHA256> signing <ticketCode>:<eventId> using server ticket secret.
• Privacy Preservation: Zero attendee PII (names, phone numbers, emails, Telegram IDs, or sequential DB IDs) exposed in QR payloads.
• Cross-Event Rejection: Event-bound signatures fail instantly in constant time if presented at a different event.
• Reissue & Revocation Lifecycle: Organisers can reissue lost tickets, instantly marking the previous ticket as reissued/revoked with traceable pointers.

4. Mobile-First Door Check-In Experience

• Scanner Viewport (/organiser/events/:id/scan): Native camera stream scanning via BarcodeDetector and canvas frame analysis with laser reticle animation.
• Manual Lookup Fallback: Clean fallback input form for entering TK-XXXX-XXXX-XXXX codes when camera hardware or permissions are unavailable.
• Duplicate & Replay Protection: Database row locking (FOR UPDATE OF t) prevents race conditions and concurrent double-admissions, returning HTTP 409 with prior scan timestamp and staff details.
• Manager Manual Overrides: Audited manual admission override workflow requiring an explicit recorded reason and manager/organiser authority.
• Append-Only Scan Ledger (ticket_scans): Every admission attempt (success, duplicate, revoked, cancelled, signature mismatch) is recorded with timestamp, staff ID, and payload hash.

5. Database Schema & Migrations

• Added migrations/019_organiser_workspace_and_checkin.sql enhancing event_team, creating event_staff_invites, tickets, ticket_scans, and event_announcements, with automatic ticket backfill for historical confirmed bookings.
• Updated test/migrations.test.js to 17 sequential migrations; 8/8 tests pass.

6. Automated Testing & Verification

• Dedicated test suite test/m6-organiser-workspace.test.js (15/15 passing tests).
• Full regression suite: 642/642 unit/integration tests passing (0 failures, 2 skipped).
• Code lint: 145/145 files passing cleanly via npm run lint.
• Governance: ENABLE_LIVE_PAYMENTS=false preserved across all environments.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
strangersmeetup	Ready	Preview	Nov 6, 2026 9:44am UTC