🤖 Prefill public checkout from URL query params (name/email + optional lock)

[skvost]

What & why

Integrators that link to or embed the public checkout (a mobile app WebView, a personalized email link) often already know the attendee's name and email, but there's currently no way to pre-fill the checkout "Your Details" form. The fields are controlled Mantine inputs with generated ids, so DOM injection from an embedder is unreliable. This adds opt-in, frontend-only query-param prefill.

Note: issue creation on this repo appears to be restricted for my account, so I'm opening this directly with a full description per CONTRIBUTING. Happy to move the discussion wherever you prefer, and to adjust the param names / behaviour.

Behavior

• Details step (/checkout/:eventId/:orderShortId/details) reads first_name, last_name, email and prefills the buyer's "Your Details" form (and copies to ticket attendees). email_confirmation is derived from email; a malformed email is ignored. Only the waitlist param was read here before, so there's no collision.
• lock=true (or 1) makes the prefilled fields read-only — per-field: a field locks only if its param was provided. When locked, the "copy details to attendees" control is hidden so locked values can't be blanked.
• Propagation: the same params are carried from the event page through order creation to the details step, so /event/:id/:slug?first_name=…&email=…&lock=true works — not just a direct checkout deep-link.

Scope

Frontend-only. No backend, no migrations, no new dependencies, no new translatable strings.

• New frontend/src/hooks/useCheckoutPrefill.ts — parses/validates the params; exports CHECKOUT_PREFILL_PARAM_KEYS as the single source of truth.
• CollectInformation — prefill buyer + ticket attendees, per-field lock, hide the copy-control under lock.
• SelectProducts — forward the prefill params on the checkout navigation.

+ in email must be percent-encoded (%2B), per normal URL query semantics. npx tsc --noEmit introduces no new type errors.

Testing

Manually verified against a local stack (Docker), driving the real event page → select ticket → Continue → details flow, on both a free and a paid event:

Scenario	Result
Full prefill + lock=true	✅ all fields filled + locked; copy-control hidden
Full prefill, no lock	✅ filled + editable; copy-control visible
lock=1	✅ locks
lock=false / other values	✅ does not lock
Email only + lock	✅ email + confirm locked; names editable
Names only (no email)	✅ names filled; email blank
Invalid email	✅ ignored (field blank + editable)
Plus-address, encoded (%2B)	✅ kept
Raw + in email	✅ dropped (decodes to space → invalid)
Whitespace-only name	✅ dropped
lock with no fields	✅ locks nothing
No params	✅ behavior unchanged
Propagation: event → details	✅ params ride through order creation
Multiple attendees (qty 2+)	✅ each attendee prefilled + locked per-field

Screenshots: event page with prefill link, and the resulting locked details page (attached below).

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[skvost]

[skvost]

I have read the CLA Document and I hereby sign the CLA