EN VI
Product Overview — March 2026

OnePass

Enterprise-grade event ticketing with integrated queue management, seating, payments, merchandise, and content — built for scale.

8
Microservices
4
Applications
100+
API Endpoints
40+
UI Screens
20+
DB Tables

Platform Modules

Click each module to expand feature details

👤
User & Authentication
Registration, login, profiles, role-based access control
Live ▼
Authentication
Email/Password Registration
Secure signup with validation (8-128 chars)
Login & Session Management
JWT-based auth, 24h token expiry
Logout
Secure session termination
Email Verification
Tracked verification status per user
User Management
Profile Management
Edit name, phone, personal details
Role-Based Access (RBAC)
Customer, Admin, Super Admin roles
Admin User Management
List, search, role assignment, suspension
Activity Tracking
Last login, status monitoring
🎪
Event Catalog
Event creation, publishing, discovery, and categorization
Live ▼
Event Lifecycle
Draft → Publish Workflow
Create in draft, configure, then publish to go live
Event Categories
Music, sports, theater, company, outdoor
Scheduling
Event date, doors open, public start, sale window
Queue Toggle
Enable/disable waiting room per event
Discovery
Public Event Listing
Paginated, filterable by category and date
SEO-Friendly Slugs
URL-friendly unique identifiers
Rich Media
Banners, images, descriptions
Pre-Sale Countdown
Visible event detail before sale starts
💺
Seating & Inventory
Venues, seat maps, holds, real-time availability
Live ▼
Venue Management
Venue CRUD
Name, address, capacity configuration
Seat Map Designer
Sections, rows, categories (VIP, balcony, etc.)
CSV Bulk Import
Upload up to 10K seats, 5MB limit, validation
Seat Map Preview
SVG/JSON visual layout preview
Inventory Control
Real-Time Availability
Live seat status: available, held, sold, blocked
Temporary Holds
10-min TTL with automatic expiration
Concurrency Protection
SELECT FOR UPDATE prevents double-booking
Admin Override
Lock/unlock seats, manual status control
🛒
Order Management
Checkout flow, state machine, pricing, expiration
Live ▼
Order Lifecycle
State Machine
Draft → Pending → Paid → Confirmed → Refunded/Cancelled/Expired
Auto Order Numbers
TKT-YYYY-NNNNNN sequential format
Auto Expiration
Unpaid orders expire, seats return to available
Queue Validation
Validates queue session at order creation
Pricing
Fee Calculation
Subtotal + 10% fees + 8% tax
Currency Precision
roundMoney for accurate calculations
Admin Order Management
List, filter, cancel, refund from dashboard
Optimistic Locking
Prevents concurrent state transition conflicts
💳
Payment Processing
PayPal integration, webhooks, refunds
Live ▼
Payment Flow
PayPal SDK Integration
Create, capture, refund operations
Two-Stage Capture
Authorize → Capture for secure processing
Webhook Processing
Idempotent, signature-verified callbacks
Fail-Closed Security
Rejects webhooks when config missing
Refunds
Full & Partial Refunds
Cumulative sum validation for partial refunds
Admin Refund Dashboard
View, issue, and track refund history
Transactional Processing
DB transaction ensures consistency
Status Tracking
Pending → Authorized → Captured → Refunded
⏳
Queue & Waiting Room
Virtual queue, bot protection, batch release, fair access
Live ▼
Queue System
Join & Position Tracking
Real-time position and estimated wait time
Batch Release
Configurable batch size and release intervals
Session Heartbeat
Keep-alive pings prevent premature expiration
One-Time Use Tokens
Session marked "used" on first checkout entry
Security & Fairness
Bot Guard Middleware
Automated detection and blocking
Visitor Fingerprinting
Browser + hardware + timezone hash
Multi-Tab Prevention
Fingerprint dedup blocks multiple sessions
Checkout Gate
Seating + Order services validate queue access
Waiting Room UI
Ring Progress Display
Visual circular progress indicator
State Machine UI
Join → Queue → Soon → Go → Redirect
Session Resumption
Refresh without losing queue position
Auto-Redirect
3-second countdown then redirect to event
🎫
Tickets & Check-In
QR code generation, scanning, entry management
Phase 6 ▼
Ticket Issuance
Auto-Issue on Payment
1 ticket per seat, triggered by order confirmation
QR Code Generation
Unique codes with ticket ID + order ID + hash
My Tickets View
User dashboard with upcoming and past events
Ticket Cancellation
Cancel with automatic refund flow
Check-In System
QR Scanner
Mobile-friendly camera scanning
Manual Check-In
Admin lookup by name, order, or ticket number
Double-Scan Prevention
Status → USED after first scan
Attendance Stats
Check-in rate, no-show tracking per event
📄
Content & Merchandise
Custom pages, blog, merch shop — OnePage CMS
Live ▼
Custom Pages
Page Builder
Create branded landing pages with CMS
Featured Events
Link and showcase events on pages
Publish Workflow
Draft → Published with admin control
Image Upload
S3 presigned URLs for media management
Blog
Post Management
Create, edit, publish/unpublish blog posts
Comments
User comments with optional authentication
Emoji Reactions
Interactive engagement on posts
SEO Optimization
Meta tags and structured data
Merchandise Shop
Product Catalog
Products with variants (size, color)
Inventory Tracking
Stock levels per variant
Payment Integration
PayPal + Stripe deferred capture
Order Tracking
Fulfillment status and order history
⚙️
Admin Portal
Dashboard, analytics, operations, check-in
Live ▼
Dashboard & Analytics
Overview Dashboard
Revenue, orders, check-ins at a glance
Queue Monitor
Real-time stats with 10s auto-refresh
Sales Reports
Revenue breakdown, attendance, refund tracking
Event Analytics
Per-event metrics: sold, checked-in, no-shows
Operations
Event Wizard
Step-by-step event creation flow
Seat Map Editor
Visual editor with CSV import
Queue Configuration
Batch size, release delay, thresholds
Mobile Check-In
Responsive QR scanner for entry staff

End-to-End User Journey

Complete ticket purchase flow from discovery to entry

Browse Events
→
Pre-Sale
Countdown
→
Join Queue
→
Waiting Room
→
Select Seats
→
Checkout
→
Pay (PayPal)
→
Get Tickets
→
QR Check-In

Technology Stack

Modern, serverless, scalable architecture

Backend

TypeScript Hono AWS Lambda Node.js

Frontend

React Remix (SSR) Vite Tailwind CSS

Database

PostgreSQL Drizzle ORM Redis

Infrastructure

AWS API Gateway S3 / CloudFront SQS EventBridge

DevOps

Pulumi Terraform Turborepo pnpm

Payments

PayPal Stripe (planned) Webhooks

Platform Capacity

Designed for high-demand events

1,000+
Concurrent Users / Event
10,000+
Queue Capacity
50,000
Max Seats / Import
< 500ms
Event Listing Latency
< 300ms
Queue Status Check
100
Users Released / Batch

Development Roadmap

10-phase delivery plan — 6 of 10 complete

Phase 0 — Complete
Foundation & Infrastructure
AWS setup, Lambda deployments, CI/CD pipeline, database schema, auth infrastructure
AWSRDSLambdaCI/CD
Phase 1 — Complete
Event Catalog & User Management
User registration/login, event CRUD, categories, publishing workflow, basic admin portal
AuthEventsAdmin UI
Phase 2 — Complete
Seating & Inventory Management
Venue management, seat maps, CSV import, interactive seat selection, hold system with TTL
VenuesSeat MapsCSV ImportHolds
Phase 3 — Complete
Order Management & Checkout
Order lifecycle state machine, pricing (fees + tax), checkout flow, auto-expiration, concurrency control
OrdersState MachinePricing
Phase 4 — Complete
Payment Integration
PayPal SDK wrapper, two-stage capture, webhook processing, partial refunds, fail-closed security
PayPalWebhooksRefunds
Phase 5 — Complete
Waiting Room Integration
Queue service, bot guard, fingerprinting, batch release, checkout gate, waiting room UI, admin queue monitor
QueueBot GuardWaiting RoomSQS
Phase 6 — Next Up
Ticket Management & Check-In
QR code generation, digital tickets, scanner app, attendance tracking, no-show reporting
QR CodesCheck-InScanning
Phase 7 — Planned
Admin Operations & Reporting
Advanced dashboard, revenue analytics, user management tools, automated reports
DashboardReportsAnalytics
Phase 8 — Planned
Performance & Polish
Load testing, caching optimization, security hardening, WCAG accessibility, mobile responsiveness
PerformanceSecurityA11y
Phase 9 — Planned
Beta Testing & Launch
User acceptance testing, documentation, production readiness, monitoring, launch prep
UATDocsLaunch

Security & Compliance

Enterprise-grade protection at every layer

Authentication

JWT Tokens bcrypt (salt 12) 24h Expiry RBAC

Anti-Fraud

Bot Guard Fingerprinting One-Time Tokens Rate Limiting

Data Protection

HTTPS Everywhere Encryption at Rest HMAC Signatures Webhook Verification

Compliance

GDPR Ready PCI via PayPal WCAG 2.1 AA Audit Trails