The website and the attendee account

Pages

Every page exists in English under /en and in Arabic under /ar. The website has no data of its own: every event, seat, hold, order and ticket comes from the Ticketory API.

"Sell tickets" and the organiser links send organisers to the dashboard's sign-in at NEXT_PUBLIC_DASHBOARD_URL.

The events catalogue

• A search over titles, summaries, venues, cities and organisers, a city, a date range and a category (workshop, talk, festival), kept in the address as q, city, from, to, category and page, so a search can be shared, refreshed and walked with back and forward.
• Only upcoming public events appear, soonest first. Drafts, unlisted, cancelled and archived events never do; an unlisted event sells by its link alone.
• A fresh seed lists 22 events from four organisers, three of them on now.

The event page and seat selection

• An event has no photograph: its title, date and colour are drawn as a ticket. The Schedule tab shows the agenda in the event's own time zone, and the Venue tab its access, transit and capacity.
• Reserved seating: Select seats opens the seat map. Choosing the first seat starts the hold, which keeps the seats for the organiser's hold time (ten minutes as seeded), counted on the server's clock. The map is read again every 20 seconds, works from the keyboard and has an accessible list view and zoom. One order holds at most 8 seats.
• General admission: the buyer chooses a quantity on the event page and presses Continue, which holds the places.
• A sold-out event stays open and can still be saved; a cancelled one says so and sells nothing.

• Events, venues and seat layouts

Checkout

Checkout needs no account. The buyer gives a first name, a last name and an email, chooses Stripe, PayPal or Test payment (whichever the API offers), accepts the terms and presses Continue to payment. The payment itself happens on the provider's own page, or on the test payment page that stands in for one; no card field is ever on the website. Free tickets show no payment method, and Get tickets opens the confirmation at once.

The hold belongs to the browser tab that made it. The confirmation shows passes only once the API reports the order paid.

• Orders, payments and refunds
• Tickets, passes and emails

The attendee account

• Create an account: first name, last name, email and a password of 8 to 72 characters with at least one letter and one digit. The API emails a six-digit verification code, valid for 24 hours; without a mail service the code is written to the API's log.
• Guest orders join the account: once the code is accepted, every order placed with that email becomes the account's own.
• My tickets: upcoming and past bookings with a calendar, and each pass with its QR code, its PDF and its calendar file.
• Orders: every order with its receipt and a timeline of what happened to it.
• Saved events: the star on an event saves it to the account. A visitor who is not signed in is sent to sign in first.
• Profile: the name and email (a new email asks to be verified again) and two email preferences. Event reminders (on by default) sends one email about a day before each event the attendee has tickets for, listing them. News and offers is only saved as the attendee's choice: the template sends no news emails. Ticket, receipt and refund emails always go out.
• Sign in: Remember me keeps the attendee signed in for 30 days instead of one. A wrong email and a wrong password read the same, and the password reset link works for one hour.

The seed includes an attendee with eight orders and four saved events; its sign-in details are in the installation guide.

• Installation

The contact form

A name, an email, a subject (a general question, tickets and orders, selling as an organiser, the Scale plan, or press) and a message of 10 to 2000 characters. Each one becomes an inquiry in the dashboard, with a notification to the team members who can read inquiries.

The form carries a hidden field that catches bots, sends the same message only once, and accepts five submissions per address in ten minutes. Behind a reverse proxy, set TRUST_PROXY=1 in the API's .env, or every visitor shares the proxy's allowance.

How changes reach the pages

The home, event, venue and organiser pages are prerendered and kept for an hour at most. When an event is published, edited, cancelled or sells out, the API tells the website to rebuild them at once, as long as both share the same REVALIDATE_SECRET. Docker Compose sets that up by itself; without Docker, put the same value in back-end/.env and storefront/.env. Seat availability, holds, tickets and the account pages are always read live.

• Configuration

Search engines

• Every page sets its own title, description, canonical address and the alternate language, built from NEXT_PUBLIC_SITE_URL, so set it to your real address before you build.
• /sitemap.xml lists every public page in both languages, every upcoming event in the catalogue, and every venue and organiser. /robots.txt points to it and keeps crawlers out of the account, checkout, order and sign-in pages.
• The account, checkout, confirmation, sign-in, saved events and seat selection pages are marked noindex.

Analytics and tracking tags

Six networks are wired in. Turn one on by putting its id in storefront/.env (with Docker Compose, in the .env beside docker-compose.yml) and rebuilding; an id left blank loads no script.

• If GA4 runs inside your Tag Manager container, leave the GA4 id blank, or every session is counted twice.
• NEXT_PUBLIC_ANALYTICS_CURRENCY (USD by default) is sent with an event that carries no currency of its own, and NEXT_PUBLIC_ANALYTICS_DEBUG=true logs each event to the browser console.
• The tags load as soon as the page does. If you serve visitors in the EU or the UK, put a consent banner in front of them first.

How the website's code fits together