Ticket Out

Tracked outbound handoff to an external ticket platform.

Loop 7 (external-ticket continuity track):

• #L7-1: session_id from query param now captured in outbound_clicks.
• #L7-2: city/country now resolved from IP when available.
• #L7-5: fire-and-forget log now uses get_db_context() — the request-scoped session was leaking because FastAPI closes it immediately after the response returns (same pattern as Loop 3 #L3-12).
• #L7-6: destination URL re-validated at serve time. Resolver validates at import, but someone could have PATCHed external_ticket_url directly after import.
• #L7-8: light per-IP rate limit to prevent click-count inflation by bots. Analytics must be trustworthy.
• #L7-9: Cache-Control no-store — every call generates a fresh ref_token and must not be cached by intermediaries.

Scale design preserved:

• Click log write is fire-and-forget: response returns before the DB write completes. A logging failure never blocks the user.
• Returns structured JSON — frontend opens destination in in-app browser. Never a server-side redirect (PWA/Capacitor opens external URLs client-side).
• source_platform is always 'ticket_gateway' so analytics can isolate ticket clicks from other outbound click types.