NorawTickets

Listings, checkout through Kaspi and card, a hidden back office with agency-contract economics, and a PWA scanner at the door. Three interfaces, three roles, one database.

What is inside

• A ticket QR is neither a link nor an id but base64url("id.HMAC-SHA256(id+nonce)"). The server recomputes the signature and compares in constant time, so a ticket cannot be drawn in Photoshop
• Seats are held for 15 minutes by an atomic Redis Lua script; availability is quantity − sold − held, and issuance runs as one idempotent Postgres transaction
• Agency economics: a 7% commission and a gross / commission / net snapshot inside the order — an organizer only ever sees their own events
• The door scanner is a PWA: it floods the screen with colour and plays a sound before the checker has read a word. Green is valid, red already used, orange voided
• Access tokens live 15 minutes; the refresh token sits in a rotated HttpOnly cookie and is stored only as a hash. Nothing lives in localStorage
• Three languages, a region picker, rate limiting on login and payment, Sentry and Vitest tests

Stack

Screens