{{ event_name }}
- +
+
+ Promo codes
+
+
+
+ No promo codes for this event.
+
+
+
+
+
+
+
+
+ Discount: %
+
+
+ Status:
+
+
+ Event begins
@@ -248,7 +303,6 @@
>
+
+ Conditional Events
+
+ Make this event conditional if
+ minimum tickets are sold. User will be asked to
+ provide a Lightning Address or LNURL pay for refunds.
+
+
+
+
+
+ Promo Codes
+
+ Allow users to enter a promo code for discounts.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Add Promo Code
+
+ 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Buy Ticket
+
+ Submit
+ Clear
+
+
+ Link to your ticket!
+
+
+ +
You'll be redirected in a few moments...
+
+
+
+ Copy invoice
+ Close
+
+
+
+
diff --git a/static/js/index.js b/static/js/index.js
index d26133c..ca34383 100644
--- a/static/js/index.js
+++ b/static/js/index.js
@@ -1,13 +1,5 @@
-const mapEvents = function (obj) {
- obj.date = LNbits.utils.formatTimestamp(obj.time)
- obj.fsat = new Intl.NumberFormat(window.g.locale).format(obj.price_per_ticket)
- obj.displayUrl = ['/events/', obj.id].join('')
- return obj
-}
-
-window.app = Vue.createApp({
- el: '#vue',
- mixins: [windowMixin],
+window.PageEvents = {
+ template: '#page-events',
data() {
return {
events: [],
@@ -105,6 +97,7 @@ window.app = Vue.createApp({
formDialog: {
show: false,
data: {
+ currency: 'sats',
extra: {
promo_codes: []
}
@@ -118,18 +111,15 @@ window.app = Vue.createApp({
.request(
'GET',
'/events/api/v1/tickets?all_wallets=true',
- this.g.user.wallets[0].inkey
+ this.g.user.wallets[0].adminkey
)
.then(response => {
- this.tickets = response.data
- .map(function (obj) {
- return mapEvents(obj)
- })
- .filter(e => e.paid)
+ this.tickets = response.data.filter(e => e.paid)
})
},
deleteTicket(ticketId) {
const tickets = _.findWhere(this.tickets, {id: ticketId})
+ const wallet = _.findWhere(this.g.user.wallets, {id: tickets.wallet})
LNbits.utils
.confirmDialog('Are you sure you want to delete this ticket')
@@ -138,16 +128,14 @@ window.app = Vue.createApp({
.request(
'DELETE',
'/events/api/v1/tickets/' + ticketId,
- _.findWhere(this.g.user.wallets, {id: tickets.wallet}).inkey
+ wallet.adminkey
)
.then(response => {
this.tickets = _.reject(this.tickets, function (obj) {
return obj.id == ticketId
})
})
- .catch(function (error) {
- LNbits.utils.notifyApiError(error)
- })
+ .catch(LNbits.utils.notifyApiError)
})
},
exportticketsCSV() {
@@ -161,9 +149,7 @@ window.app = Vue.createApp({
this.g.user.wallets[0].inkey
)
.then(response => {
- this.events = response.data.map(obj => {
- return mapEvents(obj)
- })
+ this.events = response.data
this.checkCanceledEvents()
})
},
@@ -190,6 +176,7 @@ window.app = Vue.createApp({
this.formDialog.data = {...data}
} else {
this.formDialog.data = {
+ currency: 'sats',
extra: {
conditional: false,
min_tickets: 1,
@@ -212,7 +199,7 @@ window.app = Vue.createApp({
LNbits.api
.request('POST', '/events/api/v1/events', wallet.adminkey, data)
.then(response => {
- this.events.push(mapEvents(response.data))
+ this.events.push(response.data)
this.resetEventDialog()
})
.catch(LNbits.utils.notifyApiError)
@@ -233,7 +220,7 @@ window.app = Vue.createApp({
this.events = _.reject(this.events, function (obj) {
return obj.id == data.id
})
- this.events.push(mapEvents(response.data))
+ this.events.push(response.data)
this.resetEventDialog()
})
.catch(LNbits.utils.notifyApiError)
@@ -255,7 +242,7 @@ window.app = Vue.createApp({
return obj.id == eventsId
})
})
- .catch(LNbits.utils.notifyApiError(error))
+ .catch(LNbits.utils.notifyApiError)
})
},
exporteventsCSV() {
@@ -279,9 +266,7 @@ window.app = Vue.createApp({
message: `Event ${ev.name} has been canceled and refunds have been issued.`,
icon: null
})
- this.events = this.events.map(e =>
- e.id === ev.id ? mapEvents(data) : e
- )
+ this.events = this.events.map(e => (e.id === ev.id ? data : e))
}
})
}
@@ -290,7 +275,11 @@ window.app = Vue.createApp({
if (this.g.user.wallets.length) {
this.getTickets()
this.getEvents()
- this.currencies = await LNbits.api.getCurrencies()
+ if (this.g.allowedCurrencies && this.g.allowedCurrencies.length > 0) {
+ this.currencies = ['sats', ...this.g.allowedCurrencies]
+ } else {
+ this.currencies = ['sats', ...this.g.currencies]
+ }
}
}
-})
+}
diff --git a/static/js/index.vue b/static/js/index.vue
new file mode 100644
index 0000000..174f0c1
--- /dev/null
+++ b/static/js/index.vue
@@ -0,0 +1,511 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/static/js/register.js b/static/js/register.js
index a7ab92f..76ccbcb 100644
--- a/static/js/register.js
+++ b/static/js/register.js
@@ -1,28 +1,22 @@
-const mapEvents = function (obj) {
- obj.date = Quasar.date.formatDate(
- new Date(obj.time * 1000),
- 'YYYY-MM-DD HH:mm'
- )
- obj.fsat = new Intl.NumberFormat(LOCALE).format(obj.amount)
- obj.displayUrl = ['/events/', obj.id].join('')
- return obj
-}
-
-window.app = Vue.createApp({
- el: '#vue',
- mixins: [windowMixin],
+window.PageEventsRegister = {
+ template: '#page-events-register',
data() {
return {
tickets: [],
ticketsTable: {
columns: [
- {name: 'id', align: 'left', label: 'ID', field: 'id'},
{name: 'name', align: 'left', label: 'Name', field: 'name'},
{
name: 'registered',
align: 'left',
label: 'Registered',
field: 'registered'
+ },
+ {
+ name: 'paid',
+ align: 'left',
+ label: 'Paid',
+ field: 'paid'
}
],
pagination: {
@@ -49,30 +43,26 @@ window.app = Vue.createApp({
this.sendCamera.show = false
const value = res[0].rawValue.split('//')[1]
LNbits.api
- .request('GET', `/events/api/v1/register/ticket/${value}`)
+ .request('PUT', `/events/api/v1/tickets/register/${value}`)
.then(() => {
Quasar.Notify.create({
type: 'positive',
message: 'Registered!'
})
- setTimeout(() => {
- window.location.reload()
- }, 2000)
})
.catch(LNbits.utils.notifyApiError)
},
getEventTickets() {
LNbits.api
- .request('GET', `/events/api/v1/eventtickets/${event_id}`)
+ .request('GET', `/events/api/v1/events/${this.eventId}/tickets`)
.then(response => {
- this.tickets = response.data.map(obj => {
- return mapEvents(obj)
- })
+ this.tickets = response.data
})
.catch(LNbits.utils.notifyApiError)
}
},
created() {
+ this.eventId = this.$route.params.id
this.getEventTickets()
}
-})
+}
diff --git a/static/js/register.vue b/static/js/register.vue
new file mode 100644
index 0000000..9b40537
--- /dev/null
+++ b/static/js/register.vue
@@ -0,0 +1,64 @@
+
+
+
+
+ New Event
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Events
+
+ Export to CSV
+
+
+
+ Promo codes
+
+
+
+ No promo codes for this event.
+
+
+
+
+
+
+
+
+ Discount:
+ %
+
+
+ Status:
+
+
+
+
+
+
+ Tickets
+
+ Export to CSV
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ + + Events extension +
++ Events: Sell and register ticket waves for an event +
+
+ Events allows you to make a wave of tickets for an event,
+ each ticket is in the form of a unique QRcode, which the
+ user presents at registration. Events comes with a shareable
+ ticket scanner, which can be used to register attendees.
+
+ Created by,
+ Ben Arc
+
+
+
+
+
+
+
+
+
+
+
+
+ Ticket closing date
+
+
+
+
+
+ Event begins
+
+
+
+
+ Event ends
+
+
+
+
+
+
+
+
+
+
+
+
+ Conditional Events
+
+ Make this event conditional if
+ minimum tickets are sold. User will be asked to
+ provide a Lightning Address or LNURL pay for refunds.
+
+
+
+
+
+ Promo Codes
+
+ Allow users to enter a promo code for discounts.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Add Promo Code
+
+
+ Update Event
+ Create Event
+ Cancel
+
+
+
+
+
+
+
+
diff --git a/static/js/ticket.js b/static/js/ticket.js
new file mode 100644
index 0000000..3085f47
--- /dev/null
+++ b/static/js/ticket.js
@@ -0,0 +1,26 @@
+window.PageEventsTicket = {
+ template: '#page-events-ticket',
+ data() {
+ return {
+ ticketId: null,
+ ticketName: null
+ }
+ },
+ methods: {
+ printWindow() {
+ window.print()
+ }
+ },
+ async created() {
+ this.ticketId = this.$route.params.id
+ try {
+ const {data} = await LNbits.api.request(
+ 'GET',
+ `/events/api/v1/tickets/${this.ticketId}`
+ )
+ this.ticketName = data.ticket_name
+ } catch (error) {
+ LNbits.utils.notifyApiError(error)
+ }
+ }
+}
diff --git a/static/js/ticket.vue b/static/js/ticket.vue
new file mode 100644
index 0000000..7fdecce
--- /dev/null
+++ b/static/js/ticket.vue
@@ -0,0 +1,27 @@
+
+
+
+
+
+
+ +
+ +Scan ticket
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Registration
++ +
+ +
+
+
+ Cancel
+
+
+
+
diff --git a/static/routes.json b/static/routes.json
new file mode 100644
index 0000000..ae46a9a
--- /dev/null
+++ b/static/routes.json
@@ -0,0 +1,26 @@
+[
+ {
+ "path": "/events/",
+ "name": "PageEvents",
+ "template": "/events/static/js/index.vue",
+ "component": "/events/static/js/index.js"
+ },
+ {
+ "path": "/events/:id",
+ "name": "PageEventsDisplay",
+ "template": "/events/static/js/display.vue",
+ "component": "/events/static/js/display.js"
+ },
+ {
+ "path": "/events/ticket/:id",
+ "name": "PageEventsTicket",
+ "template": "/events/static/js/ticket.vue",
+ "component": "/events/static/js/ticket.js"
+ },
+ {
+ "path": "/events/register/:id",
+ "name": "PageEventsRegister",
+ "template": "/events/static/js/register.vue",
+ "component": "/events/static/js/register.js"
+ }
+]
diff --git a/tasks.py b/tasks.py
index f7300bb..651994e 100644
--- a/tasks.py
+++ b/tasks.py
@@ -5,8 +5,24 @@ from lnbits.tasks import register_invoice_listener
from loguru import logger
from .crud import get_ticket
+from .models import Ticket
from .services import set_ticket_paid
+payment_listeners: dict[str, list[asyncio.Queue[Ticket]]] = {}
+
+
+def register_payment_listener(payment_hash, queue: asyncio.Queue[Ticket]) -> None:
+ if payment_hash not in payment_listeners:
+ payment_listeners[payment_hash] = []
+ payment_listeners[payment_hash].append(queue)
+
+
+def deregister_payment_listener(payment_hash, queue: asyncio.Queue[Ticket]) -> None:
+ if payment_hash in payment_listeners:
+ payment_listeners[payment_hash].remove(queue)
+ if not payment_listeners[payment_hash]:
+ del payment_listeners[payment_hash]
+
async def wait_for_paid_invoices():
invoice_queue = asyncio.Queue()
@@ -21,13 +37,12 @@ async def on_invoice_paid(payment: Payment) -> None:
if not payment.extra or "events" != payment.extra.get("tag"):
return
- if not payment.extra.get("name") or not payment.extra.get("email"):
- logger.warning(f"Ticket {payment.payment_hash} missing name or email.")
- return
-
ticket = await get_ticket(payment.payment_hash)
if not ticket:
logger.warning(f"Ticket for payment {payment.payment_hash} not found.")
return
- await set_ticket_paid(ticket)
+ ticket = await set_ticket_paid(ticket)
+ if payment_listeners.get(payment.payment_hash):
+ for paid_ticket_queue in payment_listeners[payment.payment_hash]:
+ paid_ticket_queue.put_nowait(ticket)
diff --git a/templates/events/_api_docs.html b/templates/events/_api_docs.html
deleted file mode 100644
index dbf0131..0000000
--- a/templates/events/_api_docs.html
+++ /dev/null
@@ -1,25 +0,0 @@
-
+
+
+
+
+
+ Bookmark, print or screenshot this page,
+
+
+
+
+
+
+
+
+ Ticket
++
+ Bookmark, print or screenshot this page,
+ and present it for registration!
+
+ +
+
- Events: Sell and register ticket waves for an event -
-
- Events allows you to make a wave of tickets for an event, each ticket is
- in the form of a unique QRcode, which the user presents at registration.
- Events comes with a shareable ticket scanner, which can be used to
- register attendees.
-
- Created by,
- Ben Arc
-
-
-
-
-
-
-
-
-
-
-{% endblock %} {% block scripts %}
-
-
-{% endblock %}
diff --git a/templates/events/error.html b/templates/events/error.html
deleted file mode 100644
index 3993db5..0000000
--- a/templates/events/error.html
+++ /dev/null
@@ -1,31 +0,0 @@
-{% extends "public.html" %} {% block page %}
-
-
-
-
- -
-
-
-
-
-
-
-
-
-
-
-
-
-
- {{ event_name }}
-- -
-
Buy Ticket
-
- Submit
- Cancel
-
-
- Link to your ticket!
-
-
- -
You'll be redirected in a few moments...
-
-
-
- Copy invoice
- Close
-
-
-
-{% endblock %} {% block scripts %}
-
-
-
-{% endblock %}
diff --git a/templates/events/index.html b/templates/events/index.html
deleted file mode 100644
index 62752d1..0000000
--- a/templates/events/index.html
+++ /dev/null
@@ -1,464 +0,0 @@
-{% extends "base.html" %} {% from "macros.jinja" import window_vars with context
-%} {% block page %}
-
-
-
-
-
-
-
-
-
-
-{{ event_name }} error
--
{{ event_error }}
--
-
-
-
-
-
-
-
-
-
-
-{% endblock %} {% block scripts %} {{ window_vars(user) }}
-
-
-{% endblock %}
diff --git a/templates/events/register.html b/templates/events/register.html
deleted file mode 100644
index 92589a3..0000000
--- a/templates/events/register.html
+++ /dev/null
@@ -1,84 +0,0 @@
-{% extends "public.html" %} {% block page %}
-
-
-
-
- New Event
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Events
-
- Export to CSV
-
-
-
- Promo codes
-
-
-
- No promo codes for this event.
-
-
-
-
-
-
-
-
- Discount: %
-
-
- Status:
-
-
-
-
-
-
- Tickets
-
- Export to CSV
-
-
-
-
-
-
- {% include "events/_api_docs.html" %}
-
-
-
-
- - {{SITE_TITLE}} Events extension -
-
-
-
-
-
-
-
-
-
-
-
- Ticket closing date
-
-
-
-
-
- Event begins
-
-
-
-
- Event ends
-
-
-
-
-
-
-
-
-
-
-
-
- Conditional Events
-
- Make this event conditional if
- minimum tickets are sold. User will be asked to
- provide a Lightning Address or LNURL pay for refunds.
-
-
-
-
-
- Promo Codes
-
- Allow users to enter a promo code for discounts.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Add Promo Code
-
-
- Update Event
- Create Event
- Cancel
-
-
-
-
-
-
-
-{% endblock %} {% block scripts %}
-
-
-{% endblock %}
diff --git a/templates/events/ticket.html b/templates/events/ticket.html
deleted file mode 100644
index bcf7e82..0000000
--- a/templates/events/ticket.html
+++ /dev/null
@@ -1,39 +0,0 @@
-{% extends "public.html" %} {% block page %}
-
-
-
-
-
- -
- -Scan ticket
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- {{ event_name }} Registration
-- -
- -
-
-
- Cancel
-
-
-
-{% endblock %} {% block scripts %}
-
-{% endblock %}
diff --git a/views.py b/views.py
index 0680dcc..4a3f142 100644
--- a/views.py
+++ b/views.py
@@ -1,139 +1,24 @@
-from datetime import date, datetime
-from http import HTTPStatus
-
-from fastapi import APIRouter, Depends, Request
-from lnbits.core.models import User
-from lnbits.decorators import check_user_exists
-from lnbits.helpers import template_renderer
-from starlette.exceptions import HTTPException
-from starlette.responses import HTMLResponse
-
-from .crud import get_event, get_ticket, purge_unpaid_tickets, update_event
-from .services import refund_tickets
+from fastapi import APIRouter, Depends
+from lnbits.core.views.generic import index, index_public
+from lnbits.decorators import check_account_id_exists
events_generic_router = APIRouter()
+events_generic_router.add_api_route(
+ "/",
+ methods=["GET"],
+ endpoint=index,
+ dependencies=[Depends(check_account_id_exists)],
+)
-def events_renderer():
- return template_renderer(["events/templates"])
+events_generic_router.add_api_route(
+ "/{event_id}", methods=["GET"], endpoint=index_public
+)
+events_generic_router.add_api_route(
+ "/ticket/{ticket_id}", methods=["GET"], endpoint=index_public
+)
-@events_generic_router.get("/", response_class=HTMLResponse)
-async def index(request: Request, user: User = Depends(check_user_exists)):
- return events_renderer().TemplateResponse(
- "events/index.html", {"request": request, "user": user.json()}
- )
-
-
-@events_generic_router.get("/{event_id}", response_class=HTMLResponse)
-async def display(request: Request, event_id):
- event = await get_event(event_id)
- if not event:
- raise HTTPException(
- status_code=HTTPStatus.NOT_FOUND, detail="Event does not exist."
- )
-
- await purge_unpaid_tickets(event_id)
-
- is_window_open = (
- date.today() < datetime.strptime(event.closing_date, "%Y-%m-%d").date()
- )
- is_min_tickets_met = (
- event.sold >= event.extra.min_tickets if event.extra.conditional else True
- )
-
- if event.amount_tickets < 1:
- return events_renderer().TemplateResponse(
- "events/error.html",
- {
- "request": request,
- "event_name": event.name,
- "event_error": "Sorry, tickets are sold out :(",
- },
- )
- if event.extra.conditional and not is_min_tickets_met and not is_window_open:
- event.canceled = True
- await update_event(event)
- await refund_tickets(event_id)
-
- return events_renderer().TemplateResponse(
- "events/error.html",
- {
- "request": request,
- "event_name": event.name,
- "event_error": "Sorry, event was cancelled.",
- },
- )
- if not is_window_open:
- return events_renderer().TemplateResponse(
- "events/error.html",
- {
- "request": request,
- "event_name": event.name,
- "event_error": "Sorry, ticket closing date has passed :(",
- },
- )
-
- if len(event.extra.promo_codes) > 0:
- has_promo_codes = True
- else:
- has_promo_codes = False
-
- event.extra.promo_codes = []
- return events_renderer().TemplateResponse(
- "events/display.html",
- {
- "request": request,
- "event_id": event_id,
- "event_name": event.name,
- "event_info": event.info,
- "event_price": event.price_per_ticket,
- "event_banner": event.banner,
- "event_extra": event.extra.json(),
- "has_promo_codes": has_promo_codes,
- },
- )
-
-
-@events_generic_router.get("/ticket/{ticket_id}", response_class=HTMLResponse)
-async def ticket(request: Request, ticket_id):
- ticket = await get_ticket(ticket_id)
- if not ticket:
- raise HTTPException(
- status_code=HTTPStatus.NOT_FOUND, detail="Ticket does not exist."
- )
-
- event = await get_event(ticket.event)
- if not event:
- raise HTTPException(
- status_code=HTTPStatus.NOT_FOUND, detail="Event does not exist."
- )
-
- return events_renderer().TemplateResponse(
- "events/ticket.html",
- {
- "request": request,
- "ticket_id": ticket_id,
- "ticket_name": event.name,
- "ticket_info": event.info,
- },
- )
-
-
-@events_generic_router.get("/register/{event_id}", response_class=HTMLResponse)
-async def register(request: Request, event_id):
- event = await get_event(event_id)
- if not event:
- raise HTTPException(
- status_code=HTTPStatus.NOT_FOUND, detail="Event does not exist."
- )
-
- return events_renderer().TemplateResponse(
- "events/register.html",
- {
- "request": request,
- "event_id": event_id,
- "event_name": event.name,
- "wallet_id": event.wallet,
- },
- )
+events_generic_router.add_api_route(
+ "/register/{event_id}", methods=["GET"], endpoint=index_public
+)
diff --git a/views_api.py b/views_api.py
index 58c9bca..d9789ec 100644
--- a/views_api.py
+++ b/views_api.py
@@ -1,8 +1,17 @@
+import asyncio
from datetime import datetime, timezone
from http import HTTPStatus
+from typing import Any
-from fastapi import APIRouter, Depends, Query
-from lnbits.core.crud import get_standalone_payment, get_user
+from fastapi import (
+ APIRouter,
+ Depends,
+ HTTPException,
+ Query,
+ WebSocket,
+ WebSocketDisconnect,
+)
+from lnbits.core.crud import get_user
from lnbits.core.models import WalletTypeInfo
from lnbits.core.services import create_invoice
from lnbits.decorators import (
@@ -13,7 +22,6 @@ from lnbits.utils.exchange_rates import (
fiat_amount_as_satoshis,
get_fiat_rate_satoshis,
)
-from starlette.exceptions import HTTPException
from .crud import (
create_event,
@@ -26,36 +34,79 @@ from .crud import (
get_events,
get_ticket,
get_tickets,
+ purge_unpaid_tickets,
update_event,
update_ticket,
)
-from .models import CreateEvent, CreateTicket, Ticket
-from .services import refund_tickets, set_ticket_paid
+from .models import (
+ CreateEvent,
+ CreateTicket,
+ Event,
+ PublicEvent,
+ PublicTicket,
+ Ticket,
+ TicketPaymentRequest,
+)
+from .services import refund_tickets
+from .tasks import deregister_payment_listener, register_payment_listener
-events_api_router = APIRouter()
+events_api_router = APIRouter(prefix="/api/v1/events")
+tickets_api_router = APIRouter(prefix="/api/v1/tickets")
-@events_api_router.get("/api/v1/events")
+@events_api_router.get("")
async def api_events(
all_wallets: bool = Query(False),
wallet: WalletTypeInfo = Depends(require_invoice_key),
-):
+) -> list[Event]:
wallet_ids = [wallet.wallet.id]
if all_wallets:
user = await get_user(wallet.wallet.user)
wallet_ids = user.wallet_ids if user else []
- return [event.dict() for event in await get_events(wallet_ids)]
+ return await get_events(wallet_ids)
-@events_api_router.post("/api/v1/events")
-@events_api_router.put("/api/v1/events/{event_id}")
+@events_api_router.get("/{event_id}", response_model=PublicEvent)
+async def api_get_event(event_id: str) -> Event:
+ event = await get_event(event_id)
+ if not event:
+ raise HTTPException(
+ status_code=HTTPStatus.NOT_FOUND, detail="Event does not exist."
+ )
+ await purge_unpaid_tickets(event_id)
+
+ is_window_open = datetime.now(timezone.utc) < datetime.strptime(
+ event.closing_date, "%Y-%m-%d"
+ ).replace(tzinfo=timezone.utc)
+ is_min_tickets_met = (
+ event.sold >= event.extra.min_tickets if event.extra.conditional else True
+ )
+ if event.amount_tickets < 1:
+ raise HTTPException(status_code=HTTPStatus.GONE, detail="Event is sold out.")
+ if event.extra.conditional and not is_min_tickets_met and not is_window_open:
+ event.canceled = True
+ await update_event(event)
+ await refund_tickets(event_id)
+
+ raise HTTPException(status_code=HTTPStatus.GONE, detail="Event canceled.")
+
+ if not is_window_open:
+ raise HTTPException(
+ status_code=HTTPStatus.GONE, detail="Ticket closing date has passed."
+ )
+
+ return event
+
+
+@events_api_router.post("")
+@events_api_router.put("/{event_id}")
async def api_event_create(
data: CreateEvent,
wallet: WalletTypeInfo = Depends(require_admin_key),
event_id: str | None = None,
-):
+) -> Event:
if event_id:
event = await get_event(event_id)
if not event:
@@ -73,14 +124,14 @@ async def api_event_create(
else:
event = await create_event(data)
- return event.dict()
+ return event
-@events_api_router.put("/api/v1/events/{event_id}/cancel")
+@events_api_router.put("/{event_id}/cancel")
async def api_event_cancel(
event_id: str,
wallet: WalletTypeInfo = Depends(require_admin_key),
-):
+) -> Event:
event = await get_event(event_id)
if not event:
raise HTTPException(
@@ -93,13 +144,13 @@ async def api_event_cancel(
event = await update_event(event)
await refund_tickets(event.id)
- return event.dict()
+ return event
-@events_api_router.delete("/api/v1/events/{event_id}")
+@events_api_router.delete("/{event_id}")
async def api_form_delete(
event_id: str, wallet: WalletTypeInfo = Depends(require_admin_key)
-):
+) -> None:
event = await get_event(event_id)
if not event:
raise HTTPException(
@@ -111,47 +162,65 @@ async def api_form_delete(
await delete_event(event_id)
await delete_event_tickets(event_id)
- return "", HTTPStatus.NO_CONTENT
-#########Tickets##########
+@events_api_router.get(
+ "/{event_id}/tickets",
+ response_model=list[PublicTicket],
+)
+async def api_event_tickets(event_id: str) -> list[Ticket]:
+ return await get_event_tickets(event_id)
-@events_api_router.get("/api/v1/tickets")
+@tickets_api_router.get("")
async def api_tickets(
all_wallets: bool = Query(False),
- wallet: WalletTypeInfo = Depends(require_invoice_key),
+ key_info: WalletTypeInfo = Depends(require_admin_key),
) -> list[Ticket]:
- wallet_ids = [wallet.wallet.id]
+ wallet_ids = [key_info.wallet.id]
if all_wallets:
- user = await get_user(wallet.wallet.user)
+ user = await get_user(key_info.wallet.user)
wallet_ids = user.wallet_ids if user else []
return await get_tickets(wallet_ids)
-@events_api_router.post("/api/v1/tickets/{event_id}")
-async def api_ticket_create(event_id: str, data: CreateTicket):
- name = data.name
- email = data.email
- promo_code = data.promo_code.upper() if data.promo_code else None
- refund_address = data.refund_address
- return await api_ticket_make_ticket(
- event_id, name, email, promo_code, refund_address
- )
+@tickets_api_router.get("/{ticket_id}", response_model=PublicTicket)
+async def api_get_ticket(ticket_id: str) -> Ticket:
+ ticket = await get_ticket(ticket_id)
+ if not ticket:
+ raise HTTPException(
+ status_code=HTTPStatus.NOT_FOUND, detail="Ticket does not exist."
+ )
+ event = await get_event(ticket.event)
+ if not event:
+ raise HTTPException(
+ status_code=HTTPStatus.NOT_FOUND, detail="Event does not exist."
+ )
+ return ticket
-@events_api_router.get("/api/v1/tickets/{event_id}/{name}/{email}")
-async def api_ticket_make_ticket(event_id, name, email, promo_code, refund_address):
+@tickets_api_router.post("/{event_id}")
+async def api_ticket_create(event_id: str, data: CreateTicket) -> TicketPaymentRequest:
event = await get_event(event_id)
if not event:
raise HTTPException(
status_code=HTTPStatus.NOT_FOUND, detail="Event does not exist."
)
+ if event.canceled:
+ raise HTTPException(status_code=HTTPStatus.GONE, detail="Event is canceled.")
+
+ if event.amount_tickets > 0 and event.sold >= event.amount_tickets:
+ raise HTTPException(status_code=HTTPStatus.GONE, detail="Event is sold out.")
+
+ name = data.name
+ email = data.email
+ promo_code = data.promo_code.upper() if data.promo_code else None
+ refund_address = data.refund_address
price = event.price_per_ticket
- extra = {"tag": "events", "name": name, "email": email}
+ extra: dict[str, Any] = {"tag": "events", "name": name, "email": email}
if promo_code:
# check if promo_code exists in event.extra.promo_codes
@@ -172,84 +241,76 @@ async def api_ticket_make_ticket(event_id, name, email, promo_code, refund_addre
price = await fiat_amount_as_satoshis(price, event.currency)
- try:
- payment = await create_invoice(
- wallet_id=event.wallet,
- amount=price,
- memo=f"{event_id}",
- extra=extra,
- )
- await create_ticket(
- payment_hash=payment.payment_hash,
- wallet=event.wallet,
- event=event.id,
- name=name,
- email=email,
- extra={
- "applied_promo_code": promo_code,
- "refund_address": refund_address,
- "sats_paid": int(price),
- },
- )
- except Exception as exc:
- raise HTTPException(
- status_code=HTTPStatus.INTERNAL_SERVER_ERROR, detail=str(exc)
- ) from exc
- return {"payment_hash": payment.payment_hash, "payment_request": payment.bolt11}
-
-
-@events_api_router.post("/api/v1/tickets/{event_id}/{payment_hash}")
-async def api_ticket_send_ticket(event_id, payment_hash):
- event = await get_event(event_id)
- if not event:
- raise HTTPException(
- status_code=HTTPStatus.NOT_FOUND,
- detail="Event could not be fetched.",
- )
-
- ticket = await get_ticket(payment_hash)
- if not ticket:
- raise HTTPException(
- status_code=HTTPStatus.NOT_FOUND,
- detail="Ticket could not be fetched.",
- )
- payment = await get_standalone_payment(payment_hash, incoming=True)
- assert payment
-
- if ticket.extra.applied_promo_code:
- promo = next(
- (
- pc
- for pc in event.extra.promo_codes
- if pc.code == ticket.extra.applied_promo_code
- ),
- None,
- )
- if promo:
- event.price_per_ticket *= 1 - promo.discount_percent / 100
-
- price = (
- event.price_per_ticket * 1000
- if event.currency == "sats"
- else await fiat_amount_as_satoshis(event.price_per_ticket, event.currency)
- * 1000
+ payment = await create_invoice(
+ wallet_id=event.wallet,
+ amount=price,
+ memo=f"{event_id}",
+ extra=extra,
+ )
+ await create_ticket(
+ payment_hash=payment.payment_hash,
+ wallet=event.wallet,
+ event=event.id,
+ name=name,
+ email=email,
+ extra={
+ "applied_promo_code": promo_code,
+ "refund_address": refund_address,
+ "sats_paid": int(price),
+ },
)
- # check if price is equal to payment.amount
- lower_bound = price * 0.99 # 1% decrease
-
- if not payment.pending and abs(payment.amount) >= lower_bound: # allow 1% error
- ticket.extra.sats_paid = int(payment.amount / 1000)
- await set_ticket_paid(ticket)
- return {"paid": True, "ticket_id": ticket.id}
-
- return {"paid": False}
+ return TicketPaymentRequest(
+ payment_hash=payment.payment_hash, payment_request=payment.bolt11
+ )
-@events_api_router.delete("/api/v1/tickets/{ticket_id}")
+@tickets_api_router.websocket("/ws/{payment_hash}")
+async def websocket_endpoint(payment_hash: str, websocket: WebSocket) -> None:
+ await websocket.accept()
+ queue: asyncio.Queue[Ticket] = asyncio.Queue()
+ register_payment_listener(payment_hash, queue)
+ disconnect_task: asyncio.Task | None = None
+ payment_task: asyncio.Task | None = None
+
+ try:
+ ticket = await get_ticket(payment_hash)
+ if ticket and ticket.paid:
+ await websocket.send_json({"paid": True})
+ return
+
+ while True:
+ disconnect_task = asyncio.create_task(websocket.receive_text())
+ payment_task = asyncio.create_task(queue.get())
+ done, pending = await asyncio.wait(
+ {disconnect_task, payment_task}, return_when=asyncio.FIRST_COMPLETED
+ )
+
+ for task in pending:
+ task.cancel()
+
+ if disconnect_task in done:
+ try:
+ disconnect_task.result()
+ except WebSocketDisconnect:
+ pass
+ break
+
+ ticket = payment_task.result()
+ await websocket.send_json({"paid": ticket.paid})
+ if ticket.paid:
+ break
+ finally:
+ for pending_task in (disconnect_task, payment_task):
+ if pending_task and not pending_task.done():
+ pending_task.cancel()
+ deregister_payment_listener(payment_hash, queue)
+
+
+@tickets_api_router.delete("/{ticket_id}")
async def api_ticket_delete(
- ticket_id: str, wallet: WalletTypeInfo = Depends(require_invoice_key)
-):
+ ticket_id: str, wallet: WalletTypeInfo = Depends(require_admin_key)
+) -> None:
ticket = await get_ticket(ticket_id)
if not ticket:
raise HTTPException(
@@ -262,14 +323,8 @@ async def api_ticket_delete(
await delete_ticket(ticket_id)
-@events_api_router.get("/api/v1/eventtickets/{event_id}")
-async def api_event_tickets(event_id: str) -> list[Ticket]:
- return await get_event_tickets(event_id)
-
-
-# TODO: PUT, updates db! @tal
-@events_api_router.get("/api/v1/register/ticket/{ticket_id}")
-async def api_event_register_ticket(ticket_id) -> list[Ticket]:
+@tickets_api_router.put("/register/{ticket_id}", response_model=PublicTicket)
+async def api_event_register_ticket(ticket_id) -> Ticket:
ticket = await get_ticket(ticket_id)
if not ticket:
@@ -289,5 +344,5 @@ async def api_event_register_ticket(ticket_id) -> list[Ticket]:
ticket.registered = True
ticket.reg_timestamp = datetime.now(timezone.utc)
- await update_ticket(ticket)
- return await get_event_tickets(ticket.event)
+ ticket = await update_ticket(ticket)
+ return ticket
From 4afc78d44d36650878728b7a6290504f1ac51fcf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?dni=20=E2=9A=A1?=
-
-
-
-
-
- Bookmark, print or screenshot this page,
-
-
-
-
-
-
-
-
-{{ ticket_name }} Ticket
--
- Bookmark, print or screenshot this page,
- and present it for registration!
-
- -
-
+
+ Registered
+ Name: {{ lastScan.ticket.name }}
+ Email: {{ lastScan.ticket.email }}
+ Paid: {{ lastScan.ticket.paid }}
+ ID: {{ shortId(lastScan.ticket.id) }}
+
+
+ Failed
+
+ Ticket ID: {{ shortId(lastScan.ticketId) }}
+
+ Error: {{ lastScan.error }}
+ Buy Ticket
+
+
+
+
+
+
+
+
+
+
+
+ -
You'll be redirected in a few moments...
+
+ Go to checkout
+
+
+ Continue to checkout
+
+ Your fiat checkout opened in a new tab. If it did not, use the
+ button below.
+
+
+ Copy payment link
+ Close
+
+ Ticket Delivery
+
+ Send the paid ticket link automatically by email or Nostr DM.
+
+
diff --git a/tasks.py b/tasks.py
index 651994e..1d30dce 100644
--- a/tasks.py
+++ b/tasks.py
@@ -6,7 +6,7 @@ from loguru import logger
from .crud import get_ticket
from .models import Ticket
-from .services import set_ticket_paid
+from .services import send_ticket_notification_in_background, set_ticket_paid
payment_listeners: dict[str, list[asyncio.Queue[Ticket]]] = {}
@@ -43,6 +43,7 @@ async def on_invoice_paid(payment: Payment) -> None:
return
ticket = await set_ticket_paid(ticket)
+ send_ticket_notification_in_background(ticket)
if payment_listeners.get(payment.payment_hash):
for paid_ticket_queue in payment_listeners[payment.payment_hash]:
paid_ticket_queue.put_nowait(ticket)
diff --git a/views_api.py b/views_api.py
index 73cecd3..84dd9b0 100644
--- a/views_api.py
+++ b/views_api.py
@@ -8,20 +8,25 @@ from fastapi import (
Depends,
HTTPException,
Query,
+ Request,
WebSocket,
WebSocketDisconnect,
)
from lnbits.core.crud import get_user
+from lnbits.core.crud.wallets import get_wallet
from lnbits.core.models import WalletTypeInfo
-from lnbits.core.services import create_invoice
+from lnbits.core.models.payments import CreateInvoice
+from lnbits.core.services import create_payment_request
from lnbits.decorators import (
require_admin_key,
require_invoice_key,
)
+from lnbits.settings import settings
from lnbits.utils.exchange_rates import (
fiat_amount_as_satoshis,
get_fiat_rate_satoshis,
)
+from lnbits.utils.nostr import normalize_public_key
from .crud import (
create_event,
@@ -53,6 +58,10 @@ events_api_router = APIRouter(prefix="/api/v1/events")
tickets_api_router = APIRouter(prefix="/api/v1/tickets")
+def _is_fiat_currency(currency: str | None) -> bool:
+ return str(currency or "").lower() not in {"sat", "sats"}
+
+
@events_api_router.get("")
async def api_events(
all_wallets: bool = Query(False),
@@ -193,7 +202,9 @@ async def api_get_ticket(ticket_id: str) -> Ticket:
@tickets_api_router.post("/{event_id}")
-async def api_ticket_create(event_id: str, data: CreateTicket) -> TicketPaymentRequest:
+async def api_ticket_create(
+ event_id: str, data: CreateTicket, request: Request
+) -> TicketPaymentRequest:
event = await get_event(event_id)
if not event:
raise HTTPException(
@@ -210,6 +221,21 @@ async def api_ticket_create(event_id: str, data: CreateTicket) -> TicketPaymentR
email = data.email
promo_code = data.promo_code.upper() if data.promo_code else None
refund_address = data.refund_address
+ nostr_identifier = data.nostr_identifier.strip() if data.nostr_identifier else None
+ payment_method = (data.payment_method or "lightning").lower()
+ if payment_method not in {"lightning", "fiat"}:
+ raise HTTPException(
+ status_code=HTTPStatus.BAD_REQUEST,
+ detail="Unsupported payment method.",
+ )
+ if nostr_identifier and "@" not in nostr_identifier:
+ try:
+ nostr_identifier = normalize_public_key(nostr_identifier)
+ except Exception as exc:
+ raise HTTPException(
+ status_code=HTTPStatus.BAD_REQUEST,
+ detail="Invalid Nostr identifier.",
+ ) from exc
price = event.price_per_ticket
extra: dict[str, Any] = {"tag": "events", "name": name, "email": email}
@@ -224,19 +250,55 @@ async def api_ticket_create(event_id: str, data: CreateTicket) -> TicketPaymentR
extra["promo_code"] = promo.code
price = event.price_per_ticket * (1 - promo.discount_percent / 100)
- if event.currency != "sats":
+ if payment_method == "fiat" and not event.allow_fiat:
+ raise HTTPException(
+ status_code=HTTPStatus.BAD_REQUEST,
+ detail="Fiat payments are not enabled for this event.",
+ )
+
+ if _is_fiat_currency(event.currency):
extra["fiat"] = True
extra["currency"] = event.currency
extra["fiatAmount"] = price
extra["rate"] = await get_fiat_rate_satoshis(event.currency)
- price = await fiat_amount_as_satoshis(price, event.currency)
+ if payment_method != "fiat":
+ price = await fiat_amount_as_satoshis(price, event.currency)
- payment = await create_invoice(
+ invoice_unit = event.currency
+ fiat_provider = None
+ if payment_method == "fiat":
+ if not _is_fiat_currency(event.currency):
+ raise HTTPException(
+ status_code=HTTPStatus.BAD_REQUEST,
+ detail="Fiat checkout requires a fiat-denominated ticket price.",
+ )
+ wallet = await get_wallet(event.wallet)
+ if not wallet:
+ raise HTTPException(
+ status_code=HTTPStatus.NOT_FOUND,
+ detail="Event wallet does not exist.",
+ )
+ providers = settings.get_fiat_providers_for_user(wallet.user)
+ fiat_provider = data.fiat_provider or (providers[0] if providers else None)
+ if not fiat_provider:
+ raise HTTPException(
+ status_code=HTTPStatus.BAD_REQUEST,
+ detail="No fiat payment provider configured for this event.",
+ )
+ else:
+ invoice_unit = "sat"
+
+ payment = await create_payment_request(
wallet_id=event.wallet,
- amount=price,
- memo=f"{event_id}",
- extra=extra,
+ invoice_data=CreateInvoice(
+ out=False,
+ amount=price,
+ unit=invoice_unit,
+ fiat_provider=fiat_provider,
+ memo=f"{event_id}",
+ extra=extra,
+ ),
)
await create_ticket(
payment_hash=payment.payment_hash,
@@ -247,12 +309,18 @@ async def api_ticket_create(event_id: str, data: CreateTicket) -> TicketPaymentR
extra={
"applied_promo_code": promo_code,
"refund_address": refund_address,
- "sats_paid": int(price),
+ "nostr_identifier": nostr_identifier,
+ "ticket_base_url": str(request.base_url).rstrip("/"),
+ "sats_paid": payment.sat,
},
)
return TicketPaymentRequest(
- payment_hash=payment.payment_hash, payment_request=payment.bolt11
+ payment_hash=payment.payment_hash,
+ payment_request=getattr(payment, "bolt11", None),
+ fiat_payment_request=getattr(payment, "extra", {}).get("fiat_payment_request"),
+ fiat_provider=getattr(payment, "fiat_provider", None) or fiat_provider,
+ is_fiat=bool(getattr(payment, "fiat_provider", None) or fiat_provider),
)
From 32c230957e5bfe3eaffbcc78fe737e1353ac2a7b Mon Sep 17 00:00:00 2001
From: Arc
Date: Thu, 7 May 2026 14:34:22 +0100
Subject: [PATCH 09/43] fix: if sats and fiat checkout conversion currency
---
migrations.py | 10 ++++++++++
models.py | 3 +++
static/js/display.js | 12 ++++++++++--
static/js/display.vue | 2 +-
static/js/index.js | 7 ++++++-
static/js/index.vue | 23 +++++++++++++++++------
views_api.py | 18 ++++++++++++------
7 files changed, 59 insertions(+), 16 deletions(-)
diff --git a/migrations.py b/migrations.py
index a7e3e86..512540d 100644
--- a/migrations.py
+++ b/migrations.py
@@ -185,3 +185,13 @@ async def m007_add_allow_fiat(db):
ALTER TABLE events.events
ADD COLUMN allow_fiat BOOLEAN NOT NULL DEFAULT FALSE;
""")
+
+
+async def m008_add_fiat_currency(db):
+ """
+ Add a fiat_currency column for sat-denominated events using fiat checkout.
+ """
+ await db.execute("""
+ ALTER TABLE events.events
+ ADD COLUMN fiat_currency TEXT NOT NULL DEFAULT 'GBP';
+ """)
diff --git a/models.py b/models.py
index 7886600..20037ec 100644
--- a/models.py
+++ b/models.py
@@ -37,6 +37,7 @@ class CreateEvent(BaseModel):
event_end_date: str
currency: str = "sat"
allow_fiat: bool = False
+ fiat_currency: str = "GBP"
amount_tickets: int = Query(..., ge=0)
price_per_ticket: float = Query(..., ge=0)
banner: str | None = None
@@ -54,6 +55,7 @@ class Event(BaseModel):
event_end_date: str
currency: str
allow_fiat: bool = False
+ fiat_currency: str = "GBP"
amount_tickets: int
price_per_ticket: float
time: datetime
@@ -72,6 +74,7 @@ class PublicEvent(BaseModel):
event_end_date: str
currency: str
allow_fiat: bool = False
+ fiat_currency: str = "GBP"
price_per_ticket: float
banner: str | None
extra: EventExtra = Field(default_factory=EventExtra)
diff --git a/static/js/display.js b/static/js/display.js
index a927b09..d8be8e9 100644
--- a/static/js/display.js
+++ b/static/js/display.js
@@ -41,8 +41,16 @@ window.PageEventsDisplay = {
return LNbits.utils.convertMarkdown(this.event?.info || '')
},
allowFiatCheckout() {
- const currency = (this.event?.currency || '').toLowerCase()
- return this.event?.allow_fiat && !['sat', 'sats'].includes(currency)
+ return Boolean(this.event?.allow_fiat)
+ },
+ fiatCheckoutLabel() {
+ if (!this.allowFiatCheckout) return 'Fiat'
+ const unit = ['sat', 'sats'].includes(
+ (this.event?.currency || '').toLowerCase()
+ )
+ ? this.event?.fiat_currency
+ : this.event?.currency
+ return `Fiat (${(unit || 'GBP').toUpperCase()})`
},
allowEmailNotifications() {
return Boolean(this.event?.extra?.email_notifications)
diff --git a/static/js/display.vue b/static/js/display.vue
index e37b844..f5ac5fb 100644
--- a/static/js/display.vue
+++ b/static/js/display.vue
@@ -72,7 +72,7 @@
:options="[
{label: 'Lightning', value: 'lightning'},
{
- label: `Fiat (${event.currency.toUpperCase()})`,
+ label: fiatCheckoutLabel,
value: 'fiat'
}
]"
diff --git a/static/js/index.js b/static/js/index.js
index e770db9..07e1b46 100644
--- a/static/js/index.js
+++ b/static/js/index.js
@@ -99,6 +99,7 @@ window.PageEvents = {
data: {
currency: 'sats',
allow_fiat: false,
+ fiat_currency: 'GBP',
extra: {
promo_codes: []
}
@@ -171,7 +172,9 @@ window.PageEvents = {
}))
}
if (!this.isFiatCurrency(data.currency)) {
- data.allow_fiat = false
+ if (!data.allow_fiat) {
+ data.fiat_currency = 'GBP'
+ }
}
if (data.id) {
@@ -188,6 +191,7 @@ window.PageEvents = {
this.formDialog.data = {
currency: 'sats',
allow_fiat: false,
+ fiat_currency: 'GBP',
extra: {
conditional: false,
min_tickets: 1,
@@ -204,6 +208,7 @@ window.PageEvents = {
this.formDialog.data = {
currency: 'sats',
allow_fiat: false,
+ fiat_currency: 'GBP',
extra: {
email_notifications: false,
nostr_notifications: false,
diff --git a/static/js/index.vue b/static/js/index.vue
index 75af661..06729f3 100644
--- a/static/js/index.vue
+++ b/static/js/index.vue
@@ -373,16 +373,27 @@
Ticket
+
Bookmark, print or screenshot this page,
and present it for registration!
- +
+
-
Buy Ticket
+
+
+
+
+
+
+
+
+
+
+
+
+ —
+ ...
+
+
+ tickets •
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Settings
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -75,6 +149,28 @@
>
+
+ Approve
+
+
+ Reject
+
-
+
@@ -149,6 +250,51 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
+
+
+
+ All Users' Events
+
+
+
+ All Users' Events
+
+
diff --git a/views_api.py b/views_api.py
index abdc1ef..a81967f 100644
--- a/views_api.py
+++ b/views_api.py
@@ -14,10 +14,11 @@ from fastapi import (
)
from lnbits.core.crud import get_user
from lnbits.core.crud.wallets import get_wallet
-from lnbits.core.models import WalletTypeInfo
+from lnbits.core.models import Account, WalletTypeInfo
from lnbits.core.models.payments import CreateInvoice
from lnbits.core.services import create_payment_request
from lnbits.decorators import (
+ check_admin,
require_admin_key,
require_invoice_key,
)
@@ -35,18 +36,25 @@ from .crud import (
delete_event,
delete_event_tickets,
delete_ticket,
+ get_all_events,
get_event,
+ get_event_tickets,
get_events,
+ get_pending_events,
+ get_public_events,
+ get_settings,
get_ticket,
get_tickets,
purge_unpaid_tickets,
update_event,
+ update_settings,
update_ticket,
)
from .models import (
CreateEvent,
CreateTicket,
Event,
+ EventsSettings,
PublicEvent,
PublicTicket,
Ticket,
@@ -63,31 +71,87 @@ def _is_fiat_currency(currency: str | None) -> bool:
return str(currency or "").lower() not in {"sat", "sats"}
+# Literal-prefix routes (/public, /all, /pending, /settings) MUST be declared
+# before any "/{event_id}" route or FastAPI matches them as a path parameter.
+
+
@events_api_router.get("")
async def api_events(
all_wallets: bool = Query(False),
wallet: WalletTypeInfo = Depends(require_invoice_key),
) -> list[Event]:
wallet_ids = [wallet.wallet.id]
-
if all_wallets:
user = await get_user(wallet.wallet.user)
wallet_ids = user.wallet_ids if user else []
-
return await get_events(wallet_ids)
+@events_api_router.get("/public")
+async def api_events_public() -> list[Event]:
+ """Approved, non-canceled events for an anonymous public listing."""
+ return await get_public_events()
+
+
+@events_api_router.get("/all")
+async def api_events_all(
+ admin: Account = Depends(check_admin),
+) -> list[Event]:
+ """All events across all wallets. LNbits admin only."""
+ return await get_all_events()
+
+
+@events_api_router.get("/pending")
+async def api_events_pending(
+ admin: Account = Depends(check_admin),
+) -> list[Event]:
+ """Proposed events awaiting admin approval. LNbits admin only."""
+ return await get_pending_events()
+
+
+@events_api_router.get("/settings")
+async def api_get_settings(
+ admin: Account = Depends(check_admin),
+) -> EventsSettings:
+ return await get_settings()
+
+
+@events_api_router.put("/settings")
+async def api_update_settings(
+ data: EventsSettings,
+ admin: Account = Depends(check_admin),
+) -> EventsSettings:
+ return await update_settings(data)
+
+
@events_api_router.get("/{event_id}", response_model=PublicEvent)
async def api_get_event(event_id: str) -> Event:
+ """Public event detail used by display.vue.
+
+ For approved events we run the upstream sold-out / closing-window /
+ conditional gates. For non-approved events (proposed / rejected) we
+ return the trimmed PublicEvent with status set so the SFC can render
+ the pending-approval banner without a separate request.
+ """
event = await get_event(event_id)
if not event:
raise HTTPException(
status_code=HTTPStatus.NOT_FOUND, detail="Event does not exist."
)
+
+ if event.status != "approved":
+ # Proposed/rejected events are not yet ticketable; skip ticket gates.
+ return event
+
await purge_unpaid_tickets(event_id)
+ # closing_date is filled in by create_event (defaults to end_date or
+ # start_date) but the field is typed Optional, so guard for the typechecker.
+ closing_date = (
+ event.closing_date or event.event_end_date or event.event_start_date
+ )
is_window_open = datetime.now(timezone.utc) < datetime.strptime(
- event.closing_date, "%Y-%m-%d"
+ closing_date, "%Y-%m-%d"
).replace(tzinfo=timezone.utc)
is_min_tickets_met = (
event.sold >= event.extra.min_tickets if event.extra.conditional else True
@@ -98,7 +162,6 @@ async def api_get_event(event_id: str) -> Event:
event.canceled = True
await update_event(event)
await refund_tickets(event_id)
-
raise HTTPException(status_code=HTTPStatus.GONE, detail="Event canceled.")
if not is_window_open:
@@ -110,30 +173,50 @@ async def api_get_event(event_id: str) -> Event:
@events_api_router.post("")
-@events_api_router.put("/{event_id}")
async def api_event_create(
data: CreateEvent,
- wallet: WalletTypeInfo = Depends(require_admin_key),
- event_id: str | None = None,
+ wallet: WalletTypeInfo = Depends(require_invoice_key),
) -> Event:
- if event_id:
- event = await get_event(event_id)
- if not event:
- raise HTTPException(
- status_code=HTTPStatus.NOT_FOUND, detail="Event does not exist."
- )
+ """Create a new event.
- if event.wallet != wallet.wallet.id:
- raise HTTPException(
- status_code=HTTPStatus.FORBIDDEN, detail="Not your event."
- )
- for k, v in data.dict().items():
- setattr(event, k, v)
- event = await update_event(event)
- else:
- event = await create_event(data)
+ Anyone with a wallet invoice key can submit. Non-LNbits-admins land in
+ `proposed` status unless `auto_approve` is enabled in extension settings.
+ """
+ if not data.wallet:
+ data.wallet = wallet.wallet.id
- return event
+ from lnbits.settings import settings
+
+ ext_settings = await get_settings()
+ user_id = wallet.wallet.user
+ is_admin = (
+ user_id == settings.super_user
+ or user_id in settings.lnbits_admin_users
+ )
+ if not is_admin and not ext_settings.auto_approve:
+ data.status = "proposed"
+
+ return await create_event(data)
+
+
+@events_api_router.put("/{event_id}")
+async def api_event_update(
+ event_id: str,
+ data: CreateEvent,
+ wallet: WalletTypeInfo = Depends(require_admin_key),
+) -> Event:
+ event = await get_event(event_id)
+ if not event:
+ raise HTTPException(
+ status_code=HTTPStatus.NOT_FOUND, detail="Event does not exist."
+ )
+ if event.wallet != wallet.wallet.id:
+ raise HTTPException(
+ status_code=HTTPStatus.FORBIDDEN, detail="Not your event."
+ )
+ for k, v in data.dict().items():
+ setattr(event, k, v)
+ return await update_event(event)
@events_api_router.put("/{event_id}/cancel")
@@ -146,13 +229,11 @@ async def api_event_cancel(
raise HTTPException(
status_code=HTTPStatus.NOT_FOUND, detail="Event does not exist."
)
-
if event.wallet != wallet.wallet.id:
raise HTTPException(status_code=HTTPStatus.FORBIDDEN, detail="Not your event.")
event.canceled = True
event = await update_event(event)
await refund_tickets(event.id)
-
return event
@@ -165,14 +246,58 @@ async def api_form_delete(
raise HTTPException(
status_code=HTTPStatus.NOT_FOUND, detail="Event does not exist."
)
-
if event.wallet != wallet.wallet.id:
raise HTTPException(status_code=HTTPStatus.FORBIDDEN, detail="Not your event.")
-
await delete_event(event_id)
await delete_event_tickets(event_id)
+@events_api_router.put("/{event_id}/approve")
+async def api_event_approve(
+ event_id: str,
+ admin: Account = Depends(check_admin),
+) -> Event:
+ event = await get_event(event_id)
+ if not event:
+ raise HTTPException(
+ status_code=HTTPStatus.NOT_FOUND, detail="Event does not exist."
+ )
+ if event.status != "proposed":
+ raise HTTPException(
+ status_code=HTTPStatus.BAD_REQUEST,
+ detail=f"Event is already {event.status}.",
+ )
+ event.status = "approved"
+ return await update_event(event)
+
+
+@events_api_router.put("/{event_id}/reject")
+async def api_event_reject(
+ event_id: str,
+ admin: Account = Depends(check_admin),
+) -> Event:
+ event = await get_event(event_id)
+ if not event:
+ raise HTTPException(
+ status_code=HTTPStatus.NOT_FOUND, detail="Event does not exist."
+ )
+ if event.status != "proposed":
+ raise HTTPException(
+ status_code=HTTPStatus.BAD_REQUEST,
+ detail=f"Event is already {event.status}.",
+ )
+ event.status = "rejected"
+ return await update_event(event)
+
+
+@events_api_router.get(
+ "/{event_id}/tickets",
+ response_model=list[PublicTicket],
+)
+async def api_event_tickets(event_id: str) -> list[Ticket]:
+ return await get_event_tickets(event_id)
+
+
@tickets_api_router.get("")
async def api_tickets(
all_wallets: bool = Query(False),
@@ -211,10 +336,13 @@ async def api_ticket_create(
raise HTTPException(
status_code=HTTPStatus.NOT_FOUND, detail="Event does not exist."
)
-
+ if event.status != "approved":
+ raise HTTPException(
+ status_code=HTTPStatus.GONE,
+ detail="Event is not yet open for tickets.",
+ )
if event.canceled:
raise HTTPException(status_code=HTTPStatus.GONE, detail="Event is canceled.")
-
if event.amount_tickets > 0 and event.sold >= event.amount_tickets:
raise HTTPException(status_code=HTTPStatus.GONE, detail="Event is sold out.")
From 6aa280680e08a78b18c8763c3bcf63563bf64c3c Mon Sep 17 00:00:00 2001
From: Padreug
Date: Tue, 5 May 2026 18:51:43 +0200
Subject: [PATCH 15/43] feat: add NIP-52 Nostr publish + sync of calendar
events
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Approved events are mirrored to Nostr as NIP-52 calendar events (kind
31922) signed by the wallet owner's pubkey, and incoming kind 31922/31923
events from subscribed relays are synced into the local DB so events
created on other LNbits instances or Nostr clients show up locally.
- m009 stores nostr_event_id + nostr_event_created_at on each event
(used for replaceable updates and NIP-09 deletes); m011 adds location
+ JSON-encoded categories list (NIP-52 location/`t` tags).
- models: Event/PublicEvent/CreateEvent gain location, categories,
nostr_event_id, nostr_event_created_at; parse_categories validator
decodes the JSON column on read.
- nostr/{event,nostr_client}.py: Schnorr signing, websocket relay client,
and a NostrEvent model (publish-only and subscribe variants).
- nostr_publisher.py: build/sign NIP-52 kind 31922 events and NIP-09
delete events; publish via the relay client.
- nostr_sync.py: subscribe to kinds 31922/31923, dedupe by nostr_event_id
/ d-tag, upsert Events; auto-approves discovered Nostr events since
they're already public.
- nostr_hooks.py: thin bridge that views_api handlers call to publish
or delete a NIP-52 event for a given local event. Lives in its own
module to keep `from . import nostr_client` out of the view layer
and avoid the views_api -> publisher import cycle.
- views_api: hooks publish_or_delete_nostr_event into create-on-approved,
update-when-already-published, cancel (delete), delete (delete), and
approve (publish).
- __init__.py: 3-task lifespan — wait_for_paid_invoices (upstream),
NostrClient bootstrap, and the NIP-52 sync loop. Module-level
nostr_client global is set by the bootstrap and read dynamically by
publish_or_delete_nostr_event so the import order works regardless of
whether nostrclient is up at startup.
Co-Authored-By: Claude Opus 4.7 (1M context)
---
__init__.py | 47 ++++++++++++-
models.py | 21 ++++++
nostr/__init__.py | 0
nostr/event.py | 26 +++++++
nostr/nostr_client.py | 142 ++++++++++++++++++++++++++++++++++++++
nostr_hooks.py | 43 ++++++++++++
nostr_publisher.py | 118 ++++++++++++++++++++++++++++++++
nostr_sync.py | 155 ++++++++++++++++++++++++++++++++++++++++++
views_api.py | 28 +++++++-
9 files changed, 575 insertions(+), 5 deletions(-)
create mode 100644 nostr/__init__.py
create mode 100644 nostr/event.py
create mode 100644 nostr/nostr_client.py
create mode 100644 nostr_hooks.py
create mode 100644 nostr_publisher.py
create mode 100644 nostr_sync.py
diff --git a/__init__.py b/__init__.py
index ef37528..c2f2300 100644
--- a/__init__.py
+++ b/__init__.py
@@ -22,6 +22,11 @@ events_static_files = [
scheduled_tasks: list[asyncio.Task] = []
+# Module-level NostrClient — None when nostrclient is unavailable. Set by the
+# bootstrap task in events_start() and read via dynamic attribute lookup
+# from nostr_hooks.publish_or_delete_nostr_event.
+nostr_client = None
+
def events_stop():
for task in scheduled_tasks:
@@ -30,12 +35,50 @@ def events_stop():
except Exception as ex:
logger.warning(ex)
+ global nostr_client
+ if nostr_client:
+ asyncio.get_event_loop().create_task(nostr_client.stop())
+
def events_start():
from lnbits.tasks import create_permanent_unique_task
- task = create_permanent_unique_task("ext_events", wait_for_paid_invoices)
- scheduled_tasks.append(task)
+ task1 = create_permanent_unique_task("ext_events", wait_for_paid_invoices)
+ scheduled_tasks.append(task1)
+
+ async def _start_nostr_client():
+ global nostr_client
+ await asyncio.sleep(10) # Wait for nostrclient to be ready
+ try:
+ from .nostr.nostr_client import NostrClient
+
+ nostr_client = NostrClient()
+ logger.info("[EVENTS] Starting NostrClient for NIP-52 sync")
+ await nostr_client.run_forever()
+ except Exception as exc:
+ logger.warning(f"[EVENTS] NostrClient failed to start: {exc}")
+ logger.info("[EVENTS] Events will work without Nostr sync")
+
+ task2 = create_permanent_unique_task("ext_events_nostr", _start_nostr_client)
+ scheduled_tasks.append(task2)
+
+ async def _sync_nostr_events():
+ global nostr_client
+ await asyncio.sleep(15) # Wait for NostrClient to connect
+ if not nostr_client:
+ logger.info("[EVENTS] No NostrClient, skipping Nostr sync")
+ return
+ try:
+ from .nostr_sync import wait_for_nostr_events
+
+ await wait_for_nostr_events(nostr_client)
+ except Exception as exc:
+ logger.error(f"[EVENTS] Nostr sync task failed: {exc}")
+
+ task3 = create_permanent_unique_task(
+ "ext_events_nostr_sync", _sync_nostr_events
+ )
+ scheduled_tasks.append(task3)
__all__ = ["db", "events_ext", "events_start", "events_static_files", "events_stop"]
diff --git a/models.py b/models.py
index a9cb31b..e759d66 100644
--- a/models.py
+++ b/models.py
@@ -1,3 +1,4 @@
+import json
from datetime import datetime
from pydantic import BaseModel, EmailStr, Field, root_validator, validator
@@ -42,6 +43,8 @@ class CreateEvent(BaseModel):
amount_tickets: int = 0 # 0 = unlimited / not ticketed
price_per_ticket: float = 0 # 0 = free
banner: str | None = None
+ location: str | None = None # venue/address (NIP-52 'location' tag)
+ categories: list[str] = Field(default_factory=list) # NIP-52 't' tags
extra: EventExtra = Field(default_factory=EventExtra)
status: str = "approved" # proposed, approved, rejected
@@ -63,8 +66,18 @@ class Event(BaseModel):
time: datetime
sold: int = 0
banner: str | None = None
+ location: str | None = None
+ categories: list[str] = Field(default_factory=list)
extra: EventExtra = Field(default_factory=EventExtra)
status: str = "approved"
+ nostr_event_id: str | None = None
+ nostr_event_created_at: int | None = None
+
+ @validator("categories", pre=True)
+ def parse_categories(cls, v):
+ if isinstance(v, str):
+ return json.loads(v) if v else []
+ return v or []
class PublicEvent(BaseModel):
@@ -80,9 +93,17 @@ class PublicEvent(BaseModel):
fiat_currency: str = "GBP"
price_per_ticket: float
banner: str | None
+ location: str | None = None
+ categories: list[str] = Field(default_factory=list)
extra: EventExtra = Field(default_factory=EventExtra)
status: str = "approved" # surfaces "proposed"/"rejected" so SFC can render banner
+ @validator("categories", pre=True)
+ def parse_categories(cls, v):
+ if isinstance(v, str):
+ return json.loads(v) if v else []
+ return v or []
+
class EventsSettings(BaseModel):
"""Extension-level settings for the events extension."""
diff --git a/nostr/__init__.py b/nostr/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/nostr/event.py b/nostr/event.py
new file mode 100644
index 0000000..b6832b1
--- /dev/null
+++ b/nostr/event.py
@@ -0,0 +1,26 @@
+import hashlib
+import json
+
+from pydantic import BaseModel
+
+
+class NostrEvent(BaseModel):
+ id: str = ""
+ pubkey: str
+ created_at: int
+ kind: int
+ tags: list[list[str]] = []
+ content: str = ""
+ sig: str | None = None
+
+ def serialize(self) -> list:
+ return [0, self.pubkey, self.created_at, self.kind, self.tags, self.content]
+
+ def serialize_json(self) -> str:
+ e = self.serialize()
+ return json.dumps(e, separators=(",", ":"), ensure_ascii=False)
+
+ @property
+ def event_id(self) -> str:
+ data = self.serialize_json()
+ return hashlib.sha256(data.encode()).hexdigest()
diff --git a/nostr/nostr_client.py b/nostr/nostr_client.py
new file mode 100644
index 0000000..8e0afc5
--- /dev/null
+++ b/nostr/nostr_client.py
@@ -0,0 +1,142 @@
+"""
+Bidirectional Nostr client for the events extension.
+
+Connects to the nostrclient extension's internal WebSocket to publish
+and subscribe to NIP-52 calendar events. Based on nostrmarket's
+NostrClient pattern.
+"""
+
+import asyncio
+import json
+from asyncio import Queue
+from collections import OrderedDict
+
+from lnbits.helpers import encrypt_internal_message, urlsafe_short_hash
+from lnbits.settings import settings
+from loguru import logger
+from websocket import WebSocketApp
+
+from .event import NostrEvent
+
+MAX_SEEN_EVENTS = 500
+
+
+class NostrClient:
+ def __init__(self):
+ self.receive_event_queue: Queue = Queue()
+ self.send_req_queue: Queue = Queue()
+ self.ws: WebSocketApp | None = None
+ self.subscription_id = "events-" + urlsafe_short_hash()[:32]
+ self.running = False
+ self._seen_events: OrderedDict[str, None] = OrderedDict()
+
+ @property
+ def is_websocket_connected(self):
+ if not self.ws:
+ return False
+ return self.ws.keep_running
+
+ async def connect(self) -> WebSocketApp:
+ relay_endpoint = encrypt_internal_message("relay", urlsafe=True)
+ ws_url = (
+ f"ws://localhost:{settings.port}"
+ f"/nostrclient/api/v1/{relay_endpoint}"
+ )
+
+ logger.info("[EVENTS] Connecting to nostrclient WebSocket...")
+
+ def on_open(_):
+ logger.info("[EVENTS] Connected to nostrclient WebSocket")
+
+ def on_message(_, message):
+ try:
+ self.receive_event_queue.put_nowait(message)
+ except Exception as e:
+ logger.error(f"[EVENTS] Failed to queue message: {e}")
+
+ def on_error(_, error):
+ logger.warning(f"[EVENTS] WebSocket error: {error}")
+
+ def on_close(_, status_code, message):
+ logger.warning(
+ f"[EVENTS] WebSocket closed: {status_code} {message}"
+ )
+ self.receive_event_queue.put_nowait(
+ ValueError("WebSocket closed")
+ )
+
+ ws = WebSocketApp(
+ ws_url,
+ on_message=on_message,
+ on_open=on_open,
+ on_close=on_close,
+ on_error=on_error,
+ )
+
+ from threading import Thread
+
+ wst = Thread(target=ws.run_forever)
+ wst.daemon = True
+ wst.start()
+
+ return ws
+
+ async def run_forever(self):
+ self.running = True
+ while self.running:
+ try:
+ if not self.is_websocket_connected:
+ self.ws = await self.connect()
+ await asyncio.sleep(5)
+
+ req = await self.send_req_queue.get()
+ assert self.ws
+ self.ws.send(json.dumps(req))
+ except Exception as ex:
+ logger.warning(f"[EVENTS] NostrClient error: {ex}")
+ await asyncio.sleep(60)
+
+ def is_duplicate_event(self, event_id: str) -> bool:
+ """Check if an event has been seen recently."""
+ if event_id in self._seen_events:
+ return True
+ self._seen_events[event_id] = None
+ if len(self._seen_events) > MAX_SEEN_EVENTS:
+ self._seen_events.popitem(last=False)
+ return False
+
+ async def get_event(self):
+ """Get next event from the receive queue."""
+ value = await self.receive_event_queue.get()
+ if isinstance(value, ValueError):
+ raise value
+ return value
+
+ async def publish_nostr_event(self, e: NostrEvent):
+ await self.send_req_queue.put(["EVENT", e.dict()])
+
+ async def subscribe(self, filters: list[dict]):
+ """Subscribe to events matching the given filters."""
+ self.subscription_id = "events-" + urlsafe_short_hash()[:32]
+ await self.send_req_queue.put(
+ ["REQ", self.subscription_id, *filters]
+ )
+ logger.info(
+ f"[EVENTS] Subscribed to NIP-52 events "
+ f"(sub: {self.subscription_id[:20]}...)"
+ )
+
+ async def unsubscribe(self):
+ """Unsubscribe from current subscription."""
+ await self.send_req_queue.put(["CLOSE", self.subscription_id])
+
+ async def stop(self):
+ await self.unsubscribe()
+ self.running = False
+ await asyncio.sleep(2)
+ if self.ws:
+ try:
+ self.ws.close()
+ except Exception:
+ pass
+ self.ws = None
diff --git a/nostr_hooks.py b/nostr_hooks.py
new file mode 100644
index 0000000..3211b24
--- /dev/null
+++ b/nostr_hooks.py
@@ -0,0 +1,43 @@
+"""Helpers that bridge event-mutation handlers to the Nostr publisher.
+
+Lives in its own module so both `events_api_router` and any future router
+can call it without importing through `views_api`, which would create an
+import cycle (views_api -> nostr_hooks -> nostr_publisher -> models).
+"""
+
+from loguru import logger
+
+from .crud import update_event
+from .models import Event
+from .nostr_publisher import publish_event_to_nostr
+
+
+async def publish_or_delete_nostr_event(event: Event, *, delete: bool = False) -> None:
+ """Publish or delete the NIP-52 calendar event for `event`.
+
+ Pulls the wallet owner's pubkey/prvkey to sign with the user's identity.
+ Failures are logged and swallowed so a Nostr outage doesn't break the
+ HTTP flow that triggered the publish.
+ """
+ try:
+ from lnbits.core.crud.users import get_account
+ from lnbits.core.crud.wallets import get_wallet
+
+ from . import nostr_client
+
+ wallet_obj = await get_wallet(event.wallet)
+ if not wallet_obj:
+ return
+ account = await get_account(wallet_obj.user)
+ if not account or not account.pubkey or not account.prvkey:
+ return
+
+ nostr_event = await publish_event_to_nostr(
+ nostr_client, event, account.pubkey, account.prvkey, delete=delete
+ )
+ if nostr_event and not delete:
+ event.nostr_event_id = nostr_event.id
+ event.nostr_event_created_at = nostr_event.created_at
+ await update_event(event)
+ except Exception as exc:
+ logger.warning(f"[EVENTS] Nostr publish failed: {exc}")
diff --git a/nostr_publisher.py b/nostr_publisher.py
new file mode 100644
index 0000000..bc109b2
--- /dev/null
+++ b/nostr_publisher.py
@@ -0,0 +1,118 @@
+"""
+NIP-52 calendar event publishing for the events extension.
+
+Builds kind 31922 (date-based) calendar events from the Event model,
+signs them with the event creator's Account keypair, and publishes
+via the NostrClient to nostrclient relays.
+
+Reference: https://github.com/nostr-protocol/nips/blob/master/52.md
+"""
+
+import time
+
+import coincurve
+from loguru import logger
+
+from .models import Event
+from .nostr.event import NostrEvent
+
+
+def build_nip52_event(event: Event, pubkey: str) -> NostrEvent:
+ """
+ Convert an Event model to a NIP-52 kind 31922 (date-based) calendar event.
+
+ Tags:
+ d - event.id (addressable identifier)
+ title - event.name
+ start - event.event_start_date (ISO date string)
+ end - event.event_end_date (optional)
+ image - event.banner (optional)
+ Content: event.info (description)
+ """
+ tags = [
+ ["d", event.id],
+ ["title", event.name],
+ ["start", event.event_start_date],
+ ]
+
+ if event.event_end_date:
+ tags.append(["end", event.event_end_date])
+ if event.banner:
+ tags.append(["image", event.banner])
+ if event.location:
+ tags.append(["location", event.location])
+ for cat in (event.categories or []):
+ tags.append(["t", cat])
+
+ nostr_event = NostrEvent(
+ pubkey=pubkey,
+ created_at=int(time.time()),
+ kind=31922,
+ tags=tags,
+ content=event.info or "",
+ )
+ nostr_event.id = nostr_event.event_id
+ return nostr_event
+
+
+def build_nip52_delete_event(event: Event, pubkey: str) -> NostrEvent:
+ """
+ Build a kind 5 delete event for a published NIP-52 calendar event.
+
+ Uses an 'a' tag to reference the parameterized replaceable event
+ (kind 31922) per NIP-09.
+ """
+ nostr_event = NostrEvent(
+ pubkey=pubkey,
+ created_at=int(time.time()),
+ kind=5,
+ tags=[
+ ["a", f"31922:{pubkey}:{event.id}"],
+ ],
+ content="Event canceled",
+ )
+ nostr_event.id = nostr_event.event_id
+ return nostr_event
+
+
+def sign_nostr_event(nostr_event: NostrEvent, private_key_hex: str) -> None:
+ """Sign a NostrEvent in-place using Schnorr signature."""
+ privkey = coincurve.PrivateKey(bytes.fromhex(private_key_hex))
+ sig = privkey.sign_schnorr(bytes.fromhex(nostr_event.id))
+ nostr_event.sig = sig.hex()
+
+
+async def publish_event_to_nostr(
+ nostr_client,
+ event: Event,
+ account_pubkey: str,
+ account_prvkey: str,
+ delete: bool = False,
+) -> NostrEvent | None:
+ """
+ Build, sign, and publish a NIP-52 calendar event (or delete event).
+
+ Returns the published NostrEvent for metadata storage, or None on failure.
+ """
+ if not nostr_client:
+ logger.debug("[EVENTS] No NostrClient available, skipping publish")
+ return None
+
+ try:
+ if delete:
+ nostr_event = build_nip52_delete_event(event, account_pubkey)
+ else:
+ nostr_event = build_nip52_event(event, account_pubkey)
+
+ sign_nostr_event(nostr_event, account_prvkey)
+ await nostr_client.publish_nostr_event(nostr_event)
+
+ logger.info(
+ f"[EVENTS] Published NIP-52 {'delete' if delete else 'calendar'} "
+ f"event: {nostr_event.id[:16]}... (kind {nostr_event.kind})"
+ )
+ return nostr_event
+
+ except Exception as e:
+ logger.warning(f"[EVENTS] Failed to publish to Nostr: {e}")
+ return None
diff --git a/nostr_sync.py b/nostr_sync.py
new file mode 100644
index 0000000..380da3c
--- /dev/null
+++ b/nostr_sync.py
@@ -0,0 +1,155 @@
+"""
+Bidirectional Nostr sync for the events extension.
+
+Subscribes to NIP-52 calendar events (kind 31922/31923) from relays
+and upserts them into the local database. Enables federated event
+discovery — events published by other LNbits instances or Nostr
+clients appear in the local events listing.
+"""
+
+import asyncio
+import json
+from datetime import datetime, timezone
+
+from loguru import logger
+
+from .crud import db, get_event, update_event
+from .models import Event
+from .nostr.nostr_client import NostrClient
+
+
+async def process_nostr_message(nostr_client: NostrClient, message: str):
+ """Process an incoming Nostr relay message."""
+ try:
+ data = json.loads(message)
+ except json.JSONDecodeError:
+ return
+
+ if not isinstance(data, list) or len(data) < 2:
+ return
+
+ msg_type = data[0]
+
+ if msg_type == "EVENT" and len(data) >= 3:
+ event_data = data[2]
+ await _handle_calendar_event(nostr_client, event_data)
+ elif msg_type == "EOSE":
+ logger.debug("[EVENTS] End of stored events from relay")
+ elif msg_type == "NOTICE":
+ logger.info(f"[EVENTS] Relay notice: {data[1]}")
+
+
+async def _handle_calendar_event(nostr_client: NostrClient, event_data: dict):
+ """Handle an incoming NIP-52 calendar event (kind 31922 or 31923)."""
+ kind = event_data.get("kind")
+ if kind not in (31922, 31923):
+ return
+
+ event_id = event_data.get("id", "")
+ if nostr_client.is_duplicate_event(event_id):
+ return
+
+ tags = {t[0]: t[1] for t in event_data.get("tags", []) if len(t) >= 2}
+ tag_lists = {}
+ for t in event_data.get("tags", []):
+ if len(t) >= 2:
+ tag_lists.setdefault(t[0], []).append(t[1])
+
+ d_tag = tags.get("d")
+ if not d_tag:
+ return
+
+ title = tags.get("title", "Untitled Event")
+ start = tags.get("start")
+ if not start:
+ return
+
+ end = tags.get("end")
+ description = event_data.get("content", "")
+ image = tags.get("image")
+ location = tags.get("location")
+ categories = tag_lists.get("t", [])
+
+ # Check if we already have this event (by d-tag as our event ID
+ # or by nostr_event_id)
+ existing = await get_event(d_tag)
+ if not existing:
+ # Check by nostr_event_id
+ existing = await db.fetchone(
+ "SELECT * FROM events.events WHERE nostr_event_id = :nid",
+ {"nid": event_id},
+ Event,
+ )
+
+ if existing:
+ # Update if the incoming event is newer
+ incoming_created_at = event_data.get("created_at", 0)
+ if (
+ existing.nostr_event_created_at
+ and incoming_created_at <= existing.nostr_event_created_at
+ ):
+ return # We already have a newer version
+
+ existing.name = title
+ existing.info = description
+ existing.event_start_date = start
+ existing.event_end_date = end
+ existing.banner = image
+ existing.location = location
+ existing.categories = categories
+ existing.nostr_event_id = event_id
+ existing.nostr_event_created_at = incoming_created_at
+ await update_event(existing)
+ logger.info(f"[EVENTS] Updated event from Nostr: {title}")
+ else:
+ # Create new event from Nostr — discovered events are auto-approved
+ # (they're already public on relays). Use the d-tag as the event ID
+ # for replaceable-event correlation.
+ new_event = Event(
+ id=d_tag,
+ wallet="",
+ name=title,
+ info=description,
+ event_start_date=start,
+ event_end_date=end,
+ banner=image,
+ location=location,
+ categories=categories,
+ status="approved",
+ time=datetime.now(timezone.utc),
+ nostr_event_id=event_id,
+ nostr_event_created_at=event_data.get("created_at", 0),
+ )
+ try:
+ await db.insert("events.events", new_event)
+ logger.info(f"[EVENTS] Discovered event from Nostr: {title}")
+ except Exception as e:
+ # Likely duplicate key — skip
+ logger.debug(f"[EVENTS] Skipped duplicate event: {e}")
+
+
+async def wait_for_nostr_events(nostr_client: NostrClient):
+ """
+ Background task: subscribe to NIP-52 events and process them.
+ """
+ logger.info("[EVENTS] Starting Nostr event sync...")
+
+ while True:
+ try:
+ # Subscribe to NIP-52 calendar events
+ await nostr_client.subscribe([
+ {"kinds": [31922, 31923]},
+ ])
+
+ # Process incoming events
+ while True:
+ message = await nostr_client.get_event()
+ await process_nostr_message(nostr_client, message)
+
+ except ValueError:
+ # WebSocket closed — will reconnect
+ logger.warning("[EVENTS] Nostr connection lost, resubscribing...")
+ await asyncio.sleep(10)
+ except Exception as e:
+ logger.error(f"[EVENTS] Nostr sync error: {e}")
+ await asyncio.sleep(30)
diff --git a/views_api.py b/views_api.py
index a81967f..dc39f7b 100644
--- a/views_api.py
+++ b/views_api.py
@@ -60,6 +60,7 @@ from .models import (
Ticket,
TicketPaymentRequest,
)
+from .nostr_hooks import publish_or_delete_nostr_event
from .services import refund_tickets, resend_ticket_email_notification
from .tasks import deregister_payment_listener, register_payment_listener
@@ -196,7 +197,12 @@ async def api_event_create(
if not is_admin and not ext_settings.auto_approve:
data.status = "proposed"
- return await create_event(data)
+ event = await create_event(data)
+
+ if event.status == "approved":
+ await publish_or_delete_nostr_event(event)
+
+ return event
@events_api_router.put("/{event_id}")
@@ -216,7 +222,13 @@ async def api_event_update(
)
for k, v in data.dict().items():
setattr(event, k, v)
- return await update_event(event)
+ event = await update_event(event)
+
+ # Re-publish the replaceable NIP-52 event if we already announced it.
+ if event.status == "approved" and event.nostr_event_id:
+ await publish_or_delete_nostr_event(event)
+
+ return event
@events_api_router.put("/{event_id}/cancel")
@@ -234,6 +246,10 @@ async def api_event_cancel(
event.canceled = True
event = await update_event(event)
await refund_tickets(event.id)
+
+ if event.nostr_event_id:
+ await publish_or_delete_nostr_event(event, delete=True)
+
return event
@@ -248,6 +264,10 @@ async def api_form_delete(
)
if event.wallet != wallet.wallet.id:
raise HTTPException(status_code=HTTPStatus.FORBIDDEN, detail="Not your event.")
+
+ if event.nostr_event_id:
+ await publish_or_delete_nostr_event(event, delete=True)
+
await delete_event(event_id)
await delete_event_tickets(event_id)
@@ -268,7 +288,9 @@ async def api_event_approve(
detail=f"Event is already {event.status}.",
)
event.status = "approved"
- return await update_event(event)
+ event = await update_event(event)
+ await publish_or_delete_nostr_event(event)
+ return event
@events_api_router.put("/{event_id}/reject")
From df4775126ffe952eda3955a756b62f4a7a66ff6c Mon Sep 17 00:00:00 2001
From: Padreug
Date: Wed, 20 May 2026 01:22:38 +0200
Subject: [PATCH 16/43] feat: support optional start/end time on events
event_start_date / event_end_date now accept either YYYY-MM-DD (date-only)
or YYYY-MM-DDTHH:MM (ISO datetime). The NIP-52 publisher switches kind
on the "T" delimiter: kind 31922 (date-based, YYYY-MM-DD start/end) when
absent, kind 31923 (time-based, unix-timestamp start/end + day-granularity
D tags) when present. Delete events match the original publish kind.
Closing-date parsing accepts both formats. The LNbits admin form gains
optional HH:MM inputs alongside each date picker; they fold into the
wire-format string on submit and split back on edit.
Co-Authored-By: Claude Opus 4.7 (1M context)
---
models.py | 8 +++--
nostr_publisher.py | 71 +++++++++++++++++++++++++++++++++++----------
static/js/index.js | 44 ++++++++++++++++++++++++++--
static/js/index.vue | 34 +++++++++++++++++-----
views_api.py | 13 +++++++--
5 files changed, 138 insertions(+), 32 deletions(-)
diff --git a/models.py b/models.py
index e759d66..6b80537 100644
--- a/models.py
+++ b/models.py
@@ -34,9 +34,11 @@ class CreateEvent(BaseModel):
wallet: str | None = None # filled from caller's wallet if absent
name: str # title (required)
info: str = "" # description (optional)
- closing_date: str | None = None # defaults to event_end_date
- event_start_date: str # required
- event_end_date: str | None = None # defaults to event_start_date
+ closing_date: str | None = None # date-only YYYY-MM-DD; defaults to event_end_date
+ # ISO 8601: date-only ("2026-05-19") or datetime ("2026-05-19T18:30").
+ # Presence of a "T" toggles NIP-52 kind (31922 date / 31923 time).
+ event_start_date: str
+ event_end_date: str | None = None # same format as event_start_date
currency: str = "sat"
allow_fiat: bool = False
fiat_currency: str = "GBP"
diff --git a/nostr_publisher.py b/nostr_publisher.py
index bc109b2..bbee871 100644
--- a/nostr_publisher.py
+++ b/nostr_publisher.py
@@ -1,14 +1,17 @@
"""
NIP-52 calendar event publishing for the events extension.
-Builds kind 31922 (date-based) calendar events from the Event model,
-signs them with the event creator's Account keypair, and publishes
-via the NostrClient to nostrclient relays.
+Builds NIP-52 calendar events from the Event model, signs them with the
+creator's Account keypair, and publishes via the NostrClient.
+
+Kind 31922 is used for date-only events; kind 31923 (time-based) is used
+when event_start_date / event_end_date include a time component.
Reference: https://github.com/nostr-protocol/nips/blob/master/52.md
"""
import time
+from datetime import datetime, timezone
import coincurve
from loguru import logger
@@ -17,26 +20,60 @@ from .models import Event
from .nostr.event import NostrEvent
+def _has_time(value: str | None) -> bool:
+ """ISO 8601 datetime strings contain a 'T' between date and time."""
+ return value is not None and "T" in value
+
+
+def _to_unix(value: str) -> int:
+ """Parse ISO 8601 datetime (assume UTC if naive) to unix seconds."""
+ dt = datetime.fromisoformat(value)
+ if dt.tzinfo is None:
+ dt = dt.replace(tzinfo=timezone.utc)
+ return int(dt.timestamp())
+
+
def build_nip52_event(event: Event, pubkey: str) -> NostrEvent:
"""
- Convert an Event model to a NIP-52 kind 31922 (date-based) calendar event.
+ Convert an Event model to a NIP-52 calendar event.
- Tags:
- d - event.id (addressable identifier)
+ Time-based (kind 31923) if event_start_date carries an HH:MM, otherwise
+ date-based (kind 31922). Tags:
+ d - event.id
title - event.name
- start - event.event_start_date (ISO date string)
- end - event.event_end_date (optional)
- image - event.banner (optional)
- Content: event.info (description)
+ start - unix timestamp (31923) or YYYY-MM-DD (31922)
+ end - same encoding (optional)
+ image, location, t (categories) - optional
+ Content: event.info
"""
+ time_based = _has_time(event.event_start_date)
+ kind = 31923 if time_based else 31922
+ start_value = (
+ str(_to_unix(event.event_start_date)) if time_based else event.event_start_date
+ )
+
tags = [
["d", event.id],
["title", event.name],
- ["start", event.event_start_date],
+ ["start", start_value],
]
+ end_unix: int | None = None
if event.event_end_date:
- tags.append(["end", event.event_end_date])
+ end_value = (
+ str(_to_unix(event.event_end_date)) if time_based else event.event_end_date
+ )
+ tags.append(["end", end_value])
+ if time_based:
+ end_unix = _to_unix(event.event_end_date)
+
+ if time_based:
+ start_unix = _to_unix(event.event_start_date)
+ start_day = start_unix // 86400
+ end_day = (end_unix // 86400) if end_unix is not None else start_day
+ for day in range(start_day, end_day + 1):
+ tags.append(["D", str(day)])
+
if event.banner:
tags.append(["image", event.banner])
if event.location:
@@ -47,7 +84,7 @@ def build_nip52_event(event: Event, pubkey: str) -> NostrEvent:
nostr_event = NostrEvent(
pubkey=pubkey,
created_at=int(time.time()),
- kind=31922,
+ kind=kind,
tags=tags,
content=event.info or "",
)
@@ -59,15 +96,17 @@ def build_nip52_delete_event(event: Event, pubkey: str) -> NostrEvent:
"""
Build a kind 5 delete event for a published NIP-52 calendar event.
- Uses an 'a' tag to reference the parameterized replaceable event
- (kind 31922) per NIP-09.
+ Uses an 'a' tag to reference the parameterized replaceable event per
+ NIP-09. The referenced kind must match what we published — 31923 for
+ time-based events, 31922 for date-only.
"""
+ referenced_kind = 31923 if _has_time(event.event_start_date) else 31922
nostr_event = NostrEvent(
pubkey=pubkey,
created_at=int(time.time()),
kind=5,
tags=[
- ["a", f"31922:{pubkey}:{event.id}"],
+ ["a", f"{referenced_kind}:{pubkey}:{event.id}"],
],
content="Event canceled",
)
diff --git a/static/js/index.js b/static/js/index.js
index 9044ef1..022399c 100644
--- a/static/js/index.js
+++ b/static/js/index.js
@@ -275,11 +275,39 @@ window.PageEvents = {
.catch(LNbits.utils.notifyApiError)
})
},
+ foldDateTime(day, time) {
+ // Combine separate date/time inputs into the wire format
+ // expected by the events extension: "YYYY-MM-DD" or
+ // "YYYY-MM-DDTHH:MM" (time is optional).
+ if (!day) return null
+ return time ? `${day}T${time}` : day
+ },
+ splitDateTime(value) {
+ // Inverse of foldDateTime: split a stored string back into the
+ // day/time pieces the form inputs bind to.
+ if (!value) return {day: '', time: ''}
+ const [day, time = ''] = value.split('T')
+ // Time inputs only accept HH:MM, drop any seconds we stored.
+ return {day, time: time.slice(0, 5)}
+ },
sendEventData() {
const wallet = _.findWhere(this.g.user.wallets, {
id: this.formDialog.data.wallet
})
- const data = this.formDialog.data
+ const data = {...this.formDialog.data}
+ data.event_start_date = this.foldDateTime(
+ data.event_start_day,
+ data.event_start_time
+ )
+ data.event_end_date = this.foldDateTime(
+ data.event_end_day,
+ data.event_end_time
+ )
+ delete data.event_start_day
+ delete data.event_start_time
+ delete data.event_end_day
+ delete data.event_end_time
+
if (data.extra?.promo_codes) {
data.extra.promo_codes = data.extra.promo_codes
.filter(code => code.code?.trim() !== '')
@@ -303,12 +331,24 @@ window.PageEvents = {
openEventDialog(data = false) {
if (data && data.id) {
- this.formDialog.data = {...data}
+ const start = this.splitDateTime(data.event_start_date)
+ const end = this.splitDateTime(data.event_end_date)
+ this.formDialog.data = {
+ ...data,
+ event_start_day: start.day,
+ event_start_time: start.time,
+ event_end_day: end.day,
+ event_end_time: end.time
+ }
} else {
this.formDialog.data = {
currency: 'sats',
allow_fiat: false,
fiat_currency: 'GBP',
+ event_start_day: '',
+ event_start_time: '',
+ event_end_day: '',
+ event_end_time: '',
extra: {
conditional: false,
min_tickets: 1,
diff --git a/static/js/index.vue b/static/js/index.vue
index 88ae90d..4117f47 100644
--- a/static/js/index.vue
+++ b/static/js/index.vue
@@ -475,28 +475,46 @@
>
+
Event begins
-
+
-
+
+
+
Date: Sat, 23 May 2026 21:02:36 +0200
Subject: [PATCH 26/43] feat: organizer-side "Republish mine" button + scoped
endpoint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The admin /republish-all hits every approved event regardless of
owner — useful for the catalog migration, but heavy. Organizers
who want to re-emit just THEIR own events (e.g. after the AIO
publisher gained the tickets_* tags and an organizer's events
should pick them up) need a lighter knob.
Backend: new POST /republish-mine wallet-scoped via require_admin_key,
mirrors api_tickets's `all_wallets=true` shape so the page can
re-emit across every wallet the user owns. Filters to approved +
non-canceled rows.
UI: "Republish mine" button alongside "New Event" so every
logged-in user sees it (no isAdmin gate). Loading state +
confirm dialog + success count notification.
Co-Authored-By: Claude Opus 4.7 (1M context)
---
static/js/index.js | 31 +++++++++++++++++++++++++++++++
static/js/index.vue | 20 +++++++++++++++++---
views_api.py | 31 +++++++++++++++++++++++++++++++
3 files changed, 79 insertions(+), 3 deletions(-)
diff --git a/static/js/index.js b/static/js/index.js
index 8ec41a6..a65f5f8 100644
--- a/static/js/index.js
+++ b/static/js/index.js
@@ -10,6 +10,7 @@ window.PageEvents = {
allUserEvents: [],
isAdmin: false,
republishing: false,
+ republishingMine: false,
settings: {
auto_approve: false
},
@@ -303,6 +304,36 @@ window.PageEvents = {
})
})
},
+ republishMyEvents() {
+ LNbits.utils
+ .confirmDialog(
+ 'Re-emit your approved events to Nostr relays?'
+ )
+ .onOk(() => {
+ this.republishingMine = true
+ LNbits.api
+ .request(
+ 'POST',
+ '/events/api/v1/events/republish-mine?all_wallets=true',
+ this.g.user.wallets[0].adminkey
+ )
+ .then(response => {
+ Quasar.Notify.create({
+ type: 'positive',
+ message:
+ 'Republished ' +
+ response.data.republished +
+ ' of your ' +
+ response.data.total +
+ ' events'
+ })
+ })
+ .catch(LNbits.utils.notifyApiError)
+ .finally(() => {
+ this.republishingMine = false
+ })
+ })
+ },
foldDateTime(day, time) {
// Combine separate date/time inputs into the wire format
// expected by the events extension: "YYYY-MM-DD" or
diff --git a/static/js/index.vue b/static/js/index.vue
index befc230..4760c6b 100644
--- a/static/js/index.vue
+++ b/static/js/index.vue
@@ -42,9 +42,23 @@
- New Event
+
diff --git a/views_api.py b/views_api.py
index b7c6a0d..35da0cd 100644
--- a/views_api.py
+++ b/views_api.py
@@ -136,6 +136,37 @@ async def api_republish_all(
return {"republished": len(approved), "total": len(events)}
+@events_api_router.post("/republish-mine")
+async def api_republish_mine(
+ all_wallets: bool = Query(False),
+ key_info: WalletTypeInfo = Depends(require_admin_key),
+) -> dict:
+ """Force-republish the caller's own approved events to Nostr relays.
+
+ Same shape as /republish-all but scoped to events owned by the
+ authenticated wallet (or all wallets belonging to the wallet's
+ user when `?all_wallets=true`). Lets the organizer trigger the
+ same migration the admin uses, without needing instance-admin
+ rights — useful when the AIO publisher gains a new tag set and
+ an organizer wants their published events to carry it.
+
+ Only events with `status == "approved"` are republished; pending
+ and rejected rows aren't on relays in the first place, so a
+ republish for them would be a no-op (or worse, surface a
+ proposed-but-not-approved row to subscribers).
+ """
+ wallet_ids: list[str] = [key_info.wallet.id]
+ if all_wallets:
+ user = await get_user(key_info.wallet.user)
+ wallet_ids = user.wallet_ids if user else []
+
+ events = await get_events(wallet_ids)
+ approved = [e for e in events if e.status == "approved" and not e.canceled]
+ for event in approved:
+ await publish_or_delete_nostr_event(event)
+ return {"republished": len(approved), "total": len(events)}
+
+
@events_api_router.get("/settings")
async def api_get_settings(
admin: Account = Depends(check_admin),
From 902bafe7f20dfbd2f8535afbcf277517a78c244e Mon Sep 17 00:00:00 2001
From: Padreug
Date: Sat, 23 May 2026 21:06:03 +0200
Subject: [PATCH 27/43] feat: POST /tickets/{event_id}/{payment_hash} polling
endpoint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The webapp's useTicketPurchase polls this every 2s after firing
Pay with Wallet (or after presenting the QR) to confirm payment
before advancing to the ticket-QR success state. Without this
endpoint the post-payment poll loop returns 404 indefinitely and
the buyer never sees their ticket land — even though set_ticket_paid
fired on the invoice listener and the row is correctly marked paid
in the DB.
Returns {paid: bool, ticket_id?: str}. A missing or cross-event
ticket returns paid: false rather than 404 so the poll loop doesn't
need to special-case the not-yet-created race.
The WebSocket at /tickets/ws/{payment_hash} is more efficient for
push notifications — this POST is the fallback for clients that
can't open a relay-side socket.
Co-Authored-By: Claude Opus 4.7 (1M context)
---
views_api.py | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
diff --git a/views_api.py b/views_api.py
index 35da0cd..f04f24e 100644
--- a/views_api.py
+++ b/views_api.py
@@ -623,6 +623,29 @@ async def api_ticket_create(
)
+@tickets_api_router.post("/{event_id}/{payment_hash}")
+async def api_ticket_payment_status(event_id: str, payment_hash: str) -> dict:
+ """Poll-style payment confirmation for a pending ticket.
+
+ The webapp's `useTicketPurchase` polls this every 2s after firing
+ `Pay with Wallet` (or after presenting the QR for an external
+ wallet) until `paid: true` comes back, then advances to the
+ ticket-QR success state. The companion WebSocket at
+ `/tickets/ws/{payment_hash}` is more efficient for pushes — this
+ endpoint is the fallback for clients that can't open a relay-side
+ socket.
+
+ Returns `{paid: bool, ticket_id?: str}` so the client can hand off
+ to the ticket-detail flow without an extra GET. A missing /
+ cross-event ticket returns `paid: false` rather than 404 so the
+ poll loop doesn't have to special-case the not-yet-created race.
+ """
+ ticket = await get_ticket(payment_hash)
+ if not ticket or ticket.event != event_id:
+ return {"paid": False}
+ return {"paid": ticket.paid, "ticket_id": ticket.id}
+
+
@tickets_api_router.websocket("/ws/{payment_hash}")
async def websocket_endpoint(payment_hash: str, websocket: WebSocket) -> None:
await websocket.accept()
From 36568d3eee6de3bfcb256891a2baf4359c540c2b Mon Sep 17 00:00:00 2001
From: Padreug
Date: Sat, 23 May 2026 21:10:33 +0200
Subject: [PATCH 28/43] fix: propagate CreateTicket.user_id to the persisted
ticket row
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
api_ticket_create accepted user_id in the CreateTicket request body
(its root_validator even requires user_id XOR name+email), but
dropped it on the way to crud.create_ticket — tickets ended up
with user_id = NULL and the new GET /tickets/user/{id} endpoint
returned an empty list for every webapp buyer.
Pull data.user_id alongside name/email and forward it to
create_ticket. Backfilling existing rows is left to the operator
(deployment-specific data fix); fresh purchases starting from this
commit are correctly attributed.
Co-Authored-By: Claude Opus 4.7 (1M context)
---
views_api.py | 2 ++
1 file changed, 2 insertions(+)
diff --git a/views_api.py b/views_api.py
index f04f24e..b25d2c4 100644
--- a/views_api.py
+++ b/views_api.py
@@ -513,6 +513,7 @@ async def api_ticket_create(
name = data.name
email = data.email
+ user_id = data.user_id
promo_code = data.promo_code.upper() if data.promo_code else None
refund_address = data.refund_address
nostr_identifier = data.nostr_identifier.strip() if data.nostr_identifier else None
@@ -605,6 +606,7 @@ async def api_ticket_create(
event=event.id,
name=name,
email=email,
+ user_id=user_id,
extra={
"applied_promo_code": promo_code,
"refund_address": refund_address,
From 59068fe09d25141c632897f89aa32923ccac3136 Mon Sep 17 00:00:00 2001
From: Padreug
Date: Sat, 23 May 2026 22:35:56 +0200
Subject: [PATCH 29/43] feat: multi-ticket purchases as N rows sharing one
payment_hash
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Replaces the previous "one row, N seats via extra.quantity" model
with proper one-row-per-attendee semantics. Each attendee gets a
unique scannable id; the door PUT /register/{ticket_id} marks
them registered independently — so a buyer can purchase 3 tickets,
hand 2 QRs to friends arriving separately, and each attendee can
enter on their own schedule.
Schema (migrations_fork.py m002):
- ticket.payment_hash: new TEXT column shared across all rows of
a multi-ticket purchase. Backfilled `payment_hash = id` for
pre-migration rows (id WAS the payment_hash by invariant).
Wire:
- TicketPaymentRequest grows `ticket_ids: list[str]` so the
webapp gets every scannable id back in the create response.
- POST /tickets/{event_id}/{payment_hash} polling endpoint now
reports `ticket_ids` (every row) + keeps `ticket_id` for
back-compat.
- api_ticket_create loops quantity times; the first row reuses
payment_hash as id (preserves legacy `id == payment_hash`
invariant for single-ticket purchases), the rest get
urlsafe_short_hash() uuids.
Payment flow:
- on_invoice_paid fetches all rows by payment_hash and marks each
paid via set_ticket_paid, which now increments event.sold by 1
per row (was N per row via extra.quantity — simpler now). The
per-event asyncio lock still serializes counter + republish so
concurrent multi-ticket purchases for the same event don't
reorder the published Nostr state.
- Each paid row triggers its own send_ticket_notification_in_
background call — no-op for buyers without nostr_identifier /
email, useful when the buyer set those on the row.
Co-Authored-By: Claude Opus 4.7 (1M context)
---
crud.py | 32 +++++++++++++++-
migrations_fork.py | 25 ++++++++++++
models.py | 13 +++++++
tasks.py | 33 ++++++++++++----
views_api.py | 95 +++++++++++++++++++++++++++++-----------------
5 files changed, 155 insertions(+), 43 deletions(-)
diff --git a/crud.py b/crud.py
index 004fa7f..a72b3b3 100644
--- a/crud.py
+++ b/crud.py
@@ -41,8 +41,19 @@ async def create_ticket(
email: str | None = None,
user_id: str | None = None,
extra: dict | None = None,
+ ticket_id: str | None = None,
) -> Ticket:
+ """Persist one ticket row.
+
+ `payment_hash` is the LNbits invoice hash shared across all rows
+ of a multi-ticket purchase. `ticket_id` is the row primary key /
+ scannable id; defaults to `payment_hash` for single-ticket
+ purchases so the legacy id == payment_hash invariant holds.
+ Multi-ticket callers pass a unique uuid here so each attendee
+ gets a distinct scannable QR.
+ """
now = datetime.now(timezone.utc)
+ row_id = ticket_id or payment_hash
# name/email columns are NOT NULL in the schema, so we store "" when only
# user_id is supplied. _parse_ticket_row reverses this on read.
@@ -54,7 +65,7 @@ async def create_ticket(
db_email = email or ""
db_ticket = Ticket(
- id=payment_hash,
+ id=row_id,
wallet=wallet,
event=event,
name=db_name,
@@ -65,11 +76,12 @@ async def create_ticket(
reg_timestamp=now,
time=now,
extra=TicketExtra(**extra) if extra else TicketExtra(),
+ payment_hash=payment_hash,
)
await db.insert("events.ticket", db_ticket)
return Ticket(
- id=payment_hash,
+ id=row_id,
wallet=wallet,
event=event,
name=name,
@@ -80,6 +92,7 @@ async def create_ticket(
reg_timestamp=now,
time=now,
extra=TicketExtra(**extra) if extra else TicketExtra(),
+ payment_hash=payment_hash,
)
@@ -93,6 +106,21 @@ async def update_ticket(ticket: Ticket) -> Ticket:
return ticket
+async def get_tickets_by_payment_hash(payment_hash: str) -> list[Ticket]:
+ """All ticket rows sharing the given LNbits invoice payment_hash.
+
+ For a single-ticket purchase returns one row (legacy invariant
+ `id == payment_hash` still holds). For a multi-ticket purchase
+ returns the N rows created with shared `payment_hash` but
+ distinct `id`s — each attendee's scannable QR.
+ """
+ rows = await db.fetchall(
+ "SELECT * FROM events.ticket WHERE payment_hash = :ph",
+ {"ph": payment_hash},
+ )
+ return [Ticket(**_parse_ticket_row(row)) for row in rows]
+
+
async def get_ticket(payment_hash: str) -> Ticket | None:
row = await db.fetchone(
"SELECT * FROM events.ticket WHERE id = :id",
diff --git a/migrations_fork.py b/migrations_fork.py
index 365d259..864cbb8 100644
--- a/migrations_fork.py
+++ b/migrations_fork.py
@@ -103,3 +103,28 @@ async def m001_aio_event_schema(db):
await _alter_add_column_safe(
db, "ALTER TABLE events.events ADD COLUMN categories TEXT"
)
+
+
+async def m002_ticket_payment_hash(db):
+ """
+ Add `ticket.payment_hash` for multi-ticket purchases.
+
+ Multi-ticket purchases land as N rows sharing one LNbits invoice
+ (so each attendee gets a distinct scannable QR but the buyer
+ pays once). `ticket.id` stays the row primary key — for legacy
+ single-purchase rows it equals payment_hash; for multi-purchase
+ children it's a uuid generated at create-time. `payment_hash`
+ is the new join key for invoice lookup.
+
+ Backfill existing rows from id so the
+ GET-tickets-by-payment-hash path keeps working for pre-migration
+ data (id was the payment_hash by invariant before this column).
+ """
+ await _alter_add_column_safe(
+ db, "ALTER TABLE events.ticket ADD COLUMN payment_hash TEXT"
+ )
+ await db.execute(
+ "UPDATE events.ticket SET payment_hash = id "
+ "WHERE payment_hash IS NULL OR payment_hash = ''"
+ )
+
diff --git a/models.py b/models.py
index d3f43d3..04520a0 100644
--- a/models.py
+++ b/models.py
@@ -133,6 +133,9 @@ class CreateTicket(BaseModel):
nostr_identifier: str | None = None
payment_method: str | None = None
fiat_provider: str | None = None
+ # Number of tickets to buy on this single invoice. Bounded so a
+ # bad client can't run away with the organizer's capacity.
+ quantity: int = Field(default=1, ge=1, le=10)
@root_validator
def validate_identifiers(cls, values):
@@ -158,6 +161,11 @@ class Ticket(BaseModel):
time: datetime
reg_timestamp: datetime
extra: TicketExtra = Field(default_factory=TicketExtra)
+ # Shared LNbits invoice payment_hash. Equals `id` for single-ticket
+ # purchases (legacy + post-migration default). Multi-ticket
+ # purchases create N rows sharing one payment_hash so each attendee
+ # gets a distinct scannable id while the buyer pays once.
+ payment_hash: str | None = None
class PublicTicket(BaseModel):
@@ -175,3 +183,8 @@ class TicketPaymentRequest(BaseModel):
fiat_payment_request: str | None = None
fiat_provider: str | None = None
is_fiat: bool = False
+ # Row ids created on this invoice — one for single-ticket
+ # purchases, N for multi-ticket (each independently scannable at
+ # the door). Buyers fetch these after payment to render N QRs in
+ # My Tickets.
+ ticket_ids: list[str] = Field(default_factory=list)
diff --git a/tasks.py b/tasks.py
index 1d30dce..1641a75 100644
--- a/tasks.py
+++ b/tasks.py
@@ -4,7 +4,7 @@ from lnbits.core.models import Payment
from lnbits.tasks import register_invoice_listener
from loguru import logger
-from .crud import get_ticket
+from .crud import get_ticket, get_tickets_by_payment_hash
from .models import Ticket
from .services import send_ticket_notification_in_background, set_ticket_paid
@@ -37,13 +37,32 @@ async def on_invoice_paid(payment: Payment) -> None:
if not payment.extra or "events" != payment.extra.get("tag"):
return
- ticket = await get_ticket(payment.payment_hash)
- if not ticket:
- logger.warning(f"Ticket for payment {payment.payment_hash} not found.")
+ # Multi-ticket purchases land as N rows sharing this payment_hash;
+ # each one needs to be marked paid + counted against capacity, and
+ # each gets its own buyer notification (mostly a no-op when all
+ # rows are owned by the same buyer, but cheap and consistent).
+ tickets = await get_tickets_by_payment_hash(payment.payment_hash)
+ if not tickets:
+ # Backstop for any legacy row created before the payment_hash
+ # column was populated by the migration backfill.
+ legacy = await get_ticket(payment.payment_hash)
+ if legacy:
+ tickets = [legacy]
+
+ if not tickets:
+ logger.warning(f"No tickets for payment {payment.payment_hash}.")
return
- ticket = await set_ticket_paid(ticket)
- send_ticket_notification_in_background(ticket)
+ paid_tickets: list[Ticket] = []
+ for ticket in tickets:
+ paid_tickets.append(await set_ticket_paid(ticket))
+
+ for paid_ticket in paid_tickets:
+ send_ticket_notification_in_background(paid_ticket)
+
+ # Wake up the WebSocket / poll listeners. Forward the first paid
+ # ticket so the existing single-ticket subscribers still work; the
+ # webapp re-fetches all ids via the polling endpoint anyway.
if payment_listeners.get(payment.payment_hash):
for paid_ticket_queue in payment_listeners[payment.payment_hash]:
- paid_ticket_queue.put_nowait(ticket)
+ paid_ticket_queue.put_nowait(paid_tickets[0])
diff --git a/views_api.py b/views_api.py
index b25d2c4..c288c20 100644
--- a/views_api.py
+++ b/views_api.py
@@ -17,6 +17,7 @@ from lnbits.core.crud.wallets import get_wallet
from lnbits.core.models import Account, User, WalletTypeInfo
from lnbits.core.models.payments import CreateInvoice
from lnbits.core.services import create_payment_request
+from lnbits.helpers import urlsafe_short_hash
from lnbits.decorators import (
check_admin,
check_user_exists,
@@ -46,6 +47,7 @@ from .crud import (
get_settings,
get_ticket,
get_tickets,
+ get_tickets_by_payment_hash,
get_tickets_by_user_id,
purge_unpaid_tickets,
update_event,
@@ -508,8 +510,16 @@ async def api_ticket_create(
)
if event.canceled:
raise HTTPException(status_code=HTTPStatus.GONE, detail="Event is canceled.")
- if event.amount_tickets > 0 and event.sold >= event.amount_tickets:
- raise HTTPException(status_code=HTTPStatus.GONE, detail="Event is sold out.")
+ quantity = data.quantity
+ if event.amount_tickets > 0:
+ if event.sold >= event.amount_tickets:
+ raise HTTPException(status_code=HTTPStatus.GONE, detail="Event is sold out.")
+ remaining = event.amount_tickets - event.sold
+ if quantity > remaining:
+ raise HTTPException(
+ status_code=HTTPStatus.BAD_REQUEST,
+ detail=f"Only {remaining} ticket(s) remaining for this event.",
+ )
name = data.name
email = data.email
@@ -531,7 +541,7 @@ async def api_ticket_create(
status_code=HTTPStatus.BAD_REQUEST,
detail="Invalid Nostr identifier.",
) from exc
- price = event.price_per_ticket
+ unit_price = event.price_per_ticket
extra: dict[str, Any] = {"tag": "events", "name": name, "email": email}
if promo_code:
@@ -543,7 +553,9 @@ async def api_ticket_create(
# get the promocode
promo = next(pc for pc in event.extra.promo_codes if pc.code == promo_code)
extra["promo_code"] = promo.code
- price = event.price_per_ticket * (1 - promo.discount_percent / 100)
+ unit_price = event.price_per_ticket * (1 - promo.discount_percent / 100)
+ # Scale by quantity AFTER the promo applies. One invoice, N tickets.
+ price = unit_price * quantity
if payment_method == "fiat" and not event.allow_fiat:
raise HTTPException(
@@ -600,21 +612,32 @@ async def api_ticket_create(
extra=extra,
),
)
- await create_ticket(
- payment_hash=payment.payment_hash,
- wallet=event.wallet,
- event=event.id,
- name=name,
- email=email,
- user_id=user_id,
- extra={
- "applied_promo_code": promo_code,
- "refund_address": refund_address,
- "nostr_identifier": nostr_identifier,
- "ticket_base_url": str(request.base_url).rstrip("/"),
- "sats_paid": payment.sat,
- },
- )
+ # Multi-ticket purchases land as N rows sharing the LNbits invoice
+ # payment_hash but with distinct `id`s — one independently
+ # scannable QR per attendee. The first row reuses payment_hash as
+ # its id so the legacy single-purchase invariant
+ # (`id == payment_hash`) still holds for quantity == 1 callers.
+ ticket_ids: list[str] = []
+ sats_per_ticket = payment.sat // quantity if quantity else payment.sat
+ for index in range(quantity):
+ row_id = payment.payment_hash if index == 0 else urlsafe_short_hash()
+ await create_ticket(
+ payment_hash=payment.payment_hash,
+ wallet=event.wallet,
+ event=event.id,
+ name=name,
+ email=email,
+ user_id=user_id,
+ ticket_id=row_id,
+ extra={
+ "applied_promo_code": promo_code,
+ "refund_address": refund_address,
+ "nostr_identifier": nostr_identifier,
+ "ticket_base_url": str(request.base_url).rstrip("/"),
+ "sats_paid": sats_per_ticket,
+ },
+ )
+ ticket_ids.append(row_id)
return TicketPaymentRequest(
payment_hash=payment.payment_hash,
@@ -622,30 +645,34 @@ async def api_ticket_create(
fiat_payment_request=getattr(payment, "extra", {}).get("fiat_payment_request"),
fiat_provider=getattr(payment, "fiat_provider", None) or fiat_provider,
is_fiat=bool(getattr(payment, "fiat_provider", None) or fiat_provider),
+ ticket_ids=ticket_ids,
)
@tickets_api_router.post("/{event_id}/{payment_hash}")
async def api_ticket_payment_status(event_id: str, payment_hash: str) -> dict:
- """Poll-style payment confirmation for a pending ticket.
+ """Poll-style payment confirmation for a pending ticket purchase.
- The webapp's `useTicketPurchase` polls this every 2s after firing
- `Pay with Wallet` (or after presenting the QR for an external
- wallet) until `paid: true` comes back, then advances to the
- ticket-QR success state. The companion WebSocket at
- `/tickets/ws/{payment_hash}` is more efficient for pushes — this
- endpoint is the fallback for clients that can't open a relay-side
- socket.
+ The webapp polls this every 2s after presenting the invoice until
+ `paid: true` comes back, then advances to the success state. The
+ companion WebSocket at `/tickets/ws/{payment_hash}` is more
+ efficient for pushes — this endpoint is the fallback.
- Returns `{paid: bool, ticket_id?: str}` so the client can hand off
- to the ticket-detail flow without an extra GET. A missing /
- cross-event ticket returns `paid: false` rather than 404 so the
- poll loop doesn't have to special-case the not-yet-created race.
+ Returns `{paid, ticket_ids: [...]}` so multi-ticket buyers get
+ every scannable id back in one response (one for single-ticket
+ purchases). A missing / cross-event purchase returns
+ `paid: false` rather than 404 so the poll doesn't have to
+ special-case the not-yet-created race.
"""
- ticket = await get_ticket(payment_hash)
- if not ticket or ticket.event != event_id:
+ tickets = await get_tickets_by_payment_hash(payment_hash)
+ relevant = [t for t in tickets if t.event == event_id]
+ if not relevant:
return {"paid": False}
- return {"paid": ticket.paid, "ticket_id": ticket.id}
+ return {
+ "paid": all(t.paid for t in relevant),
+ "ticket_id": relevant[0].id, # back-compat with single-ticket clients
+ "ticket_ids": [t.id for t in relevant],
+ }
@tickets_api_router.websocket("/ws/{payment_hash}")
From 7b761a1aef739b83ec336a1e5fe8a0c850402689 Mon Sep 17 00:00:00 2001
From: Padreug
Date: Sat, 23 May 2026 22:45:59 +0200
Subject: [PATCH 30/43] fix: every ticket row gets a fresh short-hash id (no
payment_hash reuse)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Previous commit reused the LNbits invoice payment_hash as the
first row's id, so a 3-ticket purchase ended up with one 64-hex
id and two short-hash ids — inconsistent and noisy in My Tickets.
Switch every row to urlsafe_short_hash. The shared payment_hash
column is the join key for invoice lookups (poll endpoint, ws
notifier, on_invoice_paid); rows never need to BE the payment
hash, they only need to point at it.
Co-Authored-By: Claude Opus 4.7 (1M context)
---
views_api.py | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/views_api.py b/views_api.py
index c288c20..e7c118f 100644
--- a/views_api.py
+++ b/views_api.py
@@ -612,15 +612,15 @@ async def api_ticket_create(
extra=extra,
),
)
- # Multi-ticket purchases land as N rows sharing the LNbits invoice
- # payment_hash but with distinct `id`s — one independently
- # scannable QR per attendee. The first row reuses payment_hash as
- # its id so the legacy single-purchase invariant
- # (`id == payment_hash`) still holds for quantity == 1 callers.
+ # Each row gets a fresh urlsafe_short_hash id so single- and
+ # multi-ticket purchases stay shape-consistent — every scannable
+ # ticket id is a short hash, never the long bolt11 payment_hash.
+ # The shared `payment_hash` column is the join key for invoice
+ # lookup (poll endpoint, ws notifier, set_ticket_paid loop).
ticket_ids: list[str] = []
sats_per_ticket = payment.sat // quantity if quantity else payment.sat
- for index in range(quantity):
- row_id = payment.payment_hash if index == 0 else urlsafe_short_hash()
+ for _ in range(quantity):
+ row_id = urlsafe_short_hash()
await create_ticket(
payment_hash=payment.payment_hash,
wallet=event.wallet,
From 2b3d9df11d648bef146331405806d94f5ec704ee Mon Sep 17 00:00:00 2001
From: Padreug
Date: Sun, 24 May 2026 16:32:18 +0200
Subject: [PATCH 31/43] feat: events_ticket_register RPC over nostr transport
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Organizer-side ticket scanning over LNbits's freshly-merged
nostr-transport (kind 21000, NIP-44 v2). The organizer signs the
RPC event with their Nostr key; the transport dispatcher resolves
pubkey → Account → wallet (AUTH_WALLET) and the handler verifies
event-level ownership (event.wallet ∈ caller_user.wallet_ids)
before flipping `registered = True`.
Idempotence + state transitions mirror the legacy HTTP endpoint:
"Ticket not paid for" / "Ticket already registered" / "Ticket
does not exist on this event" / "You do not own this event" come
back as ERROR responses. Registration in events_start() is
guarded with try/except ImportError so the extension still loads
on older LNbits versions that pre-date the transport (HTTP path
stays the fallback there).
Webapp uses this as the new primary scan call site instead of
the legacy HTTP endpoint — see companion webapp PR.
Co-Authored-By: Claude Opus 4.7 (1M context)
---
__init__.py | 21 +++++++++++++++
transport_rpcs.py | 68 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 89 insertions(+)
create mode 100644 transport_rpcs.py
diff --git a/__init__.py b/__init__.py
index b6b58a9..bfe3d45 100644
--- a/__init__.py
+++ b/__init__.py
@@ -46,6 +46,27 @@ def events_start():
task1 = create_permanent_unique_task("ext_events", wait_for_paid_invoices)
scheduled_tasks.append(task1)
+ # Register nostr-transport RPCs. Swallow ImportError on older LNbits
+ # versions that pre-date the transport (the events extension still
+ # works fine via HTTP without it).
+ try:
+ from lnbits.core.services.nostr_transport.dispatcher import (
+ AUTH_WALLET,
+ register_rpc,
+ )
+
+ from .transport_rpcs import handle_events_ticket_register
+
+ register_rpc(
+ "events_ticket_register", handle_events_ticket_register, AUTH_WALLET
+ )
+ logger.info("[EVENTS] Registered nostr-transport RPC: events_ticket_register")
+ except ImportError:
+ logger.info(
+ "[EVENTS] nostr_transport not available on this LNbits — "
+ "ticket scanner over Nostr disabled, HTTP endpoint still works"
+ )
+
async def _start_nostr_client():
global nostr_client
await asyncio.sleep(10) # Wait for nostrclient to be ready
diff --git a/transport_rpcs.py b/transport_rpcs.py
new file mode 100644
index 0000000..16060d6
--- /dev/null
+++ b/transport_rpcs.py
@@ -0,0 +1,68 @@
+"""
+Nostr-transport RPC handlers for the aiolabs/events extension.
+
+Each handler is registered with `lnbits.core.services.nostr_transport.
+dispatcher.register_rpc` in `events_start()`. The dispatcher resolves
+the caller's Nostr pubkey to an LNbits Account → wallet (`AUTH_WALLET`)
+and passes a `WalletTypeInfo` as the first argument; handlers verify
+event-level ownership on top.
+
+Errors raise `PermissionError` / `ValueError` so the dispatcher maps
+them into `{status: "ERROR", error: }` responses; any other
+exception falls through to a generic "Internal error" reply.
+"""
+
+from __future__ import annotations
+
+from datetime import datetime, timezone
+
+from lnbits.core.crud import get_user
+from lnbits.core.models import WalletTypeInfo
+from lnbits.core.services.nostr_transport.models import NostrRpcRequest
+
+from .crud import get_event, get_ticket, update_ticket
+
+
+async def handle_events_ticket_register(
+ auth: WalletTypeInfo,
+ request: NostrRpcRequest,
+) -> dict:
+ """Mark a ticket as registered at the door (organizer flow).
+
+ The Nostr-transport dispatcher already verified the caller signed
+ the kind-21000 RPC event and bound them to `auth.wallet`. This
+ handler adds the event-level check: the ticket's event must be
+ owned by one of the caller's wallets.
+
+ Idempotence mirrors the HTTP endpoint: scanning the same ticket
+ twice fails with "Ticket already registered". The buyer-side flow
+ (notifications etc.) reuses whatever the legacy register endpoint
+ does — we just flip the flag + timestamp.
+ """
+ body = request.body or {}
+ event_id = body.get("event_id")
+ ticket_id = body.get("ticket_id")
+ if not event_id or not ticket_id:
+ raise ValueError("event_id and ticket_id are required")
+
+ ticket = await get_ticket(ticket_id)
+ if not ticket or ticket.event != event_id:
+ raise ValueError("Ticket does not exist on this event")
+ if not ticket.paid:
+ raise PermissionError("Ticket not paid for")
+ if ticket.registered:
+ raise PermissionError("Ticket already registered")
+
+ event = await get_event(event_id)
+ if not event:
+ raise ValueError("Event does not exist")
+
+ user = await get_user(auth.wallet.user)
+ owned_wallet_ids = user.wallet_ids if user else [auth.wallet.id]
+ if event.wallet not in owned_wallet_ids:
+ raise PermissionError("You do not own this event")
+
+ ticket.registered = True
+ ticket.reg_timestamp = datetime.now(timezone.utc)
+ await update_ticket(ticket)
+ return ticket.dict()
From 1d8dacbaa3d9b41965b9b7a489dfa7f104b2f82b Mon Sep 17 00:00:00 2001
From: Padreug
Date: Sun, 24 May 2026 16:32:29 +0200
Subject: [PATCH 32/43] fix: require admin_key + owner check on PUT
/tickets/register
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The legacy register endpoint had no auth decorator and no
event-ownership check — any caller who knew a ticket id could
mark it registered. Add require_admin_key (matches the rest of
the wallet-bound endpoints in this file) and verify the caller's
user owns the event the ticket belongs to.
Breaking change for any external integration that hit this
endpoint unauthed; the in-tree Quasar register page
(static/js/register.js) already sends the session admin_key via
LNbits.api.request so it keeps working.
The Nostr-transport flow at events_ticket_register (previous
commit) is the preferred call site for new callers; this HTTP
path stays for the legacy LNbits admin UI.
Co-Authored-By: Claude Opus 4.7 (1M context)
---
views_api.py | 33 ++++++++++++++++++++++++++++++++-
1 file changed, 32 insertions(+), 1 deletion(-)
diff --git a/views_api.py b/views_api.py
index e7c118f..d2bac8f 100644
--- a/views_api.py
+++ b/views_api.py
@@ -766,7 +766,24 @@ async def api_ticket_resend_email(
@tickets_api_router.put("/register/{ticket_id}")
-async def api_event_register_ticket(ticket_id) -> Ticket:
+async def api_event_register_ticket(
+ ticket_id: str,
+ key_info: WalletTypeInfo = Depends(require_admin_key),
+) -> Ticket:
+ """Mark a ticket as registered at the door.
+
+ Auth: wallet admin_key. Caller must own the event the ticket
+ belongs to — we check `event.wallet` against the user's full
+ wallet set so an organizer with multiple wallets can scan
+ regardless of which wallet's key they're using.
+
+ Until v1.6.1-aio.3 this endpoint had no auth, which meant any
+ caller who knew a ticket id could register it. The
+ Nostr-transport flow at `events_ticket_register` is now the
+ preferred call site for the webapp; this HTTP path stays for
+ the legacy LNbits Quasar register page which already sends
+ the wallet admin_key through `LNbits.api.request`.
+ """
ticket = await get_ticket(ticket_id)
if not ticket:
@@ -774,6 +791,20 @@ async def api_event_register_ticket(ticket_id) -> Ticket:
status_code=HTTPStatus.NOT_FOUND, detail="Ticket does not exist."
)
+ event = await get_event(ticket.event)
+ if not event:
+ raise HTTPException(
+ status_code=HTTPStatus.NOT_FOUND, detail="Event does not exist."
+ )
+
+ user = await get_user(key_info.wallet.user)
+ owned_wallet_ids = user.wallet_ids if user else [key_info.wallet.id]
+ if event.wallet not in owned_wallet_ids:
+ raise HTTPException(
+ status_code=HTTPStatus.FORBIDDEN,
+ detail="You do not own this event.",
+ )
+
if not ticket.paid:
raise HTTPException(
status_code=HTTPStatus.FORBIDDEN, detail="Ticket not paid for."
From 02071e6541a46dcd3ff40148956881f7ea6e7e84 Mon Sep 17 00:00:00 2001
From: Padreug
Date: Sun, 24 May 2026 18:45:48 +0200
Subject: [PATCH 33/43] feat: events_list_event_tickets RPC for organizer
ticket roster
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Second nostr-transport handler on this branch. Returns paid + registered
counts plus the per-ticket roster (id, name, registered status, timestamp)
for one calendar event, organizer-only.
Backs the door scanner's counts strip and "scanned" list with backend
truth so a second organizer scanning on another device, an operator
switching from mobile to laptop mid-event, or a refresh in incognito
all see the same numbers instead of diverging from a per-device
localStorage cache.
Same authorisation posture as events_ticket_register: dispatcher
binds caller pubkey to wallet via AUTH_WALLET, handler verifies the
event's wallet is in the caller's wallet set. Only paid tickets land
in the response — proposed/unpaid rows are irrelevant at the door.
Webapp consumes this in aiolabs/webapp#73.
---
__init__.py | 15 +++++++++++--
crud.py | 9 ++++++++
transport_rpcs.py | 54 ++++++++++++++++++++++++++++++++++++++++++++++-
3 files changed, 75 insertions(+), 3 deletions(-)
diff --git a/__init__.py b/__init__.py
index bfe3d45..01b145e 100644
--- a/__init__.py
+++ b/__init__.py
@@ -55,12 +55,23 @@ def events_start():
register_rpc,
)
- from .transport_rpcs import handle_events_ticket_register
+ from .transport_rpcs import (
+ handle_events_list_event_tickets,
+ handle_events_ticket_register,
+ )
register_rpc(
"events_ticket_register", handle_events_ticket_register, AUTH_WALLET
)
- logger.info("[EVENTS] Registered nostr-transport RPC: events_ticket_register")
+ register_rpc(
+ "events_list_event_tickets",
+ handle_events_list_event_tickets,
+ AUTH_WALLET,
+ )
+ logger.info(
+ "[EVENTS] Registered nostr-transport RPCs: "
+ "events_ticket_register, events_list_event_tickets"
+ )
except ImportError:
logger.info(
"[EVENTS] nostr_transport not available on this LNbits — "
diff --git a/crud.py b/crud.py
index a72b3b3..551a3bc 100644
--- a/crud.py
+++ b/crud.py
@@ -139,6 +139,15 @@ async def get_tickets(wallet_ids: str | list[str]) -> list[Ticket]:
return [Ticket(**_parse_ticket_row(row)) for row in rows]
+async def get_tickets_by_event(event_id: str) -> list[Ticket]:
+ """All ticket rows for the given calendar event id."""
+ rows = await db.fetchall(
+ "SELECT * FROM events.ticket WHERE event = :event_id",
+ {"event_id": event_id},
+ )
+ return [Ticket(**_parse_ticket_row(row)) for row in rows]
+
+
async def get_tickets_by_user_id(user_id: str) -> list[Ticket]:
"""All tickets owned by the given LNbits user_id."""
rows = await db.fetchall(
diff --git a/transport_rpcs.py b/transport_rpcs.py
index 16060d6..e278f91 100644
--- a/transport_rpcs.py
+++ b/transport_rpcs.py
@@ -20,7 +20,7 @@ from lnbits.core.crud import get_user
from lnbits.core.models import WalletTypeInfo
from lnbits.core.services.nostr_transport.models import NostrRpcRequest
-from .crud import get_event, get_ticket, update_ticket
+from .crud import get_event, get_ticket, get_tickets_by_event, update_ticket
async def handle_events_ticket_register(
@@ -66,3 +66,55 @@ async def handle_events_ticket_register(
ticket.reg_timestamp = datetime.now(timezone.utc)
await update_ticket(ticket)
return ticket.dict()
+
+
+async def handle_events_list_event_tickets(
+ auth: WalletTypeInfo,
+ request: NostrRpcRequest,
+) -> dict:
+ """Return paid + registered counts plus the per-ticket roster for
+ one calendar event, organizer-only.
+
+ Backs the door scanner's counts strip and "All scanned" tab so the
+ UI reads authoritative state from the backend instead of relying
+ on per-device localStorage (which diverges the moment a second
+ organizer scans, or the operator switches devices).
+
+ The roster only includes paid tickets — proposed/unpaid rows are
+ irrelevant at the door.
+ """
+ body = request.body or {}
+ event_id = body.get("event_id")
+ if not event_id:
+ raise ValueError("event_id is required")
+
+ event = await get_event(event_id)
+ if not event:
+ raise ValueError("Event does not exist")
+
+ user = await get_user(auth.wallet.user)
+ owned_wallet_ids = user.wallet_ids if user else [auth.wallet.id]
+ if event.wallet not in owned_wallet_ids:
+ raise PermissionError("You do not own this event")
+
+ tickets = await get_tickets_by_event(event_id)
+ paid_tickets = [t for t in tickets if t.paid]
+ registered_count = sum(1 for t in paid_tickets if t.registered)
+
+ return {
+ "event_id": event_id,
+ "sold": len(paid_tickets),
+ "registered": registered_count,
+ "remaining": len(paid_tickets) - registered_count,
+ "tickets": [
+ {
+ "id": t.id,
+ "name": t.name,
+ "registered": t.registered,
+ "registered_at": (
+ t.reg_timestamp.isoformat() if t.reg_timestamp else None
+ ),
+ }
+ for t in paid_tickets
+ ],
+ }
From 66d263ef1467803c7f036b4c8e175580089fc9e4 Mon Sep 17 00:00:00 2001
From: Padreug
Date: Sun, 24 May 2026 18:46:18 +0200
Subject: [PATCH 34/43] ui(admin): Tickets card above All Users' Events on the
admin index
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The Tickets table is what an organiser actually scans during day-of
operations — it deserves the top slot. All Users' Events stays one
section down for the cross-tenant audit view (admin-only anyway).
---
static/js/index.vue | 90 ++++++++++++++++++++++-----------------------
1 file changed, 45 insertions(+), 45 deletions(-)
diff --git a/static/js/index.vue b/static/js/index.vue
index 4760c6b..4b97fab 100644
--- a/static/js/index.vue
+++ b/static/js/index.vue
@@ -286,51 +286,6 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
From 3606fd9a0ae1c55fe8af14d7fe09b66deec8e2a6 Mon Sep 17 00:00:00 2001
From: Padreug
Date: Sun, 24 May 2026 18:51:51 +0200
Subject: [PATCH 35/43] feat(admin): Owner column on All Users' Events card
Adds the event's wallet owner (user_id) as the first column of the
admin-only All Users' Events table so cross-tenant rows are
attributable at a glance. Server-side join: GET /events/all now
resolves each event.wallet -> wallet.user and stamps the result on
the response as wallet_user_id. Frontend gets a dedicated
allUsersEventsTable.columns definition so the user's own-events
table stays unchanged.
Follow-up #22 covers letting the admin actually edit those events
once attributed.
---
static/js/index.js | 45 +++++++++++++++++++++++++++++++++++++++++++++
static/js/index.vue | 2 +-
views_api.py | 19 ++++++++++++++++---
3 files changed, 62 insertions(+), 4 deletions(-)
diff --git a/static/js/index.js b/static/js/index.js
index a65f5f8..2b4bcb9 100644
--- a/static/js/index.js
+++ b/static/js/index.js
@@ -14,6 +14,51 @@ window.PageEvents = {
settings: {
auto_approve: false
},
+ allUsersEventsTable: {
+ // Shown on the admin All Users' Events card. Includes the
+ // wallet owner (`wallet_user_id` resolved server-side) so
+ // cross-tenant rows are attributable to a user.
+ columns: [
+ {
+ name: 'wallet_user_id',
+ align: 'left',
+ label: 'Owner',
+ field: 'wallet_user_id'
+ },
+ {name: 'id', align: 'left', label: 'ID', field: 'id'},
+ {name: 'name', align: 'left', label: 'Name', field: 'name'},
+ {
+ name: 'event_start_date',
+ align: 'left',
+ label: 'Start date',
+ field: 'event_start_date'
+ },
+ {
+ name: 'event_end_date',
+ align: 'left',
+ label: 'End date',
+ field: 'event_end_date'
+ },
+ {
+ name: 'closing_date',
+ align: 'left',
+ label: 'Ticket close',
+ field: 'closing_date'
+ },
+ {
+ name: 'canceled',
+ align: 'left',
+ label: 'Canceled',
+ field: row => {
+ if (row.extra && row.extra.conditional && row.canceled) {
+ return 'Yes'
+ }
+ return 'No'
+ }
+ },
+ {name: 'status', align: 'left', label: 'Status', field: 'status'}
+ ]
+ },
eventsTable: {
columns: [
{name: 'id', align: 'left', label: 'ID', field: 'id'},
diff --git a/static/js/index.vue b/static/js/index.vue
index 4b97fab..6e6891f 100644
--- a/static/js/index.vue
+++ b/static/js/index.vue
@@ -384,7 +384,7 @@
flat
:rows="allUserEvents"
row-key="id"
- :columns="eventsTable.columns"
+ :columns="allUsersEventsTable.columns"
:pagination="{rowsPerPage: 10}"
>
diff --git a/views_api.py b/views_api.py
index d2bac8f..3edd953 100644
--- a/views_api.py
+++ b/views_api.py
@@ -101,9 +101,22 @@ async def api_events_public() -> list[Event]:
@events_api_router.get("/all")
async def api_events_all(
admin: Account = Depends(check_admin),
-) -> list[Event]:
- """All events across all wallets. LNbits admin only."""
- return await get_all_events()
+) -> list[dict]:
+ """All events across all wallets, with each row's wallet owner
+ resolved to a user_id. LNbits admin only.
+
+ Returns dicts (not strict `Event` rows) so the response can carry
+ the synthetic `wallet_user_id` column the admin UI uses to attribute
+ each cross-tenant event to a user.
+ """
+ events = await get_all_events()
+ enriched: list[dict] = []
+ for event in events:
+ wallet = await get_wallet(event.wallet)
+ row = event.dict()
+ row["wallet_user_id"] = wallet.user if wallet else None
+ enriched.append(row)
+ return enriched
@events_api_router.get("/pending")
From 37fad05c1faaab9a6c75dfea03f3efad6e2bbeaf Mon Sep 17 00:00:00 2001
From: Padreug
Date: Sun, 24 May 2026 18:56:07 +0200
Subject: [PATCH 36/43] chore: bump config.json version to 1.6.1-aio.3
---
config.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/config.json b/config.json
index 57a7f75..021565f 100644
--- a/config.json
+++ b/config.json
@@ -1,6 +1,6 @@
{
"id": "events",
- "version": "1.6.1-aio.1",
+ "version": "1.6.1-aio.3",
"name": "Events",
"repo": "https://git.atitlan.io/aiolabs/events",
"short_description": "Sell and register event tickets",
From 66076d6ca75295ce27bd68c8b6e87801ea83dcb5 Mon Sep 17 00:00:00 2001
From: Padreug
Date: Wed, 27 May 2026 21:55:56 +0200
Subject: [PATCH 37/43] =?UTF-8?q?feat(signer):=20migrate=20Nostr=20publish?=
=?UTF-8?q?ing=20off=20account.prvkey=20=E2=86=92=20resolve=5Ffor=5Fwallet?=
=?UTF-8?q?=20(#23)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Closes aiolabs/events#23. Pre-cascade prerequisite for aiolabs/lnbits#17
(signer abstraction phase 1), which lands an m002 startup job that
NULLs the legacy `accounts.prvkey` column. After this migration, the
events extension reads no plaintext nsec and works with any
NostrSigner backend (LocalSigner / RemoteBunkerSigner / ClientSideOnlySigner).
## What changed
### nostr_hooks.py — publish_or_delete_nostr_event
Was: pulled `(account.pubkey, account.prvkey)` from the wallet owner,
passed both to `publish_event_to_nostr`. Hard-skipped publish when
`account.prvkey` was None.
Now: calls `await resolve_for_wallet(event.wallet)` (the DRY helper
from aiolabs/lnbits#23 — wallet → account → signer → can_sign-check
in one call, returns None on any soft-fail). Passes the resolved
`NostrSigner` to the publisher. Soft-skip on None (wallet missing,
account unclassified, or ClientSideOnlySigner where the server has
no signing authority) — matching previous "no prvkey" behavior.
### nostr_publisher.py — publish_event_to_nostr
Was: accepted `(account_pubkey, account_prvkey)` and signed via a
local `sign_nostr_event` helper that called `coincurve.PrivateKey
.sign_schnorr` directly on the plaintext nsec.
Now: accepts `signer: NostrSigner`. Builds the unsigned event dict
(`kind`/`created_at`/`tags`/`content`), hands it to
`await signer.sign_event(...)`, reconstructs the local `NostrEvent`
model from the signed dict (`id`/`pubkey`/`sig` fields). The signer
backend (LocalSigner / RemoteBunkerSigner) is transparent.
Removed the `sign_nostr_event` helper entirely — the signer abstraction
handles all signing now.
Dropped the `coincurve` import; no direct crypto in this extension.
## Acceptance
- [x] keypair helper replaced (nostr_hooks no longer touches account.prvkey)
- [x] publish_event_to_nostr accepts NostrSigner instead of (pubkey, prvkey)
- [x] extension-local Schnorr code removed (sign_nostr_event gone)
- [x] re-grep `events/`: zero `account.prvkey` references
- [x] version bumped: 1.6.1-aio.3 → 1.6.1-aio.4
Manual smoke testing + tag + catalog entry follow the migration
landing; will run against the regtest stack with lnbits on
`issue-18-phase-2.3` (which validates both LocalSigner and
RemoteBunkerSigner signing paths end-to-end).
## Cross-references
- aiolabs/events#23 — issue this commit closes
- aiolabs/lnbits#17 — the cascading signer-abstraction PR
- aiolabs/lnbits#23 — the resolve_for_wallet helper this uses
- aiolabs/lnbits#26 — phase 2.3 (sign_event over bunker, validated against
aiolabs/nsecbunkerd@fb1c239)
- aiolabs/lnbits#21 — umbrella audit identifying 5 affected extensions
Co-Authored-By: Claude Opus 4.7 (1M context)
---
config.json | 2 +-
nostr_hooks.py | 27 ++++++++++++++++-----------
nostr_publisher.py | 42 +++++++++++++++++++++++++++---------------
3 files changed, 44 insertions(+), 27 deletions(-)
diff --git a/config.json b/config.json
index 021565f..9691da4 100644
--- a/config.json
+++ b/config.json
@@ -1,6 +1,6 @@
{
"id": "events",
- "version": "1.6.1-aio.3",
+ "version": "1.6.1-aio.4",
"name": "Events",
"repo": "https://git.atitlan.io/aiolabs/events",
"short_description": "Sell and register event tickets",
diff --git a/nostr_hooks.py b/nostr_hooks.py
index 3211b24..32ea11c 100644
--- a/nostr_hooks.py
+++ b/nostr_hooks.py
@@ -15,25 +15,30 @@ from .nostr_publisher import publish_event_to_nostr
async def publish_or_delete_nostr_event(event: Event, *, delete: bool = False) -> None:
"""Publish or delete the NIP-52 calendar event for `event`.
- Pulls the wallet owner's pubkey/prvkey to sign with the user's identity.
- Failures are logged and swallowed so a Nostr outage doesn't break the
- HTTP flow that triggered the publish.
+ Resolves a `NostrSigner` for the wallet owner — backend-agnostic
+ (LocalSigner / RemoteBunkerSigner / ClientSideOnlySigner). The
+ signer abstraction handles the actual key material; this hook
+ only needs `signer.pubkey` for event construction and
+ `await signer.sign_event(...)` for signing. Failures are logged
+ and swallowed so a Nostr outage doesn't break the HTTP flow that
+ triggered the publish.
"""
try:
- from lnbits.core.crud.users import get_account
- from lnbits.core.crud.wallets import get_wallet
+ from lnbits.core.signers import resolve_for_wallet
from . import nostr_client
- wallet_obj = await get_wallet(event.wallet)
- if not wallet_obj:
- return
- account = await get_account(wallet_obj.user)
- if not account or not account.pubkey or not account.prvkey:
+ signer = await resolve_for_wallet(event.wallet)
+ if signer is None:
+ # Wallet missing, account missing, unclassified row, or
+ # ClientSideOnlySigner account (server can't sign for them).
+ # Soft-fail: skip the publish silently. The user can still
+ # publish kind-31922/31923 events client-side once we have
+ # that path.
return
nostr_event = await publish_event_to_nostr(
- nostr_client, event, account.pubkey, account.prvkey, delete=delete
+ nostr_client, event, signer, delete=delete
)
if nostr_event and not delete:
event.nostr_event_id = nostr_event.id
diff --git a/nostr_publisher.py b/nostr_publisher.py
index 6867041..81324fc 100644
--- a/nostr_publisher.py
+++ b/nostr_publisher.py
@@ -1,8 +1,9 @@
"""
NIP-52 calendar event publishing for the events extension.
-Builds NIP-52 calendar events from the Event model, signs them with the
-creator's Account keypair, and publishes via the NostrClient.
+Builds NIP-52 calendar events from the Event model, signs them via the
+core `NostrSigner` abstraction (backend-agnostic: LocalSigner,
+RemoteBunkerSigner, etc.), and publishes via the NostrClient.
Kind 31922 is used for date-only events; kind 31923 (time-based) is used
when event_start_date / event_end_date include a time component.
@@ -13,7 +14,7 @@ Reference: https://github.com/nostr-protocol/nips/blob/master/52.md
import time
from datetime import datetime, timezone
-import coincurve
+from lnbits.core.signers import NostrSigner
from loguru import logger
from .models import Event
@@ -142,23 +143,20 @@ def build_nip52_delete_event(event: Event, pubkey: str) -> NostrEvent:
return nostr_event
-def sign_nostr_event(nostr_event: NostrEvent, private_key_hex: str) -> None:
- """Sign a NostrEvent in-place using Schnorr signature."""
- privkey = coincurve.PrivateKey(bytes.fromhex(private_key_hex))
- sig = privkey.sign_schnorr(bytes.fromhex(nostr_event.id))
- nostr_event.sig = sig.hex()
-
-
async def publish_event_to_nostr(
nostr_client,
event: Event,
- account_pubkey: str,
- account_prvkey: str,
+ signer: NostrSigner,
delete: bool = False,
) -> NostrEvent | None:
"""
Build, sign, and publish a NIP-52 calendar event (or delete event).
+ Signing routes through the core `NostrSigner` abstraction —
+ `signer.pubkey` for the event identity, `await signer.sign_event(...)`
+ for the Schnorr signature. The signer backend (LocalSigner /
+ RemoteBunkerSigner) is transparent to this function.
+
Returns the published NostrEvent for metadata storage, or None on failure.
"""
if not nostr_client:
@@ -167,11 +165,25 @@ async def publish_event_to_nostr(
try:
if delete:
- nostr_event = build_nip52_delete_event(event, account_pubkey)
+ nostr_event = build_nip52_delete_event(event, signer.pubkey)
else:
- nostr_event = build_nip52_event(event, account_pubkey)
+ nostr_event = build_nip52_event(event, signer.pubkey)
+
+ # Hand the unsigned event to the signer — it fills in `id`,
+ # `pubkey`, and `sig`. The signer's serialization rules match
+ # NIP-01 (same as the local `event_id` property uses), so the
+ # returned id matches what we'd have computed locally.
+ unsigned = {
+ "kind": nostr_event.kind,
+ "created_at": nostr_event.created_at,
+ "tags": nostr_event.tags,
+ "content": nostr_event.content,
+ }
+ signed = await signer.sign_event(unsigned)
+ nostr_event.id = signed["id"]
+ nostr_event.pubkey = signed["pubkey"]
+ nostr_event.sig = signed["sig"]
- sign_nostr_event(nostr_event, account_prvkey)
await nostr_client.publish_nostr_event(nostr_event)
logger.info(
From 4238b41f108fd1b883a023998e254a5d8fec024a Mon Sep 17 00:00:00 2001
From: Padreug
Date: Wed, 3 Jun 2026 19:47:49 +0200
Subject: [PATCH 38/43] feat: GET /tickets/event/{event_id}/stats for
door-scanner roster
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Mirrors the events_list_event_tickets nostr-transport RPC for callers
that don't hold a raw user prvkey (the webapp post-#9, in particular —
useTicketScanner.refreshStats now has a working HTTP path). Auth:
wallet admin_key + the event's wallet must be in the caller's wallet
set, matching the register endpoint's owner check.
Without this endpoint the activities scanner page loaded its initial
counts (via no-op fallbacks) but every post-scan refreshStats returned
404, leaving the Scanned counter stuck at 0 even though registrations
landed correctly. Surfaced by aio-demo manual test on 2026-06-03.
Co-Authored-By: Claude Opus 4.7 (1M context)
---
views_api.py | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 50 insertions(+)
diff --git a/views_api.py b/views_api.py
index 3edd953..14d60e2 100644
--- a/views_api.py
+++ b/views_api.py
@@ -47,6 +47,7 @@ from .crud import (
get_settings,
get_ticket,
get_tickets,
+ get_tickets_by_event,
get_tickets_by_payment_hash,
get_tickets_by_user_id,
purge_unpaid_tickets,
@@ -832,3 +833,52 @@ async def api_event_register_ticket(
ticket.reg_timestamp = datetime.now(timezone.utc)
ticket = await update_ticket(ticket)
return ticket
+
+
+@tickets_api_router.get("/event/{event_id}/stats")
+async def api_event_ticket_stats(
+ event_id: str,
+ key_info: WalletTypeInfo = Depends(require_admin_key),
+) -> dict:
+ """Door-scanner roster + counts for one event, organizer-only.
+
+ Mirrors the `events_list_event_tickets` nostr-transport RPC for
+ callers that don't hold a raw user prvkey (the webapp post-#9, in
+ particular). Auth: wallet admin_key + the event's wallet must be
+ in the caller's wallet set.
+ """
+ event = await get_event(event_id)
+ if not event:
+ raise HTTPException(
+ status_code=HTTPStatus.NOT_FOUND, detail="Event does not exist."
+ )
+
+ user = await get_user(key_info.wallet.user)
+ owned_wallet_ids = user.wallet_ids if user else [key_info.wallet.id]
+ if event.wallet not in owned_wallet_ids:
+ raise HTTPException(
+ status_code=HTTPStatus.FORBIDDEN,
+ detail="You do not own this event.",
+ )
+
+ tickets = await get_tickets_by_event(event_id)
+ paid_tickets = [t for t in tickets if t.paid]
+ registered_count = sum(1 for t in paid_tickets if t.registered)
+
+ return {
+ "event_id": event_id,
+ "sold": len(paid_tickets),
+ "registered": registered_count,
+ "remaining": len(paid_tickets) - registered_count,
+ "tickets": [
+ {
+ "id": t.id,
+ "name": t.name,
+ "registered": t.registered,
+ "registered_at": (
+ t.reg_timestamp.isoformat() if t.reg_timestamp else None
+ ),
+ }
+ for t in paid_tickets
+ ],
+ }
From 1fb96bfe3cd7c325c89657372100ad800677800c Mon Sep 17 00:00:00 2001
From: Padreug
Date: Wed, 3 Jun 2026 19:48:18 +0200
Subject: [PATCH 39/43] chore: bump config.json version to 1.6.1-aio.5
Releases the door-scanner stats endpoint.
Co-Authored-By: Claude Opus 4.7 (1M context)
---
config.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/config.json b/config.json
index 9691da4..03be67f 100644
--- a/config.json
+++ b/config.json
@@ -1,6 +1,6 @@
{
"id": "events",
- "version": "1.6.1-aio.4",
+ "version": "1.6.1-aio.5",
"name": "Events",
"repo": "https://git.atitlan.io/aiolabs/events",
"short_description": "Sell and register event tickets",
From b5c87c60b478a23b529505a9546c6ef3b5965a9c Mon Sep 17 00:00:00 2001
From: Padreug
Date: Thu, 18 Jun 2026 14:13:10 +0200
Subject: [PATCH 40/43] fix: publish NIP-52 events with monotonic created_at
(#26)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
NIP-52 calendar events (31922/31923) are replaceable and republished
whenever inventory changes (a ticket sells). build_nip52_event stamped
created_at=int(time.time()); relays only push a replacement to OPEN
subscriptions when created_at is strictly newer, so two republishes in
the same wall-clock second tie and the second is silently dropped for
live subscribers — clients' "tickets remaining" badge stalls until a
reload. Same root cause as the webapp fix (aiolabs/webapp#122).
- Add monotonic_created_at() in nostr_timestamp.py = max(now, last+1),
mirroring the webapp helper + docs/nostr-patterns/replaceable-events.md.
- Anchor it on the already-persisted Event.nostr_event_created_at
(set after each publish in nostr_hooks.py). The kind-5 delete event is
not replaceable, so it keeps plain int(time.time()).
- Unit tests mirror the webapp's timestamp suite.
Concurrent same-second sales reading the same stored anchor can still
collide; full hardening (row-level lock) is noted as follow-up in #26.
Co-Authored-By: Claude Opus 4.8 (1M context)
---
nostr_publisher.py | 9 ++++++++-
nostr_timestamp.py | 34 ++++++++++++++++++++++++++++++++++
tests/test_nostr_timestamp.py | 32 ++++++++++++++++++++++++++++++++
3 files changed, 74 insertions(+), 1 deletion(-)
create mode 100644 nostr_timestamp.py
create mode 100644 tests/test_nostr_timestamp.py
diff --git a/nostr_publisher.py b/nostr_publisher.py
index 81324fc..2588fcb 100644
--- a/nostr_publisher.py
+++ b/nostr_publisher.py
@@ -19,6 +19,7 @@ from loguru import logger
from .models import Event
from .nostr.event import NostrEvent
+from .nostr_timestamp import monotonic_created_at
def _has_time(value: str | None) -> bool:
@@ -110,9 +111,15 @@ def build_nip52_event(event: Event, pubkey: str) -> NostrEvent:
if event.fiat_currency:
tags.append(["tickets_fiat_currency", event.fiat_currency])
+ # NIP-52 calendar events are replaceable: this d-tag is republished
+ # whenever inventory changes (a ticket sells). Use a strictly-monotonic
+ # created_at anchored on the last published value so a same-second
+ # republish still outranks the prior version and relays push it to open
+ # subscriptions — a bare int(time.time()) can tie and be silently
+ # dropped, stalling clients' live "tickets remaining" badge.
nostr_event = NostrEvent(
pubkey=pubkey,
- created_at=int(time.time()),
+ created_at=monotonic_created_at(event.nostr_event_created_at),
kind=kind,
tags=tags,
content=event.info or "",
diff --git a/nostr_timestamp.py b/nostr_timestamp.py
new file mode 100644
index 0000000..625b21c
--- /dev/null
+++ b/nostr_timestamp.py
@@ -0,0 +1,34 @@
+"""Monotonic ``created_at`` for replaceable / addressable Nostr events.
+
+Relays only push a replaceable update to OPEN subscriptions when its
+``created_at`` is strictly newer than the version they already hold.
+``created_at`` is integer seconds, so a publisher that stamps
+``int(time.time())`` can emit two versions within the same wall-clock
+second (e.g. two ticket sales republishing the NIP-52 calendar event) —
+the relay treats the second as not-newer and never propagates it to live
+subscribers (it only surfaces on a reload / fresh REQ).
+
+Returning ``max(now, last_created_at + 1)`` guarantees a strictly
+increasing timestamp across successive publishes of the same replaceable
+event. When enough real seconds have elapsed it tracks wall-clock; only
+same-second (or clock-skewed) republishes get nudged forward.
+
+Mirrors the webapp's ``monotonicCreatedAt`` (src/lib/nostr/timestamp.ts)
+and ``docs/nostr-patterns/replaceable-events.md``.
+"""
+
+import time
+
+
+def monotonic_created_at(last_created_at: int | None, now: int | None = None) -> int:
+ """Strictly-newer ``created_at`` for the next publish of a coord.
+
+ :param last_created_at: ``created_at`` of the previously published
+ version (seconds), or ``None`` if none has been published yet.
+ :param now: Current time in seconds — injectable for tests; defaults
+ to ``int(time.time())``.
+ """
+ base = int(time.time()) if now is None else now
+ if last_created_at is None:
+ return base
+ return max(base, last_created_at + 1)
diff --git a/tests/test_nostr_timestamp.py b/tests/test_nostr_timestamp.py
new file mode 100644
index 0000000..693a997
--- /dev/null
+++ b/tests/test_nostr_timestamp.py
@@ -0,0 +1,32 @@
+from itertools import pairwise
+
+from ..nostr_timestamp import monotonic_created_at
+
+
+def test_no_prior_uses_now():
+ assert monotonic_created_at(None, now=1000) == 1000
+
+
+def test_same_second_bumps_past_prior():
+ # now == last: a naive int(time.time()) would tie and the relay would
+ # drop the update; we must produce a strictly newer stamp.
+ assert monotonic_created_at(1000, now=1000) == 1001
+
+
+def test_tracks_wallclock_once_seconds_elapse():
+ assert monotonic_created_at(1000, now=1005) == 1005
+
+
+def test_steps_past_future_dated_prior():
+ # clock skew / rapid bursts left the stored value ahead of now
+ assert monotonic_created_at(2000, now=1000) == 2001
+
+
+def test_strictly_increasing_same_second_burst():
+ last = None
+ stamps = []
+ for _ in range(5):
+ last = monotonic_created_at(last, now=1000) # clock frozen at 1000
+ stamps.append(last)
+ assert stamps == [1000, 1001, 1002, 1003, 1004]
+ assert all(b > a for a, b in pairwise(stamps))
From cfc2e38a5eda997bffca684a192ca6aa93b2603c Mon Sep 17 00:00:00 2001
From: Padreug
Date: Thu, 18 Jun 2026 14:13:11 +0200
Subject: [PATCH 41/43] chore: bump config.json version to 1.6.1-aio.6
Marks the monotonic created_at fix (#26). aio semver stays ahead of the
upstream 1.6.1 tag per fork versioning rules.
Co-Authored-By: Claude Opus 4.8 (1M context)
---
config.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/config.json b/config.json
index 03be67f..36da491 100644
--- a/config.json
+++ b/config.json
@@ -1,6 +1,6 @@
{
"id": "events",
- "version": "1.6.1-aio.5",
+ "version": "1.6.1-aio.6",
"name": "Events",
"repo": "https://git.atitlan.io/aiolabs/events",
"short_description": "Sell and register event tickets",
From 9d7efd7662c70c9068553109f2396ee8545284d1 Mon Sep 17 00:00:00 2001
From: Padreug
Date: Sat, 20 Jun 2026 09:03:44 +0200
Subject: [PATCH 42/43] feat: issue free tickets without minting an invoice
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Free events (price_per_ticket == 0) tried to mint a 0-amount Lightning
invoice via create_payment_request — an invoice that can't settle, and
which the invoice listener would never mark paid, so the ticket never
became scannable.
api_ticket_create now short-circuits when the final charge is 0 (a free
event or a 100%-off promo, computed after promo + quantity) before any
invoice / fiat-provider logic: _issue_free_tickets creates the N rows and
runs each through the existing set_ticket_paid — the same path
on_invoice_paid drives for a settled payment (flip paid, bump
sold/available under the per-event lock, republish the NIP-52 event) —
plus the ticket notification. The response carries a new
TicketPaymentRequest.paid=True with no payment_request so the client
skips the QR / payment-poll and goes straight to the ticket QRs.
No invoice means sats_paid=0, so free tickets are naturally skipped by
refund_tickets. All rows in a batch share one synthetic payment_hash —
the join key the poll / WebSocket / My-Tickets lookups use — mirroring
the paid multi-ticket path.
Self-service forfeit (#28), abuse/identity limits (#29) and
pay-what-you-want/donation tickets (#30) are tracked as follow-ups.
Co-Authored-By: Claude Opus 4.8
---
models.py | 4 +++
views_api.py | 79 +++++++++++++++++++++++++++++++++++++++++++++++++++-
2 files changed, 82 insertions(+), 1 deletion(-)
diff --git a/models.py b/models.py
index 04520a0..7f1feac 100644
--- a/models.py
+++ b/models.py
@@ -183,6 +183,10 @@ class TicketPaymentRequest(BaseModel):
fiat_payment_request: str | None = None
fiat_provider: str | None = None
is_fiat: bool = False
+ # True when the tickets are already issued + paid with no invoice to
+ # settle — free events (price 0) or a 100%-off promo. The client skips
+ # the QR / payment-poll step and goes straight to the ticket QRs.
+ paid: bool = False
# Row ids created on this invoice — one for single-ticket
# purchases, N for multi-ticket (each independently scannable at
# the door). Buyers fetch these after payment to render N QRs in
diff --git a/views_api.py b/views_api.py
index 14d60e2..5ced0ef 100644
--- a/views_api.py
+++ b/views_api.py
@@ -66,7 +66,12 @@ from .models import (
TicketPaymentRequest,
)
from .nostr_hooks import publish_or_delete_nostr_event
-from .services import refund_tickets, resend_ticket_email_notification
+from .services import (
+ refund_tickets,
+ resend_ticket_email_notification,
+ send_ticket_notification_in_background,
+ set_ticket_paid,
+)
from .tasks import deregister_payment_listener, register_payment_listener
events_api_router = APIRouter(prefix="/api/v1/events")
@@ -508,6 +513,62 @@ async def api_get_ticket(ticket_id: str) -> Ticket:
return ticket
+async def _issue_free_tickets(
+ *,
+ event: Event,
+ quantity: int,
+ name: str | None,
+ email: str | None,
+ user_id: str | None,
+ promo_code: str | None,
+ nostr_identifier: str | None,
+ request: Request,
+) -> TicketPaymentRequest:
+ """Issue `quantity` free tickets without minting an invoice.
+
+ Each row is created then run through `set_ticket_paid` — the exact path
+ `on_invoice_paid` drives for a settled payment: it flips `paid`, bumps
+ the sold / available counters under the per-event lock, and republishes
+ the NIP-52 calendar event so connected clients see the new counts.
+ Notifications fire the same way. No invoice exists, so `sats_paid` is 0
+ and these tickets are naturally skipped by `refund_tickets`.
+
+ All rows in the batch share one synthetic `payment_hash` — the join key
+ the poll / WebSocket / My-Tickets lookups use — mirroring how the paid
+ multi-ticket path shares the real invoice hash.
+ """
+ payment_hash = urlsafe_short_hash()
+ ticket_ids: list[str] = []
+ for _ in range(quantity):
+ row_id = urlsafe_short_hash()
+ ticket = await create_ticket(
+ payment_hash=payment_hash,
+ wallet=event.wallet,
+ event=event.id,
+ name=name,
+ email=email,
+ user_id=user_id,
+ ticket_id=row_id,
+ extra={
+ "applied_promo_code": promo_code,
+ "nostr_identifier": nostr_identifier,
+ "ticket_base_url": str(request.base_url).rstrip("/"),
+ "sats_paid": 0,
+ },
+ )
+ await set_ticket_paid(ticket)
+ send_ticket_notification_in_background(ticket)
+ ticket_ids.append(row_id)
+
+ return TicketPaymentRequest(
+ payment_hash=payment_hash,
+ payment_request=None,
+ is_fiat=False,
+ paid=True,
+ ticket_ids=ticket_ids,
+ )
+
+
@tickets_api_router.post("/{event_id}")
async def api_ticket_create(
event_id: str, data: CreateTicket, request: Request
@@ -571,6 +632,22 @@ async def api_ticket_create(
# Scale by quantity AFTER the promo applies. One invoice, N tickets.
price = unit_price * quantity
+ # Free tickets (final charge 0 — a free event or a 100%-off promo).
+ # Short-circuit before any invoice / fiat-provider logic: no Lightning
+ # invoice can settle for 0, so we issue the rows and mark them paid
+ # directly. payment_method is irrelevant here (nothing is charged).
+ if price <= 0:
+ return await _issue_free_tickets(
+ event=event,
+ quantity=quantity,
+ name=name,
+ email=email,
+ user_id=user_id,
+ promo_code=promo_code,
+ nostr_identifier=nostr_identifier,
+ request=request,
+ )
+
if payment_method == "fiat" and not event.allow_fiat:
raise HTTPException(
status_code=HTTPStatus.BAD_REQUEST,
From 2093e63020a1b1ba424c67d74e16478dcb5559ff Mon Sep 17 00:00:00 2001
From: Padreug
Date: Sat, 20 Jun 2026 09:04:02 +0200
Subject: [PATCH 43/43] chore: bump config.json version to 1.6.1-aio.7
Co-Authored-By: Claude Opus 4.8
---
config.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/config.json b/config.json
index 36da491..02272e3 100644
--- a/config.json
+++ b/config.json
@@ -1,6 +1,6 @@
{
"id": "events",
- "version": "1.6.1-aio.6",
+ "version": "1.6.1-aio.7",
"name": "Events",
"repo": "https://git.atitlan.io/aiolabs/events",
"short_description": "Sell and register event tickets",
Event ends
-
+
+
@@ -710,8 +728,8 @@
formDialog.data.name == null ||
formDialog.data.info == null ||
formDialog.data.closing_date == null ||
- formDialog.data.event_start_date == null ||
- formDialog.data.event_end_date == null ||
+ formDialog.data.event_start_day == null ||
+ formDialog.data.event_end_day == null ||
formDialog.data.amount_tickets == null ||
formDialog.data.price_per_ticket == null
"
diff --git a/views_api.py b/views_api.py
index dc39f7b..fd59390 100644
--- a/views_api.py
+++ b/views_api.py
@@ -151,9 +151,16 @@ async def api_get_event(event_id: str) -> Event:
closing_date = (
event.closing_date or event.event_end_date or event.event_start_date
)
- is_window_open = datetime.now(timezone.utc) < datetime.strptime(
- closing_date, "%Y-%m-%d"
- ).replace(tzinfo=timezone.utc)
+ # Accept either YYYY-MM-DD or full ISO 8601 datetime (event_end_date
+ # may carry a time component since v1.3.0-aio.3 / our start-end-time
+ # feature).
+ try:
+ closing_dt = datetime.fromisoformat(closing_date)
+ except ValueError:
+ closing_dt = datetime.strptime(closing_date[:10], "%Y-%m-%d")
+ if closing_dt.tzinfo is None:
+ closing_dt = closing_dt.replace(tzinfo=timezone.utc)
+ is_window_open = datetime.now(timezone.utc) < closing_dt
is_min_tickets_met = (
event.sold >= event.extra.min_tickets if event.extra.conditional else True
)
From 0dc2dcc35f6c79275ec1e5e72d3430556870c515 Mon Sep 17 00:00:00 2001
From: Padreug
Date: Thu, 21 May 2026 12:23:10 +0200
Subject: [PATCH 17/43] fix: gate event edits through the approval workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The PUT /events/{id} endpoint blindly copied every field from the
request body onto the existing event, including `status`. A non-admin
owner with auto_approve=false could PUT {"status": "approved", ...}
and self-approve, bypassing review entirely.
Replace the blanket setattr loop with an explicit field list (status
omitted) and derive the new status from the same admin / auto_approve
gate that api_event_create uses. Reconcile Nostr against the status
transition:
approved → approved : re-publish the replaceable NIP-52 event
proposed → approved : fresh publish
approved → proposed : NIP-09 delete so the public feed drops it
until the edit is re-approved
proposed → proposed : no-op
Also apply the same end/closing-date defaulting as create_event so an
edit that omits those fields doesn't wipe them.
Co-Authored-By: Claude Opus 4.7 (1M context)
---
views_api.py | 61 ++++++++++++++++++++++++++++++++++++++++++++++++----
1 file changed, 57 insertions(+), 4 deletions(-)
diff --git a/views_api.py b/views_api.py
index fd59390..afea116 100644
--- a/views_api.py
+++ b/views_api.py
@@ -218,6 +218,18 @@ async def api_event_update(
data: CreateEvent,
wallet: WalletTypeInfo = Depends(require_admin_key),
) -> Event:
+ """Update an event. The owner can edit any mutable field; the status
+ is derived (admin / `auto_approve` ⇒ approved, otherwise proposed)
+ and is NEVER taken from the request body — that would let owners
+ self-approve.
+
+ Nostr is reconciled against the status transition:
+ approved → approved : re-publish the replaceable NIP-52 event
+ proposed → approved : fresh publish
+ approved → proposed : NIP-09 delete so the public feed drops it
+ until the edit is re-approved
+ proposed → proposed : no-op
+ """
event = await get_event(event_id)
if not event:
raise HTTPException(
@@ -227,13 +239,54 @@ async def api_event_update(
raise HTTPException(
status_code=HTTPStatus.FORBIDDEN, detail="Not your event."
)
- for k, v in data.dict().items():
- setattr(event, k, v)
+
+ from lnbits.settings import settings
+
+ ext_settings = await get_settings()
+ user_id = wallet.wallet.user
+ is_admin = user_id == settings.super_user or user_id in settings.lnbits_admin_users
+
+ previous_status = event.status
+
+ # Same defaulting as create_event: optional end/closing dates fall
+ # back to start_date when omitted, so an edit that doesn't restate
+ # them doesn't wipe them.
+ if not data.event_end_date:
+ data.event_end_date = data.event_start_date
+ if not data.closing_date:
+ data.closing_date = data.event_end_date
+
+ # Explicit field list — never copy `status` from the request body.
+ # Includes upstream v1.6.1 fields (allow_fiat, fiat_currency) so an
+ # owner editing a fiat-enabled event keeps the fiat config.
+ for field in (
+ "name",
+ "info",
+ "closing_date",
+ "event_start_date",
+ "event_end_date",
+ "currency",
+ "allow_fiat",
+ "fiat_currency",
+ "amount_tickets",
+ "price_per_ticket",
+ "banner",
+ "location",
+ "categories",
+ "extra",
+ ):
+ setattr(event, field, getattr(data, field))
+
+ event.status = "approved" if (is_admin or ext_settings.auto_approve) else "proposed"
+
+
event = await update_event(event)
- # Re-publish the replaceable NIP-52 event if we already announced it.
- if event.status == "approved" and event.nostr_event_id:
+ if event.status == "approved":
await publish_or_delete_nostr_event(event)
+ elif previous_status == "approved":
+ # Take it down from the public feed while it waits for re-approval.
+ await publish_or_delete_nostr_event(event, delete=True)
return event
From 16eb68d080c79028dd4246def8cf6755d6034da7 Mon Sep 17 00:00:00 2001
From: Padreug
Date: Thu, 21 May 2026 15:52:07 +0200
Subject: [PATCH 18/43] feat: public auto_approve probe + bump to v1.3.0-aio.5
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Add GET /events/api/v1/events/settings/public — invoice-key-gated
(anyone with a wallet) — returning just `{ auto_approve }`. The webapp
needs this to render accurate edit-flow copy without forcing every
event creator to also be an LNbits admin.
The admin-only GET /settings stays the source of truth for the full
EventsSettings payload.
Co-Authored-By: Claude Opus 4.7 (1M context)
---
views_api.py | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/views_api.py b/views_api.py
index afea116..36a444b 100644
--- a/views_api.py
+++ b/views_api.py
@@ -125,6 +125,19 @@ async def api_update_settings(
return await update_settings(data)
+@events_api_router.get("/settings/public")
+async def api_get_settings_public(
+ wallet: WalletTypeInfo = Depends(require_invoice_key),
+) -> dict:
+ """Subset of EventsSettings safe to expose to any authenticated
+ caller. The webapp needs `auto_approve` to render accurate edit-flow
+ copy ("your edit will go back to pending" vs "edit stays approved")
+ without forcing every event-creator to also be an LNbits admin.
+ """
+ settings = await get_settings()
+ return {"auto_approve": settings.auto_approve}
+
+
@events_api_router.get("/{event_id}", response_model=PublicEvent)
async def api_get_event(event_id: str) -> Event:
"""Public event detail used by display.vue.
From b576a490d24f04a7672ffe11acb16e6e9ed01a6d Mon Sep 17 00:00:00 2001
From: Padreug
Date: Fri, 22 May 2026 08:41:44 +0200
Subject: [PATCH 19/43] refactor: move fork-only migrations to
migrations_fork.py
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
`migrations.py` now matches upstream v1.3.0 exactly. Every aio-only
schema delta (the old m007-m011: user_id, status, nostr_event_id +
created_at, settings table, location + categories) moves into a
single `m001_aio_event_schema` function in `migrations_fork.py`,
tracked under `events_fork` in `dbversions` by the loader added in
aiolabs/lnbits@ae997181.
Idempotency guards on every ADD COLUMN / CREATE TABLE let the
squashed migration no-op cleanly on dev DBs that already ran the
old m007-m011 — schema lands identical from either path.
Why now: aiolabs/lnbits#8. We're about to rebase events onto
upstream v1.6.1 which adds its own m007_add_allow_fiat. With this
move done first, migrations.py stays a fast-forward on rebase and
our fork-only schema lives in a separate file that never collides.
Requires aiolabs/lnbits @ ae997181 or later for the extension_fork
loader. Running on an upstream lnbits without the loader patch
will NOT apply the fork schema — but the aiolabs deploy fleet
already pulls from aiolabs/lnbits, so this is the only host we
ship to.
Co-Authored-By: Claude Opus 4.7 (1M context)
---
migrations_fork.py | 105 +++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 105 insertions(+)
create mode 100644 migrations_fork.py
diff --git a/migrations_fork.py b/migrations_fork.py
new file mode 100644
index 0000000..365d259
--- /dev/null
+++ b/migrations_fork.py
@@ -0,0 +1,105 @@
+"""
+Fork-specific database migrations for the aiolabs events extension.
+
+These migrations are tracked separately under `events_fork` in the
+`dbversions` table (loaded by `lnbits/core/helpers.py:migrate_extension_database`),
+so they do not collide with upstream's `m{NNN}_*` numbering in
+`migrations.py`. Keeping the upstream-tracked file untouched means
+`git pull upstream` stays rebase-clean for schema changes.
+
+Conventions:
+ - Sequential numbering starting from m001.
+ - Each migration is `async def m{NNN}_(db)`.
+ - DDL must be idempotent: a fresh install runs every migration; an
+ install that previously ran the OLD versions of these as
+ `m007-m011` in `migrations.py` has the columns/tables already.
+ Use `_alter_add_column_safe` / `_create_table_safe` so re-runs are
+ no-ops instead of crashes.
+
+History compressed into m001 (was m007-m011 in migrations.py pre-v1.6
+rebase):
+ - m007 add_user_id_support (ticket.user_id column)
+ - m008 add_event_status (events.status column)
+ - m009 add_nostr_columns (events.nostr_event_id + created_at)
+ - m010 add_events_settings (events.settings singleton table)
+ - m011 add_location_and_categories (events.location + categories)
+"""
+
+
+async def _alter_add_column_safe(db, sql: str) -> None:
+ """ALTER TABLE ADD COLUMN that swallows duplicate-column errors.
+
+ Re-running the squashed migration on a database that already has
+ these columns (from the pre-squash `m007-m011` in migrations.py)
+ must be a silent no-op. Same swallow we used in the old migrations.
+ """
+ try:
+ await db.execute(sql)
+ except Exception as exc:
+ msg = str(exc).lower()
+ if "duplicate column" in msg or "already exists" in msg:
+ return
+ raise
+
+
+async def m001_aio_event_schema(db):
+ """
+ Apply every aiolabs schema delta on top of upstream events v1.3.0.
+
+ This is the squashed equivalent of the pre-v1.6 sequence
+ m007 → m011. Order matters for the settings table seed insert
+ but the individual column adds are independent and idempotent.
+ """
+
+ # --- ticket.user_id ----------------------------------------------
+ # Lets a ticket reference an LNbits user id instead of (name, email).
+ # Application logic enforces that exactly one identifier scheme is
+ # used per ticket.
+ await _alter_add_column_safe(
+ db, "ALTER TABLE events.ticket ADD COLUMN user_id TEXT"
+ )
+
+ # --- events.status -----------------------------------------------
+ # Proposal / approval workflow. Existing rows default to 'approved'
+ # so they stay visible after upgrade.
+ await _alter_add_column_safe(
+ db,
+ "ALTER TABLE events.events ADD COLUMN status TEXT NOT NULL DEFAULT 'approved'",
+ )
+
+ # --- events.nostr_event_id, nostr_event_created_at ---------------
+ # Track the most recent NIP-52 calendar event we published, so
+ # subsequent edits can issue replaceable updates and NIP-09 deletes
+ # against the right addressable coordinate.
+ await _alter_add_column_safe(
+ db, "ALTER TABLE events.events ADD COLUMN nostr_event_id TEXT"
+ )
+ await _alter_add_column_safe(
+ db, "ALTER TABLE events.events ADD COLUMN nostr_event_created_at INTEGER"
+ )
+
+ # --- events.settings ---------------------------------------------
+ # Singleton settings row used by the admin UI to toggle e.g.
+ # auto_approve. CREATE TABLE IF NOT EXISTS + a guarded seed keeps
+ # this idempotent.
+ await db.execute("""
+ CREATE TABLE IF NOT EXISTS events.settings (
+ id INTEGER PRIMARY KEY DEFAULT 1,
+ auto_approve BOOLEAN NOT NULL DEFAULT FALSE
+ )
+ """)
+ await db.execute(
+ "INSERT INTO events.settings (id, auto_approve) "
+ "SELECT 1, FALSE WHERE NOT EXISTS "
+ "(SELECT 1 FROM events.settings WHERE id = 1)"
+ )
+
+ # --- events.location, events.categories --------------------------
+ # NIP-52 calendar metadata. `categories` carries a JSON-encoded
+ # list of hashtags (the NIP-52 `t` tags).
+ await _alter_add_column_safe(
+ db, "ALTER TABLE events.events ADD COLUMN location TEXT"
+ )
+ await _alter_add_column_safe(
+ db, "ALTER TABLE events.events ADD COLUMN categories TEXT"
+ )
From 27cc8d2f1ce12a41d7299c288d446b9702b850df Mon Sep 17 00:00:00 2001
From: Padreug
Date: Fri, 22 May 2026 09:24:35 +0200
Subject: [PATCH 20/43] chore: rebase onto upstream v1.6.1 + bump to
v1.6.1-aio.1
Rebases the aio fork onto upstream v1.6.1 (4bf867e), pulling in:
- fiat checkout + email/Nostr DM ticket notifications (PR #50)
- currency-conversion fix (v1.5.0)
- custom notification subject/body (v1.6.0)
- resend-email button on the ticket list (PR #51)
Notable merges:
- views_api.api_event_update keeps the explicit-field-list gating from
the aio.4 security fix, with allow_fiat + fiat_currency added so an
owner editing a fiat-enabled event keeps the fiat config.
- models.PublicEvent now exposes both upstream's fiat fields and our
location / categories / status fields.
- migrations.py reverts to byte-identical to upstream v1.6.1 (no aio
entries); fork schema lives in migrations_fork.py (per aiolabs/lnbits#8).
- Lint reformatted with black + ruff to match upstream style.
Contributors entry adds `padreug` (aio fork maintainer).
Co-Authored-By: Claude Opus 4.7 (1M context)
---
__init__.py | 4 +---
config.json | 9 +++++++--
models.py | 4 +---
nostr/nostr_client.py | 15 ++++-----------
nostr_publisher.py | 2 +-
nostr_sync.py | 8 +++++---
views_api.py | 14 +++-----------
7 files changed, 22 insertions(+), 34 deletions(-)
diff --git a/__init__.py b/__init__.py
index c2f2300..b6b58a9 100644
--- a/__init__.py
+++ b/__init__.py
@@ -75,9 +75,7 @@ def events_start():
except Exception as exc:
logger.error(f"[EVENTS] Nostr sync task failed: {exc}")
- task3 = create_permanent_unique_task(
- "ext_events_nostr_sync", _sync_nostr_events
- )
+ task3 = create_permanent_unique_task("ext_events_nostr_sync", _sync_nostr_events)
scheduled_tasks.append(task3)
diff --git a/config.json b/config.json
index a945b43..57a7f75 100644
--- a/config.json
+++ b/config.json
@@ -1,8 +1,8 @@
{
"id": "events",
- "version": "1.6.1",
+ "version": "1.6.1-aio.1",
"name": "Events",
- "repo": "https://github.com/lnbits/events",
+ "repo": "https://git.atitlan.io/aiolabs/events",
"short_description": "Sell and register event tickets",
"description": "",
"tile": "/events/static/image/events.png",
@@ -32,6 +32,11 @@
"name": "motorina0",
"uri": "https://github.com/motorina0",
"role": "Developer"
+ },
+ {
+ "name": "padreug",
+ "uri": "https://git.atitlan.io/padreug",
+ "role": "Developer (aio fork: approval workflow + NIP-52 Nostr sync + edit gating)"
}
],
"images": [
diff --git a/models.py b/models.py
index 6b80537..d3f43d3 100644
--- a/models.py
+++ b/models.py
@@ -140,9 +140,7 @@ class CreateTicket(BaseModel):
email = values.get("email")
user_id = values.get("user_id")
if not user_id and not (name and email):
- raise ValueError(
- "Either user_id or both name and email must be provided"
- )
+ raise ValueError("Either user_id or both name and email must be provided")
if user_id and (name or email):
raise ValueError("Cannot provide both user_id and name/email")
return values
diff --git a/nostr/nostr_client.py b/nostr/nostr_client.py
index 8e0afc5..4de332f 100644
--- a/nostr/nostr_client.py
+++ b/nostr/nostr_client.py
@@ -39,8 +39,7 @@ class NostrClient:
async def connect(self) -> WebSocketApp:
relay_endpoint = encrypt_internal_message("relay", urlsafe=True)
ws_url = (
- f"ws://localhost:{settings.port}"
- f"/nostrclient/api/v1/{relay_endpoint}"
+ f"ws://localhost:{settings.port}" f"/nostrclient/api/v1/{relay_endpoint}"
)
logger.info("[EVENTS] Connecting to nostrclient WebSocket...")
@@ -58,12 +57,8 @@ class NostrClient:
logger.warning(f"[EVENTS] WebSocket error: {error}")
def on_close(_, status_code, message):
- logger.warning(
- f"[EVENTS] WebSocket closed: {status_code} {message}"
- )
- self.receive_event_queue.put_nowait(
- ValueError("WebSocket closed")
- )
+ logger.warning(f"[EVENTS] WebSocket closed: {status_code} {message}")
+ self.receive_event_queue.put_nowait(ValueError("WebSocket closed"))
ws = WebSocketApp(
ws_url,
@@ -118,9 +113,7 @@ class NostrClient:
async def subscribe(self, filters: list[dict]):
"""Subscribe to events matching the given filters."""
self.subscription_id = "events-" + urlsafe_short_hash()[:32]
- await self.send_req_queue.put(
- ["REQ", self.subscription_id, *filters]
- )
+ await self.send_req_queue.put(["REQ", self.subscription_id, *filters])
logger.info(
f"[EVENTS] Subscribed to NIP-52 events "
f"(sub: {self.subscription_id[:20]}...)"
diff --git a/nostr_publisher.py b/nostr_publisher.py
index bbee871..a6d487b 100644
--- a/nostr_publisher.py
+++ b/nostr_publisher.py
@@ -78,7 +78,7 @@ def build_nip52_event(event: Event, pubkey: str) -> NostrEvent:
tags.append(["image", event.banner])
if event.location:
tags.append(["location", event.location])
- for cat in (event.categories or []):
+ for cat in event.categories or []:
tags.append(["t", cat])
nostr_event = NostrEvent(
diff --git a/nostr_sync.py b/nostr_sync.py
index 380da3c..1dc52bc 100644
--- a/nostr_sync.py
+++ b/nostr_sync.py
@@ -137,9 +137,11 @@ async def wait_for_nostr_events(nostr_client: NostrClient):
while True:
try:
# Subscribe to NIP-52 calendar events
- await nostr_client.subscribe([
- {"kinds": [31922, 31923]},
- ])
+ await nostr_client.subscribe(
+ [
+ {"kinds": [31922, 31923]},
+ ]
+ )
# Process incoming events
while True:
diff --git a/views_api.py b/views_api.py
index 36a444b..08e94ab 100644
--- a/views_api.py
+++ b/views_api.py
@@ -161,9 +161,7 @@ async def api_get_event(event_id: str) -> Event:
# closing_date is filled in by create_event (defaults to end_date or
# start_date) but the field is typed Optional, so guard for the typechecker.
- closing_date = (
- event.closing_date or event.event_end_date or event.event_start_date
- )
+ closing_date = event.closing_date or event.event_end_date or event.event_start_date
# Accept either YYYY-MM-DD or full ISO 8601 datetime (event_end_date
# may carry a time component since v1.3.0-aio.3 / our start-end-time
# feature).
@@ -210,10 +208,7 @@ async def api_event_create(
ext_settings = await get_settings()
user_id = wallet.wallet.user
- is_admin = (
- user_id == settings.super_user
- or user_id in settings.lnbits_admin_users
- )
+ is_admin = user_id == settings.super_user or user_id in settings.lnbits_admin_users
if not is_admin and not ext_settings.auto_approve:
data.status = "proposed"
@@ -249,9 +244,7 @@ async def api_event_update(
status_code=HTTPStatus.NOT_FOUND, detail="Event does not exist."
)
if event.wallet != wallet.wallet.id:
- raise HTTPException(
- status_code=HTTPStatus.FORBIDDEN, detail="Not your event."
- )
+ raise HTTPException(status_code=HTTPStatus.FORBIDDEN, detail="Not your event.")
from lnbits.settings import settings
@@ -292,7 +285,6 @@ async def api_event_update(
event.status = "approved" if (is_admin or ext_settings.auto_approve) else "proposed"
-
event = await update_event(event)
if event.status == "approved":
From 814581f3079fddf4963186432e2d9fdf89c8f73e Mon Sep 17 00:00:00 2001
From: Padreug
Date: Sat, 23 May 2026 20:30:03 +0200
Subject: [PATCH 21/43] feat: expose GET /tickets/user/{user_id} endpoint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The webapp My Tickets view + the owned-ticket badges in the
activities feed both rely on this endpoint to enumerate a buyer's
tickets across all events. The CRUD function already existed
(`get_tickets_by_user_id`); just expose it.
Auth: Bearer access token (the same shape the webapp already sends
to other LNbits endpoints). The path param must match the token-
bound user.id — users can only enumerate their own tickets, not
anyone else's by ID-guessing.
Returns full `Ticket` rows rather than `PublicTicket` because the
owner needs the payment_hash (for the QR) + the `extra` envelope
(for refund / promo / notification state) in My Tickets.
Co-Authored-By: Claude Opus 4.7 (1M context)
---
views_api.py | 25 ++++++++++++++++++++++++-
1 file changed, 24 insertions(+), 1 deletion(-)
diff --git a/views_api.py b/views_api.py
index 08e94ab..7fd3aa0 100644
--- a/views_api.py
+++ b/views_api.py
@@ -14,11 +14,12 @@ from fastapi import (
)
from lnbits.core.crud import get_user
from lnbits.core.crud.wallets import get_wallet
-from lnbits.core.models import Account, WalletTypeInfo
+from lnbits.core.models import Account, User, WalletTypeInfo
from lnbits.core.models.payments import CreateInvoice
from lnbits.core.services import create_payment_request
from lnbits.decorators import (
check_admin,
+ check_user_exists,
require_admin_key,
require_invoice_key,
)
@@ -45,6 +46,7 @@ from .crud import (
get_settings,
get_ticket,
get_tickets,
+ get_tickets_by_user_id,
purge_unpaid_tickets,
update_event,
update_settings,
@@ -399,6 +401,27 @@ async def api_tickets(
return await get_tickets(wallet_ids)
+@tickets_api_router.get("/user/{user_id}")
+async def api_tickets_by_user(
+ user_id: str,
+ user: User = Depends(check_user_exists),
+) -> list[Ticket]:
+ """All tickets for the authenticated user.
+
+ The `user_id` path param must match the token-bound user so a
+ Bearer-authenticated session can only enumerate its own tickets.
+ Returns full `Ticket` rows (not `PublicTicket`) since the owner
+ needs the payment_hash to render the QR + the `extra` envelope
+ to surface payment/refund state in My Tickets.
+ """
+ if user_id != user.id:
+ raise HTTPException(
+ status_code=HTTPStatus.FORBIDDEN,
+ detail="Can only fetch your own tickets.",
+ )
+ return await get_tickets_by_user_id(user_id)
+
+
@tickets_api_router.get("/{ticket_id}", response_model=PublicTicket)
async def api_get_ticket(ticket_id: str) -> Ticket:
ticket = await get_ticket(ticket_id)
From edf1493e0cb9028bcae707938c31338ecf6f7077 Mon Sep 17 00:00:00 2001
From: Padreug
Date: Sat, 23 May 2026 20:31:56 +0200
Subject: [PATCH 22/43] feat: publish ticket counts in NIP-52 tags + republish
on sale
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Inventory sync over Nostr, mirroring how nostrmarket republishes
kind 30018 product events when stock changes. Connected webapp /
other-client subscriptions pick up the new state via their existing
relay subscription — no REST polling needed.
build_nip52_event grows four AIO custom tags on every published
kind 31922/31923 event:
- tickets_available — current remaining (omitted when amount_tickets
is 0, the schema's "unlimited" sentinel, so clients can tell the
difference between unlimited and sold-out)
- tickets_sold — running count, always emitted (clients derive
original_capacity = available + sold for progress bars)
- tickets_price — price_per_ticket (0 means free)
- tickets_currency — the currency string
Tags are AIO additions outside the NIP-52 spec; spec-compliant
clients MUST ignore unknown tags so this stays backwards-compatible.
set_ticket_paid calls publish_or_delete_nostr_event after the
counter update so the new state lands on relays. The whole sequence
(counter update + republish) is wrapped in a per-event-id asyncio
lock to address the existing # todo: lock and to ensure two paid
invoices for the same event can't reorder the published state.
Failures inside the Nostr publish are logged + swallowed by the
existing wrapper, so a relay outage can never break the payment
flow.
Co-Authored-By: Claude Opus 4.7 (1M context)
---
nostr_publisher.py | 28 ++++++++++++++++++++++++----
services.py | 39 ++++++++++++++++++++++++++++++++-------
2 files changed, 56 insertions(+), 11 deletions(-)
diff --git a/nostr_publisher.py b/nostr_publisher.py
index a6d487b..240b406 100644
--- a/nostr_publisher.py
+++ b/nostr_publisher.py
@@ -39,12 +39,23 @@ def build_nip52_event(event: Event, pubkey: str) -> NostrEvent:
Time-based (kind 31923) if event_start_date carries an HH:MM, otherwise
date-based (kind 31922). Tags:
- d - event.id
- title - event.name
- start - unix timestamp (31923) or YYYY-MM-DD (31922)
- end - same encoding (optional)
+ d - event.id
+ title - event.name
+ start - unix timestamp (31923) or YYYY-MM-DD (31922)
+ end - same encoding (optional)
image, location, t (categories) - optional
+ tickets_available - current remaining capacity (omitted when unlimited)
+ tickets_sold - running paid-count (always emitted; clients can
+ derive original_capacity = available + sold)
+ tickets_price - price_per_ticket (always emitted; 0 means free)
+ tickets_currency - the currency string
Content: event.info
+
+ The four ticket_* tags are AIO custom additions outside the NIP-52
+ spec; spec-compliant clients ignore unknown tags so this stays
+ backwards-compatible. They let connected clients render the
+ "X tickets remaining" badge and the Buy CTA without an extra REST hop,
+ and pick up live inventory updates via the same relay subscription.
"""
time_based = _has_time(event.event_start_date)
kind = 31923 if time_based else 31922
@@ -81,6 +92,15 @@ def build_nip52_event(event: Event, pubkey: str) -> NostrEvent:
for cat in event.categories or []:
tags.append(["t", cat])
+ # `amount_tickets == 0` means unlimited capacity in this extension's
+ # schema. Omitting the tag is how clients distinguish unlimited from
+ # "0 left" (sold out).
+ if event.amount_tickets > 0:
+ tags.append(["tickets_available", str(event.amount_tickets)])
+ tags.append(["tickets_sold", str(event.sold)])
+ tags.append(["tickets_price", str(event.price_per_ticket)])
+ tags.append(["tickets_currency", event.currency])
+
nostr_event = NostrEvent(
pubkey=pubkey,
created_at=int(time.time()),
diff --git a/services.py b/services.py
index 159bbdc..0a2de28 100644
--- a/services.py
+++ b/services.py
@@ -1,5 +1,6 @@
from __future__ import annotations
+import asyncio
from asyncio.tasks import create_task
from lnbits.core.models.users import UserNotifications
@@ -21,6 +22,7 @@ from .crud import (
update_ticket,
)
from .models import Event, Ticket
+from .nostr_hooks import publish_or_delete_nostr_event
DEFAULT_NOSTR_RELAYS = [
"wss://relay.damus.io",
@@ -28,19 +30,42 @@ DEFAULT_NOSTR_RELAYS = [
"wss://relay.nostr.band",
]
+# Per-event lock: serializes the counter-update + Nostr republish for a
+# single event_id so two paid invoices landing on the listener queue back-
+# to-back can't reorder the published state. Lazy-populated; entries are
+# left in memory for the lifetime of the process (cheap — one asyncio.Lock
+# object per event ever sold).
+_event_paid_locks: dict[str, asyncio.Lock] = {}
+
+
+def _event_paid_lock(event_id: str) -> asyncio.Lock:
+ lock = _event_paid_locks.get(event_id)
+ if lock is None:
+ lock = asyncio.Lock()
+ _event_paid_locks[event_id] = lock
+ return lock
+
async def set_ticket_paid(ticket: Ticket) -> Ticket:
if ticket.paid:
return ticket
- ticket.paid = True
- await update_ticket(ticket)
+ async with _event_paid_lock(ticket.event):
+ ticket.paid = True
+ await update_ticket(ticket)
- event = await get_event(ticket.event)
- assert event, "Couldn't get event from ticket being paid"
- event.sold += 1
- event.amount_tickets -= 1
- await update_event(event)
+ event = await get_event(ticket.event)
+ assert event, "Couldn't get event from ticket being paid"
+ event.sold += 1
+ event.amount_tickets -= 1
+ await update_event(event)
+
+ # Republish the NIP-52 calendar event so connected clients see
+ # the new tickets_available / tickets_sold counters via their
+ # existing relay subscription. Failures are logged + swallowed
+ # inside publish_or_delete_nostr_event so a Nostr outage doesn't
+ # break the payment flow.
+ await publish_or_delete_nostr_event(event)
return ticket
From b0d089d3c9c8a318984247716d49dc2ddd57098c Mon Sep 17 00:00:00 2001
From: Padreug
Date: Sat, 23 May 2026 20:37:19 +0200
Subject: [PATCH 23/43] feat: also publish allow_fiat + fiat_currency in NIP-52
tags
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The buyer-side webapp Purchase button needs allow_fiat to know
whether to surface the fiat method, and fiat_currency for the
conversion-preview label. Without these in the published Nostr
event, the buyer would either have to REST-fetch the LNbits event
again (defeats the inventory-sync goal) or guess.
Same backwards-compat reasoning as the four counter tags — tags
are AIO additions outside the NIP-52 spec; unknown tags are
ignored by spec-compliant clients.
- tickets_allow_fiat: "true" when the organizer enabled the fiat
toggle. Omitted otherwise so the on-the-wire payload stays
small for the common Lightning-only case.
- tickets_fiat_currency: only emitted when allow_fiat is on
(otherwise it'd be ambiguous what the value represents).
Co-Authored-By: Claude Opus 4.7 (1M context)
---
nostr_publisher.py | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/nostr_publisher.py b/nostr_publisher.py
index 240b406..6867041 100644
--- a/nostr_publisher.py
+++ b/nostr_publisher.py
@@ -44,11 +44,13 @@ def build_nip52_event(event: Event, pubkey: str) -> NostrEvent:
start - unix timestamp (31923) or YYYY-MM-DD (31922)
end - same encoding (optional)
image, location, t (categories) - optional
- tickets_available - current remaining capacity (omitted when unlimited)
- tickets_sold - running paid-count (always emitted; clients can
- derive original_capacity = available + sold)
- tickets_price - price_per_ticket (always emitted; 0 means free)
- tickets_currency - the currency string
+ tickets_available - current remaining capacity (omitted when unlimited)
+ tickets_sold - running paid-count (always emitted; clients can
+ derive original_capacity = available + sold)
+ tickets_price - price_per_ticket (always emitted; 0 means free)
+ tickets_currency - the currency string
+ tickets_allow_fiat - "true" when fiat checkout is enabled (omitted otherwise)
+ tickets_fiat_currency - the fiat settle currency (only when allow_fiat)
Content: event.info
The four ticket_* tags are AIO custom additions outside the NIP-52
@@ -100,6 +102,12 @@ def build_nip52_event(event: Event, pubkey: str) -> NostrEvent:
tags.append(["tickets_sold", str(event.sold)])
tags.append(["tickets_price", str(event.price_per_ticket)])
tags.append(["tickets_currency", event.currency])
+ # Fiat-checkout config — only emitted when allow_fiat is on so
+ # clients can branch the buy UI without re-reading the schema.
+ if event.allow_fiat:
+ tags.append(["tickets_allow_fiat", "true"])
+ if event.fiat_currency:
+ tags.append(["tickets_fiat_currency", event.fiat_currency])
nostr_event = NostrEvent(
pubkey=pubkey,
From 05593c9c3c8ed5ccecf852d1881a26d00db9b3d6 Mon Sep 17 00:00:00 2001
From: Padreug
Date: Sat, 23 May 2026 20:58:20 +0200
Subject: [PATCH 24/43] feat: POST /republish-all admin endpoint
Loops over approved events and re-emits each NIP-52 calendar event.
Useful as a one-shot migration after the publisher's tag set
changes (e.g. the tickets_* tag rollout introduced in this PR) so
existing events on a deployed instance pick up the new metadata
without each organizer having to edit and save.
Gated by check_admin (LNbits instance admin), errors swallowed
per-event inside the publisher so one bad row doesn't block the
rest. Returns a count summary.
Co-Authored-By: Claude Opus 4.7 (1M context)
---
views_api.py | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/views_api.py b/views_api.py
index 7fd3aa0..b7c6a0d 100644
--- a/views_api.py
+++ b/views_api.py
@@ -112,6 +112,30 @@ async def api_events_pending(
return await get_pending_events()
+@events_api_router.post("/republish-all")
+async def api_republish_all(
+ admin: Account = Depends(check_admin),
+) -> dict:
+ """Force-republish every approved event to Nostr relays. Admin only.
+
+ Used by the catalog-bump migration that introduced the AIO ticket
+ tags: existing events on a deployed instance were published before
+ the publisher learned the new tag set, so they don't carry
+ tickets_available / tickets_sold / etc. until something triggers
+ a republish. This endpoint walks the approved list and re-emits
+ each calendar event so connected clients see the new metadata
+ without waiting for a per-event edit.
+
+ Errors are swallowed per-event (logged inside the publisher) so
+ one bad event doesn't block the rest. Returns a count summary.
+ """
+ events = await get_all_events()
+ approved = [e for e in events if e.status == "approved" and not e.canceled]
+ for event in approved:
+ await publish_or_delete_nostr_event(event)
+ return {"republished": len(approved), "total": len(events)}
+
+
@events_api_router.get("/settings")
async def api_get_settings(
admin: Account = Depends(check_admin),
From fa2a6e40f0198d9ef26552434c3c63f81f520c82 Mon Sep 17 00:00:00 2001
From: Padreug
Date: Sat, 23 May 2026 21:00:30 +0200
Subject: [PATCH 25/43] feat(ui): "Republish all" button on the admin Settings
card
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Surfaces the POST /republish-all endpoint added in the previous
commit. Lives in the existing admin-gated Settings card on the
events extension landing page, so the LNbits operator can trigger
the migration without curl + access tokens.
Confirm dialog before firing (the endpoint emits one Nostr event
per approved row, fine to retry but worth a click of friction).
Notification shows the republished/total count on success.
Self-closing tags expanded per the LNbits UMD rule
(webapp CLAUDE.md > LNbits + Quasar UMD gotchas) — q-separator
and q-btn would silently nest wrong otherwise.
Co-Authored-By: Claude Opus 4.7 (1M context)
---
static/js/index.js | 28 ++++++++++++++++++++++++++++
static/js/index.vue | 22 ++++++++++++++++++++++
2 files changed, 50 insertions(+)
diff --git a/static/js/index.js b/static/js/index.js
index 022399c..8ec41a6 100644
--- a/static/js/index.js
+++ b/static/js/index.js
@@ -9,6 +9,7 @@ window.PageEvents = {
pendingEvents: [],
allUserEvents: [],
isAdmin: false,
+ republishing: false,
settings: {
auto_approve: false
},
@@ -275,6 +276,33 @@ window.PageEvents = {
.catch(LNbits.utils.notifyApiError)
})
},
+ republishAllEvents() {
+ LNbits.utils
+ .confirmDialog(
+ 'Re-emit every approved event to Nostr relays? This is safe ' +
+ 'to run multiple times but generates one event per approved row.'
+ )
+ .onOk(() => {
+ this.republishing = true
+ LNbits.api
+ .request('POST', '/events/api/v1/events/republish-all')
+ .then(response => {
+ Quasar.Notify.create({
+ type: 'positive',
+ message:
+ 'Republished ' +
+ response.data.republished +
+ ' of ' +
+ response.data.total +
+ ' events'
+ })
+ })
+ .catch(LNbits.utils.notifyApiError)
+ .finally(() => {
+ this.republishing = false
+ })
+ })
+ },
foldDateTime(day, time) {
// Combine separate date/time inputs into the wire format
// expected by the events extension: "YYYY-MM-DD" or
diff --git a/static/js/index.vue b/static/js/index.vue
index 4117f47..befc230 100644
--- a/static/js/index.vue
+++ b/static/js/index.vue
@@ -15,6 +15,28 @@
>
+
From ced6ca2b2b7591788424ea990470405dc4275fbc Mon Sep 17 00:00:00 2001
From: Padreug
+ Republish to Nostr
+
+
+ Re-emit every approved event so connected clients pick
+ up the latest tag set. Useful after the extension
+ publisher changes (e.g. new tickets_* tags) so existing
+ events don't need a per-event edit.
+
+
+
+
+ New Event
+
+
+ Re-emit your approved events to Nostr relays. Useful after
+ a publisher upgrade or if a relay dropped your events.
+
-
-
-
- All Users' Events
-
-
-
- All Users' Events
-
-
@@ -409,6 +364,51 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ All Users' Events
+
+
+