# AWS Events — WordPress implementation handoff

Prepared October 9, 2026. The ChatGPT review site is the visual and interaction reference. WordPress was inspected read-only; no settings, content, plugins, users or files were changed.

## Review links

- [Events listing](https://aws-website-design-review.eugene-touss-3978.chatgpt.site/events)
- [Future-event demonstration](https://aws-website-design-review.eugene-touss-3978.chatgpt.site/events/template-preview)
- [Implementation overview](https://aws-website-design-review.eugene-touss-3978.chatgpt.site/events/implementation)
- [Trailer drop recap](https://aws-website-design-review.eugene-touss-3978.chatgpt.site/events/series-premiere-party)
- [Pilot premiere recap](https://aws-website-design-review.eugene-touss-3978.chatgpt.site/events/pilot-episode-premiere)
- [Live recording and brunch recap](https://aws-website-design-review.eugene-touss-3978.chatgpt.site/events/live-recording-bottomless-brunch)

## Approved access model

“Member” means anyone with an AWS account who is signed in. Access does not require a paid plan or an event ticket. Offer both full-gallery viewing and original-photo downloads. Public visitors can read the recap, view selected highlights and any approved public video, and see an invitation to register or sign in. Account email collection does not automatically opt users into marketing.

The review site's account and member states are illustrative, using its existing synthetic account. All 11 event photo samples are intentionally public derivatives. Signing in changes the interface, not the security of these samples. No member-only originals have been added to the public prototype. Original-download controls explain the intended protected request; sample downloads are real resized files.

## Verified historical facts

All three Eventbrite pages were retrieved directly. Their embedded Event JSON supplied full start/end timestamps and locations; page descriptions supplied the program and admission details. Their visible pages say sales/event ended. Do not reuse the stale “Scheduled” status in their historical structured data.

| Event | Date and time, New York | Venue and full address | Historical admission |
| --- | --- | --- | --- |
| Trailer drop / series premiere party | Sat November 23, 2019, 10 p.m. through Sun November 24, 4 a.m. EST | The Paper Box, 17 Meadow Street, Brooklyn, NY 11206 | Five-hour open bar, 10 p.m.–3 a.m.; ticket price not recovered |
| Pilot episode premiere | Thu January 9, 2020, 7–10 p.m. EST | Bombay Theatre, 6825 Fresh Meadow Lane, Fresh Meadows, NY 11365 | Free tickets with refreshments; an additional 100 tickets at $30 with an AWS T-shirt were advertised |
| Live recording and bottomless brunch | Sun February 9, 2020, 2–6 p.m. EST | The Paper Box, 17 Meadow Street, Brooklyn, NY 11206 | $40, four-hour bottomless brunch with drinks and finger foods |

All times use America/New_York, UTC−5 on these dates. The trailer event crosses midnight; its open-bar end time is not its event end time.

Primary sources:

1. [AWS original Events page](https://attorneyswithswag.org/events): event narrative; over 100 friends/family at the trailer launch, over 300 attendees at the pilot premiere, and 30 guests at the brunch. These counts are attributed to AWS's recap, not independently counted from photos.
2. [Trailer party Eventbrite](https://www.eventbrite.com/e/attorneys-with-swag-series-premiere-party-w-5hr-open-bar-tickets-77060771843): trailer premiere; Double T performance; Garfield Anthony and DJ Cashmere; date, time and venue.
3. [Pilot premiere Eventbrite](https://www.eventbrite.com/e/attorneys-with-swag-pilot-episode-premiere-tickets-86286582491): four hosts' paths to law school/public defense, date/time, Bombay Theatre, admission tiers. AWS's archive adds the hour-long screening, introductions and Q&A.
4. [Brunch Eventbrite](https://www.eventbrite.com/e/attorneys-with-swags-live-recording-bottomless-brunch-tickets-92543605415): Black History Month, All Black Everything, all-Black lawyer panel, DJ Cashmere, date/time, venue and price.

The old AWS page calls the brunch Episode 3; Eventbrite and its flyer call it Episode IV/4. The published recap deliberately uses **All Black Everything**, without an episode number. The flyer remains a labeled historical source.

### Media evidence and gaps

Original AWS Google Drive folders were inspected. Trailer and pilot images came from the premiere material; February photos came from “Filming of All Black Everything!!! Episode 3 / Jack.” Files were matched using folder context, EXIF capture date, and visual setting:

| Event | Public selections | Capture evidence |
| --- | --- | --- |
| Trailer | Four photos: portraits, celebration, guests, performance | November 23–24, 2019 |
| Pilot | Four photos: portraits, theater posters, lobby, stage | January 9, 2020 |
| Brunch | Three photos: venue, on-set moment, camera crew | February 9, 2020 |

Public copies are at most 1600×1200 with metadata removed. The project source contains `docs/events/photo-provenance.json` with source file IDs, exact timestamps, dimensions and captions. Original files remain outside the public website. An additional public archive asset is the brunch flyer from Eventbrite.

The recovered brunch folder has 14 HEIC images mostly covering a short behind-the-scenes sequence; a fuller gallery was not recovered. Do not label these as a comprehensive event album. The existing verified AWS media catalog supports links to “Becoming a Public Defender” and “Being a Black Attorney.” These are labeled **related episodes**, not conclusively identified recordings of these events. No confirmed trailer-drop video or recap video has been attached.

Still unresolved: original trailer ticket price; exact program segment times; confirmed individual speaker identities; any accessibility/age/check-in policies that applied historically; definitive recording matches; additional brunch photography. Missing historical details are omitted rather than invented.

## Staging: observed versus proposed

Inspected staging dashboard, normal installed-plugin list, Events list, public calendar and General Settings under authorized access.

| Area | Verified existing setup | Required work |
| --- | --- | --- |
| Calendar | The Events Calendar 6.18.0 and Pro 7.8.3 active; Events, Venues, Organizers, Series and Calendar Embeds menus; public list/month/day controls | Branded list and single-event layouts, filters, related-event cards and statuses in AWS Theme |
| Content | Advanced Custom Fields PRO active | Add recap, program, speakers, photos, media, attendance notes and ticket-state fields; configure editor guidance |
| Accounts | Anyone can register checked; new-user default Subscriber; WooCommerce and LearnDash active | Reuse account registration/sign-in; return to the requested event/gallery; confirm email and reset behavior |
| Ticketing | No Eventbrite Tickets or Event Tickets plugin in the installed list | External Eventbrite link is sufficient for the proposed basic purchase flow. Optional import/sync/embedded checkout requires a separate integration and testing |
| Galleries | No dedicated gallery or protected-media plugin identified in the installed list | Implement the gallery UI and protected storage/download layer, or evaluate an appropriate plugin and host compatibility |
| Existing content | Two sample events: Season III Premiere / live taping and Stop & Frisk Workshop, both January 24, 2026 | Replace those placeholders in the production implementation; preserve or redirect any real indexed URLs deliberately |

An active plugin is not proof of a configured feature or security control. The theme source, must-use/custom protection code, server configuration, individual event editor and protected file access were not verified. Browser credential protection blocked the later individual-event-page inspection; the remaining research continued without bypassing that protection. No claim is made that staging already protects private photos.

### Configuration issues to resolve

- General Settings uses UTC+0. Review site-wide and event-specific timezone behavior before importing dates; use America/New_York for these events, retaining explicit offsets.
- Dashboard reported one inactive Events Calendar license while Pro was active. Confirm license/update entitlement; do not confuse license status with plugin activation.
- WP Mail SMTP reported recent sending failures. Verify registration, account verification if enabled, and password-reset delivery before launch.
- Existing third-party caching/CDN behavior needs review for authenticated content and private media.

## Content model and template

Use one The Events Calendar event record and one stable public URL for the event's entire life. Avoid creating a second recap post that fragments the history. Keep the WordPress archive/single route convention consistent; staging currently uses `/events/` and `/event/{slug}/`, while the review site uses `/events/{slug}/`.

| Fields | Suggested implementation |
| --- | --- |
| Title, introduction, full description, cover, category | Event title/content/excerpt/featured image and category |
| Start/end date and time, timezone, venue, address, organizer | Existing Events Calendar fields; model overnight events with distinct end dates |
| Door time, running order | ACF optional door time and repeater: time, heading, description; never fill unverified times |
| Hosts/guests | Organizer records or ACF relationship/repeater: name, role, approved headshot, bio/link |
| Attendance | ACF: age policy, accessibility, entrance/check-in instructions, inclusions, refund-policy link, photography notice, contact |
| Ticketing | ACF: validated Eventbrite URL/ID, ticket state, price label/currency, fee note, sale window, optional verified waitlist URL, status message and update date |
| Recap | ACF rich text, recap heading, recap publication date, key moments, attendance count with evidence, related content |
| Public media | Curated public derivative gallery: attachment, alt text, caption, credit, public approval; approved video URL and caption/transcript where available |
| Member media | Private collection identifier and protected asset IDs, downloadable flag, rights/credit note; never expose private storage paths as public fields |
| Internal evidence | Source URLs, confidence, unresolved notes and original media mapping; editorial use, not repetitive front-end notices |

Implement template overrides in the maintained AWS theme/child theme; do not modify plugin files. Use the plugin's documented override locations for the installed editor/view. Keep header, footer, brand faces, spacing and approved Live Events popup photography intact.

The review listing uses cards because there are three historical events. Search and category filtering work together; the upcoming view has an honest empty state. A production calendar can retain TEC's month/day views when useful. The demonstration is linked separately and must not enter the public upcoming-event query, feed, structured event data or ticket inventory.

## Ticket and lifecycle behavior

| State | Main action and presentation |
| --- | --- |
| Details not confirmed | Publish only approved announcement information. Do not enable sales without confirmed attendance essentials and Eventbrite URL |
| Available | “Get tickets on Eventbrite” opens the verified listing. Eventbrite handles ticket types, quantities, current availability, fees, payment, confirmation and refunds |
| Sold out | Replace purchase action with “Sold out.” Show a waitlist only when a real organizer-enabled URL exists |
| Canceled | Prominent cancellation update; no ticket purchase. Link the organizer's actual refund/update guidance; never promise an unverified refund |
| Completed | No purchase action. Lead with recap/highlights, keep original details, label Eventbrite as a historical reference |

Use the event's end timestamp for automatic archive placement, with explicit cancellation and sold-out overrides. A manual editorial status requires an owner and timely updates. Automated Eventbrite status sync requires an authorized API/integration, error handling and a defined stale-status policy. The external listing remains the authority for current sales. Do not claim live availability from a hardcoded button.

A plain Eventbrite link needs no additional ticket plugin. Optional Eventbrite Tickets integration is not installed; its official guide covers account/API configuration and importing. Verify current compatibility and licensing before any purchase. Native WooCommerce checkout is unnecessary for this scope and has not been configured for tickets.

## Real file protection

Recommended engineering design, **not verified staging behavior**:

1. Keep public highlight derivatives separate from member originals and member-only resized variants. Use a private object store with public access blocked, or storage outside the public web root supported by the host.
2. WordPress authorizes each gallery-manifest and photo/download request against its real authenticated session. Any active signed-in AWS account qualifies; an event ticket does not. Validate asset IDs and event membership server-side; never accept arbitrary filesystem paths.
3. After authorization, stream the file through the application/protected server location, or issue a short-lived signed delivery URL. Ordinary WordPress page privacy does not protect a directly accessible file. A nonce alone is not authorization.
4. Prevent direct access through origin URLs, CDN URLs, attachment pages, generated sizes, image `srcset`, REST responses, XML/sitemaps and caches. Public pages should never emit private asset URLs or manifests. Registration/sign-in redirect destinations must be local and validated.
5. Exclude authenticated manifests and responses from shared caching; set appropriate private/no-store headers. Ensure the host/CDN respects them. Purge obsolete public copies if files were previously exposed; hiding a link does not revoke a cached copy.
6. Make sample downloads clearly separate from original downloads. For real downloads, preserve approved credits and filename handling. Prevent path traversal; rate-limit costly archive generation if adding “download all.”

An optional solution to evaluate is WP Offload Media with private bucket objects and signed delivery, plus AWS account-aware authorization code. It is **not installed or tested** here. Its official documentation describes private items and expiring URLs; storage/CDN signing alone does not decide who may request a link. A signed URL can be shared during its lifetime. For strict per-request session access, use an authenticated streaming/proxy design; choose an acceptable lifetime before launch. Authorized members can retain or redistribute downloaded photos—access controls cannot prevent that.

Production acceptance tests: logged-out manifest and original requests fail; guessed raw/origin URLs fail; all private size variants fail anonymously; authorized viewing and downloads succeed; expired signatures fail; logout prevents new grants; no shared cache leaks one member's response to another visitor. Test on the actual hosting/CDN stack and after plugin updates.

## Validation and remaining decisions

Review-site validation covers TypeScript, production build, event date/order/source invariants, local asset existence, public derivative size/provenance, safe sign-in return paths, and preservation of approved homepage popup source. Interactive browser QA was unavailable under the managed Sites environment; mobile layout, keyboard dialog behavior and click flows require visual review on the published site. No real WordPress registration, email, payment, ticket inventory or private-file security was tested.

Earlier-thread search failed, so no additional recovered instructions are claimed. The explicit decisions supplied in this conversation were preserved: free account access, both viewing and downloads, selected public highlights, and the approved homepage cover/photo arrangement.

Remaining implementation decisions: private-storage/provider approach and signed-link lifetime; external Eventbrite link versus optional embedded checkout/sync; any email-verification requirement; public photo credits/usage terms; additional media and speaker confirmations. None prevents reviewing the completed design. No real future event is being advertised.

## Primary technical references

- [TEC template overrides](https://dev.theeventscalendar.com/knowledgebase/customizing-template-files-2/)
- [TEC Eventbrite configuration](https://dev.theeventscalendar.com/knowledgebase/configuring-eventbrite-tickets/)
- [TEC Eventbrite imports](https://dev.theeventscalendar.com/knowledgebase/importing-events-from-eventbrite-com/)
- [WordPress auth_redirect](https://developer.wordpress.org/reference/functions/auth_redirect/)
- [WordPress login return URL](https://developer.wordpress.org/reference/functions/wp_login_url/)
- [WordPress non-cache headers](https://developer.wordpress.org/reference/functions/nocache_headers/)
- [WP Offload Media private media](https://deliciousbrains.com/wp-offload-media/doc/how-to-restrict-access-to-offloaded-media/)

These document possible implementation mechanisms. They do not establish that those mechanisms are configured on AWS staging.