Add tests for locking in API

Currently translated at 100.0% (5436 of 5436 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de_Informal/

powered by weblate

src/pretix/locale/de_Informal/LC_MESSAGES/django.po

@@ -8,8 +8,8 @@ msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2023-09-08 13:36+0000\n"
-"PO-Revision-Date: 2023-09-08 13:52+0000\n"
-"Last-Translator: Raphael Michel <michel@rami.io>\n"
+"PO-Revision-Date: 2023-09-24 05:00+0000\n"
+"Last-Translator: Felix Hartnagel <felix@fhcom.de>\n"
 "Language-Team: German (informal) <https://translate.pretix.eu/projects/"
 "pretix/pretix/de_Informal/>\n"
 "Language: de_Informal\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 4.18.2\n"
+"X-Generator: Weblate 5.0.2\n"
 
 #: pretix/_base_settings.py:78
 msgid "English"
@@ -32035,7 +32035,7 @@ msgstr "Kundendaten ändern"
 #: pretix/presale/templates/pretixpresale/organizers/customer_login.html:11
 #, python-format
 msgid "Sign in to your account at %(org)s"
-msgstr "Log-in in Ihr Kundenkonto bei %(org)s"
+msgstr "Log-in in dein Kundenkonto bei %(org)s"
 
 #: pretix/presale/templates/pretixpresale/organizers/customer_login.html:38
 #: pretix/presale/templates/pretixpresale/organizers/customer_registration.html:20

src/pretix/locale/id/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2023-09-08 13:36+0000\n"
-"PO-Revision-Date: 2023-09-20 14:01+0000\n"
+"PO-Revision-Date: 2023-09-21 00:00+0000\n"
 "Last-Translator: Mahdia Aliyy <mahdlyy.k@gmail.com>\n"
 "Language-Team: Indonesian <https://translate.pretix.eu/projects/pretix/"
 "pretix/id/>\n"
@@ -30407,7 +30407,7 @@ msgstr "Lanjutkan dengan pembayaran"
 
 #: pretix/presale/templates/pretixpresale/event/fragment_cart_box.html:43
 msgid "Empty cart"
-msgstr "Keranjang kosong"
+msgstr "Kosongkan keranjang"
 
 #: pretix/presale/templates/pretixpresale/event/fragment_cart_box.html:48
 #: pretix/presale/templates/pretixpresale/event/index.html:236

src/tests/concurrency_tests/test_api_order_creation_locking.py

@@ -0,0 +1,189 @@
+#
+# This file is part of pretix (Community Edition).
+#
+# Copyright (C) 2014-2020 Raphael Michel and contributors
+# Copyright (C) 2020-2021 rami.io GmbH and contributors
+#
+# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
+# Public License as published by the Free Software Foundation in version 3 of the License.
+#
+# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
+# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
+# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
+# this file, see <https://pretix.eu/about/en/license>.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
+# <https://www.gnu.org/licenses/>.
+#
+import asyncio
+from datetime import timedelta
+from importlib import import_module
+
+import pytest
+from asgiref.sync import sync_to_async
+from django.conf import settings
+from django.utils.timezone import now
+from django_scopes import scopes_disabled
+from tests.concurrency_tests.utils import post
+
+from pretix.base.models import CartPosition, OrderPosition
+
+SessionStore = import_module(settings.SESSION_ENGINE).SessionStore
+
+
+@pytest.fixture
+@scopes_disabled()
+def cart1_expired(event, organizer, item, customer):
+    cp = CartPosition.objects.create(
+        event=event,
+        item=item,
+        datetime=now(),
+        expires=now() - timedelta(days=1),
+        price=item.default_price,
+        cart_id="cart1"
+    )
+    session = SessionStore("cart1")
+    session['current_cart_event_{}'.format(event.pk)] = "cart1"
+    session['carts'] = {
+        'cart1': {
+            'payment': 'banktransfer',
+            'email': 'admin@localhost',
+            'customer': customer.pk,
+        }
+    }
+    session[f'customer_auth_id:{event.organizer.pk}'] = customer.pk
+    session[f'customer_auth_hash:{event.organizer.pk}'] = customer.get_session_auth_hash()
+    session.save()
+    return cp, session
+
+
+@pytest.fixture
+@scopes_disabled()
+def cart2_expired(event, organizer, item, customer):
+    cp = CartPosition.objects.create(
+        event=event,
+        item=item,
+        datetime=now(),
+        expires=now() - timedelta(days=1),
+        price=item.default_price,
+        cart_id="cart2"
+    )
+    session = SessionStore("cart2")
+    session['current_cart_event_{}'.format(event.pk)] = "cart2"
+    session['carts'] = {
+        'cart2': {
+            'payment': 'banktransfer',
+            'email': 'admin@localhost',
+            'customer': customer.pk,
+        }
+    }
+    session[f'customer_auth_id:{event.organizer.pk}'] = customer.pk
+    session[f'customer_auth_hash:{event.organizer.pk}'] = customer.get_session_auth_hash()
+    session.save()
+    return cp, session
+
+
+@pytest.mark.asyncio
+async def test_quota_race_condition_happens_if_we_disable_locks(live_server, session, event, item, quota,
+                                                                cart1_expired, cart2_expired):
+    # This test exists to ensure that our test setup makes sense. If it fails, all tests down below
+    # might be useless.
+    quota.size = 1
+    await sync_to_async(quota.save)()
+
+    url = f"/{event.organizer.slug}/{event.slug}/checkout/confirm/?_debug_flag=skip-csrf&_debug_flag=skip-locking&_debug_flag=sleep-after-quota-check"
+    payload = {}
+
+    r1, r2 = await asyncio.gather(
+        post(session, f"{live_server}{url}", data=payload, cookies={settings.SESSION_COOKIE_NAME: cart1_expired[1].session_key}),
+        post(session, f"{live_server}{url}", data=payload, cookies={settings.SESSION_COOKIE_NAME: cart2_expired[1].session_key}),
+    )
+    assert ['thank-you' in r1, 'thank-you' in r2].count(True) == 2
+    with scopes_disabled():
+        assert await sync_to_async(CartPosition.objects.filter(item=item).count)() == 0
+        assert await sync_to_async(OrderPosition.objects.filter(item=item).count)() == 2
+
+
+@pytest.mark.asyncio
+async def test_quota_race_condition_prevented_by_locks(live_server, session, event, item, quota, cart1_expired, cart2_expired):
+    quota.size = 1
+    await sync_to_async(quota.save)()
+
+    url = f"/{event.organizer.slug}/{event.slug}/checkout/confirm/?_debug_flag=skip-csrf&_debug_flag=sleep-after-quota-check"
+    payload = {}
+
+    r1, r2 = await asyncio.gather(
+        post(session, f"{live_server}{url}", data=payload, cookies={settings.SESSION_COOKIE_NAME: cart1_expired[1].session_key}),
+        post(session, f"{live_server}{url}", data=payload, cookies={settings.SESSION_COOKIE_NAME: cart2_expired[1].session_key}),
+    )
+    assert ['thank-you' in r1, 'thank-you' in r2].count(True) == 1
+    with scopes_disabled():
+        assert await sync_to_async(OrderPosition.objects.filter(item=item).count)() == 1
+        assert await sync_to_async(CartPosition.objects.filter(item=item).count)() == 0
+
+
+@pytest.mark.asyncio
+async def test_voucher_race_condition_prevented_by_locks(live_server, session, event, item, quota, cart1_expired, cart2_expired, voucher):
+    cart1_expired[0].voucher = voucher
+    await sync_to_async(cart1_expired[0].save)()
+    cart2_expired[0].voucher = voucher
+    await sync_to_async(cart2_expired[0].save)()
+
+    url = f"/{event.organizer.slug}/{event.slug}/checkout/confirm/?_debug_flag=skip-csrf&_debug_flag=sleep-after-quota-check"
+    payload = {}
+
+    r1, r2 = await asyncio.gather(
+        post(session, f"{live_server}{url}", data=payload, cookies={settings.SESSION_COOKIE_NAME: cart1_expired[1].session_key}),
+        post(session, f"{live_server}{url}", data=payload, cookies={settings.SESSION_COOKIE_NAME: cart2_expired[1].session_key}),
+    )
+    assert ['thank-you' in r1, 'thank-you' in r2].count(True) == 1
+    with scopes_disabled():
+        assert await sync_to_async(OrderPosition.objects.filter(item=item, voucher=voucher).count)() == 1
+        assert await sync_to_async(CartPosition.objects.filter(item=item, voucher=voucher).count)() == 0
+
+
+@pytest.mark.asyncio
+async def test_seat_race_condition_prevented_by_locks(live_server, session, event, item, quota, cart1_expired, cart2_expired, seat):
+    cart1_expired[0].seat = seat
+    await sync_to_async(cart1_expired[0].save)()
+    cart2_expired[0].seat = seat
+    await sync_to_async(cart2_expired[0].save)()
+
+    url = f"/{event.organizer.slug}/{event.slug}/checkout/confirm/?_debug_flag=skip-csrf&_debug_flag=sleep-after-quota-check"
+    payload = {}
+
+    r1, r2 = await asyncio.gather(
+        post(session, f"{live_server}{url}", data=payload, cookies={settings.SESSION_COOKIE_NAME: cart1_expired[1].session_key}),
+        post(session, f"{live_server}{url}", data=payload, cookies={settings.SESSION_COOKIE_NAME: cart2_expired[1].session_key}),
+    )
+    assert ['thank-you' in r1, 'thank-you' in r2].count(True) == 1
+    with scopes_disabled():
+        assert await sync_to_async(OrderPosition.objects.filter(item=item, seat=seat).count)() == 1
+        assert await sync_to_async(CartPosition.objects.filter(item=item, seat=seat).count)() == 0
+
+
+@pytest.mark.asyncio
+async def test_membership_race_condition_prevented_by_locks(live_server, session, event, item, quota, cart1_expired, cart2_expired, membership):
+    cart1_expired[0].used_membership = membership
+    await sync_to_async(cart1_expired[0].save)()
+    cart2_expired[0].used_membership = membership
+    await sync_to_async(cart2_expired[0].save)()
+    item.require_membership = True
+    await sync_to_async(item.save)()
+    await sync_to_async(item.require_membership_types.set)([membership.membership_type])
+
+    url = f"/{event.organizer.slug}/{event.slug}/checkout/confirm/?_debug_flag=skip-csrf&_debug_flag=sleep-after-quota-check"
+    payload = {}
+
+    r1, r2 = await asyncio.gather(
+        post(session, f"{live_server}{url}", data=payload, cookies={settings.SESSION_COOKIE_NAME: cart1_expired[1].session_key}),
+        post(session, f"{live_server}{url}", data=payload, cookies={settings.SESSION_COOKIE_NAME: cart2_expired[1].session_key}),
+    )
+    assert ['thank-you' in r1, 'thank-you' in r2].count(True) == 1
+    with scopes_disabled():
+        assert await sync_to_async(OrderPosition.objects.filter(item=item).count)() == 1
+        assert await sync_to_async(CartPosition.objects.filter(item=item).count)() == 1