feat: Guest booking with email/phone OTP

[UmakanthKaspa]

closes: #89

Summary

Let guests book tickets without logging in. Event organizers can turn this on per event and pick how
to verify the guest: no check, email code, or phone code.

What changed

• New fields on Buzz Event: "Allow Guest Booking" toggle and "Verification Method" dropdown (None /
  Email OTP / Phone OTP)
• New API endpoints to send a 6-digit code by email or SMS, limited to 5 requests per hour
• Wrong code locks you out after 5 tries for 10 minutes, and each code can only be used once
• A user account is created for the guest silently (no password, no welcome email) so the booking has
  a real owner
• Booking page now works without login when guest booking is on — guests see only basic event info,
  not the full event doc
• Coupon per-user limit now checks the guest's actual email instead of the shared "Guest" user
• Frontend: guest contact form, code verification popup with resend timer, success screen with login
  link
• Navbar shows "Log In" button for guests

How to test

• 6 backend tests cover: booking without code, booking with code, disabled guest booking, wrong code,
  missing email, and lockout after too many tries
• 3 end-to-end browser tests cover: no verification, email code, and phone code
• CI sets e2e_test_mode so code endpoints return the code in the response instead of sending real
  emails/SMS

##Demo

Screen.Recording.2026-01-27.at.9.53.06.PM.mov

Screen.Recording.2026-01-27.at.9.59.53.PM.mov

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[NagariaHussain]

Let’s make both SMS and Email OTP options available to the user (they can also set it to No OTP verification btw). There is a PR somewhere in Framework repo by Bhushan to add generic phone OTP feature, from which we can borrow the code.

[UmakanthKaspa]

@NagariaHussain

Without OTP:

• How do we know the email is really theirs?
• If someone enters wrong email, tickets go to wrong person
• We create user account when guest books. Next time, how do we know it's the same person?

[NagariaHussain]

Let the event organisers decide. If someone is paying, they will enter their real email ID. If not the event organisers can turn it on.

[UmakanthKaspa]

@NagariaHussain

[NagariaHussain]

Let's add some e2e test @UmakanthKaspa

All the three scenarios:

• Guest
• Guest with email OTP
• Guest with phone OTP

You can use some flag in backend to return some hardcoded OTPs.

[NagariaHussain]

@UmakanthKaspa please add videos and relevant screenshots.

[UmakanthKaspa]

@NagariaHussain added

[NagariaHussain]

Looks odd, let's remove for now.

Instead of a toast let's show an error message below the input:

Use error message component from FrappeUI.

[NagariaHussain]

Commits are no longer conventional 😅

Let's maintain the convention.

[vishwajeet-13]

If I am logging in as a guest and buying a ticket for myself we shouldnt need to add our details two times?
Your details then attendee 1 details again

[UmakanthKaspa]

If I am logging in as a guest and buying a ticket for myself we shouldnt need to add our details two times? Your details then attendee 1 details again

@vishwajeet-13 Good catch! Will auto-fill Attendee 1 from guest details — they can edit if booking for someone else 👍

[UmakanthKaspa]

@vishwajeet-13

• Guest name/email/phone saved to localStorage
• Auto-fills attendee 1 on blur, only if field is empty
• User can edit both guest and attendee fields independently

Screen.Recording.2026-01-30.at.8.20.54.PM.mov

[NagariaHussain]

Can you add this case in the e2e test please?

[UmakanthKaspa]

@NagariaHussain added

[NagariaHussain]

Why maintain two config keys? in_test and allow_tests? Let's make "in_test" work (toggle before running UI tests too, check how it is toggled for unit tests) everywhere both in UI and unit tests.

[NagariaHussain]

Always look in Frappe code for patterns before reinventing them 😉

[UmakanthKaspa]

@NagariaHussain I tried bench execute toggle_test_mode - doesn't work before or after server start.

Why: bench execute runs in separate process. When bench start runs, those flags are lost.

Fix: We need either env var or site config. Currently using CI env var. Can switch to allow_tests if you
prefer.

Did I miss anything? Let me know your thoughts.

[nanoharsha]

Hello @UmakanthKaspa
Could you pls check this issue w.r.t Ticket booking screen not visible post booking via Guest Login.
#167