first commit

backend/app/api/routes/tickets.py

@@ -0,0 +1,37 @@
+from fastapi import APIRouter, Header, Request
+
+from app.core.config import get_settings
+from app.core.deps import CurrentUser, DbSession
+from app.core.rate_limit import enforce_rate_limit
+from app.schemas.orders import TicketPublic
+from app.schemas.tickets import TicketDetailPublic, TicketVerifyRequest, TicketVerifyResponse
+from app.services.orders import get_ticket_for_user, list_user_tickets, ticket_to_public
+from app.services.tickets import assert_checkin_authorized, get_ticket_detail_for_user, verify_ticket_at_gate
+
+router = APIRouter(prefix="/tickets", tags=["tickets"])
+
+
+@router.get("/my", response_model=list[TicketPublic])
+def my_tickets(db: DbSession, user: CurrentUser) -> list[TicketPublic]:
+    rows = list_user_tickets(db, user.id)
+    return [TicketPublic.model_validate(ticket_to_public(row)) for row in rows]
+
+
+@router.post("/verify", response_model=TicketVerifyResponse)
+def verify_ticket(
+    body: TicketVerifyRequest,
+    request: Request,
+    db: DbSession,
+    x_check_in_key: str | None = Header(default=None, alias="X-Check-In-Key"),
+) -> TicketVerifyResponse:
+    enforce_rate_limit(request, scope="ticket_verify", limit=60, window_seconds=60)
+    settings = get_settings()
+    assert_checkin_authorized(settings, x_check_in_key)
+    result = verify_ticket_at_gate(db, body.qr_token.strip())
+    return TicketVerifyResponse.model_validate(result)
+
+
+@router.get("/{ticket_id}", response_model=TicketDetailPublic)
+def get_ticket(ticket_id: int, db: DbSession, user: CurrentUser) -> TicketDetailPublic:
+    detail = get_ticket_detail_for_user(db, ticket_id, user.id)
+    return TicketDetailPublic.model_validate(detail)