Design a Ticket Booking System (Ticketmaster)

1Requirements

2Back-of-envelope estimation

3API design

4High-level design

The architecture is a funnel with three pressure zones. Zone 1 (browse) is read-only and cache-served: CDN for static assets, Redis pub-sub or SSE for seat-map deltas, and it must survive 500k QPS untouched by transactions. Zone 2 (waiting room) is the admission valve: it queues the 1M-user stampede and releases users into zone 3 at a rate the core can handle. Zone 3 (transact) is a strongly consistent inventory service on a relational database where holds and purchases mutate seat rows under locks.

Seat inventory is modeled as one row per seat per event with a state machine: available -> held -> sold, plus held -> available on expiry. The invariant 'a seat has at most one active hold or sale' is enforced by the database itself, not application logic: either row locks (SELECT ... FOR UPDATE, flip state only if currently available) or optimistic conditional updates (UPDATE ... WHERE status = 'available', check rows affected). Both make double-selling impossible at the storage layer, which is where correctness guarantees belong.

Holds carry a TTL (expires_at). Expiry is enforced lazily and eagerly at once: lazily, every read and hold attempt treats an expired hold as available (WHERE status='available' OR (status='held' AND hold_expires_at < now())), so correctness never depends on a timer firing; eagerly, a sweeper flips expired rows back in batches so seat maps and counts stay tidy. This lazy-check pattern is the crucial trick: TTL cleanup jobs can lag without ever causing incorrect behavior.

The purchase step spans two systems (inventory DB and payment provider), which is a distributed transaction in disguise. The standard resolution: hold seats first, then charge payment with an idempotency key, then mark sold in a local transaction; if the charge succeeds but the confirm write fails, a reconciliation worker replays the confirm using the payment provider's records as truth. The hold TTL is deliberately longer than any payment-provider timeout so the seat cannot be given away while a charge is in flight.

The virtual waiting room is what turns an impossible load problem into a solved one. Users arriving before or at on-sale join a queue (Redis sorted set scored by arrival time plus anti-bot checks); a gatekeeper admits N users per second, N tuned to keep zone 3 below its measured capacity, issuing signed, short-lived admission tokens that the hold API requires. Everyone else sees an honest position indicator. This converts a 1M-QPS thundering herd into a steady 2k QPS the database shrugs at, and fairness becomes an explicit, auditable policy rather than an accident of who retried fastest.

5Data model

6Deep dives

7Rapid implementation: build the MVP

Theory is table stakes. Here is how you would stand up a working version fast, on a budget, with the core algorithm in real code.

1. 01Create the seats table (one row per seat, status + hold_expires_at columns) and seed a 500-seat venue for one event
2. 02Implement POST /holds as a single transaction: SELECT ... FOR UPDATE NOWAIT on sorted seat ids, verify each is available or expired-held, set held with an 8-minute expiry
3. 03Implement purchase: re-verify the hold under FOR UPDATE, create a Stripe test-mode PaymentIntent with the client's idempotency key, then mark seats sold and the order paid in one commit
4. 04Add lazy expiry to every predicate (status='available' OR hold_expires_at < now()) and a 30-second sweeper cron that releases expired holds with SKIP LOCKED
5. 05Build the seat map endpoint from a Redis hash (seat_id -> status) updated after every commit, with a 2-second client poll
6. 06Add the waiting room: ZADD users into a Redis sorted set on arrival, a gatekeeper loop that pops the lowest N scores per second and writes single-use signed admission tokens, and token verification middleware on the hold route
7. 07Write a contention test: fire 200 concurrent hold requests at the same 5 seats with autocannon and assert exactly 1 winner per seat and zero rows with status='sold' duplicated
8. 08Simulate the flash sale end to end: 2,000 scripted users through the waiting room against 500 seats, verify sell-out with zero oversells and honest queue positions

BEGIN;

-- Lock in sorted order to prevent deadlocks; NOWAIT fails fast under contention.
SELECT seat_id, status, hold_expires_at
FROM seats
WHERE event_id = $1 AND seat_id = ANY($2)   -- $2 must be sorted by caller
ORDER BY seat_id
FOR UPDATE NOWAIT;

-- Application verifies every returned row is grabbable, then:
UPDATE seats
SET    status = 'held',
       hold_id = $3,
       hold_expires_at = now() + interval '8 minutes'
WHERE  event_id = $1
  AND  seat_id = ANY($2)
  AND  (status = 'available'
        OR (status = 'held' AND hold_expires_at < now()));
-- If row_count <> array_length($2), another user won a seat: ROLLBACK and 409.

COMMIT;

import { pool } from "./db";
import { stripe } from "./stripe";

export async function purchase(holdId: string, userId: string, idemKey: string) {
  const existing = await pool.query(
    "SELECT order_id, status FROM orders WHERE idempotency_key = $1", [idemKey]);
  if (existing.rows[0]) return existing.rows[0]; // safe retry

  const client = await pool.connect();
  try {
    await client.query("BEGIN");
    const hold = await client.query(
      "SELECT * FROM holds WHERE hold_id = $1 AND user_id = $2 " +
      "AND state = 'active' AND expires_at > now() FOR UPDATE", [holdId, userId]);
    if (!hold.rows[0]) throw new Error("HOLD_EXPIRED");

    // Charge outside any seat-row locks; idempotency key makes it retry-safe.
    const intent = await stripe.paymentIntents.create(
      { amount: hold.rows[0].amount, currency: "usd", confirm: true,
        payment_method: hold.rows[0].payment_method },
      { idempotencyKey: idemKey });

    await client.query(
      "UPDATE seats SET status = 'sold' WHERE hold_id = $1 AND status = 'held'", [holdId]);
    await client.query(
      "UPDATE holds SET state = 'converted' WHERE hold_id = $1", [holdId]);
    await client.query(
      "INSERT INTO orders (user_id, seat_ids, amount, payment_intent_id, idempotency_key, status) " +
      "VALUES ($1, $2, $3, $4, $5, 'paid')",
      [userId, hold.rows[0].seat_ids, hold.rows[0].amount, intent.id, idemKey]);
    await client.query("COMMIT");
    return { status: "paid" };
  } catch (err) {
    await client.query("ROLLBACK");
    throw err; // reconciler replays confirms for succeeded charges
  } finally {
    client.release();
  }
}

import { createHmac, randomUUID } from "crypto";
import { redis } from "./redis";

const ADMIT_PER_SECOND = 50; // tune against measured hold-endpoint capacity

export async function joinQueue(eventId: string, userId: string) {
  await redis.zadd("wr:" + eventId, { score: Date.now(), member: userId });
}

export async function gatekeeperTick(eventId: string) {
  const admitted = await redis.zpopmin("wr:" + eventId, ADMIT_PER_SECOND);
  for (const { member: userId } of admitted) {
    const nonce = randomUUID();
    const exp = Date.now() + 10 * 60 * 1000;
    const payload = [eventId, userId, exp, nonce].join(".");
    const sig = createHmac("sha256", process.env.WR_SECRET!).update(payload).digest("hex");
    await redis.set("wrtok:" + nonce, userId, { ex: 600 }); // single-use marker
    await redis.set("wradmit:" + eventId + ":" + userId, payload + "." + sig, { ex: 600 });
  }
}

export async function verifyToken(token: string): Promise<boolean> {
  const parts = token.split(".");
  const sig = parts.pop();
  const [, , exp, nonce] = parts;
  const expected = createHmac("sha256", process.env.WR_SECRET!)
    .update(parts.join(".")).digest("hex");
  if (sig !== expected || Number(exp) < Date.now()) return false;
  const used = await redis.getdel("wrtok:" + nonce); // atomic single-use burn
  return used !== null;
}