Add event lineup and schedule, and customisable homepage sections (#1406)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: daveearley

CLAUDE.md

@@ -166,6 +166,21 @@ Gotchas:
 - Code lives under `backend/ee/Seating/` and `frontend/src/ee/seating/`. A product is seated iff a price **band** links to it (never call a band a tier), and `seat_claims` has no status column — HELD/SOLD/BLOCKED derive from the owning order via `SeatClaimRepository`, so never add a sweeper or stored status
 - Any new path that sells a ticket must claim a seat (under `SeatingEventLockService::lock`, order lock first) or refuse seated products, and anything that voids a ticket must release its claim. Rules that exist in both PHP and TS are pinned to `backend/tests/Fixtures/seating/` — change the fixture first
 
+#### Lineup & schedule
+- Profiles (speakers, artists, hosts) belong to the organizer and are reused across events. `event_lineup_entries` puts a profile on an event (billing tier, role, `is_hidden`), `event_spaces` are stages/rooms (optionally tied to one of the event's `event_locations`), and `event_schedule_items` are time slots linked to lineup entries through `event_schedule_item_performers`
+- Writing a profile needs organizer access; event-only members can add existing profiles to their event's lineup and schedule. Hidden entries, and untitled slots whose people are all hidden, are filtered for the public endpoint in `GetEventLineupHandler`
+- Profile photos are `PROFILE_IMAGE` images on the generic `/images` endpoint, ordered by `images.sort_order` (nulls last, so new uploads go to the end); the first is the main photo. Link types come from `ProfileLinkType::fromUrl`, never from the client
+- Schedule days use a 05:00 boundary (`DAY_BOUNDARY_HOUR` in `utilites/lineupSchedule.ts`, kept free of dependencies so e2e unit specs can import it) so late sets stay on their night. Per-date lineups for recurring events are derived, never stored: a date shows the slots that fall on it plus people with no slots at all (`lineupForOccurrence`)
+- Duplicating an event copies its lineup through `EventLineupCloneService`; single events shift slot times by the start-date offset, recurring events keep them
+- The run-sheet export (`LineupExport`) and the import share column names: the browser parses CSV/XLSX itself (`utilites/spreadsheetReader.ts`, XLSX via `DecompressionStream` + `DOMParser`, no library) and `utilites/lineupImport.ts` (dependency-free, unit-tested from e2e) builds the preview; the server only receives clean JSON. Header labels are translated with the Lingui context "Lineup spreadsheet column", whose translations must equal the backend's `__()` header strings so a localized export re-imports. People and stages match by `nameKey` (lowercase, collapsed whitespace) on both sides — keep `ImportLineupHandler::key` and `nameKey` identical or the preview lies. The preview mirrors every server validation limit so one bad cell never fails the whole import. `ImportLineupHandler` locks the event row, writes through repositories in bulk (not the per-row upsert handlers — far too slow for 1,000 slots), skips slots that already exist, and dispatches the spam check once. Import needs organizer write access because it creates profiles
+- Lineup highlights in order and ticket emails come from `EmailLineupHighlightsService`, gated on the LINEUP/SCHEDULE homepage sections, and per-date only for recurring events (the same rule the widget strip and event page use). Mailables keep the DTO in a non-readonly property with a `null` default so mails queued before a deploy still unserialize
+
+#### Homepage sections
+- The event homepage renders `event_settings.homepage_sections` in order: one JSON list of `{id, type, enabled, heading, …}`. A `null` list, or a missing built-in, falls back to the default order (`resolveHomepageSections`), so events that never saved sections look exactly as before. The hero and footer are fixed. `TICKETS` is always present and enabled, enforced server-side
+- The About section renders `event.description`; never copy the description into a section (SEO, listings, emails and the API all read it). Extra copy belongs in `TEXT` sections
+- `HomepageSectionsSanitizer` is the only writer: it purifies HTML, de-duplicates built-ins, keeps only gallery/sponsor image ids that are this event's `EVENT_GALLERY`/`EVENT_SPONSOR_LOGO` images and only allows YouTube/Vimeo video links. New section text must also be added to `EventSpamCheckContentService::homepageSectionContent`
+- Organizer pages use the same system via `organizer_settings.homepage_sections` (`sanitizeForOrganizer`, built-ins `EVENTS` (always shown)/`ABOUT`/`CONTACT`/`PAST_EVENTS`, images `ORGANIZER_GALLERY`/`ORGANIZER_SPONSOR_LOGO`). Layout rules live in `utilites/homepageSectionLayout.ts` (dependency-free, unit-tested from e2e): a leading run of ABOUT/CONTACT renders inside the profile card, and PAST_EVENTS directly after EVENTS is the Past tab, elsewhere its own list — so the default order reproduces the classic organizer page
+
 #### Abuse & spam
 - Treat every user-typed string that can reach an email to an unverified address as a spam vector. Never greet with a user-supplied name in account/auth emails, and validate person-name fields with `PersonNameRule` (blocks URLs, phone numbers, markup; allows every script)
 - Buyer/attendee mail that carries event content implements `ContainsEventContent` (+ `ProvidesEventContent`). `BaseMail::send()` swaps it for the content-free `UnpublishedEventUpdateMail` while the event is DRAFT or PENDING_MANUAL_REVIEW, unless every recipient is a verified member of the event's account. New event-scoped mailables must implement the interface

backend/app/DomainObjects/Enums/HomepageSectionType.php

@@ -0,0 +1,99 @@
+<?php
+
+namespace HiEvents\DomainObjects\Enums;
+
+enum HomepageSectionType: string
+{
+    use BaseEnum;
+
+    case TICKETS = 'TICKETS';
+    case ABOUT = 'ABOUT';
+    case LINEUP = 'LINEUP';
+    case SCHEDULE = 'SCHEDULE';
+    case LOCATION = 'LOCATION';
+    case ORGANIZER = 'ORGANIZER';
+    case EVENTS = 'EVENTS';
+    case CONTACT = 'CONTACT';
+    case PAST_EVENTS = 'PAST_EVENTS';
+    case TEXT = 'TEXT';
+    case GALLERY = 'GALLERY';
+    case FAQ = 'FAQ';
+    case VIDEO = 'VIDEO';
+    case SPONSORS = 'SPONSORS';
+
+    /**
+     * @return self[]
+     */
+    public static function eventBuiltIns(): array
+    {
+        return [self::TICKETS, self::ABOUT, self::LINEUP, self::SCHEDULE, self::LOCATION, self::ORGANIZER];
+    }
+
+    /**
+     * @return self[]
+     */
+    public static function organizerBuiltIns(): array
+    {
+        return [self::EVENTS, self::ABOUT, self::CONTACT, self::PAST_EVENTS];
+    }
+
+    /**
+     * @return self[]
+     */
+    public static function customTypes(): array
+    {
+        return [self::TEXT, self::GALLERY, self::FAQ, self::VIDEO, self::SPONSORS];
+    }
+
+    /**
+     * @return string[]
+     */
+    public static function eventValues(): array
+    {
+        return array_map(static fn (self $type) => $type->value, [...self::eventBuiltIns(), ...self::customTypes()]);
+    }
+
+    /**
+     * @return string[]
+     */
+    public static function organizerValues(): array
+    {
+        return array_map(static fn (self $type) => $type->value, [...self::organizerBuiltIns(), ...self::customTypes()]);
+    }
+
+    public function isEnabledIn(mixed $sections): bool
+    {
+        if (! is_array($sections)) {
+            return true;
+        }
+
+        foreach ($sections as $section) {
+            if (($section['type'] ?? null) === $this->value) {
+                return (bool) ($section['enabled'] ?? true);
+            }
+        }
+
+        return true;
+    }
+
+    public static function publicSections(mixed $sections): mixed
+    {
+        if (! is_array($sections)) {
+            return $sections;
+        }
+
+        return array_values(array_filter(
+            $sections,
+            static fn ($section) => ($section['enabled'] ?? true)
+                || ! in_array(self::tryFrom($section['type'] ?? ''), self::customTypes(), true),
+        ));
+    }
+
+    public static function isVideoUrl(string $url): bool
+    {
+        $host = strtolower((string) parse_url($url, PHP_URL_HOST));
+        $host = preg_replace('/^(www|m)\./', '', $host);
+
+        return in_array($host, ['youtube.com', 'youtu.be', 'vimeo.com', 'player.vimeo.com'], true);
+    }
+}

backend/app/DomainObjects/Enums/ImageType.php

@@ -4,6 +4,7 @@
 
 use HiEvents\DomainObjects\EventDomainObject;
 use HiEvents\DomainObjects\OrganizerDomainObject;
+use HiEvents\DomainObjects\ProfileDomainObject;
 use HiEvents\DomainObjects\UserDomainObject;
 use InvalidArgumentException;
 
@@ -16,16 +17,24 @@ enum ImageType
     // Event images
     case EVENT_COVER;
     case TICKET_LOGO;
+    case EVENT_GALLERY;
+    case EVENT_SPONSOR_LOGO;
 
     // Organizer images
     case ORGANIZER_LOGO;
     case ORGANIZER_COVER;
+    case ORGANIZER_GALLERY;
+    case ORGANIZER_SPONSOR_LOGO;
+
+    case PROFILE_IMAGE;
 
     public static function eventImageTypes(): array
     {
         return [
             self::EVENT_COVER,
             self::TICKET_LOGO,
+            self::EVENT_GALLERY,
+            self::EVENT_SPONSOR_LOGO,
         ];
     }
 
@@ -34,6 +43,15 @@ public static function organizerImageTypes(): array
         return [
             self::ORGANIZER_LOGO,
             self::ORGANIZER_COVER,
+            self::ORGANIZER_GALLERY,
+            self::ORGANIZER_SPONSOR_LOGO,
+        ];
+    }
+
+    public static function profileImageTypes(): array
+    {
+        return [
+            self::PROFILE_IMAGE,
         ];
     }
 
@@ -52,6 +70,11 @@ public static function getMinimumDimensionsMap(ImageType $imageType): array
             self::TICKET_LOGO->name => [100, 100],
             self::ORGANIZER_LOGO->name => [100, 100],
             self::ORGANIZER_COVER->name => [600, 50],
+            self::PROFILE_IMAGE->name => [200, 200],
+            self::EVENT_GALLERY->name => [400, 300],
+            self::EVENT_SPONSOR_LOGO->name => [80, 40],
+            self::ORGANIZER_GALLERY->name => [400, 300],
+            self::ORGANIZER_SPONSOR_LOGO->name => [80, 40],
         ];
 
         return $map[$imageType->name] ?? $map[self::GENERIC->name];
@@ -67,6 +90,10 @@ public function getEntityType(): string
             return OrganizerDomainObject::class;
         }
 
+        if (in_array($this, self::profileImageTypes())) {
+            return ProfileDomainObject::class;
+        }
+
         if (in_array($this, self::genericImageTypes())) {
             return UserDomainObject::class;
         }

backend/app/DomainObjects/Enums/LineupBillingTier.php

@@ -0,0 +1,12 @@
+<?php
+
+namespace HiEvents\DomainObjects\Enums;
+
+enum LineupBillingTier: string
+{
+    use BaseEnum;
+
+    case HEADLINER = 'HEADLINER';
+    case FEATURED = 'FEATURED';
+    case STANDARD = 'STANDARD';
+}

backend/app/DomainObjects/Enums/ProfileLinkType.php

@@ -0,0 +1,70 @@
+<?php
+
+namespace HiEvents\DomainObjects\Enums;
+
+enum ProfileLinkType: string
+{
+    use BaseEnum;
+
+    case SPOTIFY = 'SPOTIFY';
+    case APPLE_MUSIC = 'APPLE_MUSIC';
+    case SOUNDCLOUD = 'SOUNDCLOUD';
+    case BANDCAMP = 'BANDCAMP';
+    case YOUTUBE = 'YOUTUBE';
+    case INSTAGRAM = 'INSTAGRAM';
+    case TIKTOK = 'TIKTOK';
+    case X = 'X';
+    case FACEBOOK = 'FACEBOOK';
+    case LINKEDIN = 'LINKEDIN';
+    case GITHUB = 'GITHUB';
+    case WEBSITE = 'WEBSITE';
+
+    public static function fromUrl(string $url): self
+    {
+        $host = strtolower((string) parse_url($url, PHP_URL_HOST));
+
+        return match (true) {
+            self::hostMatches($host, ['spotify.com', 'spotify.link']) => self::SPOTIFY,
+            self::hostMatches($host, ['music.apple.com']) => self::APPLE_MUSIC,
+            self::hostMatches($host, ['soundcloud.com']) => self::SOUNDCLOUD,
+            self::hostMatches($host, ['bandcamp.com']) => self::BANDCAMP,
+            self::hostMatches($host, ['youtube.com', 'youtu.be']) => self::YOUTUBE,
+            self::hostMatches($host, ['instagram.com']) => self::INSTAGRAM,
+            self::hostMatches($host, ['tiktok.com']) => self::TIKTOK,
+            self::hostMatches($host, ['x.com', 'twitter.com']) => self::X,
+            self::hostMatches($host, ['facebook.com', 'fb.com']) => self::FACEBOOK,
+            self::hostMatches($host, ['linkedin.com']) => self::LINKEDIN,
+            self::hostMatches($host, ['github.com']) => self::GITHUB,
+            default => self::WEBSITE,
+        };
+    }
+
+    /**
+     * @param  string[]  $urls
+     * @return array<int, array{type: string, url: string}>
+     */
+    public static function linksFromUrls(array $urls): array
+    {
+        return collect($urls)
+            ->map(fn (string $url) => trim($url))
+            ->filter()
+            ->unique()
+            ->values()
+            ->map(fn (string $url) => [
+                'type' => self::fromUrl($url)->value,
+                'url' => $url,
+            ])
+            ->all();
+    }
+
+    private static function hostMatches(string $host, array $domains): bool
+    {
+        foreach ($domains as $domain) {
+            if ($host === $domain || str_ends_with($host, '.'.$domain)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}

backend/app/DomainObjects/EventDomainObject.php

@@ -35,6 +35,12 @@ class EventDomainObject extends Generated\EventDomainObjectAbstract implements I
 
     private ?Collection $affiliates = null;
 
+    private ?Collection $eventLineupEntries = null;
+
+    private ?Collection $eventSpaces = null;
+
+    private ?Collection $eventScheduleItems = null;
+
     private ?Collection $eventOccurrences = null;
 
     private ?EventSettingDomainObject $settings = null;
@@ -482,4 +488,40 @@ public function setEventLocation(?EventLocationDomainObject $eventLocation): sel
 
         return $this;
     }
+
+    public function getEventLineupEntries(): ?Collection
+    {
+        return $this->eventLineupEntries;
+    }
+
+    public function setEventLineupEntries(?Collection $eventLineupEntries): self
+    {
+        $this->eventLineupEntries = $eventLineupEntries;
+
+        return $this;
+    }
+
+    public function getEventSpaces(): ?Collection
+    {
+        return $this->eventSpaces;
+    }
+
+    public function setEventSpaces(?Collection $eventSpaces): self
+    {
+        $this->eventSpaces = $eventSpaces;
+
+        return $this;
+    }
+
+    public function getEventScheduleItems(): ?Collection
+    {
+        return $this->eventScheduleItems;
+    }
+
+    public function setEventScheduleItems(?Collection $eventScheduleItems): self
+    {
+        $this->eventScheduleItems = $eventScheduleItems;
+
+        return $this;
+    }
 }

backend/app/DomainObjects/EventLineupEntryDomainObject.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace HiEvents\DomainObjects;
+
+class EventLineupEntryDomainObject extends Generated\EventLineupEntryDomainObjectAbstract
+{
+    private ?ProfileDomainObject $profile = null;
+
+    private ?EventDomainObject $event = null;
+
+    public function getEvent(): ?EventDomainObject
+    {
+        return $this->event;
+    }
+
+    public function setEvent(?EventDomainObject $event): self
+    {
+        $this->event = $event;
+
+        return $this;
+    }
+
+    public function getProfile(): ?ProfileDomainObject
+    {
+        return $this->profile;
+    }
+
+    public function setProfile(?ProfileDomainObject $profile): self
+    {
+        $this->profile = $profile;
+
+        return $this;
+    }
+}

backend/app/DomainObjects/EventScheduleItemDomainObject.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace HiEvents\DomainObjects;
+
+use Illuminate\Support\Collection;
+
+class EventScheduleItemDomainObject extends Generated\EventScheduleItemDomainObjectAbstract
+{
+    private ?Collection $performers = null;
+
+    public function getPerformers(): ?Collection
+    {
+        return $this->performers;
+    }
+
+    public function setPerformers(?Collection $performers): self
+    {
+        $this->performers = $performers;
+
+        return $this;
+    }
+}

backend/app/DomainObjects/EventScheduleItemPerformerDomainObject.php

@@ -0,0 +1,5 @@
+<?php
+
+namespace HiEvents\DomainObjects;
+
+class EventScheduleItemPerformerDomainObject extends Generated\EventScheduleItemPerformerDomainObjectAbstract {}