feat: Add plugin to list squadup tickets

Author: bcbogdan

package-lock.json

@@ -0,0 +1,10 @@
+/** @type {import("eslint").Linter.Config} */
+module.exports = {
+  extends: [require.resolve("@shared/eslint/node.js")],
+  parserOptions: {
+    project: "tsconfig.json",
+    tsconfigRootDir: __dirname,
+    sourceType: "module",
+  },
+  ignorePatterns: ["**/*.test.ts", "**/*.spec.ts"],
+};

packages/squadup-nodejs/.eslintrc.js

@@ -0,0 +1,23 @@
+# SuperTokens SquadUp Plugin
+
+Adds an authenticated endpoint for listing SquadUp tickets for the current SuperTokens user.
+
+```ts
+import SquadUpPlugin from "@supertokens-plugins/squadup-nodejs";
+
+SuperTokens.init({
+  experimental: {
+    plugins: [
+      SquadUpPlugin.init({
+        apiKey: process.env.SQUADUP_API_KEY!,
+      }),
+    ],
+  },
+});
+```
+
+## Endpoint
+
+`GET /auth/plugin/squadup/tickets`
+
+The endpoint requires a SuperTokens session. It uses a passwordless email login method, or a verified third-party email login method, as the SquadUp lookup email.

packages/squadup-nodejs/README.md

@@ -0,0 +1,41 @@
+{
+  "name": "@supertokens-plugins/squadup-nodejs",
+  "version": "0.1.0",
+  "description": "SquadUp ticketing plugin for SuperTokens",
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "src"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "lint": "eslint ./src --ext .ts",
+    "test": "TEST_MODE=testing vitest run --pool=forks"
+  },
+  "keywords": [
+    "supertokens",
+    "squadup",
+    "ticketing",
+    "plugin"
+  ],
+  "license": "Apache-2.0",
+  "dependencies": {},
+  "peerDependencies": {
+    "supertokens-node": ">=23.0.0"
+  },
+  "devDependencies": {
+    "@shared/eslint": "*",
+    "@shared/nodejs": "*",
+    "@shared/tsconfig": "*",
+    "@types/node": "^20.0.0",
+    "eslint": "^8.57.0",
+    "tsup": "^8.0.2",
+    "typescript": "^5.7.3",
+    "vitest": "^1.3.1"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

packages/squadup-nodejs/package.json

@@ -0,0 +1,7 @@
+export const PLUGIN_ID = "supertokens-plugin-squadup";
+export const PLUGIN_SDK_VERSION = ["23.0.0", "23.0.1", ">=23.0.1"];
+export const HANDLE_BASE_PATH = "/plugin/squadup";
+
+export const DEFAULT_SQUADUP_BASE_URL = "https://www.squadup.com";
+export const DEFAULT_PAGE_SIZE = 100;
+export const DEFAULT_TICKET_AVAILABILITY_WINDOW_MS = 2 * 60 * 60 * 1000;

packages/squadup-nodejs/src/constants.ts

@@ -0,0 +1,6 @@
+export * from "./plugin";
+import { init } from "./plugin";
+export { init };
+export default { init };
+export * from "./types";
+export * from "./constants";

packages/squadup-nodejs/src/index.ts

@@ -0,0 +1,7 @@
+import { buildLogger } from "@shared/nodejs";
+import { PLUGIN_ID, PLUGIN_SDK_VERSION } from "./constants";
+
+export const { logDebugMessage, enableDebugLogs } = buildLogger(
+  PLUGIN_ID,
+  PLUGIN_SDK_VERSION,
+);

packages/squadup-nodejs/src/logger.ts

@@ -0,0 +1,253 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import SuperTokens from "supertokens-node";
+import { init } from "./plugin";
+import {
+  getEmailFromSession,
+  listTickets,
+  mapSquadUpAttendeesToEvents,
+  parsePageSize,
+} from "./pluginImplementation";
+import {
+  DEFAULT_PAGE_SIZE,
+  DEFAULT_SQUADUP_BASE_URL,
+  DEFAULT_TICKET_AVAILABILITY_WINDOW_MS,
+  HANDLE_BASE_PATH,
+} from "./constants";
+import { SquadUpPluginNormalisedConfig } from "./types";
+
+vi.mock("supertokens-node", () => ({
+  default: {
+    getUser: vi.fn(),
+  },
+}));
+
+const mockGetUser = vi.mocked(SuperTokens.getUser);
+
+const baseConfig: SquadUpPluginNormalisedConfig = {
+  apiKey: "squadup-api-key",
+  baseUrl: DEFAULT_SQUADUP_BASE_URL,
+  defaultPageSize: DEFAULT_PAGE_SIZE,
+  ticketAvailabilityWindowMs: DEFAULT_TICKET_AVAILABILITY_WINDOW_MS,
+};
+
+describe("squadup-nodejs plugin", () => {
+  beforeEach(() => {
+    vi.restoreAllMocks();
+    vi.useRealTimers();
+  });
+
+  it("throws if apiKey is missing", () => {
+    expect(() => init({ apiKey: "" })).toThrow(
+      "Missing apiKey in SquadUp plugin config",
+    );
+  });
+
+  it("throws if defaultPageSize is invalid", () => {
+    expect(() => init({ apiKey: "key", defaultPageSize: 0 })).toThrow(
+      "defaultPageSize must be a positive integer",
+    );
+  });
+
+  it("throws if ticketAvailabilityWindowMs is invalid", () => {
+    expect(() =>
+      init({ apiKey: "key", ticketAvailabilityWindowMs: -1 }),
+    ).toThrow("ticketAvailabilityWindowMs must be non-negative");
+  });
+
+  it("registers an authenticated tickets route", () => {
+    const plugin = init({ apiKey: "key" });
+    const routeResult = plugin.routeHandlers!({
+      appInfo: {
+        apiBasePath: {
+          getAsStringDangerous: () => "/auth",
+        },
+      },
+    } as any);
+
+    expect(routeResult.status).toBe("OK");
+    expect(routeResult.routeHandlers).toMatchObject([
+      {
+        path: `/auth${HANDLE_BASE_PATH}/tickets`,
+        method: "get",
+        verifySessionOptions: { sessionRequired: true },
+      },
+    ]);
+  });
+
+  it("uses passwordless email as the SquadUp lookup email", async () => {
+    mockGetUser.mockResolvedValue({
+      loginMethods: [
+        {
+          recipeId: "passwordless",
+          email: "pass@example.com",
+        },
+      ],
+    } as any);
+
+    await expect(getEmailFromSession(fakeSession("user-1"))).resolves.toBe(
+      "pass@example.com",
+    );
+  });
+
+  it("uses verified thirdparty email as the SquadUp lookup email", async () => {
+    mockGetUser.mockResolvedValue({
+      loginMethods: [
+        {
+          recipeId: "thirdparty",
+          email: "thirdparty@example.com",
+          verified: true,
+        },
+      ],
+    } as any);
+
+    await expect(getEmailFromSession(fakeSession("user-2"))).resolves.toBe(
+      "thirdparty@example.com",
+    );
+  });
+
+  it("rejects unverified thirdparty email users", async () => {
+    mockGetUser.mockResolvedValue({
+      loginMethods: [
+        {
+          recipeId: "thirdparty",
+          email: "thirdparty@example.com",
+          verified: false,
+        },
+      ],
+    } as any);
+
+    await expect(
+      getEmailFromSession(fakeSession("user-4")),
+    ).resolves.toBeUndefined();
+  });
+
+  it("passes pageSize as page_size to SquadUp", async () => {
+    const fetchMock = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify({ attendees: [] }), {
+        status: 200,
+      }),
+    );
+    vi.stubGlobal("fetch", fetchMock);
+
+    await listTickets(baseConfig, "tickets@example.com", 25);
+
+    expect(fetchMock).toHaveBeenCalledOnce();
+    const [url, opts] = fetchMock.mock.calls[0];
+    expect(String(url)).toBe(
+      "https://www.squadup.com/api/v3/attendees/search?access_token=squadup-api-key",
+    );
+    expect(JSON.parse(opts.body)).toEqual({
+      email: "tickets@example.com",
+      page_size: 25,
+    });
+  });
+
+  it("returns empty events when SquadUp returns 404", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(new Response("", { status: 404 })),
+    );
+
+    await expect(
+      listTickets(baseConfig, "missing@example.com"),
+    ).resolves.toEqual({
+      status: "OK",
+      events: [],
+    });
+  });
+
+  it("returns ERROR for non-404 SquadUp failures", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(new Response("", { status: 500 })),
+    );
+
+    await expect(
+      listTickets(baseConfig, "error@example.com"),
+    ).resolves.toMatchObject({
+      status: "ERROR",
+      message: "Failed to list SquadUp tickets",
+    });
+  });
+
+  it("hides QR and PDF URLs for future tickets", () => {
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date("2026-05-15T12:00:00.000Z"));
+
+    const events = mapSquadUpAttendeesToEvents(
+      [attendeeWithTicket("2026-05-15T15:00:01.000Z")],
+      DEFAULT_TICKET_AVAILABILITY_WINDOW_MS,
+    );
+
+    expect(events[0].tickets[0].pdf_url).toBeNull();
+    expect(events[0].tickets[0].qrcode_str).toBeNull();
+  });
+
+  it("keeps QR and PDF URLs for available tickets", () => {
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date("2026-05-15T12:00:00.000Z"));
+
+    const events = mapSquadUpAttendeesToEvents(
+      [attendeeWithTicket("2026-05-15T13:59:59.000Z")],
+      DEFAULT_TICKET_AVAILABILITY_WINDOW_MS,
+    );
+
+    expect(events[0].tickets[0].pdf_url).toBe(
+      "https://tickets.example.com/ticket.pdf",
+    );
+    expect(events[0].tickets[0].qrcode_str).toBe("qr-code");
+  });
+
+  it("rejects invalid pageSize query values", async () => {
+    await expect(
+      parsePageSize(
+        {
+          getKeyValueFromQuery: async () => "not-a-number",
+        } as any,
+        100,
+      ),
+    ).resolves.toEqual({
+      status: "BAD_INPUT_ERROR",
+      message: "pageSize must be a positive integer",
+    });
+  });
+});
+
+function fakeSession(userId: string) {
+  return {
+    getUserId: () => userId,
+  } as any;
+}
+
+function attendeeWithTicket(startAt: string) {
+  return {
+    event: {
+      id: "event-1",
+      name: "Event",
+      start_at: startAt,
+      end_at: startAt,
+      image: {
+        thumbnail_url: null,
+        default_url: null,
+      },
+      location: {
+        name: "Venue",
+        address_line_1: "123 Main St",
+      },
+      location_type: "venue",
+    },
+    attendee_guests: [
+      {
+        ticket: {
+          id: "ticket-1",
+          type: "General Admission",
+          event: {
+            start_at: startAt,
+          },
+          pdf_url: "https://tickets.example.com/ticket.pdf",
+          qrcode_str: "qr-code",
+        },
+      },
+    ],
+  };
+}