How would you add a fair waiting room for a large sale?

Say it in 30 seconds

Say it like this (20-30 seconds)

This is an explain-only extension; MiniTickets has rate limits and an inventory gate, not a waiting room. I would define fairness, issue signed short-lived admission tokens and release visitors at a rate the booking path can sustain. Admission must be enforced at the protected API, not only in the page. Inventory remains authoritative in Postgres. A waiting room controls load and ordering; it does not promise a ticket or solve bot abuse by itself.

The deeper answer

Fairness is a product decision: arrival order, a randomized draw or a priority group produce different outcomes. Decide whether reconnects retain position and whether an account may hold multiple places. Do not claim FIFO fairness without defining the identity and timestamp authority.

A proposed admission service would persist queue state and bind tokens to sale, expiry and an identity or session. Token verification belongs before expensive booking work, with bounded replay rules and a documented response when the waiting-room service is unavailable. A copied token must not grant unlimited admission.

Rate the release against measured database capacity, not simply current API CPU. Cap retries and provide backoff so rejected clients do not amplify load. Existing rate limiting controls repeated requests and the inventory gate rejects some sold-out work; neither supplies ordered admission or position state. The waiting-room state, UI and admission-token validation are proposed only.

Counter-questions

Does admission reserve seats?

No, unless a separate reservation protocol explicitly does so. Users admitted near sell-out can still receive a booking conflict.

Would you fail open during a waiting-room outage?

That preserves access but can overload the booking system. Choose the availability trade-off ahead of a sale and keep a bounded emergency admission rate.

How do you prevent bots?

Use layered identity and abuse controls, while considering shared networks and accessibility. A token signature prevents forgery, not mass account creation.

Where in MiniTickets

Read the path chapter, select the relevant map piece →, then inspect apps/api/src/services/booking-inventory.ts → createGatedBooking.