Bump version to 2.1.0

Update from Weblate.

.gitlab-ci.yml

@@ -17,7 +17,7 @@ pypi:
         - virtualenv env
         - source env/bin/activate
         - pip install -U pip wheel setuptools
-        - XDG_CACHE_HOME=/cache pip3 install -Ur src/requirements.txt -r src/requirements/dev.txt -r src/requirements/py34.txt
+        - XDG_CACHE_HOME=/cache pip3 install -Ur src/requirements.txt -r src/requirements/dev.txt
         - cd src
         - python setup.py sdist
         - pip install dist/pretix-*.tar.gz

.readthedocs.requirements.txt

@@ -1,2 +1 @@
--r src/requirements/py34.txt
 -r doc/requirements.txt

.travis.sh

@@ -15,17 +15,17 @@ if [ "$PRETIX_CONFIG_FILE" == "tests/travis_postgres.cfg" ]; then
 fi
 
 if [ "$1" == "style" ]; then
-	XDG_CACHE_HOME=/cache pip3 install -Ur src/requirements.txt -r src/requirements/dev.txt -r src/requirements/py34.txt
+	XDG_CACHE_HOME=/cache pip3 install -Ur src/requirements.txt -r src/requirements/dev.txt
 	cd src
     flake8 .
     isort -c -rc -df .
 fi
 if [ "$1" == "doctests" ]; then
-	XDG_CACHE_HOME=/cache pip3 install -Ur doc/requirements.txt -r src/requirements/py34.txt
+	XDG_CACHE_HOME=/cache pip3 install -Ur doc/requirements.txt
 	cd doc
 	make doctest
 fi
-if [ "$1" == "spelling" ]; then
+if [ "$1" == "doc-spelling" ]; then
 	XDG_CACHE_HOME=/cache pip3 install -Ur doc/requirements.txt
 	cd doc
 	make spelling
@@ -33,22 +33,27 @@ if [ "$1" == "spelling" ]; then
 		exit 1
 	fi
 fi
+if [ "$1" == "translation-spelling" ]; then
+	XDG_CACHE_HOME=/cache pip3 install -Ur src/requirements/dev.txt
+	cd src
+	potypo
+fi
 if [ "$1" == "tests" ]; then
-	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt -r src/requirements/py34.txt
+	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt pytest-xdist
 	cd src
 	python manage.py check
 	make all compress
-	py.test --reruns 5 tests
+	py.test --reruns 5 -n 2 tests
 fi
 if [ "$1" == "tests-cov" ]; then
-	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt -r src/requirements/py34.txt
+	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt
 	cd src
 	python manage.py check
 	make all compress
 	coverage run -m py.test --reruns 5 tests && codecov
 fi
 if [ "$1" == "plugins" ]; then
-	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt -r src/requirements/py34.txt
+	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt
 	cd src
 	python setup.py develop
 	make all compress

.travis.yml

@@ -15,34 +15,28 @@ matrix:
     - python: 3.6
       env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_sqlite.cfg
     - python: 3.6
-      env: JOB=tests-cov
+      env: JOB=tests-cov PRETIX_CONFIG_FILE=tests/travis_postgres.cfg
     - python: 3.6
       env: JOB=style
-    - python: 3.4
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_sqlite.cfg
     - python: 3.5
       env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_sqlite.cfg
-    - python: 3.4
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_mysql.cfg
-    - python: 3.5
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_mysql.cfg
     - python: 3.6
       env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_mysql.cfg
-    - python: 3.4
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_postgres.cfg
-    - python: 3.5
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_postgres.cfg
     - python: 3.6
       env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_postgres.cfg
     - python: 3.6
       env: JOB=plugins
     - python: 3.6
-      env: JOB=spelling
+      env: JOB=doc-spelling
+    - python: 3.6
+      env: JOB=translation-spelling
 addons:
   postgresql: "9.4"
   apt:
       packages:
           - enchant
+          - myspell-de-de
+          - aspell-en
 branches:
   except:
   - /^weblate-.*/

Dockerfile

@@ -3,7 +3,7 @@ FROM python:3.6
 RUN apt-get update && \
     apt-get install -y git libxml2-dev libxslt1-dev python-dev python-virtualenv locales \
       libffi-dev build-essential python3-dev zlib1g-dev libssl-dev gettext libpq-dev \
-      libmysqlclient-dev libmemcached-dev libjpeg-dev supervisor nginx sudo \
+      default-libmysqlclient-dev libmemcached-dev libjpeg-dev supervisor nginx sudo \
 	  --no-install-recommends && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \

deployment/docker/pretix.bash

@@ -3,7 +3,7 @@ cd /pretix/src
 export DJANGO_SETTINGS_MODULE=production_settings
 export DATA_DIR=/data/
 export HOME=/pretix
-NUM_WORKERS=10
+export NUM_WORKERS=$((2 * $(nproc --all)))
 
 if [ ! -d /data/logs ]; then
     mkdir /data/logs;

doc/admin/config.rst

@@ -53,6 +53,10 @@ Example::
     A comma-separated list of plugins that are enabled by default for all new events.
     Defaults to ``pretix.plugins.sendmail,pretix.plugins.statistics``.
 
+``plugins_exclude``
+    A comma-separated list of plugins that are not available even though they are installed.
+    Defaults to an empty string.
+
 ``cookie_domain``
     The cookie domain to be set. Defaults to ``None``.
 

doc/admin/installation/manual_smallscale.rst

@@ -121,8 +121,7 @@ command if you're running PostgreSQL::
 
     (venv)$ pip3 install "pretix[mysql]" gunicorn
 
-If you are running Python 3.4, you also need to ``pip3 install typing``. This is not required on 3.5 or newer.
-You can find out your Python version using ``python -V``.
+Note that you need Python 3.5 or newer. You can find out your Python version using ``python -V``.
 
 We also need to create a data directory::
 

doc/api/auth.rst

@@ -0,0 +1,9 @@
+Authentication
+==============
+
+.. toctree::
+   :maxdepth: 2
+
+   tokenauth
+   oauth
+   deviceauth

doc/api/deviceauth.rst

@@ -0,0 +1,137 @@
+.. _`rest-deviceauth`:
+
+Device authentication
+=====================
+
+Initializing a new device
+-------------------------
+
+Users can create new devices in the "Device" section of their organizer settings. When creating
+a new device, users can specify a list of events the device is allowed to access. After a new
+device is created, users will be presented initialization instructions, consisting of an URL
+and an initialization token. They will also be shown as a QR code with the following contents::
+
+   {"handshake_version": 1, "url": "https://pretix.eu", "token": "kpp4jn8g2ynzonp6"}
+
+Your application should be able to scan a QR code of this type, or allow to enter the URL and the
+initialization token manually. The handshake version is not used for manual initialization. When a
+QR code is scanned with a higher handshake version than you support, you should reject the request
+and prompt the user to update the client application.
+
+After your application received the token, you need to call the initialization endpoint to obtain
+a proper API token. At this point, you need to identify the name and version of your application,
+as well as the type of underlying hardware. Example:
+
+.. sourcecode:: http
+
+   POST /api/v1/device/initialize HTTP/1.1
+   Host: pretix.eu
+   Content-Type: application/json
+
+   {
+       "token": "kpp4jn8g2ynzonp6",
+       "hardware_brand": "Samsung",
+       "hardware_model": "Galaxy S",
+       "software_brand": "pretixdroid",
+       "software_version": "4.0.0"
+   }
+
+Every initialization token can only be used once. On success, you will receive a response containing
+information on your device as well as your API token:
+
+.. sourcecode:: http
+
+   HTTP/1.1 200 OK
+   Content-Type: application/json
+
+   {
+       "organizer": "foo",
+       "device_id": 5,
+       "unique_serial": "HHZ9LW9JWP390VFZ",
+       "api_token": "1kcsh572fonm3hawalrncam4l1gktr2rzx25a22l8g9hx108o9oi0rztpcvwnfnd",
+       "name": "Bar"
+   }
+
+Please make sure that you store this ``api_token`` value. We also recommend storing your device ID, your assigned
+``unique_serial``, and the ``organizer`` you have access to, but that's up to you.
+
+In case of an error, the response will look like this:
+
+.. sourcecode:: http
+
+   HTTP/1.1 400 Bad Request
+   Content-Type: application/json
+
+   {"token":["This initialization token has already been used."]}
+
+
+Performing API requests
+-----------------------
+
+You need to include the API token with every request to pretix' API in the ``Authorization`` header
+like the following:
+
+.. sourcecode:: http
+   :emphasize-lines: 3
+
+   GET /api/v1/organizers/ HTTP/1.1
+   Host: pretix.eu
+   Authorization: Device 1kcsh572fonm3hawalrncam4l1gktr2rzx25a22l8g9hx108o9oi0rztpcvwnfnd
+
+Updating the software version
+-----------------------------
+
+If your application is updated, we ask you to tell the server about the new version in use. You can do this at the
+following endpoint:
+
+.. sourcecode:: http
+
+   POST /api/v1/device/update HTTP/1.1
+   Host: pretix.eu
+   Content-Type: application/json
+   Authorization: Device 1kcsh572fonm3hawalrncam4l1gktr2rzx25a22l8g9hx108o9oi0rztpcvwnfnd
+
+   {
+       "hardware_brand": "Samsung",
+       "hardware_model": "Galaxy S",
+       "software_brand": "pretixdroid",
+       "software_version": "4.1.0"
+   }
+
+Creating a new API key
+----------------------
+
+If you think your API key might have leaked or just want to be extra cautious, the API allows you to create a new key.
+The old API key will be invalid immediately. A request for a new key looks like this:
+
+.. sourcecode:: http
+
+   POST /api/v1/device/roll HTTP/1.1
+   Host: pretix.eu
+   Authorization: Device 1kcsh572fonm3hawalrncam4l1gktr2rzx25a22l8g9hx108o9oi0rztpcvwnfnd
+
+The response will look like the response to the initialization request.
+
+Removing a device
+-----------------
+
+If you want implement a way to to deprovision a device in your software, you can call the ``revoke`` endpoint to
+invalidate your API key. There is no way to reverse this operation.
+
+.. sourcecode:: http
+
+   POST /api/v1/device/revoke HTTP/1.1
+   Host: pretix.eu
+   Authorization: Device 1kcsh572fonm3hawalrncam4l1gktr2rzx25a22l8g9hx108o9oi0rztpcvwnfnd
+
+This can also be done by the user through the web interface.
+
+Permissions
+-----------
+
+Device authentication is currently hardcoded to grant the following permissions:
+
+* View event meta data and products etc.
+* View and change orders
+
+Devices cannot change events or products and cannot access vouchers.

doc/api/fundamentals.rst

@@ -6,43 +6,23 @@ with pretix' REST API, such as authentication, pagination and similar definition
 
 .. _`rest-auth`:
 
-Obtaining an API token
-----------------------
-
-To authenticate your API requests, you need to obtain an API token. You can create a
-token in the pretix web interface on the level of organizer teams. Create a new team
-or choose an existing team that has the level of permissions the token should have and
-create a new token using the form below the list of team members:
-
-.. image:: img/token_form.png
-   :class: screenshot
-
-You can enter a description for the token to distinguish from other tokens later on.
-Once you click "Add", you will be provided with an API token in the success message.
-Copy this token, as you won't be able to retrieve it again.
-
-.. image:: img/token_success.png
-   :class: screenshot
-
 Authentication
 --------------
 
-You need to include the API token with every request to pretix' API in the ``Authorization`` header
-like the following:
+To access the API, you need to present valid authentication credentials. pretix currently
+supports the following authorization schemes:
 
-.. sourcecode:: http
-   :emphasize-lines: 3
-
-   GET /api/v1/organizers/ HTTP/1.1
-   Host: pretix.eu
-   Authorization: Token e1l6gq2ye72thbwkacj7jbri7a7tvxe614ojv8ybureain92ocub46t5gab5966k
-
-.. note:: The API currently also supports authentication via browser sessions, i.e. the
-          same way that you authenticate with pretix when using the browser interface.
-          Using this type of authentication is *not* officially supported for use by
-          third-party clients and might change or be removed at any time. We plan on
-          adding OAuth2 support in the future for user-level authentication. If you want
-          to use session authentication, be sure to comply with Django's `CSRF policies`_.
+* :ref:`rest-tokenauth`: This is the simplest way and recommended for server-side applications
+  that interact with pretix without user interaction.
+* :ref:`rest-oauth`: This is the recommended way to use if you write a third-party application
+  that users can connect with their pretix account. It provides the best user experience, but
+  requires user interaction and slightly more implementation effort.
+* :ref:`rest-deviceauth`: This is the recommended way if you build apps or hardware devices that can
+  connect to pretix, e.g. for processing check-ins or to sell tickets offline. It provides a way
+  to uniquely identify devices and allows for a quick configuration flow inside your software.
+* Authentication using browser sessions: This is used by the pretix web interface and it is *not*
+  officially supported for use by third-party applications. It might change or be removed at any
+  time without prior notice. If you use it, you need to comply with Django's `CSRF policies`_.
 
 Permissions
 -----------
@@ -109,6 +89,41 @@ respective page.
 The field ``results`` contains a list of objects representing the first results. For most
 objects, every page contains 50 results.
 
+Conditional fetching
+--------------------
+
+If you pull object lists from pretix' APIs regularly, we ask you to implement conditional fetching
+to avoid unnecessary data traffic. This is not supported on all resources and we currently implement
+two different mechanisms for different resources, which is necessary because we can only obtain best
+efficiency for resources that do not support deletion operations.
+
+Object-level conditional fetching
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The :ref:`rest-orders` resource list contains an HTTP header called ``X-Page-Generated`` containing the
+current time on the server in ISO 8601 format. On your next request, you can pass this header
+(as is, without any modifications necessary) as the ``modified_since`` query parameter and you will receive
+a list containing only objects that have changed in the time since your last request.
+
+List-level conditional fetching
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+If modification checks are not possible with this granularity, you can instead check for the full list.
+In this case, the list of objects may contain a regular HTTP header ``Last-Modified`` with the date of the
+last modification to any item of that resource. You can then pass this date back in your next request in the
+``If-Modified-Since`` header. If the any object has changed in the meantime, you will receive back a full list
+(if something it missing, this means the object has been deleted). If nothing happened, we'll send back a
+``304 Not Modified`` return code.
+
+This is currently implemented on the following resources:
+
+* :ref:`rest-categories`
+* :ref:`rest-items`
+* :ref:`rest-questions`
+* :ref:`rest-quotas`
+* :ref:`rest-subevents`
+* :ref:`rest-taxrules`
+
 Errors
 ------
 
@@ -165,4 +180,4 @@ as the string values ``true`` and ``false``.
 If the ``ordering`` parameter is documented for a resource, you can use it to sort the result set by one of the allowed
 fields. Prepend a ``-`` to the field name to reverse the sort order.
 
-.. _CSRF policies: https://docs.djangoproject.com/en/1.11/ref/csrf/#ajax
+.. _CSRF policies: https://docs.djangoproject.com/en/1.11/ref/csrf/#ajax

doc/api/index.rst

@@ -14,4 +14,5 @@ in functionality over time.
    :maxdepth: 2
 
    fundamentals
+   auth
    resources/index

doc/api/oauth.rst

@@ -0,0 +1,171 @@
+.. _`rest-oauth`:
+
+OAuth authentication / "Connect with pretix"
+============================================
+
+In addition to static tokens, pretix supports `OAuth2`_-based authentication starting with
+pretix 1.16. This allows you to put a "Connect with pretix" button into your website or tool
+that allows the user to easily set up a connection between the two systems.
+
+If you haven't worked with OAuth before, have a look at the `OAuth2 Simplified`_ tutorial.
+
+Registering an application
+--------------------------
+
+To use OAuth, you need to register your application with the pretix instance you want to connect to.
+In order to do this, log in to your pretix account and go to your user settings. Click on "Authorized applications"
+first and then on "Manage your own apps". From there, you can "Create a new application".
+
+You should fill in a descriptive name of your application that allows users to recognize who you are. You also need to
+give a list of fully-qualified URLs that users will be redirected to after a successful authorization. After you pressed
+"Save", you will be presented with a client ID and a client secret. Please note them down and treat the client secret
+like a password; it should not become available to your users.
+
+Obtaining an authorization grant
+--------------------------------
+
+To authorize a new user, link or redirect them to the ``authorize`` endpoint, passing your client ID as a query
+parameter. Additionally, you can pass a scope (currently either ``read``, ``write``, or ``read write``)
+and an URL the user should be redirected to after successful or failed authorization. You also need to pass the
+``response_type`` parameter with a value of ``code``. Example::
+
+    https://pretix.eu/api/v1/oauth/authorize?client_id=lsLi0hNL0vk53mEdYjNJxHUn1PcO1R6wVg81dLNT&response_type=code&scope=read+write&redirect_uri=https://pretalx.com
+
+To prevent CSRF attacks, you can also optionally pass a ``state`` parameter with a random string. Later, when
+redirecting back to your application, we will pass the same ``state`` parameter back to you, so you can compare if they
+match.
+
+After the user granted or denied access, they will be redirected back either to the ``redirect_url`` you passed in the
+query or to the first redirect URL configured in your application settings.
+
+On successful registration, we will append the query parameter ``code`` to the URL containing an authorization code.
+For example, we might redirect the user to this URL::
+
+    https://pretalx.com/?code=eYBBf8gmeD4E01HLoj0XflqO4Lg3Cw&state=e3KCh9mfx07qxU4bRpXk
+
+You will need this ``code`` parameter to perform the next step.
+
+On a failed registration, a query string like ``?error=access_denied`` will be appended to the redirection URL.
+
+.. note:: In this step, the user is allowed to restrict your access to certain organizer accounts. If you try to
+          re-authenticate the user later, the user might be instantly redirected back to you if authorization is already
+          given and would therefore be unable to review their organizer restriction settings. You can append the
+          ``approval_prompt=force`` query parameter if you want to make sure the user actively needs to confirm the
+          authorization.
+
+Getting an access token
+-----------------------
+
+Using the ``code`` value you obtained above and your client ID, you can now request an access token that actually gives
+access to the API. The ``token`` endpoint expects you to authenticate using `HTTP Basic authentication`_ using your client
+ID as a username and your client secret as a password. You are also required to again supply the same ``redirect_uri``
+parameter that you used for the authorization.
+
+.. http:get:: /api/v1/oauth/token
+
+   Request a new access token
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/oauth/token HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Authorization: Basic bHNMaTBoTkwwdms1M21FZFlqTkp4SFVuMVBjTzFSNndWZzgxZExOVDplSmpzZVA0UjJMN0hMcjBiS0p1b3BmbnJtT2cyY3NDeTdYaFVVZ0FoalhUU0NhZHhRTjk3cVNvMkpPaXlWTFpQOEozaTVQd1FVdFIwNUNycG5ac2Z0bXJjdmNTbkZ1SkFmb2ZsUTdZUDRpSjZNTWFYTHIwQ0FpNlhIRFJjV1Awcg==
+
+      grant_type=authorization_code&code=eYBBf8gmeD4E01HLoj0XflqO4Lg3Cw&redirect_uri=https://pretalx.com
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "access_token": "i3ytqTSRWsKp16fqjekHXa4tdM4qNC",
+        "expires_in": 86400,
+        "token_type": "Bearer",
+        "scope": "read write",
+        "refresh_token": "XBK0r8z4A4TTeR9LyMUyU2AM5rqpXp"
+      }
+
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+
+
+As you can see, you receive two types of tokens: One "access token", and one "refresh token". The access token is valid
+for a day and can be used to actually access the API. The refresh token does not have an expiration date and can be used
+to obtain a new access_token after a day, so you should make sure to store the access token safely if you need long-term
+access.
+
+Using the API with an access token
+----------------------------------
+
+You can supply a valid access token as a ``Bearer``-type token in the ``Authorization`` header to get API access.
+
+.. sourcecode:: http
+   :emphasize-lines: 3
+
+       GET /api/v1/organizers/ HTTP/1.1
+       Host: pretix.eu
+       Authorization: Bearer i3ytqTSRWsKp16fqjekHXa4tdM4qNC
+
+Refreshing an access token
+--------------------------
+
+You can obtain a new access token using your refresh token any time. This can be done using the same ``token`` endpoint
+used to obtain the first access token above, but with a different set of parameters:
+
+.. sourcecode:: http
+
+  POST /api/v1/oauth/token HTTP/1.1
+  Host: pretix.eu
+  Accept: application/json, text/javascript
+  Authorization: Basic bHNMaTBoTkwwdms1M21FZFlqTkp4SFVuMVBjTzFSNndWZzgxZExOVDplSmpzZVA0UjJMN0hMcjBiS0p1b3BmbnJtT2cyY3NDeTdYaFVVZ0FoalhUU0NhZHhRTjk3cVNvMkpPaXlWTFpQOEozaTVQd1FVdFIwNUNycG5ac2Z0bXJjdmNTbkZ1SkFmb2ZsUTdZUDRpSjZNTWFYTHIwQ0FpNlhIRFJjV1Awcg==
+
+  grant_type=refresh_token&refresh_token=XBK0r8z4A4TTeR9LyMUyU2AM5rqpXp
+
+The previous access token will instantly become invalid.
+
+Revoking a token
+----------------
+
+If you don't need a token any more or if you believe it may have been compromised, you can use the ``revoke_token``
+endpoint to revoke it.
+
+.. http:get:: /api/v1/oauth/revoke_token
+
+   Revoke an access or refresh token. If you revoke an access token, you can still create a new one using the refresh token. If you
+   revoke a refresh token, the connected access token  will also be revoked.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/oauth/revoke_token HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Authorization: Basic bHNMaTBoTkwwdms1M21FZFlqTkp4SFVuMVBjTzFSNndWZzgxZExOVDplSmpzZVA0UjJMN0hMcjBiS0p1b3BmbnJtT2cyY3NDeTdYaFVVZ0FoalhUU0NhZHhRTjk3cVNvMkpPaXlWTFpQOEozaTVQd1FVdFIwNUNycG5ac2Z0bXJjdmNTbkZ1SkFmb2ZsUTdZUDRpSjZNTWFYTHIwQ0FpNlhIRFJjV1Awcg==
+
+      token=XBK0r8z4A4TTeR9LyMUyU2AM5rqpXp
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+
+If you want to revoke your client secret, you can generate a new one in the list of your managed applications in the
+pretix user interface.
+
+.. _OAuth2: https://en.wikipedia.org/wiki/OAuth
+.. _OAuth2 Simplified: https://aaronparecki.com/oauth-2-simplified/
+.. _HTTP Basic authentication: https://en.wikipedia.org/wiki/Basic_access_authentication

doc/api/resources/carts.rst

@@ -0,0 +1,258 @@
+.. _rest-carts:
+
+Cart positions
+==============
+
+The API provides limited access to the cart position data model. This API currently only allows creating and deleting
+cart positions to reserve quota.
+
+Cart position resource
+----------------------
+
+The cart position resource contains the following public fields:
+
+.. rst-class:: rest-resource-table
+
+===================================== ========================== =======================================================
+Field                                 Type                       Description
+===================================== ========================== =======================================================
+id                                    integer                    Internal ID of the cart position
+cart_id                               string                     Identifier of the cart this belongs to. Needs to end
+                                                                 in "@api" for API-created positions.
+datetime                              datetime                   Time of creation
+expires                               datetime                   The cart position will expire at this time and no longer block quota
+item                                  integer                    ID of the item
+variation                             integer                    ID of the variation (or ``null``)
+price                                 money (string)             Price of this position
+attendee_name                         string                     Specified attendee name for this position (or ``null``)
+attendee_email                        string                     Specified attendee email address for this position (or ``null``)
+voucher                               integer                    Internal ID of the voucher used for this position (or ``null``)
+addon_to                              integer                    Internal ID of the position this position is an add-on for (or ``null``)
+subevent                              integer                    ID of the date inside an event series this position belongs to (or ``null``).
+answers                               list of objects            Answers to user-defined questions
+├ question                            integer                    Internal ID of the answered question
+├ answer                              string                     Text representation of the answer
+├ question_identifier                 string                     The question's ``identifier`` field
+├ options                             list of integers           Internal IDs of selected option(s)s (only for choice types)
+└ option_identifiers                  list of strings            The ``identifier`` fields of the selected option(s)s
+===================================== ========================== =======================================================
+
+.. versionchanged:: 1.17
+
+   This resource has been added.
+
+
+Cart position endpoints
+-----------------------
+
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/cartpositions/
+
+   Returns a list of API-created cart positions.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/events/sampleconf/cartpositions/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+      X-Page-Generated: 2017-12-01T10:00:00Z
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "id": 1,
+            "cart_id": "XwokV8FojQviD9jhtDzKvHFdlLRNMhlfo3cNjGbuK6MUTQDT@api",
+            "item": 1,
+            "variation": null,
+            "price": "23.00",
+            "attendee_name": null,
+            "attendee_email": null,
+            "voucher": null,
+            "addon_to": null,
+            "subevent": null,
+            "datetime": "2018-06-11T10:00:00Z",
+            "expires": "2018-06-11T10:00:00Z",
+            "includes_tax": true,
+            "answers": []
+          }
+        ]
+      }
+
+   :query integer page: The page number in case of a multi-page result set, default is 1
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
+
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/cartpositions/(id)/
+
+   Returns information on one cart position, identified by its internal ID.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/events/sampleconf/cartpositions/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 1,
+        "cart_id": "XwokV8FojQviD9jhtDzKvHFdlLRNMhlfo3cNjGbuK6MUTQDT@api",
+        "item": 1,
+        "variation": null,
+        "price": "23.00",
+        "attendee_name": null,
+        "attendee_email": null,
+        "voucher": null,
+        "addon_to": null,
+        "subevent": null,
+        "datetime": "2018-06-11T10:00:00Z",
+        "expires": "2018-06-11T10:00:00Z",
+        "includes_tax": true,
+        "answers": []
+      }
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param event: The ``slug`` field of the event to fetch
+   :param id: The ``id`` field of the position to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
+   :statuscode 404: The requested cart position does not exist.
+
+.. http:post:: /api/v1/organizers/(organizer)/events/(event)/cartpositions/
+
+   Creates a new cart position.
+
+   .. warning:: This endpoint is considered **experimental**. It might change at any time without prior notice.
+
+   .. warning::
+
+       This endpoint is intended for advanced users. It is not designed to be used to build your own shop frontend.
+       There is a lot that it does not or can not do, and you will need to be careful using it.
+       It allows to bypass many of the restrictions imposed when creating a cart through the
+       regular shop.
+
+       Specifically, this endpoint currently
+
+       * does not validate if products are only to be sold in a specific time frame
+
+       * does not validate if the event's ticket sales are already over or haven't started
+
+       * does not support add-on products at the moment
+
+       * does not check or calculate prices but believes any prices you send
+
+       * does not support the redemption of vouchers
+
+       * does not prevent you from buying items that can only be bought with a voucher
+
+       * does not support file upload questions
+
+   You can supply the following fields of the resource:
+
+   * ``cart_id`` (optional, needs to end in ``@api``)
+   * ``item``
+   * ``variation`` (optional)
+   * ``price``
+   * ``attendee_name`` (optional)
+   * ``attendee_email`` (optional)
+   * ``subevent`` (optional)
+   * ``expires`` (optional)
+   * ``includes_tax`` (optional)
+   * ``answers``
+
+      * ``question``
+      * ``answer``
+      * ``options``
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/organizers/bigevents/events/sampleconf/cartpositions/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content: application/json
+
+      {
+        "item": 1,
+        "variation": null,
+        "price": "23.00",
+        "attendee_name": "Peter",
+        "attendee_email": null,
+        "answers": [
+          {
+            "question": 1,
+            "answer": "23",
+            "options": []
+          }
+        ],
+        "subevent": null
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 201 Created
+      Vary: Accept
+      Content-Type: application/json
+
+      (Full cart position resource, see above.)
+
+   :param organizer: The ``slug`` field of the organizer of the event to create a position for
+   :param event: The ``slug`` field of the event to create a position for
+   :statuscode 201: no error
+   :statuscode 400: The item could not be created due to invalid submitted data or lack of quota.
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to create this
+         order.
+
+.. http:delete:: /api/v1/organizers/(organizer)/events/(event)/cartpositions/(id)/
+
+   Deletes a cart position, identified by its internal ID.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      DELETE /api/v1/organizers/bigevents/events/sampleconf/cartpositions/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 204 No Content
+      Vary: Accept
+      Content-Type: application/json
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param event: The ``slug`` field of the event to fetch
+   :param id: The ``id`` field of the position to delete
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
+   :statuscode 404: The requested cart position does not exist.

doc/api/resources/categories.rst

@@ -1,3 +1,5 @@
+.. _`rest-categories`:
+
 Item categories
 ===============
 
@@ -14,6 +16,7 @@ Field                                 Type                       Description
 ===================================== ========================== =======================================================
 id                                    integer                    Internal ID of the category
 name                                  multi-lingual string       The category's visible name
+internal_name                         string                     An optional name that is only used in the backend
 description                           multi-lingual string       A public description (might include markdown, can
                                                                  be ``null``)
 position                              integer                    An integer, used for sorting the categories
@@ -26,6 +29,10 @@ is_addon                              boolean                    If ``True``, it
 
    The operations POST, PATCH, PUT and DELETE have been added.
 
+.. versionchanged:: 1.16
+
+   The field ``internal_name`` has been added.
+
 
 Endpoints
 ---------
@@ -58,6 +65,7 @@ Endpoints
           {
             "id": 1,
             "name": {"en": "Tickets"},
+            "internal_name": "",
             "description": {"en": "Tickets are what you need to get in."},
             "position": 1,
             "is_addon": false
@@ -99,6 +107,7 @@ Endpoints
       {
         "id": 1,
         "name": {"en": "Tickets"},
+        "internal_name": "",
         "description": {"en": "Tickets are what you need to get in."},
         "position": 1,
         "is_addon": false
@@ -126,6 +135,7 @@ Endpoints
 
       {
         "name": {"en": "Tickets"},
+        "internal_name": "",
         "description": {"en": "Tickets are what you need to get in."},
         "position": 1,
         "is_addon": false
@@ -142,6 +152,7 @@ Endpoints
       {
         "id": 1,
         "name": {"en": "Tickets"},
+        "internal_name": "",
         "description": {"en": "Tickets are what you need to get in."},
         "position": 1,
         "is_addon": false
@@ -187,6 +198,7 @@ Endpoints
       {
         "id": 1,
         "name": {"en": "Tickets"},
+        "internal_name": "",
         "description": {"en": "Tickets are what you need to get in."},
         "position": 1,
         "is_addon": true

doc/api/resources/checkinlists.rst

@@ -332,6 +332,10 @@ Order position endpoints
 
    The ``.../redeem/`` endpoint has been added.
 
+.. versionchanged:: 2.0
+
+   The order positions endpoint has been extended by the filter queries ``voucher`` and ``voucher__code``.
+
 .. http:get:: /api/v1/organizers/(organizer)/events/(event)/checkinlists/(list)/positions/
 
    Returns a list of all order positions within a given event. The result is the same as
@@ -375,6 +379,7 @@ Order position endpoints
             "secret": "z3fsn8jyufm5kpk768q69gkbyr5f4h6w",
             "addon_to": null,
             "subevent": null,
+            "pseudonymization_id": "MQLJvANO3B",
             "checkins": [
               {
                 "list": 1,
@@ -421,6 +426,8 @@ Order position endpoints
    :query integer addon_to: Only return positions that are add-ons to the position with the given ID.
    :query integer addon_to__in: Only return positions that are add-ons to one of the positions with the given
                                       comma-separated IDs.
+   :query string voucher: Only return positions with a specific voucher.
+   :query string voucher__code: Only return positions with a specific voucher code.
    :param organizer: The ``slug`` field of the organizer to fetch
    :param event: The ``slug`` field of the event to fetch
    :param list: The ID of the check-in list to look for
@@ -467,6 +474,7 @@ Order position endpoints
         "secret": "z3fsn8jyufm5kpk768q69gkbyr5f4h6w",
         "addon_to": null,
         "subevent": null,
+        "pseudonymization_id": "MQLJvANO3B",
         "checkins": [
           {
             "list": 1,

doc/api/resources/events.rst

@@ -41,6 +41,10 @@ plugins                               list                       A list of packa
    The ``plugins`` field has been added.
    The operations POST, PATCH, PUT and DELETE have been added.
 
+.. versionchanged:: 2.1
+
+   Filters have been added to the list of events.
+
 Endpoints
 ---------
 
@@ -96,6 +100,12 @@ Endpoints
       }
 
    :query page: The page number in case of a multi-page result set, default is 1
+   :query is_public: If set to ``true``/``false``, only events with a matching value of ``is_public`` are returned.
+   :query live: If set to ``true``/``false``, only events with a matching value of ``live`` are returned.
+   :query has_subevents: If set to ``true``/``false``, only events with a matching value of ``has_subevents`` are returned.
+   :query is_future: If set to ``true`` (``false``), only events that happen currently or in the future are (not) returned. Event series are never (always) returned.
+   :query is_past: If set to ``true`` (``false``), only events that are over are (not) returned. Event series are never (always) returned.
+   :query ends_after: If set to a date and time, only events that happen during of after the given time are returned. Event series are never returned.
    :param organizer: The ``slug`` field of a valid organizer
    :statuscode 200: no error
    :statuscode 401: Authentication failure

doc/api/resources/index.rst

@@ -20,3 +20,4 @@ Resources and endpoints
    vouchers
    checkinlists
    waitinglist
+   carts

doc/api/resources/items.rst

@@ -1,3 +1,5 @@
+.. _rest-items:
+
 Items
 =====
 
@@ -14,6 +16,7 @@ Field                                 Type                       Description
 ===================================== ========================== =======================================================
 id                                    integer                    Internal ID of the item
 name                                  multi-lingual string       The item's visible name
+internal_name                         string                     An optional name that is only used in the backend
 default_price                         money (string)             The item price that is applied if the price is not
                                                                  overwritten by variations or other options.
 category                              integer                    The ID of the category this item belongs to
@@ -54,11 +57,17 @@ max_per_order                         integer                    This product ca
 checkin_attention                     boolean                    If ``True``, the check-in app should show a warning
                                                                  that this ticket requires special attention if such
                                                                  a product is being scanned.
+original_price                        money (string)             An original price, shown for comparison, not used
+                                                                 for price calculations.
+require_approval                      boolean                    If ``True``, orders with this product will need to be
+                                                                 approved by the event organizer before they can be
+                                                                 paid.
 has_variations                        boolean                    Shows whether or not this item has variations.
 variations                            list of objects            A list with one object for each variation of this item.
                                                                  Can be empty. Only writable during creation,
                                                                  use separate endpoint to modify this later.
 ├ id                                  integer                    Internal ID of the variation
+├ value                               multi-lingual string       The "name" of the variation
 ├ default_price                       money (string)             The price set directly for this variation or ``null``
 ├ price                               money (string)             The price used for this variation. This is either the
                                                                  same as ``default_price`` if that value is set or equal
@@ -88,6 +97,14 @@ addons                                list of objects            Definition of a
    The write operations ``POST``, ``PATCH``, ``PUT``, and ``DELETE`` have been added.
    The attribute ``price_included`` has been added to ``addons``.
 
+.. versionchanged:: 1.16
+
+   The ``internal_name`` and ``original_price`` fields have been added.
+
+.. versionchanged:: 2.0
+
+   The field ``require_approval`` has been added.
+
 Notes
 -----
 Please note that an item either always has variations or never has. Once created with variations the item can never
@@ -129,7 +146,9 @@ Endpoints
           {
             "id": 1,
             "name": {"en": "Standard ticket"},
+            "internal_name": "",
             "default_price": "23.00",
+            "original_price": null,
             "category": null,
             "active": true,
             "description": null,
@@ -148,6 +167,7 @@ Endpoints
             "max_per_order": null,
             "checkin_attention": false,
             "has_variations": false,
+            "require_approval": false,
             "variations": [
               {
                  "value": {"en": "Student"},
@@ -211,7 +231,9 @@ Endpoints
       {
         "id": 1,
         "name": {"en": "Standard ticket"},
+        "internal_name": "",
         "default_price": "23.00",
+        "original_price": null,
         "category": null,
         "active": true,
         "description": null,
@@ -230,6 +252,7 @@ Endpoints
         "max_per_order": null,
         "checkin_attention": false,
         "has_variations": false,
+        "require_approval": false,
         "variations": [
           {
              "value": {"en": "Student"},
@@ -274,7 +297,9 @@ Endpoints
       {
         "id": 1,
         "name": {"en": "Standard ticket"},
+        "internal_name": "",
         "default_price": "23.00",
+        "original_price": null,
         "category": null,
         "active": true,
         "description": null,
@@ -292,6 +317,7 @@ Endpoints
         "min_per_order": null,
         "max_per_order": null,
         "checkin_attention": false,
+        "require_approval": false,
         "variations": [
           {
              "value": {"en": "Student"},
@@ -324,7 +350,9 @@ Endpoints
       {
         "id": 1,
         "name": {"en": "Standard ticket"},
+        "internal_name": "",
         "default_price": "23.00",
+        "original_price": null,
         "category": null,
         "active": true,
         "description": null,
@@ -343,6 +371,7 @@ Endpoints
         "max_per_order": null,
         "checkin_attention": false,
         "has_variations": true,
+        "require_approval": false,
         "variations": [
           {
              "value": {"en": "Student"},
@@ -406,7 +435,9 @@ Endpoints
       {
         "id": 1,
         "name": {"en": "Ticket"},
+        "internal_name": "",
         "default_price": "25.00",
+        "original_price": null,
         "category": null,
         "active": true,
         "description": null,
@@ -425,6 +456,7 @@ Endpoints
         "max_per_order": null,
         "checkin_attention": false,
         "has_variations": true,
+        "require_approval": false,
         "variations": [
           {
              "value": {"en": "Student"},

doc/api/resources/question_options.rst

@@ -128,7 +128,7 @@ Endpoints
       POST /api/v1/organizers/bigevents/events/sampleconf/questions/1/options/ HTTP/1.1
       Host: pretix.eu
       Accept: application/json, text/javascript
-      Content: application/json
+      Content-Type: application/json
 
       {
         "identifier": "LVETRWVU",

doc/api/resources/questions.rst

@@ -1,5 +1,7 @@
 .. spelling:: checkin
 
+.. _rest-questions:
+
 Questions
 =========
 

doc/api/resources/quotas.rst

@@ -1,3 +1,5 @@
+.. _rest-quotas:
+
 Quotas
 ======
 

doc/api/resources/subevents.rst

@@ -1,3 +1,5 @@
+.. _rest-subevents:
+
 Event series dates / Sub-events
 ===============================
 
@@ -15,6 +17,7 @@ Field                                 Type                       Description
 ===================================== ========================== =======================================================
 id                                    integer                    Internal ID of the sub-event
 name                                  multi-lingual string       The sub-event's full name
+event                                 string                     The slug of the parent event
 active                                boolean                    If ``true``, the sub-event ticket shop is publicly
                                                                  available.
 date_from                             datetime                   The sub-event's start date
@@ -38,6 +41,10 @@ meta_data                             dict                       Values set for
 
    The ``meta_data`` field has been added.
 
+.. versionchanged:: 2.1
+
+   The ``event`` field has been added, together with filters on the list of dates and an organizer-level list.
+
 
 Endpoints
 ---------
@@ -70,6 +77,7 @@ Endpoints
           {
             "id": 1,
             "name": {"en": "First Sample Conference"},
+            "event": "sampleconf",
             "active": false,
             "date_from": "2017-12-27T10:00:00Z",
             "date_to": null,
@@ -90,6 +98,10 @@ Endpoints
       }
 
    :query page: The page number in case of a multi-page result set, default is 1
+   :query active: If set to ``true``/``false``, only events with a matching value of ``active`` are returned.
+   :query is_future: If set to ``true`` (``false``), only events that happen currently or in the future are (not) returned.
+   :query is_past: If set to ``true`` (``false``), only events that are over are (not) returned.
+   :query ends_after: If set to a date and time, only events that happen during of after the given time are returned.
    :param organizer: The ``slug`` field of a valid organizer
    :param event: The ``slug`` field of the event to fetch
    :statuscode 200: no error
@@ -119,6 +131,7 @@ Endpoints
       {
         "id": 1,
         "name": {"en": "First Sample Conference"},
+        "event": "sampleconf",
         "active": false,
         "date_from": "2017-12-27T10:00:00Z",
         "date_to": null,
@@ -142,3 +155,63 @@ Endpoints
    :statuscode 200: no error
    :statuscode 401: Authentication failure
    :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view it.
+
+.. http:get:: /api/v1/organizers/(organizer)/subevents/
+
+   Returns a list of all sub-events of any event series you have access to within an organizer account.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/subevents/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "id": 1,
+            "name": {"en": "First Sample Conference"},
+            "event": "sampleconf",
+            "active": false,
+            "date_from": "2017-12-27T10:00:00Z",
+            "date_to": null,
+            "date_admission": null,
+            "presale_start": null,
+            "presale_end": null,
+            "location": null,
+            "item_price_overrides": [
+              {
+                "item": 2,
+                "price": "12.00"
+              }
+            ],
+            "variation_price_overrides": [],
+            "meta_data": {}
+          }
+        ]
+      }
+
+   :query page: The page number in case of a multi-page result set, default is 1
+   :query active: If set to ``true``/``false``, only events with a matching value of ``active`` are returned.
+   :query event__live: If set to ``true``/``false``, only events with a matching value of ``live`` on the parent event are returned.
+   :query is_future: If set to ``true`` (``false``), only events that happen currently or in the future are (not) returned.
+   :query is_past: If set to ``true`` (``false``), only events that are over are (not) returned.
+   :query ends_after: If set to a date and time, only events that happen during of after the given time are returned.
+   :param organizer: The ``slug`` field of a valid organizer
+   :param event: The ``slug`` field of the event to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view it.

doc/api/resources/taxrules.rst

@@ -1,3 +1,5 @@
+.. _rest-taxrules:
+
 Tax rules
 =========
 

doc/api/tokenauth.rst

@@ -0,0 +1,36 @@
+.. _`rest-tokenauth`:
+
+Token-based authentication
+==========================
+
+Obtaining an API token
+----------------------
+
+To authenticate your API requests with Tokens, you need to obtain a team-level API token.
+You can create a token in the pretix web interface on the level of organizer teams. Create
+a new team or choose an existing team that has the level of permissions the token should
+have and create a new token using the form below the list of team members:
+
+.. image:: img/token_form.png
+   :class: screenshot
+
+You can enter a description for the token to distinguish from other tokens later on.
+Once you click "Add", you will be provided with an API token in the success message.
+Copy this token, as you won't be able to retrieve it again.
+
+.. image:: img/token_success.png
+   :class: screenshot
+
+Using an API token
+------------------
+
+You need to include the API token with every request to pretix' API in the ``Authorization`` header
+like the following:
+
+.. sourcecode:: http
+   :emphasize-lines: 3
+
+   GET /api/v1/organizers/ HTTP/1.1
+   Host: pretix.eu
+   Authorization: Token e1l6gq2ye72thbwkacj7jbri7a7tvxe614ojv8ybureain92ocub46t5gab5966k
+

doc/development/api/customview.rst

@@ -64,7 +64,7 @@ Similarly, there is ``organizer_permission_required`` and ``OrganizerPermissionR
 event-related views, there is also a signal that allows you to add the view to the event navigation like this::
 
 
-    from django.core.urlresolvers import resolve, reverse
+    from django.urls import resolve, reverse
     from django.dispatch import receiver
     from django.utils.translation import ugettext_lazy as _
     from pretix.control.signals import nav_event

doc/development/api/email.rst

@@ -0,0 +1,109 @@
+.. highlight:: python
+   :linenothreshold: 5
+
+Writing an HTML e-mail renderer plugin
+======================================
+
+An email renderer class controls how the HTML part of e-mails sent by pretix is built.
+The creation of such a plugin is very similar to creating an export output.
+
+Please read :ref:`Creating a plugin <pluginsetup>` first, if you haven't already.
+
+Output registration
+-------------------
+
+The email HTML renderer API does not make a lot of usage from signals, however, it
+does use a signal to get a list of all available email renderers. Your plugin
+should listen for this signal and return the subclass of ``pretix.base.email.BaseHTMLMailRenderer``
+that we'll provide in this plugin::
+
+    from django.dispatch import receiver
+
+    from pretix.base.signals import register_html_mail_renderers
+
+
+    @receiver(register_html_mail_renderers, dispatch_uid="renderer_custom")
+    def register_mail_renderers(sender, **kwargs):
+        from .email import MyMailRenderer
+        return MyMailRenderer
+
+
+The renderer class
+------------------
+
+.. class:: pretix.base.email.BaseHTMLMailRenderer
+
+   The central object of each email renderer is the subclass of ``BaseHTMLMailRenderer``.
+
+   .. py:attribute:: BaseHTMLMailRenderer.event
+
+      The default constructor sets this property to the event we are currently
+      working for.
+
+   .. autoattribute:: identifier
+
+      This is an abstract attribute, you **must** override this!
+
+   .. autoattribute:: verbose_name
+
+      This is an abstract attribute, you **must** override this!
+
+   .. autoattribute:: thumbnail_filename
+
+      This is an abstract attribute, you **must** override this!
+
+   .. autoattribute:: is_available
+
+   .. automethod:: render
+
+      This is an abstract method, you **must** implement this!
+
+Helper class for template-base renderers
+----------------------------------------
+
+The email renderer that ships with pretix is based on Django templates to generate HTML.
+In case you also want to render emails based on a template, we provided a ready-made base
+class ``TemplateBasedMailRenderer`` that you can re-use to perform the following steps:
+
+* Convert the body text and the signature to HTML using our markdown renderer
+
+* Render the template
+
+* Call `inlinestyler`_ to convert all ``<style>`` style sheets to inline ``style=""``
+  attributes for better compatibility
+
+To use it, you just need to implement some variables::
+
+    class ClassicMailRenderer(TemplateBasedMailRenderer):
+        verbose_name = _('pretix default')
+        identifier = 'classic'
+        thumbnail_filename = 'pretixbase/email/thumb.png'
+        template_name = 'pretixbase/email/plainwrapper.html'
+
+The template is passed the following context variables:
+
+``site``
+   Name of the pretix installation (``settings.PRETIX_INSTANCE_NAME``)
+
+``site_url``
+   Root URL of the pretix installation (``settings.SITE_URL``)
+
+``body``
+   The body as markdown (render with ``{{ body|safe }}``)
+
+``subject``
+   The email subject
+
+``color``
+   The primary color of the event
+
+``event``
+   The ``Event`` object
+
+``signature`` (optional, only if configured)
+   The body as markdown (render with ``{{ signature|safe }}``)
+
+``order`` (optional, only if applicable)
+   The ``Order`` object
+
+.. _inlinestyler: https://pypi.org/project/inlinestyler/

doc/development/api/general.rst

@@ -48,7 +48,8 @@ Backend
 -------
 
 .. automodule:: pretix.control.signals
-   :members: nav_event, html_head, quota_detail_html, nav_topbar, nav_global, nav_organizer, nav_event_settings, order_info, event_settings_widget
+   :members: nav_event, html_head, html_page_start, quota_detail_html, nav_topbar, nav_global, nav_organizer, nav_event_settings,
+   order_info, event_settings_widget, oauth_application_registered
 
 
 .. automodule:: pretix.base.signals

doc/development/api/index.rst

@@ -10,6 +10,8 @@ Contents:
    exporter
    ticketoutput
    payment
+   payment_2.0
+   email
    invoice
    shredder
    customview

doc/development/api/payment.rst

@@ -9,6 +9,10 @@ is very similar to creating an export output.
 
 Please read :ref:`Creating a plugin <pluginsetup>` first, if you haven't already.
 
+.. warning:: We changed our payment provider API a lot in pretix 2.x. Our documentation page on :ref:`payment2.0`
+             might be insightful even if you do not have a payment provider to port, as it outlines the rationale
+             behind the current design.
+
 Provider registration
 ---------------------
 
@@ -31,7 +35,7 @@ that the plugin will provide::
 The provider class
 ------------------
 
-.. class:: pretix.base.payment.BasePaymentProvider
+.. py:class:: pretix.base.payment.BasePaymentProvider
 
    The central object of each payment provider is the subclass of ``BasePaymentProvider``.
 
@@ -54,58 +58,60 @@ The provider class
 
       This is an abstract attribute, you **must** override this!
 
-   .. autoattribute:: is_enabled
+   .. autoattribute:: public_name
 
-   .. automethod:: calculate_fee
+   .. autoattribute:: is_enabled
 
    .. autoattribute:: settings_form_fields
 
    .. automethod:: settings_content_render
 
-   .. automethod:: render_invoice_text
+   .. automethod:: is_allowed
 
    .. automethod:: payment_form_render
 
    .. automethod:: payment_form
 
-   .. automethod:: is_allowed
-
    .. autoattribute:: payment_form_fields
 
-   .. automethod:: checkout_prepare
-
    .. automethod:: payment_is_valid_session
 
+   .. automethod:: checkout_prepare
+
    .. automethod:: checkout_confirm_render
 
       This is an abstract method, you **must** override this!
 
-   .. automethod:: payment_perform
+   .. automethod:: execute_payment
+
+   .. automethod:: calculate_fee
 
    .. automethod:: order_pending_mail_render
 
-   .. automethod:: order_pending_render
+   .. automethod:: payment_pending_render
 
-      This is an abstract method, you **must** override this!
+   .. autoattribute:: abort_pending_allowed
+
+   .. automethod:: render_invoice_text
 
    .. automethod:: order_change_allowed
 
-   .. automethod:: order_can_retry
+   .. automethod:: payment_prepare
 
-   .. automethod:: order_prepare
+   .. automethod:: payment_control_render
 
-   .. automethod:: order_paid_render
+   .. automethod:: payment_refund_supported
 
-   .. automethod:: order_control_render
+   .. automethod:: payment_partial_refund_supported
 
-   .. automethod:: order_control_refund_render
-
-   .. automethod:: order_control_refund_perform
-
-   .. automethod:: is_implicit
+   .. automethod:: execute_refund
 
    .. automethod:: shred_payment_info
 
+   .. autoattribute:: is_implicit
+
+   .. autoattribute:: is_meta
+
 
 Additional views
 ----------------

doc/development/api/payment_2.0.rst

@@ -0,0 +1,129 @@
+.. highlight:: python
+   :linenothreshold: 5
+
+.. _`payment2.0`:
+
+Porting a payment provider from pretix 1.x to pretix 2.x
+========================================================
+
+In pretix 2.x, we changed large parts of the payment provider API. This documentation details the changes we made
+and shows you how you can make an existing pretix 1.x payment provider compatible with pretix 2.x
+
+Conceptual overview
+-------------------
+
+In pretix 1.x, an order was always directly connected to a payment provider for the full life of an order. As long as
+an order was unpaid, this could still be changed in some cases, but once an order was paid, no changes to the payment
+provider were possible any more. Additionally, the internal state of orders allowed orders only to be fully paid or
+not paid at all. This leads to a couple of consequences:
+
+* Payment-related functions (like "execute payment" or "do a refund") always operated on full orders.
+
+* Changing the total of an order was basically impossible once an order was paid, since there was no concept of
+  partial payments or partial refunds.
+
+* Payment provider plugins needed to take complicated steps to detect cases that require human intervention, like e.g.
+
+  * An order has expired, no quota is left to revive it, but a payment has been received
+
+  * A payment has been received for a canceled order
+
+  * A payment has been received for an order that has already been paid with a different payment method
+
+  * An external payment service notified us of a refund/dispute
+
+  We noticed that we copied and repeated large portions of code in all our official payment provider plugins, just
+  to deal with some of these cases.
+
+* Sometimes, there is the need to mark an order as refunded within pretix, without automatically triggering a refund
+  with an external API. Every payment method needed to implement a user interface for this independently.
+
+* If a refund was not possible automatically, there was no way user to track which payments actually have been refunded
+  manually and which are still left to do.
+
+* When the payment with one payment provider failed and the user changed to a different payment provider, all
+  information about the first payment was lost from the order object and could only be retrieved from order log data,
+  which also made it hard to design a data shredder API to get rid of this data.
+
+In pretix 2.x, we introduced two new models, :py:class:`OrderPayment <pretix.base.models.OrderPayment>` and
+:py:class:`OrderRefund <pretix.base.models.OrderRefund>`. Each instance of these is connected to an order and
+represents one single attempt to pay or refund a specific amount of money. Each one of these has an individual state,
+can individually fail or succeed, and carries an amount variable that can differ from the order total.
+
+This has the following advantages:
+
+* The system can now detect orders that are over- or underpaid, independent of the payment providers in use.
+
+* Therefore, we can now allow partial payments, partial refunds, and changing paid orders, and automatically detect
+  the cases listed above and notify the user.
+
+Payment providers now interact with those payment and refund objects more than with orders.
+
+Your to-do list
+---------------
+
+Payment processing
+""""""""""""""""""
+
+* The method ``BasePaymentProvider.order_pending_render`` has been removed and replaced by a new
+  ``BasePaymentProvider.payment_pending_render(request, payment)`` method that is passed an ``OrderPayment``
+  object instead of an ``Order``.
+
+* The method ``BasePaymentProvider.payment_form_render`` now receives a new ``total`` parameter.
+
+* The method ``BasePaymentProvider.payment_perform`` has been removed and replaced by a new method
+  ``BasePaymentProvider.execute_payment(request, payment)`` that is passed an ``OrderPayment``
+  object instead of an ``Order``.
+
+* The function ``pretix.base.services.mark_order_paid`` has been removed, instead call ``payment.confirm()``
+  on a pending ``OrderPayment`` object. If no further payments are required for this order, this will also
+  mark the order as paid automatically. Note that ``payment.confirm()`` can still throw a ``QuotaExceededException``,
+  however it will still mark the payment as complete (not the order!), so you should catch this exception and
+  inform the user, but not abort the transaction.
+
+* A new property ``BasePaymentProvider.abort_pending_allowed`` has been introduced. Only if set, the user will
+  be able to retry a payment or switch the payment method when the order currently has a payment object in
+  state ``"pending"``. This replaces ``BasePaymentProvider.order_can_retry``, which no longer exists.
+
+* The methods ``BasePaymentProvider.retry_prepare`` and ``BasePaymentProvider.order_prepare`` have both been
+  replaced by a new method ``BasePaymentProvider.payment_prepare(request, payment)`` that is passed an ``OrderPayment``
+  object instead of an ``Order``. **Keep in mind that this payment object might have an amount property that
+  differs from the order total, if the order is already partially paid.**
+
+* The method ``BasePaymentProvider.order_paid_render`` has been removed.
+
+* The method ``BasePaymentProvider.order_control_render`` has been removed and replaced by a new method
+  ``BasePaymentProvider.payment_control_render(request, payment)`` that is passed an ``OrderPayment``
+  object instead of an ``Order``.
+
+* There's no need to manually deal with excess payments or duplicate payments anymore, just setting the ``OrderPayment``
+  methods to the correct state will do the job.
+
+Creating refunds
+""""""""""""""""
+
+* The methods ``BasePaymentProvider.order_control_refund_render`` and ``BasePaymentProvider.order_control_refund_perform``
+  have been removed.
+
+* Two new boolean methods ``BasePaymentProvider.payment_refund_supported(payment)`` and ``BasePaymentProvider.payment_partial_refund_supported(payment)``
+  have been introduced. They should be set to return ``True`` if and only if the payment API allows to *automatically*
+  transfer the money back to the customer.
+
+* A new method ``BasePaymentProvider.execute_refund(refund)`` has been introduced. This method is called using a
+  ``OrderRefund`` object in ``"created"`` state and is expected to transfer the money back and confirm success with
+  calling ``refund.done()``. This will only ever be called if either ``BasePaymentProvider.payment_refund_supported(payment)``
+  or ``BasePaymentProvider.payment_partial_refund_supported(payment)`` return ``True``.
+
+Processing external refunds
+"""""""""""""""""""""""""""
+
+* If e.g. a webhook API notifies you that a payment has been disputed or refunded with the external API, you are
+  expected to call ``OrderPayment.create_external_refund(self, amount, execution_date, info='{}')`` on this payment.
+  This will create and return an appropriate ``OrderRefund`` object and send out a notification. However, it will not
+  mark the order as refunded, but will ask the event organizer for a decision.
+
+Data shredders
+""""""""""""""
+
+* The method ``BasePaymentProvider.shred_payment_info`` is no longer passed an order, but instead **either**
+  an ``OrderPayment`` **or** an ``OrderRefund``.

doc/development/implementation/models.rst

@@ -86,6 +86,15 @@ Carts and Orders
 .. autoclass:: pretix.base.models.OrderPosition
    :members:
 
+.. autoclass:: pretix.base.models.OrderFee
+   :members:
+
+.. autoclass:: pretix.base.models.OrderPayment
+   :members:
+
+.. autoclass:: pretix.base.models.OrderRefund
+   :members:
+
 .. autoclass:: pretix.base.models.CartPosition
    :members:
 

doc/development/setup.rst

@@ -18,7 +18,7 @@ External Dependencies
 ---------------------
 Your should install the following on your system:
 
-* Python 3.4 or newer
+* Python 3.5 or newer
 * ``pip`` for Python 3 (Debian package: ``python3-pip``)
 * ``python-dev`` for Python 3 (Debian package: ``python3-dev``)
 * ``libffi`` (Debian package: ``libffi-dev``)
@@ -54,10 +54,6 @@ The first thing you need are all the main application's dependencies::
     cd src/
     pip3 install -r requirements.txt -r requirements/dev.txt
 
-If you are working with Python 3.4, you will also need (you can skip this for Python 3.5+)::
-
-    pip3 install -r requirements/py34.txt
-
 Next, you need to copy the SCSS files from the source folder to the STATIC_ROOT directory::
 
     python manage.py collectstatic --noinput
@@ -122,13 +118,15 @@ for example, to check for any errors in any staged files when committing::
     export GIT_WORK_TREE=../
     export GIT_DIR=../.git
     source ../env/bin/activate  # Adjust to however you activate your virtual environment
-    for file in $(git diff --cached --name-only | grep -E '\.py$')
+    for file in $(git diff --cached --name-only | grep -E '\.py$' | grep -Ev "migrations|mt940\.py|pretix/settings\.py|make_testdata\.py|testutils/settings\.py|tests/settings\.py|pretix/base/models/__init__\.py")
     do
+      echo $file
       git show ":$file" | flake8 - --stdin-display-name="$file" || exit 1 # we only want to lint the staged changes, not any un-staged changes
       git show ":$file" | isort -df --check-only - | grep ERROR && exit 1 || true
     done
 
 
+
 This keeps you from accidentally creating commits violating the style guide.
 
 Working with mails

doc/plugins/badges.rst

@@ -0,0 +1,110 @@
+Badges
+======
+
+The badges plugin provides a HTTP API that exposes the various layouts used to generate PDF badges.
+
+Resource description
+--------------------
+
+The badge layout resource contains the following public fields:
+
+.. rst-class:: rest-resource-table
+
+===================================== ========================== =======================================================
+Field                                 Type                       Description
+===================================== ========================== =======================================================
+id                                    integer                    Internal layout ID
+name                                  string                     Internal layout description
+default                               boolean                    ``true`` if this is the default layout
+layout                                object                     Layout specification for libpretixprint
+background                            URL                        Background PDF file
+item_assignments                      list of objects            Products this layout is assigned to
+└ item                                integer                    Item ID
+===================================== ========================== =======================================================
+
+.. versionchanged:: 1.16
+
+   This resource has been added.
+
+
+Endpoints
+---------
+
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/badgelayouts/
+
+   Returns a list of all badge layouts
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/events/democon/badgelayouts/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: text/javascript
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "id": 1,
+            "name": "Default layout",
+            "default": true,
+            "layout": {…},
+            "background": {},
+            "item_assignments": []
+          }
+        ]
+      }
+
+   :query page: The page number in case of a multi-page result set, default is 1
+   :param organizer: The ``slug`` field of a valid organizer
+   :param event: The ``slug`` field of a valid event
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view it.
+
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/badgelayouts/(id)/
+
+   Returns information on layout.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/events/democon/layoutsbadge/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: text/javascript
+
+      {
+        "id": 1,
+        "name": "Default layout",
+        "default": true,
+        "layout": {…},
+        "background": {},
+        "item_assignments": []
+      }
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param event: The ``slug`` field of the event to fetch
+   :param id: The ``id`` field of the layout to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view it.

doc/plugins/index.rst

@@ -12,3 +12,5 @@ If you want to **create** a plugin, please go to the
    list
    pretixdroid
    banktransfer
+   ticketoutputpdf
+   badges

doc/plugins/pretixdroid.rst

@@ -81,6 +81,7 @@ uses to communicate with the pretix server.
           "attention": false,
           "redeemed": true,
           "checkin_allowed": true,
+          "addons_text": "Parking spot",
           "paid": true
         }
       }
@@ -106,6 +107,7 @@ uses to communicate with the pretix server.
           "attention": false,
           "redeemed": true,
           "checkin_allowed": true,
+          "addons_text": "Parking spot",
           "paid": true
         },
         "questions": [
@@ -152,6 +154,7 @@ uses to communicate with the pretix server.
           "attention": false,
           "redeemed": true,
           "checkin_allowed": true,
+          "addons_text": "Parking spot",
           "paid": true
         }
       }
@@ -212,6 +215,7 @@ uses to communicate with the pretix server.
             "redeemed": false,
             "attention": false,
             "checkin_allowed": true,
+            "addons_text": "Parking spot",
             "paid": true
           },
           ...

doc/plugins/ticketoutputpdf.rst

@@ -0,0 +1,111 @@
+PDF ticket output
+=================
+
+The PDF ticket output plugin provides a HTTP API that exposes the various layouts used
+to generate PDF tickets.
+
+Resource description
+--------------------
+
+The ticket layout resource contains the following public fields:
+
+.. rst-class:: rest-resource-table
+
+===================================== ========================== =======================================================
+Field                                 Type                       Description
+===================================== ========================== =======================================================
+id                                    integer                    Internal layout ID
+name                                  string                     Internal layout description
+default                               boolean                    ``true`` if this is the default layout
+layout                                object                     Layout specification for libpretixprint
+background                            URL                        Background PDF file
+item_assignments                      list of objects            Products this layout is assigned to
+└ item                                integer                    Item ID
+===================================== ========================== =======================================================
+
+.. versionchanged:: 1.16
+
+   This resource has been added.
+
+
+Endpoints
+---------
+
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/ticketlayouts/
+
+   Returns a list of all ticket layouts
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/events/democon/ticketlayouts/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: text/javascript
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "id": 1,
+            "name": "Default layout",
+            "default": true,
+            "layout": {…},
+            "background": {},
+            "item_assignments": []
+          }
+        ]
+      }
+
+   :query page: The page number in case of a multi-page result set, default is 1
+   :param organizer: The ``slug`` field of a valid organizer
+   :param event: The ``slug`` field of a valid event
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view it.
+
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/ticketlayouts/(id)/
+
+   Returns information on layout.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/events/democon/ticketlayouts/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: text/javascript
+
+      {
+        "id": 1,
+        "name": "Default layout",
+        "default": true,
+        "layout": {…},
+        "background": {},
+        "item_assignments": []
+      }
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param event: The ``slug`` field of the event to fetch
+   :param id: The ``id`` field of the layout to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view it.

doc/spelling_wordlist.txt

@@ -23,6 +23,7 @@ cronjob
 cryptographic
 debian
 deduplication
+deprovision
 discoverable
 django
 dockerfile
@@ -38,10 +39,12 @@ gunicorn
 hardcoded
 hostname
 idempotency
+incrementing
 inofficial
 invalidations
 iterable
 Jimdo
+libpretixprint
 libsass
 linters
 memcached
@@ -77,6 +80,7 @@ prometheus
 proxied
 proxying
 pseudonymize
+pseudonymization
 queryset
 redemptions
 redis

doc/user/events/widget.rst

@@ -107,6 +107,13 @@ voucher's settings.
         </div>
     </noscript>
 
+Disabling the voucher input
+---------------------------
+
+If you want to disable voucher input in the widget, you can pass the ``disable-vouchers`` attribute::
+
+   <pretix-widget event="https://pretix.eu/demo/democon/" disable-vouchers></pretix-widget>
+
 pretix Button
 -------------
 
@@ -136,7 +143,7 @@ resources. Then, instead of the ``pretix-widget`` tag, use the ``pretix-button``
 As you can see, the ``pretix-button`` element takes an additional ``items`` attribute that specifies the items that
 should be added to the cart. The syntax of this attribute is ``item_ITEMID=1,item_ITEMID=2,variation_ITEMID_VARID=4``
 where ``ITEMID`` are the internal IDs of items to be added and ``VARID`` are the internal IDs of variations of those
-items, if the items have variations.
+items, if the items have variations. If you omit the ``items`` attribute, the general start page will be presented.
 
 Just as the widget, the button supports the optional attributes ``voucher`` and ``skip-ssl-check``.
 

readthedocs.yml

@@ -0,0 +1,6 @@
+
+build:
+  image: latest
+
+python:
+  version: 3.6

src/MANIFEST.in

@@ -8,6 +8,8 @@ recursive-include pretix/control/templates *
 recursive-include pretix/presale/templates *
 recursive-include pretix/plugins/banktransfer/templates *
 recursive-include pretix/plugins/banktransfer/static *
+recursive-include pretix/plugins/manualpayment/templates *
+recursive-include pretix/plugins/manualpayment/static *
 recursive-include pretix/plugins/paypal/templates *
 recursive-include pretix/plugins/pretixdroid/templates *
 recursive-include pretix/plugins/pretixdroid/static *
@@ -18,3 +20,5 @@ recursive-include pretix/plugins/stripe/templates *
 recursive-include pretix/plugins/stripe/static *
 recursive-include pretix/plugins/ticketoutputpdf/templates *
 recursive-include pretix/plugins/ticketoutputpdf/static *
+recursive-include pretix/plugins/badges/templates *
+recursive-include pretix/plugins/badges/static *

src/pretix/__init__.py

@@ -1 +1 @@
-__version__ = "1.15.0"
+__version__ = "2.1.0"

src/pretix/api/__init__.py

@@ -0,0 +1,9 @@
+from django.apps import AppConfig
+
+
+class PretixApiConfig(AppConfig):
+    name = 'pretix.api'
+    label = 'pretixapi'
+
+
+default_app_config = 'pretix.api.PretixApiConfig'

src/pretix/api/auth/device.py

@@ -0,0 +1,25 @@
+from django.contrib.auth.models import AnonymousUser
+from rest_framework import exceptions
+from rest_framework.authentication import TokenAuthentication
+
+from pretix.base.models import Device
+
+
+class DeviceTokenAuthentication(TokenAuthentication):
+    model = Device
+    keyword = 'Device'
+
+    def authenticate_credentials(self, key):
+        model = self.get_model()
+        try:
+            device = model.objects.select_related('organizer').get(api_token=key)
+        except model.DoesNotExist:
+            raise exceptions.AuthenticationFailed('Invalid token.')
+
+        if not device.initialized:
+            raise exceptions.AuthenticationFailed('Device has not been initialized.')
+
+        if not device.api_token:
+            raise exceptions.AuthenticationFailed('Device access has been revoked.')
+
+        return AnonymousUser(), device

src/pretix/api/auth/permission.py

@@ -1,6 +1,7 @@
 from rest_framework.permissions import SAFE_METHODS, BasePermission
 
-from pretix.base.models import Event
+from pretix.api.models import OAuthAccessToken
+from pretix.base.models import Device, Event
 from pretix.base.models.organizer import Organizer, TeamAPIToken
 from pretix.helpers.security import (
     SessionInvalid, SessionReauthRequired, assert_session_valid,
@@ -8,10 +9,9 @@ from pretix.helpers.security import (
 
 
 class EventPermission(BasePermission):
-    model = TeamAPIToken
 
     def has_permission(self, request, view):
-        if not request.user.is_authenticated and not isinstance(request.auth, TeamAPIToken):
+        if not request.user.is_authenticated and not isinstance(request.auth, (Device, TeamAPIToken)):
             return False
 
         if request.method not in SAFE_METHODS and hasattr(view, 'write_permission'):
@@ -30,7 +30,7 @@ class EventPermission(BasePermission):
             except SessionReauthRequired:
                 return False
 
-        perm_holder = (request.auth if isinstance(request.auth, TeamAPIToken)
+        perm_holder = (request.auth if isinstance(request.auth, (Device, TeamAPIToken))
                        else request.user)
         if 'event' in request.resolver_match.kwargs and 'organizer' in request.resolver_match.kwargs:
             request.event = Event.objects.filter(
@@ -55,6 +55,15 @@ class EventPermission(BasePermission):
 
             if required_permission and required_permission not in request.orgapermset:
                 return False
+
+        if isinstance(request.auth, OAuthAccessToken):
+            if not request.auth.allow_scopes(['write']) and request.method not in SAFE_METHODS:
+                return False
+            if not request.auth.allow_scopes(['read']) and request.method in SAFE_METHODS:
+                return False
+        if isinstance(request.auth, OAuthAccessToken) and hasattr(request, 'organizer'):
+            if not request.auth.organizers.filter(pk=request.organizer.pk).exists():
+                return False
         return True
 
 
@@ -66,7 +75,7 @@ class EventCRUDPermission(EventPermission):
             return False
         elif view.action == 'destroy' and 'can_change_event_settings' not in request.eventpermset:
             return False
-        elif view.action in ['retrieve', 'update', 'partial_update'] \
+        elif view.action in ['update', 'partial_update'] \
                 and 'can_change_event_settings' not in request.eventpermset:
             return False
 

src/pretix/api/migrations/0001_initial.py

@@ -0,0 +1,128 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.13 on 2018-06-04 11:19
+from __future__ import unicode_literals
+
+import django.db.models.deletion
+import oauth2_provider.generators
+import oauth2_provider.validators
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    initial = True
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='OAuthAccessToken',
+            fields=[
+                ('id', models.BigAutoField(primary_key=True, serialize=False)),
+                ('token', models.CharField(max_length=255, unique=True)),
+                ('expires', models.DateTimeField()),
+                ('scope', models.TextField(blank=True)),
+                ('created', models.DateTimeField(auto_now_add=True)),
+                ('updated', models.DateTimeField(auto_now=True)),
+            ],
+            options={
+                'abstract': False,
+            },
+        ),
+        migrations.CreateModel(
+            name='OAuthApplication',
+            fields=[
+                ('id', models.BigAutoField(primary_key=True, serialize=False)),
+                ('client_type',
+                 models.CharField(choices=[('confidential', 'Confidential'), ('public', 'Public')], max_length=32)),
+                ('authorization_grant_type', models.CharField(
+                    choices=[('authorization-code', 'Authorization code'), ('implicit', 'Implicit'),
+                             ('password', 'Resource owner password-based'),
+                             ('client-credentials', 'Client credentials')], max_length=32)),
+                ('skip_authorization', models.BooleanField(default=False)),
+                ('created', models.DateTimeField(auto_now_add=True)),
+                ('updated', models.DateTimeField(auto_now=True)),
+                ('name', models.CharField(max_length=255, verbose_name='Application name')),
+                ('redirect_uris', models.TextField(help_text='Allowed URIs list, space separated',
+                                                   validators=[oauth2_provider.validators.URIValidator],
+                                                   verbose_name='Redirection URIs')),
+                ('client_id',
+                 models.CharField(db_index=True, default=oauth2_provider.generators.generate_client_id, max_length=100,
+                                  unique=True, verbose_name='Client ID')),
+                ('client_secret',
+                 models.CharField(db_index=True, default=oauth2_provider.generators.generate_client_secret,
+                                  max_length=255, verbose_name='Client secret')),
+                ('active', models.BooleanField(default=True)),
+                ('user', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE,
+                                           related_name='pretixapi_oauthapplication', to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'abstract': False,
+            },
+        ),
+        migrations.CreateModel(
+            name='OAuthGrant',
+            fields=[
+                ('id', models.BigAutoField(primary_key=True, serialize=False)),
+                ('code', models.CharField(max_length=255, unique=True)),
+                ('expires', models.DateTimeField()),
+                ('redirect_uri', models.CharField(max_length=255)),
+                ('scope', models.TextField(blank=True)),
+                ('created', models.DateTimeField(auto_now_add=True)),
+                ('updated', models.DateTimeField(auto_now=True)),
+                ('application', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE,
+                                                  to=settings.OAUTH2_PROVIDER_APPLICATION_MODEL)),
+                ('user',
+                 models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='pretixapi_oauthgrant',
+                                   to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'abstract': False,
+            },
+        ),
+        migrations.CreateModel(
+            name='OAuthRefreshToken',
+            fields=[
+                ('id', models.BigAutoField(primary_key=True, serialize=False)),
+                ('token', models.CharField(max_length=255)),
+                ('created', models.DateTimeField(auto_now_add=True)),
+                ('updated', models.DateTimeField(auto_now=True)),
+                ('revoked', models.DateTimeField(null=True)),
+                ('access_token',
+                 models.OneToOneField(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL,
+                                      related_name='refresh_token', to=settings.OAUTH2_PROVIDER_ACCESS_TOKEN_MODEL)),
+                ('application', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE,
+                                                  to=settings.OAUTH2_PROVIDER_APPLICATION_MODEL)),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE,
+                                           related_name='pretixapi_oauthrefreshtoken', to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'abstract': False,
+            },
+        ),
+        migrations.AddField(
+            model_name='oauthaccesstoken',
+            name='application',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE,
+                                    to=settings.OAUTH2_PROVIDER_APPLICATION_MODEL),
+        ),
+        migrations.AddField(
+            model_name='oauthaccesstoken',
+            name='source_refresh_token',
+            field=models.OneToOneField(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL,
+                                       related_name='refreshed_access_token',
+                                       to=settings.OAUTH2_PROVIDER_REFRESH_TOKEN_MODEL),
+        ),
+        migrations.AddField(
+            model_name='oauthaccesstoken',
+            name='user',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE,
+                                    related_name='pretixapi_oauthaccesstoken', to=settings.AUTH_USER_MODEL),
+        ),
+        migrations.AlterUniqueTogether(
+            name='oauthrefreshtoken',
+            unique_together=set([('token', 'revoked')]),
+        ),
+    ]

src/pretix/api/migrations/0002_auto_20180604_1120.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.13 on 2018-06-04 11:20
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0001_initial'),
+        ('pretixapi', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='oauthaccesstoken',
+            name='organizers',
+            field=models.ManyToManyField(to='pretixbase.Organizer'),
+        ),
+        migrations.AddField(
+            model_name='oauthgrant',
+            name='organizers',
+            field=models.ManyToManyField(to='pretixbase.Organizer'),
+        ),
+    ]

src/pretix/api/models.py

@@ -0,0 +1,70 @@
+from datetime import timedelta
+
+from django.db import models
+from django.urls import reverse
+from django.utils.timezone import now
+from django.utils.translation import ugettext_lazy as _
+from oauth2_provider.generators import (
+    generate_client_id, generate_client_secret,
+)
+from oauth2_provider.models import (
+    AbstractAccessToken, AbstractApplication, AbstractGrant,
+    AbstractRefreshToken,
+)
+from oauth2_provider.validators import URIValidator
+
+
+class OAuthApplication(AbstractApplication):
+    name = models.CharField(verbose_name=_("Application name"), max_length=255, blank=False)
+    redirect_uris = models.TextField(
+        blank=False, validators=[URIValidator],
+        verbose_name=_("Redirection URIs"),
+        help_text=_("Allowed URIs list, space separated")
+    )
+    client_id = models.CharField(
+        verbose_name=_("Client ID"),
+        max_length=100, unique=True, default=generate_client_id, db_index=True
+    )
+    client_secret = models.CharField(
+        verbose_name=_("Client secret"),
+        max_length=255, blank=False, default=generate_client_secret, db_index=True
+    )
+    active = models.BooleanField(default=True)
+
+    def get_absolute_url(self):
+        return reverse("control:user.settings.oauth.app", kwargs={'pk': self.id})
+
+    def is_usable(self, request):
+        return self.active and super().is_usable(request)
+
+
+class OAuthGrant(AbstractGrant):
+    application = models.ForeignKey(
+        OAuthApplication, on_delete=models.CASCADE
+    )
+    organizers = models.ManyToManyField('pretixbase.Organizer')
+
+
+class OAuthAccessToken(AbstractAccessToken):
+    source_refresh_token = models.OneToOneField(
+        # unique=True implied by the OneToOneField
+        'OAuthRefreshToken', on_delete=models.SET_NULL, blank=True, null=True,
+        related_name="refreshed_access_token"
+    )
+    application = models.ForeignKey(
+        OAuthApplication, on_delete=models.CASCADE, blank=True, null=True,
+    )
+    organizers = models.ManyToManyField('pretixbase.Organizer')
+
+    def revoke(self):
+        self.expires = now() - timedelta(hours=1)
+        self.save(update_fields=['expires'])
+
+
+class OAuthRefreshToken(AbstractRefreshToken):
+    application = models.ForeignKey(
+        OAuthApplication, on_delete=models.CASCADE)
+    access_token = models.OneToOneField(
+        OAuthAccessToken, on_delete=models.SET_NULL, blank=True, null=True,
+        related_name="refresh_token"
+    )

src/pretix/api/oauth.py

@@ -0,0 +1,45 @@
+from datetime import timedelta
+
+from django.utils import timezone
+from oauth2_provider.exceptions import FatalClientError
+from oauth2_provider.oauth2_validators import Grant, OAuth2Validator
+from oauth2_provider.settings import oauth2_settings
+
+
+class Validator(OAuth2Validator):
+
+    def save_authorization_code(self, client_id, code, request, *args, **kwargs):
+        if not getattr(request, 'organizers', None):
+            raise FatalClientError('No organizers selected.')
+
+        expires = timezone.now() + timedelta(
+            seconds=oauth2_settings.AUTHORIZATION_CODE_EXPIRE_SECONDS)
+        g = Grant(application=request.client, user=request.user, code=code["code"],
+                  expires=expires, redirect_uri=request.redirect_uri,
+                  scope=" ".join(request.scopes))
+        g.save()
+        g.organizers.add(*request.organizers.all())
+
+    def validate_code(self, client_id, code, client, request, *args, **kwargs):
+        try:
+            grant = Grant.objects.get(code=code, application=client)
+            if not grant.is_expired():
+                request.scopes = grant.scope.split(" ")
+                request.user = grant.user
+                request.organizers = grant.organizers.all()
+                return True
+            return False
+
+        except Grant.DoesNotExist:
+            return False
+
+    def _create_access_token(self, expires, request, token, source_refresh_token=None):
+        if not getattr(request, 'organizers', None) and not getattr(source_refresh_token, 'access_token'):
+            raise FatalClientError('No organizers selected.')
+        if hasattr(request, 'organizers'):
+            orgs = list(request.organizers.all())
+        else:
+            orgs = list(source_refresh_token.access_token.organizers.all())
+        access_token = super()._create_access_token(expires, request, token, source_refresh_token=None)
+        access_token.organizers.add(*orgs)
+        return access_token

src/pretix/api/serializers/cart.py

@@ -0,0 +1,121 @@
+from datetime import timedelta
+
+from django.utils.crypto import get_random_string
+from django.utils.timezone import now
+from django.utils.translation import ugettext_lazy
+from rest_framework import serializers
+from rest_framework.exceptions import ValidationError
+
+from pretix.api.serializers.i18n import I18nAwareModelSerializer
+from pretix.api.serializers.order import (
+    AnswerCreateSerializer, AnswerSerializer,
+)
+from pretix.base.models import Quota
+from pretix.base.models.orders import CartPosition
+
+
+class CartPositionSerializer(I18nAwareModelSerializer):
+    answers = AnswerSerializer(many=True)
+
+    class Meta:
+        model = CartPosition
+        fields = ('id', 'cart_id', 'item', 'variation', 'price', 'attendee_name', 'attendee_email',
+                  'voucher', 'addon_to', 'subevent', 'datetime', 'expires', 'includes_tax',
+                  'answers',)
+
+
+class CartPositionCreateSerializer(I18nAwareModelSerializer):
+    answers = AnswerCreateSerializer(many=True, required=False)
+    expires = serializers.DateTimeField(required=False)
+
+    class Meta:
+        model = CartPosition
+        fields = ('cart_id', 'item', 'variation', 'price', 'attendee_name', 'attendee_email',
+                  'subevent', 'expires', 'includes_tax', 'answers',)
+
+    def create(self, validated_data):
+        answers_data = validated_data.pop('answers')
+        if not validated_data.get('cart_id'):
+            cid = "{}@api".format(get_random_string(48))
+            while CartPosition.objects.filter(cart_id=cid).exists():
+                cid = "{}@api".format(get_random_string(48))
+            validated_data['cart_id'] = cid
+
+        if not validated_data.get('expires'):
+            validated_data['expires'] = now() + timedelta(
+                minutes=self.context['event'].settings.get('reservation_time', as_type=int)
+            )
+
+        with self.context['event'].lock():
+            new_quotas = (validated_data.get('variation').quotas.filter(subevent=validated_data.get('subevent'))
+                          if validated_data.get('variation')
+                          else validated_data.get('item').quotas.filter(subevent=validated_data.get('subevent')))
+            if len(new_quotas) == 0:
+                raise ValidationError(
+                    ugettext_lazy('The product "{}" is not assigned to a quota.').format(
+                        str(validated_data.get('item'))
+                    )
+                )
+            for quota in new_quotas:
+                avail = quota.availability()
+                if avail[0] != Quota.AVAILABILITY_OK or (avail[1] is not None and avail[1] < 1):
+                    raise ValidationError(
+                        ugettext_lazy('There is not enough quota available on quota "{}" to perform '
+                                      'the operation.').format(
+                            quota.name
+                        )
+                    )
+            cp = CartPosition.objects.create(event=self.context['event'], **validated_data)
+
+        for answ_data in answers_data:
+            options = answ_data.pop('options')
+            answ = cp.answers.create(**answ_data)
+            answ.options.add(*options)
+        return cp
+
+    def validate_cart_id(self, cid):
+        if cid and not cid.endswith('@api'):
+            raise ValidationError('Cart ID should end in @api or be empty.')
+
+    def validate_item(self, item):
+        if item.event != self.context['event']:
+            raise ValidationError(
+                'The specified item does not belong to this event.'
+            )
+        if not item.active:
+            raise ValidationError(
+                'The specified item is not active.'
+            )
+        return item
+
+    def validate_subevent(self, subevent):
+        if self.context['event'].has_subevents:
+            if not subevent:
+                raise ValidationError(
+                    'You need to set a subevent.'
+                )
+            if subevent.event != self.context['event']:
+                raise ValidationError(
+                    'The specified subevent does not belong to this event.'
+                )
+        elif subevent:
+            raise ValidationError(
+                'You cannot set a subevent for this event.'
+            )
+        return subevent
+
+    def validate(self, data):
+        if data.get('item'):
+            if data.get('item').has_variations:
+                if not data.get('variation'):
+                    raise ValidationError('You should specify a variation for this item.')
+                else:
+                    if data.get('variation').item != data.get('item'):
+                        raise ValidationError(
+                            'The specified variation does not belong to the specified item.'
+                        )
+            elif data.get('variation'):
+                raise ValidationError(
+                    'You cannot specify a variation for this item.'
+                )
+        return data

src/pretix/api/serializers/event.py

@@ -4,6 +4,7 @@ from django.utils.functional import cached_property
 from django.utils.translation import ugettext as _
 from django_countries.serializers import CountryFieldMixin
 from rest_framework.fields import Field
+from rest_framework.relations import SlugRelatedField
 
 from pretix.api.serializers.i18n import I18nAwareModelSerializer
 from pretix.base.models import Event, TaxRule
@@ -190,12 +191,13 @@ class SubEventItemVariationSerializer(I18nAwareModelSerializer):
 class SubEventSerializer(I18nAwareModelSerializer):
     item_price_overrides = SubEventItemSerializer(source='subeventitem_set', many=True)
     variation_price_overrides = SubEventItemVariationSerializer(source='subeventitemvariation_set', many=True)
+    event = SlugRelatedField(slug_field='slug', read_only=True)
     meta_data = MetaDataField(source='*')
 
     class Meta:
         model = SubEvent
         fields = ('id', 'name', 'date_from', 'date_to', 'active', 'date_admission',
-                  'presale_start', 'presale_end', 'location',
+                  'presale_start', 'presale_end', 'location', 'event',
                   'item_price_overrides', 'variation_price_overrides', 'meta_data')
 
 

src/pretix/api/serializers/item.py

@@ -74,12 +74,12 @@ class ItemSerializer(I18nAwareModelSerializer):
 
     class Meta:
         model = Item
-        fields = ('id', 'category', 'name', 'active', 'description',
+        fields = ('id', 'category', 'name', 'internal_name', 'active', 'description',
                   'default_price', 'free_price', 'tax_rate', 'tax_rule', 'admission',
                   'position', 'picture', 'available_from', 'available_until',
                   'require_voucher', 'hide_without_voucher', 'allow_cancel',
                   'min_per_order', 'max_per_order', 'checkin_attention', 'has_variations',
-                  'variations', 'addons')
+                  'variations', 'addons', 'original_price', 'require_approval')
         read_only_fields = ('has_variations', 'picture')
 
     def get_serializer_context(self):
@@ -129,7 +129,7 @@ class ItemCategorySerializer(I18nAwareModelSerializer):
 
     class Meta:
         model = ItemCategory
-        fields = ('id', 'name', 'description', 'position', 'is_addon')
+        fields = ('id', 'name', 'internal_name', 'description', 'position', 'is_addon')
 
 
 class QuestionOptionSerializer(I18nAwareModelSerializer):

src/pretix/api/serializers/order.py

@@ -1,18 +1,31 @@
+import json
+from collections import Counter
 from decimal import Decimal
 
+from django.utils.timezone import now
+from django.utils.translation import ugettext_lazy
+from django_countries.fields import Country
 from rest_framework import serializers
+from rest_framework.exceptions import ValidationError
+from rest_framework.relations import SlugRelatedField
 from rest_framework.reverse import reverse
 
 from pretix.api.serializers.i18n import I18nAwareModelSerializer
 from pretix.base.models import (
     Checkin, Invoice, InvoiceAddress, InvoiceLine, Order, OrderPosition,
-    QuestionAnswer,
+    Question, QuestionAnswer,
 )
-from pretix.base.models.orders import OrderFee
+from pretix.base.models.orders import (
+    CartPosition, OrderFee, OrderPayment, OrderRefund,
+)
+from pretix.base.pdf import get_variables
 from pretix.base.signals import register_ticket_outputs
 
 
 class CompatibleCountryField(serializers.Field):
+    def to_internal_value(self, data):
+        return {self.field_name: Country(data)}
+
     def to_representation(self, instance: InvoiceAddress):
         if instance.country:
             return str(instance.country)
@@ -27,6 +40,13 @@ class InvoiceAddressSerializer(I18nAwareModelSerializer):
         model = InvoiceAddress
         fields = ('last_modified', 'is_business', 'company', 'name', 'street', 'zipcode', 'city', 'country', 'vat_id',
                   'vat_id_validated', 'internal_reference')
+        read_only_fields = ('last_modified', 'vat_id_validated')
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        for v in self.fields.values():
+            v.required = False
+            v.allow_blank = True
 
 
 class AnswerQuestionIdentifierField(serializers.Field):
@@ -57,7 +77,8 @@ class CheckinSerializer(I18nAwareModelSerializer):
 class OrderDownloadsField(serializers.Field):
     def to_representation(self, instance: Order):
         if instance.status != Order.STATUS_PAID:
-            return []
+            if instance.status != Order.STATUS_PENDING or instance.require_approval or not instance.event.settings.ticket_download_pending:
+                return []
 
         request = self.context['request']
         res = []
@@ -80,7 +101,8 @@ class OrderDownloadsField(serializers.Field):
 class PositionDownloadsField(serializers.Field):
     def to_representation(self, instance: OrderPosition):
         if instance.order.status != Order.STATUS_PAID:
-            return []
+            if instance.order.status != Order.STATUS_PENDING or instance.order.require_approval or not instance.order.event.settings.ticket_download_pending:
+                return []
         if instance.addon_to_id and not instance.order.event.settings.ticket_download_addons:
             return []
         if not instance.item.admission and not instance.order.event.settings.ticket_download_nonadm:
@@ -104,17 +126,66 @@ class PositionDownloadsField(serializers.Field):
         return res
 
 
+class PdfDataSerializer(serializers.Field):
+    def to_representation(self, instance: OrderPosition):
+        res = {}
+
+        ev = instance.subevent or instance.order.event
+        # This needs to have some extra performance improvements to avoid creating hundreds of queries when
+        # we serialize a list.
+
+        if 'vars' not in self.context:
+            self.context['vars'] = get_variables(self.context['request'].event)
+
+        for k, f in self.context['vars'].items():
+            res[k] = f['evaluate'](instance, instance.order, ev)
+
+        if not hasattr(ev, '_cached_meta_data'):
+            ev._cached_meta_data = ev.meta_data
+
+        for k, v in ev._cached_meta_data.items():
+            res['meta:' + k] = v
+
+        return res
+
+
 class OrderPositionSerializer(I18nAwareModelSerializer):
     checkins = CheckinSerializer(many=True)
     answers = AnswerSerializer(many=True)
     downloads = PositionDownloadsField(source='*')
     order = serializers.SlugRelatedField(slug_field='code', read_only=True)
+    pdf_data = PdfDataSerializer(source='*')
 
     class Meta:
         model = OrderPosition
         fields = ('id', 'order', 'positionid', 'item', 'variation', 'price', 'attendee_name', 'attendee_email',
                   'voucher', 'tax_rate', 'tax_value', 'secret', 'addon_to', 'subevent', 'checkins', 'downloads',
-                  'answers', 'tax_rule')
+                  'answers', 'tax_rule', 'pseudonymization_id', 'pdf_data')
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        if 'request' in self.context and not self.context['request'].query_params.get('pdf_data', 'false') == 'true':
+            self.fields.pop('pdf_data')
+
+
+class OrderPaymentTypeField(serializers.Field):
+    # TODO: Remove after pretix 2.2
+    def to_representation(self, instance: Order):
+        t = None
+        for p in instance.payments.all():
+            t = p.provider
+        return t
+
+
+class OrderPaymentDateField(serializers.DateField):
+    # TODO: Remove after pretix 2.2
+    def to_representation(self, instance: Order):
+        t = None
+        for p in instance.payments.all():
+            t = p.payment_date or t
+        if t:
+
+            return super().to_representation(t.date())
 
 
 class OrderFeeSerializer(I18nAwareModelSerializer):
@@ -123,16 +194,18 @@ class OrderFeeSerializer(I18nAwareModelSerializer):
         fields = ('fee_type', 'value', 'description', 'internal_type', 'tax_rate', 'tax_value', 'tax_rule')
 
 
-class PaymentFeeLegacyField(serializers.Field):
-    def __init__(self, *args, **kwargs):
-        self.attr = kwargs.pop('attribute')
-        super().__init__(*args, **kwargs)
+class OrderPaymentSerializer(I18nAwareModelSerializer):
+    class Meta:
+        model = OrderPayment
+        fields = ('local_id', 'state', 'amount', 'created', 'payment_date', 'provider')
 
-    def to_representation(self, instance: Order):
-        return str(
-            sum([getattr(f, self.attr) for f in instance.fees.all() if f.fee_type == OrderFee.FEE_TYPE_PAYMENT],
-                Decimal('0.00'))
-        )
+
+class OrderRefundSerializer(I18nAwareModelSerializer):
+    payment = SlugRelatedField(slug_field='local_id', read_only=True)
+
+    class Meta:
+        model = OrderRefund
+        fields = ('local_id', 'state', 'source', 'amount', 'payment', 'created', 'execution_date', 'provider')
 
 
 class OrderSerializer(I18nAwareModelSerializer):
@@ -140,12 +213,369 @@ class OrderSerializer(I18nAwareModelSerializer):
     positions = OrderPositionSerializer(many=True)
     fees = OrderFeeSerializer(many=True)
     downloads = OrderDownloadsField(source='*')
+    payments = OrderPaymentSerializer(many=True)
+    refunds = OrderRefundSerializer(many=True)
+    payment_date = OrderPaymentDateField(source='*')
+    payment_provider = OrderPaymentTypeField(source='*')
 
     class Meta:
         model = Order
         fields = ('code', 'status', 'secret', 'email', 'locale', 'datetime', 'expires', 'payment_date',
                   'payment_provider', 'fees', 'total', 'comment', 'invoice_address', 'positions', 'downloads',
-                  'checkin_attention')
+                  'checkin_attention', 'last_modified', 'payments', 'refunds', 'require_approval')
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        if not self.context['request'].query_params.get('pdf_data', 'false') == 'true':
+            self.fields['positions'].child.fields.pop('pdf_data')
+
+
+class AnswerCreateSerializer(I18nAwareModelSerializer):
+
+    class Meta:
+        model = QuestionAnswer
+        fields = ('question', 'answer', 'options')
+
+    def validate_question(self, q):
+        if q.event != self.context['event']:
+            raise ValidationError(
+                'The specified question does not belong to this event.'
+            )
+        return q
+
+    def validate(self, data):
+        if data.get('question').type == Question.TYPE_FILE:
+            raise ValidationError(
+                'File uploads are currently not supported via the API.'
+            )
+        elif data.get('question').type in (Question.TYPE_CHOICE, Question.TYPE_CHOICE_MULTIPLE):
+            if not data.get('options'):
+                raise ValidationError(
+                    'You need to specify options if the question is of a choice type.'
+                )
+            if data.get('question').type == Question.TYPE_CHOICE and len(data.get('options')) > 1:
+                raise ValidationError(
+                    'You can specify at most one option for this question.'
+                )
+            data['answer'] = ", ".join([str(o) for o in data.get('options')])
+
+        else:
+            if data.get('options'):
+                raise ValidationError(
+                    'You should not specify options if the question is not of a choice type.'
+                )
+
+            if data.get('question').type == Question.TYPE_BOOLEAN:
+                if data.get('answer') in ['true', 'True', '1', 'TRUE']:
+                    data['answer'] = 'True'
+                elif data.get('answer') in ['false', 'False', '0', 'FALSE']:
+                    data['answer'] = 'False'
+                else:
+                    raise ValidationError(
+                        'Please specify "true" or "false" for boolean questions.'
+                    )
+            elif data.get('question').type == Question.TYPE_NUMBER:
+                serializers.DecimalField(
+                    max_digits=50,
+                    decimal_places=25
+                ).to_internal_value(data.get('answer'))
+            elif data.get('question').type == Question.TYPE_DATE:
+                data['answer'] = serializers.DateField().to_internal_value(data.get('answer'))
+            elif data.get('question').type == Question.TYPE_TIME:
+                data['answer'] = serializers.TimeField().to_internal_value(data.get('answer'))
+            elif data.get('question').type == Question.TYPE_DATETIME:
+                data['answer'] = serializers.DateTimeField().to_internal_value(data.get('answer'))
+        return data
+
+
+class OrderFeeCreateSerializer(I18nAwareModelSerializer):
+    class Meta:
+        model = OrderFee
+        fields = ('fee_type', 'value', 'description', 'internal_type', 'tax_rule')
+
+    def validate_tax_rule(self, tr):
+        if tr and tr.event != self.context['event']:
+            raise ValidationError(
+                'The specified tax rate does not belong to this event.'
+            )
+        return tr
+
+
+class OrderPositionCreateSerializer(I18nAwareModelSerializer):
+    answers = AnswerCreateSerializer(many=True, required=False)
+    addon_to = serializers.IntegerField(required=False, allow_null=True)
+    secret = serializers.CharField(required=False)
+
+    class Meta:
+        model = OrderPosition
+        fields = ('positionid', 'item', 'variation', 'price', 'attendee_name', 'attendee_email',
+                  'secret', 'addon_to', 'subevent', 'answers')
+
+    def validate_secret(self, secret):
+        if secret and OrderPosition.objects.filter(order__event=self.context['event'], secret=secret).exists():
+            raise ValidationError(
+                'You cannot assign a position secret that already exists.'
+            )
+        return secret
+
+    def validate_item(self, item):
+        if item.event != self.context['event']:
+            raise ValidationError(
+                'The specified item does not belong to this event.'
+            )
+        if not item.active:
+            raise ValidationError(
+                'The specified item is not active.'
+            )
+        return item
+
+    def validate_subevent(self, subevent):
+        if self.context['event'].has_subevents:
+            if not subevent:
+                raise ValidationError(
+                    'You need to set a subevent.'
+                )
+            if subevent.event != self.context['event']:
+                raise ValidationError(
+                    'The specified subevent does not belong to this event.'
+                )
+        elif subevent:
+            raise ValidationError(
+                'You cannot set a subevent for this event.'
+            )
+        return subevent
+
+    def validate(self, data):
+        if data.get('item'):
+            if data.get('item').has_variations:
+                if not data.get('variation'):
+                    raise ValidationError({'variation': ['You should specify a variation for this item.']})
+                else:
+                    if data.get('variation').item != data.get('item'):
+                        raise ValidationError(
+                            {'variation': ['The specified variation does not belong to the specified item.']}
+                        )
+            elif data.get('variation'):
+                raise ValidationError(
+                    {'variation': ['You cannot specify a variation for this item.']}
+                )
+        return data
+
+
+class CompatibleJSONField(serializers.JSONField):
+    def to_internal_value(self, data):
+        try:
+            return json.dumps(data)
+        except (TypeError, ValueError):
+            self.fail('invalid')
+
+    def to_representation(self, value):
+        if value:
+            return json.loads(value)
+        return value
+
+
+class OrderCreateSerializer(I18nAwareModelSerializer):
+    invoice_address = InvoiceAddressSerializer(required=False)
+    positions = OrderPositionCreateSerializer(many=True, required=False)
+    fees = OrderFeeCreateSerializer(many=True, required=False)
+    status = serializers.ChoiceField(choices=(
+        ('n', Order.STATUS_PENDING),
+        ('p', Order.STATUS_PAID),
+    ), default='n', required=False)
+    code = serializers.CharField(
+        required=False,
+        max_length=16,
+        min_length=5
+    )
+    comment = serializers.CharField(required=False, allow_blank=True)
+    payment_provider = serializers.CharField(required=True)
+    payment_info = CompatibleJSONField(required=False)
+    consume_carts = serializers.ListField(child=serializers.CharField(), required=False)
+
+    class Meta:
+        model = Order
+        fields = ('code', 'status', 'email', 'locale', 'payment_provider', 'fees', 'comment',
+                  'invoice_address', 'positions', 'checkin_attention', 'payment_info', 'consume_carts')
+
+    def validate_payment_provider(self, pp):
+        if pp not in self.context['event'].get_payment_providers():
+            raise ValidationError('The given payment provider is not known.')
+        return pp
+
+    def validate_code(self, code):
+        if code and Order.objects.filter(event__organizer=self.context['event'].organizer, code=code).exists():
+            raise ValidationError(
+                'This order code is already in use.'
+            )
+        if any(c not in 'ABCDEFGHJKLMNPQRSTUVWXYZ1234567890' for c in code):
+            raise ValidationError(
+                'This order code contains invalid characters.'
+            )
+        return code
+
+    def validate_positions(self, data):
+        if not data:
+            raise ValidationError(
+                'An order cannot be empty.'
+            )
+        errs = [{} for p in data]
+        if any([p.get('positionid') for p in data]):
+            if not all([p.get('positionid') for p in data]):
+                for i, p in enumerate(data):
+                    if not p.get('positionid'):
+                        errs[i]['positionid'] = [
+                            'If you set position IDs manually, you need to do so for all positions.'
+                        ]
+                raise ValidationError(errs)
+
+            last_non_add_on = None
+            last_posid = 0
+
+            for i, p in enumerate(data):
+                if p['positionid'] != last_posid + 1:
+                    errs[i]['positionid'] = [
+                        'Position IDs need to be consecutive.'
+                    ]
+                if p.get('addon_to') and p['addon_to'] != last_non_add_on:
+                    errs[i]['addon_to'] = [
+                        "If you set addon_to, you need to make sure that the referenced "
+                        "position ID exists and is transmitted directly before its add-ons."
+                    ]
+
+                if not p.get('addon_to'):
+                    last_non_add_on = p['positionid']
+                last_posid = p['positionid']
+
+        elif any([p.get('addon_to') for p in data]):
+            errs = [
+                {'positionid': ["If you set addon_to on any position, you need to specify position IDs manually."]}
+                for p in data
+            ]
+
+        if any(errs):
+            raise ValidationError(errs)
+        return data
+
+    def create(self, validated_data):
+        fees_data = validated_data.pop('fees') if 'fees' in validated_data else []
+        positions_data = validated_data.pop('positions') if 'positions' in validated_data else []
+        payment_provider = validated_data.pop('payment_provider')
+        payment_info = validated_data.pop('payment_info', '{}')
+
+        if 'invoice_address' in validated_data:
+            ia = InvoiceAddress(**validated_data.pop('invoice_address'))
+        else:
+            ia = None
+
+        with self.context['event'].lock() as now_dt:
+            quotadiff = Counter()
+
+            consume_carts = validated_data.pop('consume_carts', [])
+            delete_cps = []
+            quota_avail_cache = {}
+            if consume_carts:
+                for cp in CartPosition.objects.filter(event=self.context['event'], cart_id__in=consume_carts):
+                    quotas = (cp.variation.quotas.filter(subevent=cp.subevent)
+                              if cp.variation else cp.item.quotas.filter(subevent=cp.subevent))
+                    for quota in quotas:
+                        if quota not in quota_avail_cache:
+                            quota_avail_cache[quota] = list(quota.availability())
+                        if quota_avail_cache[quota][1] is not None:
+                            quota_avail_cache[quota][1] += 1
+                    if cp.expires > now_dt:
+                        quotadiff.subtract(quotas)
+                    delete_cps.append(cp)
+
+            errs = [{} for p in positions_data]
+
+            for i, pos_data in enumerate(positions_data):
+                new_quotas = (pos_data.get('variation').quotas.filter(subevent=pos_data.get('subevent'))
+                              if pos_data.get('variation')
+                              else pos_data.get('item').quotas.filter(subevent=pos_data.get('subevent')))
+                if len(new_quotas) == 0:
+                    errs[i]['item'] = [ugettext_lazy('The product "{}" is not assigned to a quota.').format(
+                        str(pos_data.get('item'))
+                    )]
+                else:
+                    for quota in new_quotas:
+                        if quota not in quota_avail_cache:
+                            quota_avail_cache[quota] = list(quota.availability())
+
+                        if quota_avail_cache[quota][1] is not None:
+                            quota_avail_cache[quota][1] -= 1
+                            if quota_avail_cache[quota][1] < 0:
+                                errs[i]['item'] = [
+                                    ugettext_lazy('There is not enough quota available on quota "{}" to perform the operation.').format(
+                                        quota.name
+                                    )
+                                ]
+
+                quotadiff.update(new_quotas)
+
+            if any(errs):
+                raise ValidationError({'positions': errs})
+
+            if validated_data.get('locale', None) is None:
+                validated_data['locale'] = self.context['event'].settings.locale
+            order = Order(event=self.context['event'], **validated_data)
+            order.set_expires(subevents=[p.get('subevent') for p in positions_data])
+            order.total = sum([p['price'] for p in positions_data]) + sum([f['value'] for f in fees_data], Decimal('0.00'))
+            order.meta_info = "{}"
+            order.save()
+
+            if order.total == Decimal('0.00') and validated_data.get('status') != Order.STATUS_PAID:
+                order.status = Order.STATUS_PAID
+                order.save()
+                order.payments.create(
+                    amount=order.total, provider='free', state=OrderPayment.PAYMENT_STATE_CONFIRMED
+                )
+            elif payment_provider == "free" and order.total != Decimal('0.00'):
+                raise ValidationError('You cannot use the "free" payment provider for non-free orders.')
+            elif validated_data.get('status') == Order.STATUS_PAID:
+                order.payments.create(
+                    amount=order.total,
+                    provider=payment_provider,
+                    info=payment_info,
+                    payment_date=now(),
+                    state=OrderPayment.PAYMENT_STATE_CONFIRMED
+                )
+            elif payment_provider:
+                order.payments.create(
+                    amount=order.total,
+                    provider=payment_provider,
+                    info=payment_info,
+                    state=OrderPayment.PAYMENT_STATE_CREATED
+                )
+
+            if ia:
+                ia.order = order
+                ia.save()
+            pos_map = {}
+            for pos_data in positions_data:
+                answers_data = pos_data.pop('answers', [])
+                addon_to = pos_data.pop('addon_to', None)
+                pos = OrderPosition(**pos_data)
+                pos.order = order
+                pos._calculate_tax()
+                if addon_to:
+                    pos.addon_to = pos_map[addon_to]
+                pos.save()
+                pos_map[pos.positionid] = pos
+                for answ_data in answers_data:
+                    options = answ_data.pop('options', [])
+                    answ = pos.answers.create(**answ_data)
+                    answ.options.add(*options)
+
+            for cp in delete_cps:
+                cp.delete()
+        for fee_data in fees_data:
+            f = OrderFee(**fee_data)
+            f.order = order
+            f._calculate_tax()
+            f.save()
+
+        return order
 
 
 class InlineInvoiceLineSerializer(I18nAwareModelSerializer):
@@ -165,3 +595,27 @@ class InvoiceSerializer(I18nAwareModelSerializer):
                   'introductory_text', 'additional_text', 'payment_provider_text', 'footer_text', 'lines',
                   'foreign_currency_display', 'foreign_currency_rate', 'foreign_currency_rate_date',
                   'internal_reference')
+
+
+class OrderRefundCreateSerializer(I18nAwareModelSerializer):
+    payment = serializers.IntegerField(required=False, allow_null=True)
+    provider = serializers.CharField(required=True, allow_null=False, allow_blank=False)
+    info = CompatibleJSONField(required=False)
+
+    class Meta:
+        model = OrderRefund
+        fields = ('state', 'source', 'amount', 'payment', 'execution_date', 'provider', 'info')
+
+    def create(self, validated_data):
+        pid = validated_data.pop('payment', None)
+        if pid:
+            try:
+                p = self.context['order'].payments.get(local_id=pid)
+            except OrderPayment.DoesNotExist:
+                raise ValidationError('Unknown payment ID.')
+        else:
+            p = None
+
+        order = OrderRefund(order=self.context['order'], payment=p, **validated_data)
+        order.save()
+        return order

src/pretix/api/serializers/waitinglist.py

@@ -8,7 +8,7 @@ class WaitingListSerializer(I18nAwareModelSerializer):
 
     class Meta:
         model = WaitingListEntry
-        fields = ('id', 'created', 'email', 'voucher', 'item', 'variation', 'locale', 'subevent')
+        fields = ('id', 'created', 'email', 'voucher', 'item', 'variation', 'locale', 'subevent', 'priority')
         read_only_fields = ('id', 'created', 'voucher')
 
     def validate(self, data):

src/pretix/api/urls.py

@@ -4,13 +4,19 @@ from django.apps import apps
 from django.conf.urls import include, url
 from rest_framework import routers
 
-from .views import checkin, event, item, order, organizer, voucher, waitinglist
+from pretix.api.views import cart
+
+from .views import (
+    checkin, device, event, item, oauth, order, organizer, voucher,
+    waitinglist,
+)
 
 router = routers.DefaultRouter()
 router.register(r'organizers', organizer.OrganizerViewSet)
 
 orga_router = routers.DefaultRouter()
 orga_router.register(r'events', event.EventViewSet)
+orga_router.register(r'subevents', event.SubEventViewSet)
 
 event_router = routers.DefaultRouter()
 event_router.register(r'subevents', event.SubEventViewSet)
@@ -26,6 +32,7 @@ event_router.register(r'invoices', order.InvoiceViewSet)
 event_router.register(r'taxrules', event.TaxRuleViewSet)
 event_router.register(r'waitinglistentries', waitinglist.WaitingListViewSet)
 event_router.register(r'checkinlists', checkin.CheckinListViewSet)
+event_router.register(r'cartpositions', cart.CartPositionViewSet)
 
 checkinlist_router = routers.DefaultRouter()
 checkinlist_router.register(r'positions', checkin.CheckinListPositionViewSet)
@@ -37,6 +44,10 @@ item_router = routers.DefaultRouter()
 item_router.register(r'variations', item.ItemVariationViewSet)
 item_router.register(r'addons', item.ItemAddOnViewSet)
 
+order_router = routers.DefaultRouter()
+order_router.register(r'payments', order.PaymentViewSet)
+order_router.register(r'refunds', order.RefundViewSet)
+
 # Force import of all plugins to give them a chance to register URLs with the router
 for app in apps.get_app_configs():
     if hasattr(app, 'PretixPluginMeta'):
@@ -52,4 +63,12 @@ urlpatterns = [
         include(question_router.urls)),
     url(r'^organizers/(?P<organizer>[^/]+)/events/(?P<event>[^/]+)/checkinlists/(?P<list>[^/]+)/',
         include(checkinlist_router.urls)),
+    url(r'^organizers/(?P<organizer>[^/]+)/events/(?P<event>[^/]+)/orders/(?P<order>[^/]+)/', include(order_router.urls)),
+    url(r"^oauth/authorize$", oauth.AuthorizationView.as_view(), name="authorize"),
+    url(r"^oauth/token$", oauth.TokenView.as_view(), name="token"),
+    url(r"^oauth/revoke_token$", oauth.RevokeTokenView.as_view(), name="revoke-token"),
+    url(r"^device/initialize$", device.InitializeView.as_view(), name="device.initialize"),
+    url(r"^device/update$", device.UpdateView.as_view(), name="device.update"),
+    url(r"^device/roll$", device.RollKeyView.as_view(), name="device.roll"),
+    url(r"^device/revoke$", device.RevokeKeyView.as_view(), name="device.revoke"),
 ]

src/pretix/api/views/__init__.py

@@ -1,3 +1,8 @@
+from calendar import timegm
+
+from django.db.models import Max
+from django.http import HttpResponse
+from django.utils.http import http_date, parse_http_date_safe
 from rest_framework.filters import OrderingFilter
 
 
@@ -21,3 +26,36 @@ class RichOrderingFilter(OrderingFilter):
             return queryset.order_by(*ordering)
 
         return queryset
+
+
+class ConditionalListView:
+
+    def list(self, request, **kwargs):
+        if_modified_since = request.META.get('HTTP_IF_MODIFIED_SINCE')
+        if if_modified_since:
+            if_modified_since = parse_http_date_safe(if_modified_since)
+        if_unmodified_since = request.META.get('HTTP_IF_UNMODIFIED_SINCE')
+        if if_unmodified_since:
+            if_unmodified_since = parse_http_date_safe(if_unmodified_since)
+        if not hasattr(request, 'event'):
+            return super().list(request, **kwargs)
+
+        lmd = request.event.logentry_set.filter(
+            content_type__model=self.queryset.model._meta.model_name,
+            content_type__app_label=self.queryset.model._meta.app_label,
+        ).aggregate(
+            m=Max('datetime')
+        )['m']
+        if lmd:
+            lmd_ts = timegm(lmd.utctimetuple())
+
+        if if_unmodified_since and lmd and lmd_ts > if_unmodified_since:
+            return HttpResponse(status=412)
+
+        if if_modified_since and lmd and lmd_ts <= if_modified_since:
+            return HttpResponse(status=304)
+
+        resp = super().list(request, **kwargs)
+        if lmd:
+            resp['Last-Modified'] = http_date(lmd_ts)
+        return resp

src/pretix/api/views/cart.py

@@ -0,0 +1,46 @@
+from django.db import transaction
+from rest_framework import status, viewsets
+from rest_framework.filters import OrderingFilter
+from rest_framework.mixins import CreateModelMixin, DestroyModelMixin
+from rest_framework.response import Response
+
+from pretix.api.serializers.cart import (
+    CartPositionCreateSerializer, CartPositionSerializer,
+)
+from pretix.base.models import CartPosition
+
+
+class CartPositionViewSet(CreateModelMixin, DestroyModelMixin, viewsets.ReadOnlyModelViewSet):
+    serializer_class = CartPositionSerializer
+    queryset = CartPosition.objects.none()
+    filter_backends = (OrderingFilter,)
+    ordering = ('datetime',)
+    ordering_fields = ('datetime', 'cart_id')
+    lookup_field = 'id'
+    permission = 'can_view_orders'
+    write_permission = 'can_change_orders'
+
+    def get_queryset(self):
+        return CartPosition.objects.filter(
+            event=self.request.event,
+            cart_id__endswith="@api"
+        )
+
+    def get_serializer_context(self):
+        ctx = super().get_serializer_context()
+        ctx['event'] = self.request.event
+        return ctx
+
+    def create(self, request, *args, **kwargs):
+        serializer = CartPositionCreateSerializer(data=request.data, context=self.get_serializer_context())
+        serializer.is_valid(raise_exception=True)
+        with transaction.atomic():
+            self.perform_create(serializer)
+            cp = serializer.instance
+            serializer = CartPositionSerializer(cp, context=serializer.context)
+
+        headers = self.get_success_headers(serializer.data)
+        return Response(serializer.data, status=status.HTTP_201_CREATED, headers=headers)
+
+    def perform_create(self, serializer):
+        serializer.save()

src/pretix/api/views/checkin.py

@@ -1,6 +1,7 @@
 from django.core.exceptions import ValidationError
 from django.db.models import Count, F, Max, OuterRef, Prefetch, Subquery
 from django.db.models.functions import Coalesce
+from django.http import Http404
 from django.shortcuts import get_object_or_404
 from django.utils.functional import cached_property
 from django.utils.timezone import now
@@ -16,7 +17,6 @@ from pretix.api.serializers.order import OrderPositionSerializer
 from pretix.api.views import RichOrderingFilter
 from pretix.api.views.order import OrderPositionFilter
 from pretix.base.models import Checkin, CheckinList, Order, OrderPosition
-from pretix.base.models.organizer import TeamAPIToken
 from pretix.base.services.checkin import (
     CheckInError, RequiredQuestionsError, perform_checkin,
 )
@@ -33,7 +33,7 @@ class CheckinListViewSet(viewsets.ModelViewSet):
     serializer_class = CheckinListSerializer
     queryset = CheckinList.objects.none()
     filter_backends = (DjangoFilterBackend,)
-    filter_class = CheckinListFilter
+    filterset_class = CheckinListFilter
     permission = 'can_view_orders'
     write_permission = 'can_change_event_settings'
 
@@ -49,7 +49,7 @@ class CheckinListViewSet(viewsets.ModelViewSet):
         serializer.instance.log_action(
             'pretix.event.checkinlist.added',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=self.request.data
         )
 
@@ -63,7 +63,7 @@ class CheckinListViewSet(viewsets.ModelViewSet):
         serializer.instance.log_action(
             'pretix.event.checkinlist.changed',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=self.request.data
         )
 
@@ -71,7 +71,7 @@ class CheckinListViewSet(viewsets.ModelViewSet):
         instance.log_action(
             'pretix.event.checkinlist.deleted',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
         )
         super().perform_destroy(instance)
 
@@ -176,13 +176,16 @@ class CheckinListPositionViewSet(viewsets.ReadOnlyModelViewSet):
         },
     }
 
-    filter_class = CheckinOrderPositionFilter
+    filterset_class = CheckinOrderPositionFilter
     permission = 'can_view_orders'
     write_permission = 'can_change_orders'
 
     @cached_property
     def checkinlist(self):
-        return get_object_or_404(CheckinList, event=self.request.event, pk=self.kwargs.get("list"))
+        try:
+            return get_object_or_404(CheckinList, event=self.request.event, pk=self.kwargs.get("list"))
+        except ValueError:
+            raise Http404()
 
     def get_queryset(self):
         cqs = Checkin.objects.filter(

src/pretix/api/views/device.py

@@ -0,0 +1,113 @@
+import logging
+
+from django.utils.timezone import now
+from rest_framework import serializers
+from rest_framework.exceptions import ValidationError
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from pretix.api.auth.device import DeviceTokenAuthentication
+from pretix.base.models import Device
+from pretix.base.models.devices import generate_api_token
+
+logger = logging.getLogger(__name__)
+
+
+class InitializationRequestSerializer(serializers.Serializer):
+    token = serializers.CharField(max_length=190)
+    hardware_brand = serializers.CharField(max_length=190)
+    hardware_model = serializers.CharField(max_length=190)
+    software_brand = serializers.CharField(max_length=190)
+    software_version = serializers.CharField(max_length=190)
+
+
+class UpdateRequestSerializer(serializers.Serializer):
+    hardware_brand = serializers.CharField(max_length=190)
+    hardware_model = serializers.CharField(max_length=190)
+    software_brand = serializers.CharField(max_length=190)
+    software_version = serializers.CharField(max_length=190)
+
+
+class DeviceSerializer(serializers.ModelSerializer):
+    organizer = serializers.SlugRelatedField(slug_field='slug', read_only=True)
+
+    class Meta:
+        model = Device
+        fields = [
+            'organizer', 'device_id', 'unique_serial', 'api_token',
+            'name'
+        ]
+
+
+class InitializeView(APIView):
+    authentication_classes = tuple()
+    permission_classes = tuple()
+
+    def post(self, request, format=None):
+        serializer = InitializationRequestSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+
+        try:
+            device = Device.objects.get(initialization_token=serializer.validated_data.get('token'))
+        except Device.DoesNotExist:
+            raise ValidationError({'token': ['Unknown initialization token.']})
+
+        if device.initialized:
+            raise ValidationError({'token': ['This initialization token has already been used.']})
+
+        device.initialized = now()
+        device.hardware_brand = serializer.validated_data.get('hardware_brand')
+        device.hardware_model = serializer.validated_data.get('hardware_model')
+        device.software_brand = serializer.validated_data.get('software_brand')
+        device.software_version = serializer.validated_data.get('software_version')
+        device.api_token = generate_api_token()
+        device.save()
+
+        device.log_action('pretix.device.initialized', data=serializer.validated_data, auth=device)
+
+        serializer = DeviceSerializer(device)
+        return Response(serializer.data)
+
+
+class UpdateView(APIView):
+    authentication_classes = (DeviceTokenAuthentication,)
+
+    def post(self, request, format=None):
+        serializer = UpdateRequestSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+        device = request.auth
+        device.hardware_brand = serializer.validated_data.get('hardware_brand')
+        device.hardware_model = serializer.validated_data.get('hardware_model')
+        device.software_brand = serializer.validated_data.get('software_brand')
+        device.software_version = serializer.validated_data.get('software_version')
+        device.save()
+        device.log_action('pretix.device.updated', data=serializer.validated_data, auth=device)
+
+        serializer = DeviceSerializer(device)
+        return Response(serializer.data)
+
+
+class RollKeyView(APIView):
+    authentication_classes = (DeviceTokenAuthentication,)
+
+    def post(self, request, format=None):
+        device = request.auth
+        device.api_token = generate_api_token()
+        device.save()
+        device.log_action('pretix.device.keyroll', auth=device)
+
+        serializer = DeviceSerializer(device)
+        return Response(serializer.data)
+
+
+class RevokeKeyView(APIView):
+    authentication_classes = (DeviceTokenAuthentication,)
+
+    def post(self, request, format=None):
+        device = request.auth
+        device.api_token = None
+        device.save()
+        device.log_action('pretix.device.revoked', auth=device)
+
+        serializer = DeviceSerializer(device)
+        return Response(serializer.data)

src/pretix/api/views/event.py

@@ -1,5 +1,7 @@
+import django_filters
 from django.db import transaction
-from django.db.models import ProtectedError
+from django.db.models import ProtectedError, Q
+from django.utils.timezone import now
 from django_filters.rest_framework import DjangoFilterBackend, FilterSet
 from rest_framework import filters, viewsets
 from rest_framework.exceptions import PermissionDenied
@@ -9,21 +11,80 @@ from pretix.api.serializers.event import (
     CloneEventSerializer, EventSerializer, SubEventSerializer,
     TaxRuleSerializer,
 )
-from pretix.base.models import Event, ItemCategory, TaxRule
+from pretix.api.views import ConditionalListView
+from pretix.base.models import (
+    Device, Event, ItemCategory, TaxRule, TeamAPIToken,
+)
 from pretix.base.models.event import SubEvent
-from pretix.base.models.organizer import TeamAPIToken
 from pretix.helpers.dicts import merge_dicts
 
 
+class EventFilter(FilterSet):
+    is_past = django_filters.rest_framework.BooleanFilter(method='is_past_qs')
+    is_future = django_filters.rest_framework.BooleanFilter(method='is_future_qs')
+    ends_after = django_filters.rest_framework.IsoDateTimeFilter(method='ends_after_qs')
+
+    class Meta:
+        model = Event
+        fields = ['is_public', 'live', 'has_subevents']
+
+    def ends_after_qs(self, queryset, name, value):
+        expr = (
+            Q(has_subevents=False) &
+            Q(
+                Q(Q(date_to__isnull=True) & Q(date_from__gte=value))
+                | Q(Q(date_to__isnull=False) & Q(date_to__gte=value))
+            )
+        )
+        return queryset.filter(expr)
+
+    def is_past_qs(self, queryset, name, value):
+        expr = (
+            Q(has_subevents=False) &
+            Q(
+                Q(Q(date_to__isnull=True) & Q(date_from__lt=now()))
+                | Q(Q(date_to__isnull=False) & Q(date_to__lt=now()))
+            )
+        )
+        if value:
+            return queryset.filter(expr)
+        else:
+            return queryset.exclude(expr)
+
+    def is_future_qs(self, queryset, name, value):
+        expr = (
+            Q(has_subevents=False) &
+            Q(
+                Q(Q(date_to__isnull=True) & Q(date_from__gte=now()))
+                | Q(Q(date_to__isnull=False) & Q(date_to__gte=now()))
+            )
+        )
+        if value:
+            return queryset.filter(expr)
+        else:
+            return queryset.exclude(expr)
+
+
 class EventViewSet(viewsets.ModelViewSet):
     serializer_class = EventSerializer
     queryset = Event.objects.none()
     lookup_field = 'slug'
     lookup_url_kwarg = 'event'
     permission_classes = (EventCRUDPermission,)
+    filter_backends = (DjangoFilterBackend, filters.OrderingFilter)
+    filterset_class = EventFilter
 
     def get_queryset(self):
-        return self.request.organizer.events.prefetch_related('meta_values', 'meta_values__property')
+        if isinstance(self.request.auth, (TeamAPIToken, Device)):
+            qs = self.request.auth.get_events_with_any_permission()
+        elif self.request.user.is_authenticated:
+            qs = self.request.user.get_events_with_any_permission(self.request).filter(
+                organizer=self.request.organizer
+            )
+
+        return qs.prefetch_related(
+            'meta_values', 'meta_values__property'
+        )
 
     def perform_update(self, serializer):
         current_live_value = serializer.instance.live
@@ -38,7 +99,7 @@ class EventViewSet(viewsets.ModelViewSet):
             serializer.instance.log_action(
                 log_action,
                 user=self.request.user,
-                api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                auth=self.request.auth,
                 data=self.request.data
             )
 
@@ -51,7 +112,7 @@ class EventViewSet(viewsets.ModelViewSet):
                 serializer.instance.log_action(
                     'pretix.event.plugins.' + action,
                     user=self.request.user,
-                    api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                    auth=self.request.auth,
                     data={'plugin': module}
                 )
 
@@ -60,7 +121,7 @@ class EventViewSet(viewsets.ModelViewSet):
             serializer.instance.log_action(
                 'pretix.event.changed',
                 user=self.request.user,
-                api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                auth=self.request.auth,
                 data=self.request.data
             )
 
@@ -69,7 +130,7 @@ class EventViewSet(viewsets.ModelViewSet):
         serializer.instance.log_action(
             'pretix.event.added',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=self.request.data
         )
 
@@ -114,30 +175,73 @@ class CloneEventViewSet(viewsets.ModelViewSet):
         serializer.instance.log_action(
             'pretix.event.added',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=self.request.data
         )
 
 
 class SubEventFilter(FilterSet):
+    is_past = django_filters.rest_framework.BooleanFilter(method='is_past_qs')
+    is_future = django_filters.rest_framework.BooleanFilter(method='is_future_qs')
+    ends_after = django_filters.rest_framework.IsoDateTimeFilter(method='ends_after_qs')
+
     class Meta:
         model = SubEvent
-        fields = ['active']
+        fields = ['active', 'event__live']
+
+    def ends_after_qs(self, queryset, name, value):
+        expr = Q(
+            Q(Q(date_to__isnull=True) & Q(date_from__gte=value))
+            | Q(Q(date_to__isnull=False) & Q(date_to__gte=value))
+        )
+        return queryset.filter(expr)
+
+    def is_past_qs(self, queryset, name, value):
+        expr = Q(
+            Q(Q(date_to__isnull=True) & Q(date_from__lt=now()))
+            | Q(Q(date_to__isnull=False) & Q(date_to__lt=now()))
+        )
+        if value:
+            return queryset.filter(expr)
+        else:
+            return queryset.exclude(expr)
+
+    def is_future_qs(self, queryset, name, value):
+        expr = Q(
+            Q(Q(date_to__isnull=True) & Q(date_from__gte=now()))
+            | Q(Q(date_to__isnull=False) & Q(date_to__gte=now()))
+        )
+        if value:
+            return queryset.filter(expr)
+        else:
+            return queryset.exclude(expr)
 
 
-class SubEventViewSet(viewsets.ReadOnlyModelViewSet):
+class SubEventViewSet(ConditionalListView, viewsets.ReadOnlyModelViewSet):
     serializer_class = SubEventSerializer
     queryset = ItemCategory.objects.none()
     filter_backends = (DjangoFilterBackend, filters.OrderingFilter)
-    filter_class = SubEventFilter
+    filterset_class = SubEventFilter
 
     def get_queryset(self):
-        return self.request.event.subevents.prefetch_related(
+        if getattr(self.request, 'event', None):
+            qs = self.request.event.subevents
+        elif isinstance(self.request.auth, (TeamAPIToken, Device)):
+            qs = SubEvent.objects.filter(
+                event__organizer=self.request.organizer,
+                event__in=self.request.auth.get_events_with_any_permission()
+            )
+        elif self.request.user.is_authenticated:
+            qs = SubEvent.objects.filter(
+                event__organizer=self.request.organizer,
+                event__in=self.request.user.get_events_with_any_permission()
+            )
+        return qs.prefetch_related(
             'subeventitem_set', 'subeventitemvariation_set'
         )
 
 
-class TaxRuleViewSet(viewsets.ModelViewSet):
+class TaxRuleViewSet(ConditionalListView, viewsets.ModelViewSet):
     serializer_class = TaxRuleSerializer
     queryset = TaxRule.objects.none()
     write_permission = 'can_change_event_settings'
@@ -150,7 +254,7 @@ class TaxRuleViewSet(viewsets.ModelViewSet):
         serializer.instance.log_action(
             'pretix.event.taxrule.changed',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=self.request.data
         )
 
@@ -159,7 +263,7 @@ class TaxRuleViewSet(viewsets.ModelViewSet):
         serializer.instance.log_action(
             'pretix.event.taxrule.added',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=self.request.data
         )
 
@@ -170,6 +274,6 @@ class TaxRuleViewSet(viewsets.ModelViewSet):
         instance.log_action(
             'pretix.event.taxrule.deleted',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
         )
         super().perform_destroy(instance)

src/pretix/api/views/item.py

@@ -13,11 +13,11 @@ from pretix.api.serializers.item import (
     ItemVariationSerializer, QuestionOptionSerializer, QuestionSerializer,
     QuotaSerializer,
 )
+from pretix.api.views import ConditionalListView
 from pretix.base.models import (
     Item, ItemAddOn, ItemCategory, ItemVariation, Question, QuestionOption,
     Quota,
 )
-from pretix.base.models.organizer import TeamAPIToken
 from pretix.helpers.dicts import merge_dicts
 
 
@@ -35,14 +35,14 @@ class ItemFilter(FilterSet):
         fields = ['active', 'category', 'admission', 'tax_rate', 'free_price']
 
 
-class ItemViewSet(viewsets.ModelViewSet):
+class ItemViewSet(ConditionalListView, viewsets.ModelViewSet):
     serializer_class = ItemSerializer
     queryset = Item.objects.none()
     filter_backends = (DjangoFilterBackend, OrderingFilter)
     ordering_fields = ('id', 'position')
     ordering = ('position', 'id')
-    filter_class = ItemFilter
-    permission = 'can_change_items'
+    filterset_class = ItemFilter
+    permission = None
     write_permission = 'can_change_items'
 
     def get_queryset(self):
@@ -53,7 +53,7 @@ class ItemViewSet(viewsets.ModelViewSet):
         serializer.instance.log_action(
             'pretix.event.item.added',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=self.request.data
         )
 
@@ -68,7 +68,7 @@ class ItemViewSet(viewsets.ModelViewSet):
         serializer.instance.log_action(
             'pretix.event.item.changed',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=self.request.data
         )
 
@@ -81,7 +81,7 @@ class ItemViewSet(viewsets.ModelViewSet):
         instance.log_action(
             'pretix.event.item.deleted',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
         )
         super().perform_destroy(instance)
 
@@ -92,7 +92,7 @@ class ItemVariationViewSet(viewsets.ModelViewSet):
     filter_backends = (DjangoFilterBackend, OrderingFilter,)
     ordering_fields = ('id', 'position')
     ordering = ('id',)
-    permission = 'can_change_items'
+    permission = None
     write_permission = 'can_change_items'
 
     def get_queryset(self):
@@ -113,7 +113,7 @@ class ItemVariationViewSet(viewsets.ModelViewSet):
         item.log_action(
             'pretix.event.item.variation.added',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=merge_dicts(self.request.data, {'ORDER': serializer.instance.position}, {'id': serializer.instance.pk},
                              {'value': serializer.instance.value})
         )
@@ -123,7 +123,7 @@ class ItemVariationViewSet(viewsets.ModelViewSet):
         serializer.instance.item.log_action(
             'pretix.event.item.variation.changed',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=merge_dicts(self.request.data, {'ORDER': serializer.instance.position}, {'id': serializer.instance.pk},
                              {'value': serializer.instance.value})
         )
@@ -140,7 +140,7 @@ class ItemVariationViewSet(viewsets.ModelViewSet):
         instance.item.log_action(
             'pretix.event.item.variation.deleted',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data={
                 'value': instance.value,
                 'id': self.kwargs['pk']
@@ -154,7 +154,7 @@ class ItemAddOnViewSet(viewsets.ModelViewSet):
     filter_backends = (DjangoFilterBackend, OrderingFilter,)
     ordering_fields = ('id', 'position')
     ordering = ('id',)
-    permission = 'can_change_items'
+    permission = None
     write_permission = 'can_change_items'
 
     def get_queryset(self):
@@ -174,7 +174,7 @@ class ItemAddOnViewSet(viewsets.ModelViewSet):
         item.log_action(
             'pretix.event.item.addons.added',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=merge_dicts(self.request.data, {'ORDER': serializer.instance.position}, {'id': serializer.instance.pk})
         )
 
@@ -183,7 +183,7 @@ class ItemAddOnViewSet(viewsets.ModelViewSet):
         serializer.instance.base_item.log_action(
             'pretix.event.item.addons.changed',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=merge_dicts(self.request.data, {'ORDER': serializer.instance.position}, {'id': serializer.instance.pk})
         )
 
@@ -192,7 +192,7 @@ class ItemAddOnViewSet(viewsets.ModelViewSet):
         instance.base_item.log_action(
             'pretix.event.item.addons.removed',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data={'category': instance.addon_category.pk}
         )
 
@@ -203,14 +203,14 @@ class ItemCategoryFilter(FilterSet):
         fields = ['is_addon']
 
 
-class ItemCategoryViewSet(viewsets.ModelViewSet):
+class ItemCategoryViewSet(ConditionalListView, viewsets.ModelViewSet):
     serializer_class = ItemCategorySerializer
     queryset = ItemCategory.objects.none()
     filter_backends = (DjangoFilterBackend, OrderingFilter)
-    filter_class = ItemCategoryFilter
+    filterset_class = ItemCategoryFilter
     ordering_fields = ('id', 'position')
     ordering = ('position', 'id')
-    permission = 'can_change_items'
+    permission = None
     write_permission = 'can_change_items'
 
     def get_queryset(self):
@@ -221,7 +221,7 @@ class ItemCategoryViewSet(viewsets.ModelViewSet):
         serializer.instance.log_action(
             'pretix.event.category.added',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=self.request.data
         )
 
@@ -235,7 +235,7 @@ class ItemCategoryViewSet(viewsets.ModelViewSet):
         serializer.instance.log_action(
             'pretix.event.category.changed',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=self.request.data
         )
 
@@ -246,7 +246,7 @@ class ItemCategoryViewSet(viewsets.ModelViewSet):
         instance.log_action(
             'pretix.event.category.deleted',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
         )
         super().perform_destroy(instance)
 
@@ -257,14 +257,15 @@ class QuestionFilter(FilterSet):
         fields = ['ask_during_checkin', 'required', 'identifier']
 
 
-class QuestionViewSet(viewsets.ModelViewSet):
+class QuestionViewSet(ConditionalListView, viewsets.ModelViewSet):
     serializer_class = QuestionSerializer
     queryset = Question.objects.none()
     filter_backends = (DjangoFilterBackend, OrderingFilter)
-    filter_class = QuestionFilter
+    filterset_class = QuestionFilter
     ordering_fields = ('id', 'position')
     ordering = ('position', 'id')
-    permission = 'can_change_items'
+    permission = None
+    write_permission = 'can_change_items'
 
     def get_queryset(self):
         return self.request.event.questions.prefetch_related('options').all()
@@ -274,7 +275,7 @@ class QuestionViewSet(viewsets.ModelViewSet):
         serializer.instance.log_action(
             'pretix.event.question.added',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=self.request.data
         )
 
@@ -288,7 +289,7 @@ class QuestionViewSet(viewsets.ModelViewSet):
         serializer.instance.log_action(
             'pretix.event.question.changed',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=self.request.data
         )
 
@@ -296,7 +297,7 @@ class QuestionViewSet(viewsets.ModelViewSet):
         instance.log_action(
             'pretix.event.question.deleted',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
         )
         super().perform_destroy(instance)
 
@@ -307,7 +308,7 @@ class QuestionOptionViewSet(viewsets.ModelViewSet):
     filter_backends = (DjangoFilterBackend, OrderingFilter,)
     ordering_fields = ('id', 'position')
     ordering = ('position',)
-    permission = 'can_change_items'
+    permission = None
     write_permission = 'can_change_items'
 
     def get_queryset(self):
@@ -326,7 +327,7 @@ class QuestionOptionViewSet(viewsets.ModelViewSet):
         q.log_action(
             'pretix.event.question.option.added',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=merge_dicts(self.request.data, {'ORDER': serializer.instance.position}, {'id': serializer.instance.pk})
         )
 
@@ -335,7 +336,7 @@ class QuestionOptionViewSet(viewsets.ModelViewSet):
         serializer.instance.question.log_action(
             'pretix.event.question.option.changed',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=merge_dicts(self.request.data, {'ORDER': serializer.instance.position}, {'id': serializer.instance.pk})
         )
 
@@ -343,7 +344,7 @@ class QuestionOptionViewSet(viewsets.ModelViewSet):
         instance.question.log_action(
             'pretix.event.question.option.deleted',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data={'id': instance.pk}
         )
         super().perform_destroy(instance)
@@ -355,14 +356,14 @@ class QuotaFilter(FilterSet):
         fields = ['subevent']
 
 
-class QuotaViewSet(viewsets.ModelViewSet):
+class QuotaViewSet(ConditionalListView, viewsets.ModelViewSet):
     serializer_class = QuotaSerializer
     queryset = Quota.objects.none()
     filter_backends = (DjangoFilterBackend, OrderingFilter,)
-    filter_class = QuotaFilter
+    filterset_class = QuotaFilter
     ordering_fields = ('id', 'size')
     ordering = ('id',)
-    permission = 'can_change_items'
+    permission = None
     write_permission = 'can_change_items'
 
     def get_queryset(self):
@@ -373,14 +374,14 @@ class QuotaViewSet(viewsets.ModelViewSet):
         serializer.instance.log_action(
             'pretix.event.quota.added',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=self.request.data
         )
         if serializer.instance.subevent:
             serializer.instance.subevent.log_action(
                 'pretix.subevent.quota.added',
                 user=self.request.user,
-                api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                auth=self.request.auth,
                 data=self.request.data
             )
 
@@ -396,7 +397,7 @@ class QuotaViewSet(viewsets.ModelViewSet):
         serializer.instance.log_action(
             'pretix.event.quota.changed',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=self.request.data
         )
         if current_subevent == request_subevent:
@@ -404,7 +405,7 @@ class QuotaViewSet(viewsets.ModelViewSet):
                 current_subevent.log_action(
                     'pretix.subevent.quota.changed',
                     user=self.request.user,
-                    api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                    auth=self.request.auth,
                     data=self.request.data
                 )
         else:
@@ -412,14 +413,14 @@ class QuotaViewSet(viewsets.ModelViewSet):
                 request_subevent.log_action(
                     'pretix.subevent.quota.added',
                     user=self.request.user,
-                    api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                    auth=self.request.auth,
                     data=self.request.data
                 )
             if current_subevent is not None:
                 current_subevent.log_action(
                     'pretix.subevent.quota.deleted',
                     user=self.request.user,
-                    api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                    auth=self.request.auth,
                 )
         serializer.instance.rebuild_cache()
 
@@ -427,13 +428,13 @@ class QuotaViewSet(viewsets.ModelViewSet):
         instance.log_action(
             'pretix.event.quota.deleted',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
         )
         if instance.subevent:
             instance.subevent.log_action(
                 'pretix.subevent.quota.deleted',
                 user=self.request.user,
-                api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                auth=self.request.auth,
             )
         super().perform_destroy(instance)
 

src/pretix/api/views/oauth.py

@@ -0,0 +1,92 @@
+import logging
+
+from django import forms
+from django.conf import settings
+from django.utils.translation import ugettext as _
+from oauth2_provider.exceptions import OAuthToolkitError
+from oauth2_provider.forms import AllowForm
+from oauth2_provider.views import (
+    AuthorizationView as BaseAuthorizationView,
+    RevokeTokenView as BaseRevokeTokenView, TokenView as BaseTokenView,
+)
+
+from pretix.api.models import OAuthApplication
+from pretix.base.models import Organizer
+
+logger = logging.getLogger(__name__)
+
+
+class OAuthAllowForm(AllowForm):
+    organizers = forms.ModelMultipleChoiceField(
+        queryset=Organizer.objects.none(),
+        widget=forms.CheckboxSelectMultiple
+    )
+
+    def __init__(self, *args, **kwargs):
+        user = kwargs.pop('user')
+        super().__init__(*args, **kwargs)
+        self.fields['organizers'].queryset = Organizer.objects.filter(
+            pk__in=user.teams.values_list('organizer', flat=True))
+
+
+class AuthorizationView(BaseAuthorizationView):
+    template_name = "pretixcontrol/auth/oauth_authorization.html"
+    form_class = OAuthAllowForm
+
+    def get_form_kwargs(self):
+        kwargs = super().get_form_kwargs()
+        kwargs['user'] = self.request.user
+        return kwargs
+
+    def get_context_data(self, **kwargs):
+        ctx = super().get_context_data(**kwargs)
+        ctx['settings'] = settings
+        return ctx
+
+    def create_authorization_response(self, request, scopes, credentials, allow, organizers):
+        credentials["organizers"] = organizers
+        return super().create_authorization_response(request, scopes, credentials, allow)
+
+    def form_valid(self, form):
+        client_id = form.cleaned_data["client_id"]
+        application = OAuthApplication.objects.get(client_id=client_id)
+        credentials = {
+            "client_id": form.cleaned_data.get("client_id"),
+            "redirect_uri": form.cleaned_data.get("redirect_uri"),
+            "response_type": form.cleaned_data.get("response_type", None),
+            "state": form.cleaned_data.get("state", None),
+        }
+        scopes = form.cleaned_data.get("scope")
+        allow = form.cleaned_data.get("allow")
+
+        try:
+            uri, headers, body, status = self.create_authorization_response(
+                request=self.request, scopes=scopes, credentials=credentials, allow=allow,
+                organizers=form.cleaned_data.get("organizers")
+            )
+        except OAuthToolkitError as error:
+            return self.error_response(error, application)
+
+        self.success_url = uri
+        logger.debug("Success url for the request: {0}".format(self.success_url))
+
+        msgs = [
+            _('The application "{application_name}" has been authorized to access your account.').format(
+                application_name=application.name
+            )
+        ]
+        self.request.user.send_security_notice(msgs)
+        self.request.user.log_action('pretix.user.oauth.authorized', user=self.request.user, data={
+            'application_id': application.pk,
+            'application_name': application.name,
+        })
+
+        return self.redirect(self.success_url, application)
+
+
+class TokenView(BaseTokenView):
+    pass
+
+
+class RevokeTokenView(BaseRevokeTokenView):
+    pass

src/pretix/api/views/order.py

@@ -2,67 +2,104 @@ import datetime
 
 import django_filters
 import pytz
-from django.db.models import Q
+from django.db import transaction
+from django.db.models import Prefetch, Q
 from django.db.models.functions import Concat
 from django.http import FileResponse
-from django.utils.timezone import make_aware
+from django.shortcuts import get_object_or_404
+from django.utils.timezone import make_aware, now
 from django_filters.rest_framework import DjangoFilterBackend, FilterSet
-from rest_framework import serializers, status, viewsets
+from rest_framework import mixins, serializers, status, viewsets
 from rest_framework.decorators import detail_route
 from rest_framework.exceptions import (
     APIException, NotFound, PermissionDenied, ValidationError,
 )
 from rest_framework.filters import OrderingFilter
+from rest_framework.mixins import CreateModelMixin
 from rest_framework.response import Response
 
+from pretix.api.models import OAuthAccessToken
 from pretix.api.serializers.order import (
-    InvoiceSerializer, OrderPositionSerializer, OrderSerializer,
+    InvoiceSerializer, OrderCreateSerializer, OrderPaymentSerializer,
+    OrderPositionSerializer, OrderRefundCreateSerializer,
+    OrderRefundSerializer, OrderSerializer,
 )
-from pretix.base.models import Invoice, Order, OrderPosition, Quota
-from pretix.base.models.organizer import TeamAPIToken
+from pretix.base.models import (
+    Device, Invoice, Order, OrderPayment, OrderPosition, OrderRefund, Quota,
+    TeamAPIToken,
+)
+from pretix.base.payment import PaymentException
 from pretix.base.services.invoices import (
-    generate_cancellation, generate_invoice, invoice_pdf, regenerate_invoice,
+    generate_cancellation, generate_invoice, invoice_pdf, invoice_qualified,
+    regenerate_invoice,
 )
 from pretix.base.services.mail import SendMailException
 from pretix.base.services.orders import (
-    OrderError, cancel_order, extend_order, mark_order_expired,
-    mark_order_paid,
+    OrderChangeManager, OrderError, approve_order, cancel_order, deny_order,
+    extend_order, mark_order_expired, mark_order_refunded,
 )
 from pretix.base.services.tickets import (
     get_cachedticket_for_order, get_cachedticket_for_position,
 )
-from pretix.base.signals import register_ticket_outputs
+from pretix.base.signals import order_placed, register_ticket_outputs
 
 
 class OrderFilter(FilterSet):
-    email = django_filters.CharFilter(name='email', lookup_expr='iexact')
-    code = django_filters.CharFilter(name='code', lookup_expr='iexact')
-    status = django_filters.CharFilter(name='status', lookup_expr='iexact')
+    email = django_filters.CharFilter(field_name='email', lookup_expr='iexact')
+    code = django_filters.CharFilter(field_name='code', lookup_expr='iexact')
+    status = django_filters.CharFilter(field_name='status', lookup_expr='iexact')
+    modified_since = django_filters.IsoDateTimeFilter(field_name='last_modified', lookup_expr='gte')
 
     class Meta:
         model = Order
-        fields = ['code', 'status', 'email', 'locale']
+        fields = ['code', 'status', 'email', 'locale', 'require_approval']
 
 
-class OrderViewSet(viewsets.ReadOnlyModelViewSet):
+class OrderViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
     serializer_class = OrderSerializer
     queryset = Order.objects.none()
     filter_backends = (DjangoFilterBackend, OrderingFilter)
     ordering = ('datetime',)
     ordering_fields = ('datetime', 'code', 'status')
-    filter_class = OrderFilter
+    filterset_class = OrderFilter
     lookup_field = 'code'
     permission = 'can_view_orders'
     write_permission = 'can_change_orders'
 
+    def get_serializer_context(self):
+        ctx = super().get_serializer_context()
+        ctx['event'] = self.request.event
+        return ctx
+
     def get_queryset(self):
-        return self.request.event.orders.prefetch_related(
-            'positions', 'positions__checkins', 'positions__item', 'positions__answers', 'positions__answers__options',
-            'positions__answers__question', 'fees'
+        qs = self.request.event.orders.prefetch_related(
+            'fees', 'payments', 'refunds', 'refunds__payment'
         ).select_related(
             'invoice_address'
         )
 
+        if self.request.query_params.get('pdf_data', 'false') == 'true':
+            qs = qs.prefetch_related(
+                Prefetch(
+                    'positions',
+                    OrderPosition.objects.all().prefetch_related(
+                        'checkins', 'item', 'variation', 'answers', 'answers__options', 'answers__question',
+                        Prefetch('addons', OrderPosition.objects.select_related('item', 'variation'))
+                    )
+                )
+            )
+        else:
+            qs = qs.prefetch_related(
+                Prefetch(
+                    'positions',
+                    OrderPosition.objects.all().prefetch_related(
+                        'checkins', 'item', 'variation', 'answers', 'answers__options', 'answers__question',
+                    )
+                )
+            )
+
+        return qs
+
     def _get_output_provider(self, identifier):
         responses = register_ticket_outputs.send(self.request.event)
         for receiver, response in responses:
@@ -71,6 +108,20 @@ class OrderViewSet(viewsets.ReadOnlyModelViewSet):
                 return prov
         raise NotFound('Unknown output provider.')
 
+    def list(self, request, **kwargs):
+        date = serializers.DateTimeField().to_representation(now())
+        queryset = self.filter_queryset(self.get_queryset())
+
+        page = self.paginate_queryset(queryset)
+        if page is not None:
+            serializer = self.get_serializer(page, many=True)
+            resp = self.get_paginated_response(serializer.data)
+            resp['X-Page-Generated'] = date
+            return resp
+
+        serializer = self.get_serializer(queryset, many=True)
+        return Response(serializer.data, headers={'X-Page-Generated': date})
+
     @detail_route(url_name='download', url_path='download/(?P<output>[^/]+)')
     def download(self, request, output, **kwargs):
         provider = self._get_output_provider(output)
@@ -96,14 +147,33 @@ class OrderViewSet(viewsets.ReadOnlyModelViewSet):
         order = self.get_object()
 
         if order.status in (Order.STATUS_PENDING, Order.STATUS_EXPIRED):
+
+            ps = order.pending_sum
             try:
-                mark_order_paid(
-                    order, manual=True,
-                    user=request.user if request.user.is_authenticated else None,
-                    api_token=(request.auth if isinstance(request.auth, TeamAPIToken) else None),
+                p = order.payments.get(
+                    state__in=(OrderPayment.PAYMENT_STATE_PENDING, OrderPayment.PAYMENT_STATE_CREATED),
+                    provider='manual',
+                    amount=ps
                 )
+            except OrderPayment.DoesNotExist:
+                order.payments.filter(state__in=(OrderPayment.PAYMENT_STATE_PENDING,
+                                                 OrderPayment.PAYMENT_STATE_CREATED)) \
+                    .update(state=OrderPayment.PAYMENT_STATE_CANCELED)
+                p = order.payments.create(
+                    state=OrderPayment.PAYMENT_STATE_CREATED,
+                    provider='manual',
+                    amount=ps,
+                    fee=None
+                )
+
+            try:
+                p.confirm(auth=self.request.auth,
+                          user=self.request.user if request.user.is_authenticated else None,
+                          count_waitinglist=False)
             except Quota.QuotaExceededException as e:
                 return Response({'detail': str(e)}, status=status.HTTP_400_BAD_REQUEST)
+            except PaymentException as e:
+                return Response({'detail': str(e)}, status=status.HTTP_400_BAD_REQUEST)
             except SendMailException:
                 pass
 
@@ -127,11 +197,49 @@ class OrderViewSet(viewsets.ReadOnlyModelViewSet):
         cancel_order(
             order,
             user=request.user if request.user.is_authenticated else None,
-            api_token=(request.auth if isinstance(request.auth, TeamAPIToken) else None),
+            api_token=request.auth if isinstance(request.auth, TeamAPIToken) else None,
+            device=request.auth if isinstance(request.auth, Device) else None,
+            oauth_application=request.auth.application if isinstance(request.auth, OAuthAccessToken) else None,
             send_mail=send_mail
         )
         return self.retrieve(request, [], **kwargs)
 
+    @detail_route(methods=['POST'])
+    def approve(self, request, **kwargs):
+        send_mail = request.data.get('send_email', True)
+
+        order = self.get_object()
+        try:
+            approve_order(
+                order,
+                user=request.user if request.user.is_authenticated else None,
+                auth=request.auth if isinstance(request.auth, (Device, TeamAPIToken, OAuthAccessToken)) else None,
+                send_mail=send_mail,
+            )
+        except Quota.QuotaExceededException as e:
+            return Response({'detail': str(e)}, status=status.HTTP_400_BAD_REQUEST)
+        except OrderError as e:
+            return Response({'detail': str(e)}, status=status.HTTP_400_BAD_REQUEST)
+        return self.retrieve(request, [], **kwargs)
+
+    @detail_route(methods=['POST'])
+    def deny(self, request, **kwargs):
+        send_mail = request.data.get('send_email', True)
+        comment = request.data.get('comment', '')
+
+        order = self.get_object()
+        try:
+            deny_order(
+                order,
+                user=request.user if request.user.is_authenticated else None,
+                auth=request.auth if isinstance(request.auth, (Device, TeamAPIToken, OAuthAccessToken)) else None,
+                send_mail=send_mail,
+                comment=comment,
+            )
+        except OrderError as e:
+            return Response({'detail': str(e)}, status=status.HTTP_400_BAD_REQUEST)
+        return self.retrieve(request, [], **kwargs)
+
     @detail_route(methods=['POST'])
     def mark_pending(self, request, **kwargs):
         order = self.get_object()
@@ -143,12 +251,11 @@ class OrderViewSet(viewsets.ReadOnlyModelViewSet):
             )
 
         order.status = Order.STATUS_PENDING
-        order.payment_manual = True
         order.save()
         order.log_action(
             'pretix.event.order.unpaid',
             user=request.user if request.user.is_authenticated else None,
-            api_token=(request.auth if isinstance(request.auth, TeamAPIToken) else None),
+            auth=request.auth,
         )
         return self.retrieve(request, [], **kwargs)
 
@@ -165,11 +272,26 @@ class OrderViewSet(viewsets.ReadOnlyModelViewSet):
         mark_order_expired(
             order,
             user=request.user if request.user.is_authenticated else None,
-            api_token=(request.auth if isinstance(request.auth, TeamAPIToken) else None),
+            auth=request.auth,
         )
         return self.retrieve(request, [], **kwargs)
 
-    # TODO: Find a way to implement mark_refunded
+    @detail_route(methods=['POST'])
+    def mark_refunded(self, request, **kwargs):
+        order = self.get_object()
+
+        if order.status != Order.STATUS_PAID:
+            return Response(
+                {'detail': 'The order is not paid.'},
+                status=status.HTTP_400_BAD_REQUEST
+            )
+
+        mark_order_refunded(
+            order,
+            user=request.user if request.user.is_authenticated else None,
+            auth=(request.auth if isinstance(request.auth, (TeamAPIToken, OAuthAccessToken, Device)) else None),
+        )
+        return self.retrieve(request, [], **kwargs)
 
     @detail_route(methods=['POST'])
     def extend(self, request, **kwargs):
@@ -204,7 +326,7 @@ class OrderViewSet(viewsets.ReadOnlyModelViewSet):
                 new_date=new_date,
                 force=force,
                 user=request.user if request.user.is_authenticated else None,
-                api_token=(request.auth if isinstance(request.auth, TeamAPIToken) else None),
+                auth=request.auth,
             )
             return self.retrieve(request, [], **kwargs)
         except OrderError as e:
@@ -213,9 +335,37 @@ class OrderViewSet(viewsets.ReadOnlyModelViewSet):
                 status=status.HTTP_400_BAD_REQUEST
             )
 
+    def create(self, request, *args, **kwargs):
+        serializer = OrderCreateSerializer(data=request.data, context=self.get_serializer_context())
+        serializer.is_valid(raise_exception=True)
+        with transaction.atomic():
+            self.perform_create(serializer)
+            order = serializer.instance
+            serializer = OrderSerializer(order, context=serializer.context)
+
+            order.log_action(
+                'pretix.event.order.placed',
+                user=request.user if request.user.is_authenticated else None,
+                auth=request.auth,
+            )
+        order_placed.send(self.request.event, order=order)
+
+        gen_invoice = invoice_qualified(order) and (
+            (order.event.settings.get('invoice_generate') == 'True') or
+            (order.event.settings.get('invoice_generate') == 'paid' and order.status == Order.STATUS_PAID)
+        ) and not order.invoices.last()
+        if gen_invoice:
+            generate_invoice(order, trigger_pdf=True)
+
+        headers = self.get_success_headers(serializer.data)
+        return Response(serializer.data, status=status.HTTP_201_CREATED, headers=headers)
+
+    def perform_create(self, serializer):
+        serializer.save()
+
 
 class OrderPositionFilter(FilterSet):
-    order = django_filters.CharFilter(name='order', lookup_expr='code__iexact')
+    order = django_filters.CharFilter(field_name='order', lookup_expr='code__iexact')
     has_checkin = django_filters.rest_framework.BooleanFilter(method='has_checkin_qs')
     attendee_name = django_filters.CharFilter(method='attendee_name_qs')
     search = django_filters.CharFilter(method='search_qs')
@@ -243,18 +393,22 @@ class OrderPositionFilter(FilterSet):
             'secret': ['exact'],
             'order__status': ['exact', 'in'],
             'addon_to': ['exact', 'in'],
-            'subevent': ['exact', 'in']
+            'subevent': ['exact', 'in'],
+            'pseudonymization_id': ['exact'],
+            'voucher__code': ['exact'],
+            'voucher': ['exact'],
         }
 
 
-class OrderPositionViewSet(viewsets.ReadOnlyModelViewSet):
+class OrderPositionViewSet(mixins.DestroyModelMixin, viewsets.ReadOnlyModelViewSet):
     serializer_class = OrderPositionSerializer
     queryset = OrderPosition.objects.none()
     filter_backends = (DjangoFilterBackend, OrderingFilter)
     ordering = ('order__datetime', 'positionid')
     ordering_fields = ('order__code', 'order__datetime', 'positionid', 'attendee_name', 'order__status',)
-    filter_class = OrderPositionFilter
+    filterset_class = OrderPositionFilter
     permission = 'can_view_orders'
+    write_permission = 'can_change_orders'
 
     def get_queryset(self):
         return OrderPosition.objects.filter(order__event=self.request.event).prefetch_related(
@@ -295,11 +449,232 @@ class OrderPositionViewSet(viewsets.ReadOnlyModelViewSet):
             )
             return resp
 
+    def perform_destroy(self, instance):
+        try:
+            ocm = OrderChangeManager(
+                instance.order,
+                user=self.request.user if self.request.user.is_authenticated else None,
+                auth=self.request.auth,
+                notify=False
+            )
+            ocm.cancel(instance)
+            ocm.commit()
+        except OrderError as e:
+            raise ValidationError(str(e))
+        except Quota.QuotaExceededException as e:
+            raise ValidationError(str(e))
+
+
+class PaymentViewSet(viewsets.ReadOnlyModelViewSet):
+    serializer_class = OrderPaymentSerializer
+    queryset = OrderPayment.objects.none()
+    permission = 'can_view_orders'
+    write_permission = 'can_change_orders'
+    lookup_field = 'local_id'
+
+    def get_queryset(self):
+        order = get_object_or_404(Order, code=self.kwargs['order'], event=self.request.event)
+        return order.payments.all()
+
+    @detail_route(methods=['POST'])
+    def confirm(self, request, **kwargs):
+        payment = self.get_object()
+        force = request.data.get('force', False)
+
+        if payment.state not in (OrderPayment.PAYMENT_STATE_PENDING, OrderPayment.PAYMENT_STATE_CREATED):
+            return Response({'detail': 'Invalid state of payment'}, status=status.HTTP_400_BAD_REQUEST)
+
+        try:
+            payment.confirm(user=self.request.user if self.request.user.is_authenticated else None,
+                            auth=self.request.auth,
+                            count_waitinglist=False,
+                            force=force)
+        except Quota.QuotaExceededException as e:
+            return Response({'detail': str(e)}, status=status.HTTP_400_BAD_REQUEST)
+        except PaymentException as e:
+            return Response({'detail': str(e)}, status=status.HTTP_400_BAD_REQUEST)
+        except SendMailException:
+            pass
+        return self.retrieve(request, [], **kwargs)
+
+    @detail_route(methods=['POST'])
+    def refund(self, request, **kwargs):
+        payment = self.get_object()
+        amount = serializers.DecimalField(max_digits=10, decimal_places=2).to_internal_value(
+            request.data.get('amount', str(payment.amount))
+        )
+        mark_refunded = request.data.get('mark_refunded', False)
+
+        if payment.state != OrderPayment.PAYMENT_STATE_CONFIRMED:
+            return Response({'detail': 'Invalid state of payment.'}, status=status.HTTP_400_BAD_REQUEST)
+
+        full_refund_possible = payment.payment_provider.payment_refund_supported(payment)
+        partial_refund_possible = payment.payment_provider.payment_partial_refund_supported(payment)
+        available_amount = payment.amount - payment.refunded_amount
+
+        if amount <= 0:
+            return Response({'amount': ['Invalid refund amount.']}, status=status.HTTP_400_BAD_REQUEST)
+        if amount > available_amount:
+            return Response(
+                {'amount': ['Invalid refund amount, only {} are available to refund.'.format(available_amount)]},
+                status=status.HTTP_400_BAD_REQUEST)
+        if amount != payment.amount and not partial_refund_possible:
+            return Response({'amount': ['Partial refund not available for this payment method.']},
+                            status=status.HTTP_400_BAD_REQUEST)
+        if amount == payment.amount and not full_refund_possible:
+            return Response({'amount': ['Full refund not available for this payment method.']},
+                            status=status.HTTP_400_BAD_REQUEST)
+        r = payment.order.refunds.create(
+            payment=payment,
+            source=OrderRefund.REFUND_SOURCE_ADMIN,
+            state=OrderRefund.REFUND_STATE_CREATED,
+            amount=amount,
+            provider=payment.provider
+        )
+
+        try:
+            r.payment_provider.execute_refund(r)
+        except PaymentException as e:
+            r.state = OrderRefund.REFUND_STATE_FAILED
+            r.save()
+            return Response({'detail': 'External error: {}'.format(str(e))},
+                            status=status.HTTP_400_BAD_REQUEST)
+        else:
+            payment.order.log_action('pretix.event.order.refund.created', {
+                'local_id': r.local_id,
+                'provider': r.provider,
+            }, user=self.request.user if self.request.user.is_authenticated else None, auth=self.request.auth)
+            if payment.order.pending_sum > 0:
+                if mark_refunded:
+                    mark_order_refunded(payment.order,
+                                        user=self.request.user if self.request.user.is_authenticated else None,
+                                        auth=self.request.auth)
+                else:
+                    payment.order.status = Order.STATUS_PENDING
+                    payment.order.set_expires(
+                        now(),
+                        payment.order.event.subevents.filter(
+                            id__in=payment.order.positions.values_list('subevent_id', flat=True))
+                    )
+                    payment.order.save()
+            return Response(OrderRefundSerializer(r).data, status=status.HTTP_200_OK)
+
+    @detail_route(methods=['POST'])
+    def cancel(self, request, **kwargs):
+        payment = self.get_object()
+
+        if payment.state not in (OrderPayment.PAYMENT_STATE_PENDING, OrderPayment.PAYMENT_STATE_CREATED):
+            return Response({'detail': 'Invalid state of payment'}, status=status.HTTP_400_BAD_REQUEST)
+
+        with transaction.atomic():
+            payment.state = OrderPayment.PAYMENT_STATE_CANCELED
+            payment.save()
+            payment.order.log_action('pretix.event.order.payment.canceled', {
+                'local_id': payment.local_id,
+                'provider': payment.provider,
+            }, user=self.request.user if self.request.user.is_authenticated else None, auth=self.request.auth)
+        return self.retrieve(request, [], **kwargs)
+
+
+class RefundViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
+    serializer_class = OrderRefundSerializer
+    queryset = OrderRefund.objects.none()
+    permission = 'can_view_orders'
+    write_permission = 'can_change_orders'
+    lookup_field = 'local_id'
+
+    def get_queryset(self):
+        order = get_object_or_404(Order, code=self.kwargs['order'], event=self.request.event)
+        return order.refunds.all()
+
+    @detail_route(methods=['POST'])
+    def cancel(self, request, **kwargs):
+        refund = self.get_object()
+
+        if refund.state not in (OrderRefund.REFUND_STATE_CREATED, OrderRefund.REFUND_STATE_TRANSIT,
+                                OrderRefund.REFUND_STATE_EXTERNAL):
+            return Response({'detail': 'Invalid state of refund'}, status=status.HTTP_400_BAD_REQUEST)
+
+        with transaction.atomic():
+            refund.state = OrderRefund.REFUND_STATE_CANCELED
+            refund.save()
+            refund.order.log_action('pretix.event.order.refund.canceled', {
+                'local_id': refund.local_id,
+                'provider': refund.provider,
+            }, user=self.request.user if self.request.user.is_authenticated else None, auth=self.request.auth)
+        return self.retrieve(request, [], **kwargs)
+
+    @detail_route(methods=['POST'])
+    def process(self, request, **kwargs):
+        refund = self.get_object()
+
+        if refund.state != OrderRefund.REFUND_STATE_EXTERNAL:
+            return Response({'detail': 'Invalid state of refund'}, status=status.HTTP_400_BAD_REQUEST)
+
+        refund.done(user=self.request.user if self.request.user.is_authenticated else None, auth=self.request.auth)
+        if request.data.get('mark_refunded', False):
+            mark_order_refunded(refund.order, user=self.request.user if self.request.user.is_authenticated else None,
+                                auth=self.request.auth)
+        else:
+            refund.order.status = Order.STATUS_PENDING
+            refund.order.set_expires(
+                now(),
+                refund.order.event.subevents.filter(
+                    id__in=refund.order.positions.values_list('subevent_id', flat=True))
+            )
+            refund.order.save()
+        return self.retrieve(request, [], **kwargs)
+
+    @detail_route(methods=['POST'])
+    def done(self, request, **kwargs):
+        refund = self.get_object()
+
+        if refund.state not in (OrderRefund.REFUND_STATE_CREATED, OrderRefund.REFUND_STATE_TRANSIT):
+            return Response({'detail': 'Invalid state of refund'}, status=status.HTTP_400_BAD_REQUEST)
+
+        refund.done(user=self.request.user if self.request.user.is_authenticated else None, auth=self.request.auth)
+        return self.retrieve(request, [], **kwargs)
+
+    def get_serializer_context(self):
+        ctx = super().get_serializer_context()
+        ctx['order'] = get_object_or_404(Order, code=self.kwargs['order'], event=self.request.event)
+        return ctx
+
+    def create(self, request, *args, **kwargs):
+        mark_refunded = request.data.pop('mark_refunded', False)
+        serializer = OrderRefundCreateSerializer(data=request.data, context=self.get_serializer_context())
+        serializer.is_valid(raise_exception=True)
+        with transaction.atomic():
+            self.perform_create(serializer)
+            r = serializer.instance
+            serializer = OrderRefundSerializer(r, context=serializer.context)
+
+            r.order.log_action(
+                'pretix.event.order.refund.created', {
+                    'local_id': r.local_id,
+                    'provider': r.provider,
+                },
+                user=request.user if request.user.is_authenticated else None,
+                auth=request.auth
+            )
+            if mark_refunded:
+                mark_order_refunded(
+                    r.order,
+                    user=request.user if request.user.is_authenticated else None,
+                    auth=(request.auth if request.auth else None),
+                )
+
+        headers = self.get_success_headers(serializer.data)
+        return Response(serializer.data, status=status.HTTP_201_CREATED, headers=headers)
+
+    def perform_create(self, serializer):
+        serializer.save()
+
 
 class InvoiceFilter(FilterSet):
     refers = django_filters.CharFilter(method='refers_qs')
     number = django_filters.CharFilter(method='nr_qs')
-    order = django_filters.CharFilter(name='order', lookup_expr='code__iexact')
+    order = django_filters.CharFilter(field_name='order', lookup_expr='code__iexact')
 
     def refers_qs(self, queryset, name, value):
         return queryset.annotate(
@@ -326,7 +701,7 @@ class InvoiceViewSet(viewsets.ReadOnlyModelViewSet):
     filter_backends = (DjangoFilterBackend, OrderingFilter)
     ordering = ('nr',)
     ordering_fields = ('nr', 'date')
-    filter_class = InvoiceFilter
+    filterset_class = InvoiceFilter
     permission = 'can_view_orders'
     lookup_url_kwarg = 'number'
     lookup_field = 'nr'
@@ -370,7 +745,7 @@ class InvoiceViewSet(viewsets.ReadOnlyModelViewSet):
                     'invoice': inv.pk
                 },
                 user=self.request.user,
-                api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                auth=self.request.auth,
             )
             return Response(status=204)
 
@@ -393,6 +768,6 @@ class InvoiceViewSet(viewsets.ReadOnlyModelViewSet):
                     'invoice': inv.pk
                 },
                 user=self.request.user,
-                api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                auth=self.request.auth,
             )
             return Response(status=204)

src/pretix/api/views/organizer.py

@@ -1,5 +1,6 @@
 from rest_framework import viewsets
 
+from pretix.api.models import OAuthAccessToken
 from pretix.api.serializers.organizer import OrganizerSerializer
 from pretix.base.models import Organizer
 
@@ -11,10 +12,18 @@ class OrganizerViewSet(viewsets.ReadOnlyModelViewSet):
     lookup_url_kwarg = 'organizer'
 
     def get_queryset(self):
-        if self.request.user.is_authenticated():
+        if self.request.user.is_authenticated:
             if self.request.user.has_active_staff_session(self.request.session.session_key):
                 return Organizer.objects.all()
+            elif isinstance(self.request.auth, OAuthAccessToken):
+                return Organizer.objects.filter(
+                    pk__in=self.request.user.teams.values_list('organizer', flat=True)
+                ).filter(
+                    pk__in=self.request.auth.organizers.values_list('pk', flat=True)
+                )
             else:
                 return Organizer.objects.filter(pk__in=self.request.user.teams.values_list('organizer', flat=True))
+        elif hasattr(self.request.auth, 'organizer_id'):
+            return Organizer.objects.filter(pk=self.request.auth.organizer_id)
         else:
             return Organizer.objects.filter(pk=self.request.auth.team.organizer_id)

src/pretix/api/views/voucher.py

@@ -9,7 +9,6 @@ from rest_framework.filters import OrderingFilter
 
 from pretix.api.serializers.voucher import VoucherSerializer
 from pretix.base.models import Voucher
-from pretix.base.models.organizer import TeamAPIToken
 
 
 class VoucherFilter(FilterSet):
@@ -35,7 +34,7 @@ class VoucherViewSet(viewsets.ModelViewSet):
     filter_backends = (DjangoFilterBackend, OrderingFilter)
     ordering = ('id',)
     ordering_fields = ('id', 'code', 'max_usages', 'valid_until', 'value')
-    filter_class = VoucherFilter
+    filterset_class = VoucherFilter
     permission = 'can_view_vouchers'
     write_permission = 'can_change_vouchers'
 
@@ -51,7 +50,7 @@ class VoucherViewSet(viewsets.ModelViewSet):
         serializer.instance.log_action(
             'pretix.voucher.added',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=self.request.data
         )
 
@@ -69,7 +68,7 @@ class VoucherViewSet(viewsets.ModelViewSet):
         serializer.instance.log_action(
             'pretix.voucher.changed',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
             data=self.request.data
         )
 
@@ -80,6 +79,6 @@ class VoucherViewSet(viewsets.ModelViewSet):
         instance.log_action(
             'pretix.voucher.deleted',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
         )
         super().perform_destroy(instance)

src/pretix/api/views/waitinglist.py

@@ -7,7 +7,7 @@ from rest_framework.filters import OrderingFilter
 from rest_framework.response import Response
 
 from pretix.api.serializers.waitinglist import WaitingListSerializer
-from pretix.base.models import TeamAPIToken, WaitingListEntry
+from pretix.base.models import WaitingListEntry
 from pretix.base.models.waitinglist import WaitingListException
 
 
@@ -28,7 +28,7 @@ class WaitingListViewSet(viewsets.ModelViewSet):
     filter_backends = (DjangoFilterBackend, OrderingFilter)
     ordering = ('created',)
     ordering_fields = ('id', 'created', 'email', 'item')
-    filter_class = WaitingListFilter
+    filterset_class = WaitingListFilter
     permission = 'can_view_orders'
     write_permission = 'can_change_orders'
 
@@ -45,7 +45,7 @@ class WaitingListViewSet(viewsets.ModelViewSet):
         serializer.instance.log_action(
             'pretix.event.orders.waitinglist.added',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
         )
 
     def perform_update(self, serializer):
@@ -55,7 +55,7 @@ class WaitingListViewSet(viewsets.ModelViewSet):
         serializer.instance.log_action(
             'pretix.event.orders.waitinglist.changed',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
         )
 
     def perform_destroy(self, instance):
@@ -65,7 +65,7 @@ class WaitingListViewSet(viewsets.ModelViewSet):
         instance.log_action(
             'pretix.event.orders.waitinglist.deleted',
             user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
         )
         super().perform_destroy(instance)
 
@@ -74,7 +74,7 @@ class WaitingListViewSet(viewsets.ModelViewSet):
         try:
             self.get_object().send_voucher(
                 user=self.request.user,
-                api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                auth=self.request.auth,
             )
         except WaitingListException as e:
             raise ValidationError(str(e))

src/pretix/base/__init__.py

@@ -12,6 +12,7 @@ class PretixBaseConfig(AppConfig):
         from . import exporters  # NOQA
         from . import invoice  # NOQA
         from . import notifications  # NOQA
+        from . import email  # NOQA
         from .services import auth, export, mail, tickets, cart, orders, invoices, cleanup, update_check, quotas, notifications  # NOQA
 
         try:

src/pretix/base/email.py

@@ -1,7 +1,18 @@
 import logging
 from smtplib import SMTPRecipientsRefused, SMTPSenderRefused
 
+import bleach
+import markdown
+from django.conf import settings
 from django.core.mail.backends.smtp import EmailBackend
+from django.dispatch import receiver
+from django.template.loader import get_template
+from django.utils.translation import ugettext_lazy as _
+from inlinestyler.utils import inline_css
+
+from pretix.base.models import Event, Order
+from pretix.base.signals import register_html_mail_renderers
+from pretix.base.templatetags.rich_text import markdown_compile
 
 logger = logging.getLogger('pretix.base.email')
 
@@ -24,3 +35,103 @@ class CustomSMTPBackend(EmailBackend):
                 raise SMTPRecipientsRefused(senderrs)
         finally:
             self.close()
+
+
+class BaseHTMLMailRenderer:
+    """
+    This is the base class for all HTML e-mail renderers.
+    """
+
+    def __init__(self, event: Event):
+        self.event = event
+
+    def __str__(self):
+        return self.identifier
+
+    def render(self, plain_body: str, plain_signature: str, subject: str, order: Order=None) -> str:
+        """
+        This method should generate the HTML part of the email.
+
+        :param plain_body: The body of the email in plain text.
+        :param plain_signature: The signature with event organizer contact details in plain text.
+        :param subject: The email subject.
+        :param order: The order if this email is connected to one, otherwise ``None``.
+        :return: An HTML string
+        """
+        raise NotImplementedError()
+
+    @property
+    def verbose_name(self) -> str:
+        """
+        A human-readable name for this renderer. This should be short but self-explanatory.
+        """
+        raise NotImplementedError()  # NOQA
+
+    @property
+    def identifier(self) -> str:
+        """
+        A short and unique identifier for this renderer.
+        This should only contain lowercase letters and in most cases will be the same as your package name or prefixed
+        with your package name.
+        """
+        raise NotImplementedError()  # NOQA
+
+    @property
+    def thumbnail_filename(self) -> str:
+        """
+        A file name discoverable in the static file storage that contains a preview of your renderer. This should
+        be with aspect resolution 4:3.
+        """
+        raise NotImplementedError()  # NOQA
+
+    @property
+    def is_available(self) -> bool:
+        """
+        This renderer will only be available if this returns ``True``. You can use this to limit this renderer
+        to certain events. Defaults to ``True``.
+        """
+        return True
+
+
+class TemplateBasedMailRenderer(BaseHTMLMailRenderer):
+
+    @property
+    def template_name(self):
+        raise NotImplemented
+
+    def render(self, plain_body: str, plain_signature: str, subject: str, order: Order) -> str:
+        body_md = bleach.linkify(markdown_compile(plain_body))
+        htmlctx = {
+            'site': settings.PRETIX_INSTANCE_NAME,
+            'site_url': settings.SITE_URL,
+            'body': body_md,
+            'subject': str(subject),
+            'color': '#8E44B3'
+        }
+        if self.event:
+            htmlctx['event'] = self.event
+            htmlctx['color'] = self.event.settings.primary_color
+
+        if plain_signature:
+            signature_md = plain_signature.replace('\n', '<br>\n')
+            signature_md = bleach.linkify(bleach.clean(markdown.markdown(signature_md), tags=bleach.ALLOWED_TAGS + ['p', 'br']))
+            htmlctx['signature'] = signature_md
+
+        if order:
+            htmlctx['order'] = order
+
+        tpl = get_template(self.template_name)
+        body_html = inline_css(tpl.render(htmlctx))
+        return body_html
+
+
+class ClassicMailRenderer(TemplateBasedMailRenderer):
+    verbose_name = _('pretix default')
+    identifier = 'classic'
+    thumbnail_filename = 'pretixbase/email/thumb.png'
+    template_name = 'pretixbase/email/plainwrapper.html'
+
+
+@receiver(register_html_mail_renderers, dispatch_uid="pretixbase_email_renderers")
+def base_renderers(sender, **kwargs):
+    return [ClassicMailRenderer]

src/pretix/base/exporters/invoices.py

@@ -5,9 +5,12 @@ from zipfile import ZipFile
 
 import dateutil.parser
 from django import forms
+from django.db.models import Exists, OuterRef, Q
 from django.dispatch import receiver
 from django.utils.translation import ugettext_lazy as _
 
+from pretix.base.models import OrderPayment
+
 from ..exporter import BaseExporter
 from ..services.invoices import invoice_pdf_task
 from ..signals import register_data_exporters
@@ -21,7 +24,14 @@ class InvoiceExporter(BaseExporter):
         qs = self.event.invoices.filter(shredded=False)
 
         if form_data.get('payment_provider'):
-            qs = qs.filter(order__payment_provider=form_data.get('payment_provider'))
+            qs = qs.annotate(
+                has_payment_with_provider=Exists(
+                    OrderPayment.objects.filter(
+                        Q(order=OuterRef('pk')) & Q(provider=form_data.get('payment_provider'))
+                    )
+                )
+            )
+            qs = qs.filter(has_payment_with_provider=1)
 
         if form_data.get('date_from'):
             date_value = form_data.get('date_from')
@@ -38,12 +48,19 @@ class InvoiceExporter(BaseExporter):
         with tempfile.TemporaryDirectory() as d:
             with ZipFile(os.path.join(d, 'tmp.zip'), 'w') as zipf:
                 for i in qs:
-                    if not i.file:
+                    try:
+                        if not i.file:
+                            invoice_pdf_task.apply(args=(i.pk,))
+                            i.refresh_from_db()
+                        i.file.open('rb')
+                        zipf.writestr('{}.pdf'.format(i.number), i.file.read())
+                        i.file.close()
+                    except FileNotFoundError:
                         invoice_pdf_task.apply(args=(i.pk,))
                         i.refresh_from_db()
-                    i.file.open('rb')
-                    zipf.writestr('{}.pdf'.format(i.number), i.file.read())
-                    i.file.close()
+                        i.file.open('rb')
+                        zipf.writestr('{}.pdf'.format(i.number), i.file.read())
+                        i.file.close()
 
             with open(os.path.join(d, 'tmp.zip'), 'rb') as zipf:
                 return '{}_invoices.zip'.format(self.event.slug), 'application/zip', zipf.read()
@@ -77,10 +94,10 @@ class InvoiceExporter(BaseExporter):
                          (k, v.verbose_name) for k, v in self.event.get_payment_providers().items()
                      ],
                      required=False,
-                     help_text=_('Only include invoices for orders that are currently set to this payment provider. '
-                                 'Note that this might include some invoices of other payment providers or misses '
-                                 'some invoices if the payment provider of an order has been changed and a new invoice '
-                                 'has been generated.')
+                     help_text=_('Only include invoices for orders that have at least one payment attempt '
+                                 'with this payment provider. '
+                                 'Note that this might include some invoices of orders which in the end have been '
+                                 'fully or partially paid with a different provider.')
                  )),
             ]
         )

src/pretix/base/exporters/json.py

@@ -24,13 +24,15 @@ class JSONExporter(BaseExporter):
                 'categories': [
                     {
                         'id': category.id,
-                        'name': str(category.name)
+                        'name': str(category.name),
+                        'internal_name': category.internal_name
                     } for category in self.event.categories.all()
                 ],
                 'items': [
                     {
                         'id': item.id,
                         'name': str(item.name),
+                        'internal_name': str(item.internal_name),
                         'category': item.category_id,
                         'price': item.default_price,
                         'tax_rate': item.tax_rule.rate if item.tax_rule else Decimal('0.00'),

src/pretix/base/exporters/orderlist.py

@@ -5,13 +5,13 @@ from decimal import Decimal
 import pytz
 from defusedcsv import csv
 from django import forms
-from django.db.models import Sum
+from django.db.models import DateTimeField, Max, OuterRef, Subquery, Sum
 from django.dispatch import receiver
 from django.utils.formats import localize
 from django.utils.translation import ugettext as _, ugettext_lazy
 
 from pretix.base.models import InvoiceAddress, Order, OrderPosition
-from pretix.base.models.orders import OrderFee
+from pretix.base.models.orders import OrderFee, OrderPayment, OrderRefund
 
 from ..exporter import BaseExporter
 from ..signals import register_data_exporters
@@ -55,7 +55,19 @@ class OrderListExporter(BaseExporter):
         tz = pytz.timezone(self.event.settings.timezone)
         writer = csv.writer(output, quoting=csv.QUOTE_NONNUMERIC, delimiter=",")
 
-        qs = self.event.orders.all().select_related('invoice_address').prefetch_related('invoices')
+        p_date = OrderPayment.objects.filter(
+            order=OuterRef('pk'),
+            state__in=(OrderPayment.PAYMENT_STATE_CONFIRMED, OrderPayment.PAYMENT_STATE_REFUNDED),
+            payment_date__isnull=False
+        ).values('order').annotate(
+            m=Max('payment_date')
+        ).values(
+            'm'
+        ).order_by()
+
+        qs = self.event.orders.annotate(
+            payment_date=Subquery(p_date, output_field=DateTimeField())
+        ).select_related('invoice_address').prefetch_related('invoices')
         if form_data['paid_only']:
             qs = qs.filter(status=Order.STATUS_PAID)
         tax_rates = self._get_all_tax_rates(qs)
@@ -63,7 +75,7 @@ class OrderListExporter(BaseExporter):
         headers = [
             _('Order code'), _('Order total'), _('Status'), _('Email'), _('Order date'),
             _('Company'), _('Name'), _('Address'), _('ZIP code'), _('City'), _('Country'), _('VAT ID'),
-            _('Payment date'), _('Payment type'), _('Fees'), _('Order locale')
+            _('Date of last payment'), _('Fees'), _('Order locale')
         ]
 
         for tr in tax_rates:
@@ -77,11 +89,6 @@ class OrderListExporter(BaseExporter):
 
         writer.writerow(headers)
 
-        provider_names = {
-            k: v.verbose_name
-            for k, v in self.event.get_payment_providers().items()
-        }
-
         full_fee_sum_cache = {
             o['order__id']: o['grosssum'] for o in
             OrderFee.objects.values('tax_rate', 'order__id').order_by().annotate(grosssum=Sum('value'))
@@ -114,7 +121,8 @@ class OrderListExporter(BaseExporter):
                     order.invoice_address.street,
                     order.invoice_address.zipcode,
                     order.invoice_address.city,
-                    order.invoice_address.country if order.invoice_address.country else order.invoice_address.country_old,
+                    order.invoice_address.country if order.invoice_address.country else
+                    order.invoice_address.country_old,
                     order.invoice_address.vat_id,
                 ]
             except InvoiceAddress.DoesNotExist:
@@ -122,14 +130,14 @@ class OrderListExporter(BaseExporter):
 
             row += [
                 order.payment_date.astimezone(tz).strftime('%Y-%m-%d') if order.payment_date else '',
-                provider_names.get(order.payment_provider, order.payment_provider),
                 localize(full_fee_sum_cache.get(order.id) or Decimal('0.00')),
                 order.locale,
             ]
 
             for tr in tax_rates:
                 taxrate_values = sum_cache.get((order.id, tr), {'grosssum': Decimal('0.00'), 'taxsum': Decimal('0.00')})
-                fee_taxrate_values = fee_sum_cache.get((order.id, tr), {'grosssum': Decimal('0.00'), 'taxsum': Decimal('0.00')})
+                fee_taxrate_values = fee_sum_cache.get((order.id, tr),
+                                                       {'grosssum': Decimal('0.00'), 'taxsum': Decimal('0.00')})
 
                 row += [
                     localize(taxrate_values['grosssum'] + fee_taxrate_values['grosssum']),
@@ -144,6 +152,77 @@ class OrderListExporter(BaseExporter):
         return '{}_orders.csv'.format(self.event.slug), 'text/csv', output.getvalue().encode("utf-8")
 
 
+class PaymentListExporter(BaseExporter):
+    identifier = 'paymentlistcsv'
+    verbose_name = ugettext_lazy('List of payments and refunds (CSV)')
+
+    @property
+    def export_form_fields(self):
+        return OrderedDict(
+            [
+                ('successful_only',
+                 forms.BooleanField(
+                     label=_('Only successful payments'),
+                     initial=True,
+                     required=False
+                 )),
+            ]
+        )
+
+    def render(self, form_data: dict):
+        output = io.StringIO()
+        tz = pytz.timezone(self.event.settings.timezone)
+        writer = csv.writer(output, quoting=csv.QUOTE_NONNUMERIC, delimiter=",")
+
+        provider_names = {
+            k: v.verbose_name
+            for k, v in self.event.get_payment_providers().items()
+        }
+
+        payments = OrderPayment.objects.filter(
+            order__event=self.event,
+        ).order_by('created')
+        refunds = OrderRefund.objects.filter(
+            order__event=self.event
+        ).order_by('created')
+
+        if form_data['successful_only']:
+            payments = payments.filter(
+                state__in=(OrderPayment.PAYMENT_STATE_CONFIRMED, OrderPayment.PAYMENT_STATE_REFUNDED),
+            )
+            refunds = refunds.filter(
+                state=OrderRefund.REFUND_STATE_DONE,
+            )
+
+        objs = sorted(list(payments) + list(refunds), key=lambda o: o.created)
+
+        headers = [
+            _('Order'), _('Payment ID'), _('Creation date'), _('Completion date'), _('Status'),
+            _('Amount'), _('Payment method')
+        ]
+        writer.writerow(headers)
+
+        for obj in objs:
+            if isinstance(obj, OrderPayment) and obj.payment_date:
+                d2 = obj.payment_date.astimezone(tz).date().strftime('%Y-%m-%d')
+            elif isinstance(obj, OrderRefund) and obj.execution_date:
+                d2 = obj.execution_date.astimezone(tz).date().strftime('%Y-%m-%d')
+            else:
+                d2 = ''
+            row = [
+                obj.order.code,
+                obj.full_id,
+                obj.created.astimezone(tz).date().strftime('%Y-%m-%d'),
+                d2,
+                obj.get_state_display(),
+                localize(obj.amount * (-1 if isinstance(obj, OrderRefund) else 1)),
+                provider_names.get(obj.provider, obj.provider)
+            ]
+            writer.writerow(row)
+
+        return '{}_payments.csv'.format(self.event.slug), 'text/csv', output.getvalue().encode("utf-8")
+
+
 class QuotaListExporter(BaseExporter):
     identifier = 'quotalistcsv'
     verbose_name = ugettext_lazy('Quota availabilities (CSV)')
@@ -180,6 +259,11 @@ def register_orderlist_exporter(sender, **kwargs):
     return OrderListExporter
 
 
+@receiver(register_data_exporters, dispatch_uid="exporter_paymentlist")
+def register_paymentlist_exporter(sender, **kwargs):
+    return PaymentListExporter
+
+
 @receiver(register_data_exporters, dispatch_uid="exporter_quotalist")
 def register_quotalist_exporter(sender, **kwargs):
     return QuotaListExporter

src/pretix/base/forms/__init__.py

@@ -57,7 +57,7 @@ class SettingsForm(i18nfield.forms.I18nFormMixin, HierarkeyForm):
         kwargs['locales'] = self.locales
         kwargs['initial'] = self.obj.settings.freeze()
         super().__init__(*args, **kwargs)
-        for f in self.fields.values():
+        for k, f in self.fields.items():
             if isinstance(f, (RelativeDateTimeField, RelativeDateField)):
                 f.set_event(self.obj)
 

src/pretix/base/forms/auth.py

@@ -39,7 +39,7 @@ class LoginForm(forms.Form):
         password = self.cleaned_data.get('password')
 
         if email and password:
-            self.user_cache = authenticate(email=email.lower(), password=password)
+            self.user_cache = authenticate(request=self.request, email=email.lower(), password=password)
             if self.user_cache is None:
                 raise forms.ValidationError(
                     self.error_messages['invalid_login'],
@@ -180,12 +180,4 @@ class PasswordForgotForm(forms.Form):
         super().__init__(*args, **kwargs)
 
     def clean_email(self):
-        email = self.cleaned_data['email']
-        try:
-            self.cleaned_data['user'] = User.objects.get(email=email)
-            return email
-        except User.DoesNotExist:
-            raise forms.ValidationError(
-                _("We are unable to find a user matching the data you provided."),
-                code='unknown_user'
-            )
+        return self.cleaned_data['email']

src/pretix/base/forms/questions.py

@@ -16,6 +16,7 @@ from pretix.base.forms.widgets import (
 )
 from pretix.base.models import InvoiceAddress, Question
 from pretix.base.models.tax import EU_COUNTRIES
+from pretix.control.forms import SplitDateTimeField
 from pretix.helpers.i18n import get_format_without_seconds
 from pretix.presale.signals import question_form_fields
 
@@ -143,7 +144,7 @@ class BaseQuestionsForm(forms.Form):
                     widget=TimePickerWidget(time_format=get_format_without_seconds('TIME_INPUT_FORMATS')),
                 )
             elif q.type == Question.TYPE_DATETIME:
-                field = forms.SplitDateTimeField(
+                field = SplitDateTimeField(
                     label=q.question, required=q.required,
                     help_text=q.help_text,
                     initial=dateutil.parser.parse(initial.answer).astimezone(tz) if initial and initial.answer else None,
@@ -199,6 +200,16 @@ class BaseInvoiceAddressForm(forms.ModelForm):
 
             if event.settings.invoice_name_required:
                 self.fields['name'].required = True
+        elif event.settings.invoice_address_company_required:
+            self.initial['is_business'] = True
+
+            self.fields['is_business'].widget = BusinessBooleanRadio(require_business=True)
+            self.fields['company'].required = True
+            self.fields['company'].widget.is_required = True
+            self.fields['company'].widget.attrs['required'] = 'required'
+            del self.fields['company'].widget.attrs['data-display-dependency']
+            if 'vat_id' in self.fields:
+                del self.fields['vat_id'].widget.attrs['data-display-dependency']
         else:
             self.fields['company'].widget.attrs['data-required-if'] = '#id_is_business_1'
             self.fields['name'].widget.attrs['data-required-if'] = '#id_is_business_0'
@@ -242,3 +253,12 @@ class BaseInvoiceAddressForm(forms.ModelForm):
                                                      'resolve this manually.'))
         else:
             self.instance.vat_id_validated = False
+
+
+class BaseInvoiceNameForm(BaseInvoiceAddressForm):
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        for f in list(self.fields.keys()):
+            if f != 'name':
+                del self.fields[f]

src/pretix/base/forms/widgets.py

@@ -2,6 +2,7 @@ import os
 
 from django import forms
 from django.utils.formats import get_format
+from django.utils.functional import lazy
 from django.utils.timezone import now
 from django.utils.translation import ugettext_lazy as _
 
@@ -92,14 +93,20 @@ class SplitDateTimePickerWidget(forms.SplitDateTimeWidget):
         date_attrs['class'] += ' datepickerfield'
         time_attrs['class'] += ' timepickerfield'
 
-        df = date_format or get_format('DATE_INPUT_FORMATS')[0]
-        date_attrs['placeholder'] = now().replace(
-            year=2000, month=12, day=31, hour=18, minute=0, second=0, microsecond=0
-        ).strftime(df)
-        tf = time_format or get_format('TIME_INPUT_FORMATS')[0]
-        time_attrs['placeholder'] = now().replace(
-            year=2000, month=1, day=1, hour=0, minute=0, second=0, microsecond=0
-        ).strftime(tf)
+        def date_placeholder():
+            df = date_format or get_format('DATE_INPUT_FORMATS')[0]
+            return now().replace(
+                year=2000, month=12, day=31, hour=18, minute=0, second=0, microsecond=0
+            ).strftime(df)
+
+        def time_placeholder():
+            tf = time_format or get_format('TIME_INPUT_FORMATS')[0]
+            return now().replace(
+                year=2000, month=1, day=1, hour=0, minute=0, second=0, microsecond=0
+            ).strftime(tf)
+
+        date_attrs['placeholder'] = lazy(date_placeholder, str)
+        time_attrs['placeholder'] = lazy(time_placeholder, str)
 
         widgets = (
             forms.DateInput(attrs=date_attrs, format=date_format),
@@ -110,14 +117,22 @@ class SplitDateTimePickerWidget(forms.SplitDateTimeWidget):
 
 
 class BusinessBooleanRadio(forms.RadioSelect):
-    def __init__(self, attrs=None):
-        choices = (
-            ('individual', _('Individual customer')),
-            ('business', _('Business customer')),
-        )
+    def __init__(self, require_business=False, attrs=None):
+        self.require_business = require_business
+        if self.require_business:
+            choices = (
+                ('business', _('Business customer')),
+            )
+        else:
+            choices = (
+                ('individual', _('Individual customer')),
+                ('business', _('Business customer')),
+            )
         super().__init__(attrs, choices)
 
     def format_value(self, value):
+        if self.require_business:
+            return 'business'
         try:
             return {True: 'business', False: 'individual'}[value]
         except KeyError:
@@ -125,6 +140,8 @@ class BusinessBooleanRadio(forms.RadioSelect):
 
     def value_from_datadict(self, data, files, name):
         value = data.get(name)
+        if self.require_business:
+            return True
         return {
             'business': True,
             True: True,

src/pretix/base/invoice.py

@@ -1,3 +1,4 @@
+import logging
 from collections import defaultdict
 from decimal import Decimal
 from io import BytesIO
@@ -8,6 +9,7 @@ from django.contrib.staticfiles import finders
 from django.dispatch import receiver
 from django.utils.formats import date_format, localize
 from django.utils.translation import pgettext
+from PIL.Image import BICUBIC
 from reportlab.lib import pagesizes
 from reportlab.lib.enums import TA_LEFT
 from reportlab.lib.styles import ParagraphStyle, StyleSheet1
@@ -26,6 +28,8 @@ from pretix.base.models import Event, Invoice
 from pretix.base.signals import register_invoice_renderers
 from pretix.base.templatetags.money import money_filter
 
+logger = logging.getLogger(__name__)
+
 
 class BaseInvoiceRenderer:
     """
@@ -178,6 +182,19 @@ class BaseReportlabInvoiceRenderer(BaseInvoiceRenderer):
         return 'invoice.pdf', 'application/pdf', buffer.read()
 
 
+class ThumbnailingImageReader(ImageReader):
+    def resize(self, width, height, dpi):
+        if width is None:
+            width = height * self._image.size[0] / self._image.size[1]
+        if height is None:
+            height = width * self._image.size[1] / self._image.size[0]
+        self._image.thumbnail(
+            size=(int(width * dpi / 72), int(height * dpi / 72)),
+            resample=BICUBIC
+        )
+        return width, height
+
+
 class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
     identifier = 'classic'
     verbose_name = pgettext('invoice', 'Classic renderer (pretix 1.0)')
@@ -192,6 +209,18 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
 
         canvas.restoreState()
 
+    def _draw_invoice_to(self, canvas):
+        p = Paragraph(self.invoice.invoice_to.strip().replace('\n', '<br />\n'), style=self.stylesheet['Normal'])
+        p.wrapOn(canvas, 85 * mm, 50 * mm)
+        p_size = p.wrap(85 * mm, 50 * mm)
+        p.drawOn(canvas, 25 * mm, (297 - 52) * mm - p_size[1])
+
+    def _draw_invoice_from(self, canvas):
+        p = Paragraph(self.invoice.invoice_from.strip().replace('\n', '<br />\n'), style=self.stylesheet['Normal'])
+        p.wrapOn(canvas, 70 * mm, 50 * mm)
+        p_size = p.wrap(70 * mm, 50 * mm)
+        p.drawOn(canvas, 25 * mm, (297 - 17) * mm - p_size[1])
+
     def _on_first_page(self, canvas: Canvas, doc):
         canvas.setCreator('pretix.eu')
         canvas.setTitle(pgettext('invoice', 'Invoice {num}').format(num=self.invoice.number))
@@ -208,20 +237,14 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
         textobject.textLine(pgettext('invoice', 'Invoice from').upper())
         canvas.drawText(textobject)
 
-        p = Paragraph(self.invoice.invoice_from.strip().replace('\n', '<br />\n'), style=self.stylesheet['Normal'])
-        p.wrapOn(canvas, 70 * mm, 50 * mm)
-        p_size = p.wrap(70 * mm, 50 * mm)
-        p.drawOn(canvas, 25 * mm, (297 - 17) * mm - p_size[1])
+        self._draw_invoice_from(canvas)
 
         textobject = canvas.beginText(25 * mm, (297 - 50) * mm)
         textobject.setFont('OpenSansBd', 8)
         textobject.textLine(pgettext('invoice', 'Invoice to').upper())
         canvas.drawText(textobject)
 
-        p = Paragraph(self.invoice.invoice_to.strip().replace('\n', '<br />\n'), style=self.stylesheet['Normal'])
-        p.wrapOn(canvas, 85 * mm, 50 * mm)
-        p_size = p.wrap(85 * mm, 50 * mm)
-        p.drawOn(canvas, 25 * mm, (297 - 52) * mm - p_size[1])
+        self._draw_invoice_to(canvas)
 
         textobject = canvas.beginText(125 * mm, (297 - 38) * mm)
         textobject.setFont('OpenSansBd', 8)
@@ -276,25 +299,42 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
 
         if self.invoice.event.settings.invoice_logo_image:
             logo_file = self.invoice.event.settings.get('invoice_logo_image', binary_file=True)
-            canvas.drawImage(ImageReader(logo_file),
+            ir = ThumbnailingImageReader(logo_file)
+            try:
+                ir.resize(25 * mm, 25 * mm, 300)
+            except:
+                logger.exception("Can not resize image")
+                pass
+            canvas.drawImage(ir,
                              95 * mm, (297 - 38) * mm,
                              width=25 * mm, height=25 * mm,
                              preserveAspectRatio=True, anchor='n',
                              mask='auto')
 
+        def shorten(txt):
+            txt = str(txt)
+            p = Paragraph(txt.strip().replace('\n', '<br />\n'), style=self.stylesheet['Normal'])
+            p_size = p.wrap(65 * mm, 50 * mm)
+
+            while p_size[1] > 2 * self.stylesheet['Normal'].leading:
+                txt = ' '.join(txt.replace('…', '').split()[:-1]) + '…'
+                p = Paragraph(txt.strip().replace('\n', '<br />\n'), style=self.stylesheet['Normal'])
+                p_size = p.wrap(65 * mm, 50 * mm)
+            return txt
+
         if not self.invoice.event.has_subevents:
             if self.invoice.event.settings.show_date_to:
                 p_str = (
-                    str(self.invoice.event.name) + '\n' + pgettext('invoice', '{from_date}\nuntil {to_date}').format(
+                    shorten(self.invoice.event.name) + '\n' + pgettext('invoice', '{from_date}\nuntil {to_date}').format(
                         from_date=self.invoice.event.get_date_from_display(),
                         to_date=self.invoice.event.get_date_to_display())
                 )
             else:
                 p_str = (
-                    str(self.invoice.event.name) + '\n' + self.invoice.event.get_date_from_display()
+                    shorten(self.invoice.event.name) + '\n' + self.invoice.event.get_date_from_display()
                 )
         else:
-            p_str = str(self.invoice.event.name)
+            p_str = shorten(self.invoice.event.name)
 
         p = Paragraph(p_str.strip().replace('\n', '<br />\n'), style=self.stylesheet['Normal'])
         p.wrapOn(canvas, 65 * mm, 50 * mm)
@@ -339,7 +379,7 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
 
         if self.invoice.internal_reference:
             story.append(Paragraph(
-                pgettext('invoice', 'Your reference: {reference}').format(reference=self.invoice.internal_reference),
+                pgettext('invoice', 'Customer reference: {reference}').format(reference=self.invoice.internal_reference),
                 self.stylesheet['Normal']
             ))
 

src/pretix/base/management/commands/rebuild.py

@@ -8,10 +8,10 @@ class Command(BaseCommand):
     help = "Rebuild static files and language files"
 
     def handle(self, *args, **options):
-        call_command('compilemessages', verbosity=1, interactive=False)
-        call_command('compilejsi18n', verbosity=1, interactive=False)
+        call_command('compilemessages', verbosity=1)
+        call_command('compilejsi18n', verbosity=1)
         call_command('collectstatic', verbosity=1, interactive=False)
-        call_command('compress', verbosity=1, interactive=False)
+        call_command('compress', verbosity=1)
         try:
             gs = GlobalSettingsObject()
             del gs.settings.update_check_last

src/pretix/base/middleware.py

@@ -3,8 +3,8 @@ from urllib.parse import urlsplit
 
 import pytz
 from django.conf import settings
-from django.core.urlresolvers import get_script_prefix
 from django.http import HttpRequest, HttpResponse
+from django.urls import get_script_prefix
 from django.utils import timezone, translation
 from django.utils.cache import patch_vary_headers
 from django.utils.deprecation import MiddlewareMixin
@@ -172,6 +172,12 @@ class SecurityMiddleware(MiddlewareMixin):
             return resp
 
         resp['X-XSS-Protection'] = '1'
+
+        # We just need to have a P3P, not matter whats in there
+        # https://blogs.msdn.microsoft.com/ieinternals/2013/09/17/a-quick-look-at-p3p/
+        # https://github.com/pretix/pretix/issues/765
+        resp['P3P'] = 'CP=\"ALL DSP COR CUR ADM TAI OUR IND COM NAV INT\"'
+
         h = {
             'default-src': ["{static}"],
             'script-src': ['{static}', 'https://checkout.stripe.com', 'https://js.stripe.com'],

src/pretix/base/migrations/0077_auto_20171124_1629_squashed_0088_auto_20180328_1217.py

@@ -0,0 +1,424 @@
+# Generated by Django 2.0.8 on 2018-09-11 14:50
+
+import django.core.validators
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+from django.db.models import F
+from django.db.models.functions import Concat
+from django.utils.crypto import get_random_string
+from django.utils.translation import ugettext as _
+
+import pretix.base.models.auth
+import pretix.base.validators
+from pretix.base.i18n import language
+
+
+def create_checkin_lists(apps, schema_editor):
+    Event = apps.get_model('pretixbase', 'Event')
+    Checkin = apps.get_model('pretixbase', 'Checkin')
+    EventSettingsStore = apps.get_model('pretixbase', 'Event_SettingsStore')
+    for e in Event.objects.all():
+        locale = EventSettingsStore.objects.filter(object=e, key='locale').first()
+        if locale:
+            locale = locale.value
+        else:
+            locale = settings.LANGUAGE_CODE
+
+        if e.has_subevents:
+            for se in e.subevents.all():
+                with language(locale):
+                    cl = e.checkin_lists.create(name=se.name, subevent=se, all_products=True)
+                Checkin.objects.filter(position__subevent=se, position__order__event=e).update(list=cl)
+        else:
+            with language(locale):
+                cl = e.checkin_lists.create(name=_('Default list'), all_products=True)
+            Checkin.objects.filter(position__order__event=e).update(list=cl)
+
+
+def set_full_invoice_no(app, schema_editor):
+    Invoice = app.get_model('pretixbase', 'Invoice')
+    Invoice.objects.all().update(
+        full_invoice_no=Concat(F('prefix'), F('invoice_no'))
+    )
+
+
+def set_position(apps, schema_editor):
+    Question = apps.get_model('pretixbase', 'Question')
+    for q in Question.objects.all():
+        for i, option in enumerate(q.options.all()):
+            option.position = i
+            option.save()
+
+
+def set_is_staff(apps, schema_editor):
+    User = apps.get_model('pretixbase', 'User')
+    User.objects.filter(is_superuser=True).update(is_staff=True)
+
+
+def set_identifiers(apps, schema_editor):
+    Question = apps.get_model('pretixbase', 'Question')
+    QuestionOption = apps.get_model('pretixbase', 'QuestionOption')
+
+    for q in Question.objects.select_related('event'):
+        if not q.identifier:
+            charset = list('ABCDEFGHJKLMNPQRSTUVWXYZ3789')
+            while True:
+                code = get_random_string(length=8, allowed_chars=charset)
+                if not Question.objects.filter(event=q.event, identifier=code).exists():
+                    q.identifier = code
+                    q.save()
+                    break
+
+    for q in QuestionOption.objects.select_related('question', 'question__event'):
+        if not q.identifier:
+            charset = list('ABCDEFGHJKLMNPQRSTUVWXYZ3789')
+            while True:
+                code = get_random_string(length=8, allowed_chars=charset)
+                if not QuestionOption.objects.filter(question__event=q.question.event, identifier=code).exists():
+                    q.identifier = code
+                    q.save()
+                    break
+
+
+class Migration(migrations.Migration):
+    replaces = [('pretixbase', '0077_auto_20171124_1629'), ('pretixbase', '0078_auto_20171206_1603'),
+                ('pretixbase', '0079_auto_20180115_0855'), ('pretixbase', '0080_question_ask_during_checkin'),
+                ('pretixbase', '0081_auto_20180220_1031'), ('pretixbase', '0082_auto_20180222_0938'),
+                ('pretixbase', '0083_auto_20180228_2102'), ('pretixbase', '0084_questionoption_position'),
+                ('pretixbase', '0085_auto_20180312_1119'), ('pretixbase', '0086_auto_20180320_1219'),
+                ('pretixbase', '0087_auto_20180317_1952'), ('pretixbase', '0088_auto_20180328_1217')]
+
+    dependencies = [
+        ('pretixbase', '0076_orderfee_squashed_0082_invoiceaddress_internal_reference'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='event',
+            name='slug',
+            field=models.SlugField(
+                help_text='Should be short, only contain lowercase letters, numbers, dots, and dashes, and must be '
+                          'unique among your events. We recommend some kind of abbreviation or a date with less than '
+                          '10 characters that can be easily remembered, but you can also choose to use a random '
+                          'value. This will be used in URLs, order codes, invoice numbers, and bank transfer '
+                          'references.',
+                validators=[django.core.validators.RegexValidator(
+                    message='The slug may only contain letters, numbers, dots and dashes.', regex='^[a-zA-Z0-9.-]+$'),
+                    pretix.base.validators.EventSlugBlacklistValidator()], verbose_name='Short form'),
+        ),
+        migrations.AlterField(
+            model_name='eventmetaproperty',
+            name='name',
+            field=models.CharField(db_index=True,
+                                   help_text='Can not contain spaces or special characters except underscores',
+                                   max_length=50, validators=[django.core.validators.RegexValidator(
+                    message='The property name may only contain letters, numbers and underscores.',
+                    regex='^[a-zA-Z0-9_]+$')], verbose_name='Name'),
+        ),
+        migrations.AlterField(
+            model_name='organizer',
+            name='slug',
+            field=models.SlugField(
+                help_text='Should be short, only contain lowercase letters, numbers, dots, and dashes. Every slug can '
+                          'only be used once. This is being used in URLs to refer to your organizer accounts and your'
+                          ' events.',
+                validators=[django.core.validators.RegexValidator(
+                    message='The slug may only contain letters, numbers, dots and dashes.', regex='^[a-zA-Z0-9.-]+$'),
+                    pretix.base.validators.OrganizerSlugBlacklistValidator()], verbose_name='Short form'),
+        ),
+        migrations.CreateModel(
+            name='CheckinList',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', models.CharField(max_length=190)),
+                ('all_products',
+                 models.BooleanField(default=True, verbose_name='All products (including newly created ones)')),
+                ('event', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='checkin_lists',
+                                            to='pretixbase.Event')),
+                ('subevent', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE,
+                                               to='pretixbase.SubEvent', verbose_name='Date')),
+                ('limit_products',
+                 models.ManyToManyField(blank=True, to='pretixbase.Item', verbose_name='Limit to products')),
+            ],
+        ),
+        migrations.AddField(
+            model_name='checkin',
+            name='list',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT,
+                                    related_name='checkins', to='pretixbase.CheckinList'),
+        ),
+        migrations.RunPython(
+            code=create_checkin_lists,
+            reverse_code=django.db.migrations.operations.special.RunPython.noop,
+        ),
+        migrations.AlterField(
+            model_name='checkin',
+            name='list',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='checkins',
+                                    to='pretixbase.CheckinList'),
+        ),
+        migrations.CreateModel(
+            name='NotificationSetting',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('action_type', models.CharField(max_length=255)),
+                ('method', models.CharField(choices=[('mail', 'E-mail')], max_length=255)),
+                ('event', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE,
+                                            to='pretixbase.Event')),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL)),
+                ('enabled', models.BooleanField(default=True)),
+            ],
+        ),
+        migrations.AlterUniqueTogether(
+            name='notificationsetting',
+            unique_together={('user', 'action_type', 'event', 'method')},
+        ),
+        migrations.AddField(
+            model_name='logentry',
+            name='visible',
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AlterField(
+            model_name='notificationsetting',
+            name='event',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE,
+                                    related_name='notification_settings', to='pretixbase.Event'),
+        ),
+        migrations.AlterField(
+            model_name='notificationsetting',
+            name='user',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='notification_settings',
+                                    to=settings.AUTH_USER_MODEL),
+        ),
+        migrations.AddField(
+            model_name='user',
+            name='notifications_send',
+            field=models.BooleanField(default=True, help_text='If turned off, you will not get any notifications.',
+                                      verbose_name='Receive notifications according to my settings below'),
+        ),
+        migrations.AddField(
+            model_name='user',
+            name='notifications_token',
+            field=models.CharField(default=pretix.base.models.auth.generate_notifications_token, max_length=255),
+        ),
+        migrations.AddField(
+            model_name='invoice',
+            name='full_invoice_no',
+            field=models.CharField(db_index=True, default='', max_length=190),
+            preserve_default=False,
+        ),
+        migrations.AlterField(
+            model_name='question',
+            name='type',
+            field=models.CharField(
+                choices=[('N', 'Number'), ('S', 'Text (one line)'), ('T', 'Multiline text'), ('B', 'Yes/No'),
+                         ('C', 'Choose one from a list'), ('M', 'Choose multiple from a list'), ('F', 'File upload'),
+                         ('D', 'Date'), ('H', 'Time'), ('W', 'Date and time')], max_length=5,
+                verbose_name='Question type'),
+        ),
+        migrations.RunPython(
+            code=set_full_invoice_no,
+            reverse_code=django.db.migrations.operations.special.RunPython.noop,
+        ),
+        migrations.AddField(
+            model_name='question',
+            name='ask_during_checkin',
+            field=models.BooleanField(default=False,
+                                      help_text='This will only work if you handle your check-in with pretixdroid 1.8 '
+                                                'or '
+                                                'newer or pretixdesk 0.2 or newer.',
+                                      verbose_name='Ask during check-in instead of in the ticket buying process'),
+        ),
+        migrations.AddField(
+            model_name='checkinlist',
+            name='include_pending',
+            field=models.BooleanField(default=False,
+                                      help_text='With this option, people will be able to check in even if the order '
+                                                'have '
+                                                'not been paid. This only works with pretixdesk 0.3.0 or newer or '
+                                                'pretixdroid 1.9 or newer.',
+                                      verbose_name='Include pending orders'),
+        ),
+        migrations.AlterField(
+            model_name='event',
+            name='presale_end',
+            field=models.DateTimeField(blank=True,
+                                       help_text='Optional. No products will be sold after this date. If you do not '
+                                                 'set '
+                                                 'this value, the presale will end after the end date of your event.',
+                                       null=True, verbose_name='End of presale'),
+        ),
+        migrations.AlterField(
+            model_name='logentry',
+            name='event',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL,
+                                    to='pretixbase.Event'),
+        ),
+        migrations.AlterField(
+            model_name='subevent',
+            name='presale_end',
+            field=models.DateTimeField(blank=True,
+                                       help_text='Optional. No products will be sold after this date. If you do not '
+                                                 'set '
+                                                 'this value, the presale will end after the end date of your event.',
+                                       null=True, verbose_name='End of presale'),
+        ),
+        migrations.AlterField(
+            model_name='user',
+            name='require_2fa',
+            field=models.BooleanField(default=False, verbose_name='Two-factor authentification is required to log in'),
+        ),
+        migrations.AddField(
+            model_name='order',
+            name='checkin_attention',
+            field=models.BooleanField(default=False,
+                                      help_text='If you set this, the check-in app will show a visible warning that '
+                                                'tickets of this order require special attention. This will not show '
+                                                'any '
+                                                'details or custom message, so you need to brief your check-in staff '
+                                                'how '
+                                                'to handle these cases.',
+                                      verbose_name='Requires special attention'),
+        ),
+        migrations.AddField(
+            model_name='taxrule',
+            name='custom_rules',
+            field=models.TextField(blank=True, null=True),
+        ),
+        migrations.AlterField(
+            model_name='orderfee',
+            name='fee_type',
+            field=models.CharField(
+                choices=[('payment', 'Payment fee'), ('shipping', 'Shipping fee'), ('service', 'Service fee'),
+                         ('other', 'Other fees')], max_length=100),
+        ),
+        migrations.AlterModelOptions(
+            name='questionoption',
+            options={'ordering': ('position', 'id'), 'verbose_name': 'Question option',
+                     'verbose_name_plural': 'Question options'},
+        ),
+        migrations.AddField(
+            model_name='questionoption',
+            name='position',
+            field=models.IntegerField(default=0),
+        ),
+        migrations.AlterField(
+            model_name='question',
+            name='position',
+            field=models.PositiveIntegerField(default=0, verbose_name='Position'),
+        ),
+        migrations.RunPython(
+            code=set_position,
+            reverse_code=django.db.migrations.operations.special.RunPython.noop,
+        ),
+        migrations.AddField(
+            model_name='question',
+            name='identifier',
+            field=models.CharField(default='', max_length=190),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='questionoption',
+            name='identifier',
+            field=models.CharField(default='', max_length=190),
+            preserve_default=False,
+        ),
+        migrations.AlterField(
+            model_name='user',
+            name='locale',
+            field=models.CharField(
+                choices=[('en', 'English'), ('de', 'German'), ('de-informal', 'German (informal)'), ('nl', 'Dutch'),
+                         ('da', 'Danish'), ('pt-br', 'Portuguese (Brazil)')], default='en', max_length=50,
+                verbose_name='Language'),
+        ),
+        migrations.RunPython(
+            code=set_identifiers,
+            reverse_code=django.db.migrations.operations.special.RunPython.noop,
+        ),
+        migrations.AlterField(
+            model_name='cachedcombinedticket',
+            name='file',
+            field=models.FileField(blank=True, max_length=255, null=True,
+                                   upload_to=pretix.base.models.orders.cachedcombinedticket_name),
+        ),
+        migrations.AlterField(
+            model_name='cachedticket',
+            name='file',
+            field=models.FileField(blank=True, max_length=255, null=True,
+                                   upload_to=pretix.base.models.orders.cachedticket_name),
+        ),
+        migrations.AlterField(
+            model_name='invoice',
+            name='file',
+            field=models.FileField(blank=True, max_length=255, null=True,
+                                   upload_to=pretix.base.models.invoices.invoice_filename),
+        ),
+        migrations.AlterField(
+            model_name='question',
+            name='identifier',
+            field=models.CharField(
+                help_text='You can enter any value here to make it easier to match the data with other sources. If '
+                          'you do '
+                          'not input one, we will generate one automatically.',
+                max_length=190, verbose_name='Internal identifier'),
+        ),
+        migrations.AlterField(
+            model_name='questionanswer',
+            name='file',
+            field=models.FileField(blank=True, max_length=255, null=True,
+                                   upload_to=pretix.base.models.orders.answerfile_name),
+        ),
+        migrations.RunPython(
+            code=set_is_staff,
+            reverse_code=django.db.migrations.operations.special.RunPython.noop,
+        ),
+        migrations.RemoveField(
+            model_name='user',
+            name='is_superuser',
+        ),
+        migrations.CreateModel(
+            name='StaffSession',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('date_start', models.DateTimeField(auto_now_add=True)),
+                ('date_end', models.DateTimeField(blank=True, null=True)),
+                ('session_key', models.CharField(max_length=255)),
+                ('comment', models.TextField()),
+            ],
+        ),
+        migrations.CreateModel(
+            name='StaffSessionAuditLog',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('datetime', models.DateTimeField(auto_now_add=True)),
+                ('url', models.CharField(max_length=255)),
+                ('session', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='logs',
+                                              to='pretixbase.StaffSession')),
+                ('impersonating', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE,
+                                                    to=settings.AUTH_USER_MODEL)),
+                ('method', models.CharField(default='GET', max_length=255)),
+            ],
+            options={
+                'ordering': ('datetime',),
+            },
+        ),
+        migrations.AddField(
+            model_name='staffsession',
+            name='user',
+            field=models.ForeignKey(default=None, on_delete=django.db.models.deletion.CASCADE,
+                                    to=settings.AUTH_USER_MODEL),
+            preserve_default=False,
+        ),
+        migrations.AlterModelOptions(
+            name='staffsession',
+            options={'ordering': ('date_start',)},
+        ),
+        migrations.AlterField(
+            model_name='item',
+            name='picture',
+            field=models.ImageField(blank=True, max_length=255, null=True,
+                                    upload_to=pretix.base.models.items.itempicture_upload_to,
+                                    verbose_name='Product picture'),
+        ),
+    ]

src/pretix/base/migrations/0089_auto_20180315_1322.py

@@ -9,6 +9,7 @@ class Migration(migrations.Migration):
 
     dependencies = [
         ('pretixbase', '0088_auto_20180328_1217'),
+        ('pretixapi', '0001_initial')
     ]
 
     operations = [

src/pretix/base/migrations/0090_auto_20180509_0917.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.11 on 2018-05-09 09:17
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('pretixbase', '0089_auto_20180315_1322'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='item',
+            name='internal_name',
+            field=models.CharField(blank=True,
+                                   help_text='If you set this, this will be used instead of the public name in the '
+                                             'backend.',
+                                   max_length=255, null=True, verbose_name='Internal name'),
+        ),
+        migrations.AddField(
+            model_name='itemcategory',
+            name='internal_name',
+            field=models.CharField(blank=True,
+                                   help_text='If you set this, this will be used instead of the public name in the backend.',
+                                   max_length=255, null=True, verbose_name='Internal name'),
+        ),
+    ]

src/pretix/base/migrations/0090_auto_20180509_0917_squashed_0095_auto_20180604_1129.py

@@ -0,0 +1,85 @@
+# Generated by Django 2.0.8 on 2018-09-11 14:54
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+from django.utils.crypto import get_random_string
+
+
+def set_pids(apps, schema_editor):
+    OrderPosition = apps.get_model('pretixbase', 'OrderPosition')  # noqa
+    taken = set()
+    charset = list('ABCDEFGHJKLMNPQRSTUVWXYZ3789')
+    for op in OrderPosition.objects.iterator():
+        while True:
+            code = get_random_string(length=10, allowed_chars=charset)
+            if code not in taken:
+                op.pseudonymization_id = code
+                taken.add(code)
+                break
+        op.save(update_fields=['pseudonymization_id'])
+
+
+class Migration(migrations.Migration):
+    replaces = [('pretixbase', '0090_auto_20180509_0917'), ('pretixbase', '0091_auto_20180513_1641'),
+                ('pretixbase', '0092_auto_20180511_1224'), ('pretixbase', '0093_auto_20180528_1432'),
+                ('pretixbase', '0094_auto_20180604_1119'), ('pretixbase', '0095_auto_20180604_1129')]
+
+    dependencies = [
+        ('pretixbase', '0089_auto_20180315_1322'),
+        ('pretixapi', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='item',
+            name='internal_name',
+            field=models.CharField(blank=True,
+                                   help_text='If you set this, this will be used instead of the public name in the '
+                                             'backend.',
+                                   max_length=255, null=True, verbose_name='Internal name'),
+        ),
+        migrations.AddField(
+            model_name='itemcategory',
+            name='internal_name',
+            field=models.CharField(blank=True,
+                                   help_text='If you set this, this will be used instead of the public name in the '
+                                             'backend.',
+                                   max_length=255, null=True, verbose_name='Internal name'),
+        ),
+        migrations.AddField(
+            model_name='order',
+            name='last_modified',
+            field=models.DateTimeField(auto_now=True, db_index=True),
+        ),
+        migrations.AddField(
+            model_name='item',
+            name='original_price',
+            field=models.DecimalField(blank=True, decimal_places=2,
+                                      help_text='If set, this will be displayed next to the current price to show '
+                                                'that the current price is a discounted one. This is just a cosmetic '
+                                                'setting and will not actually impact pricing.',
+                                      max_digits=7, null=True, verbose_name='Original price'),
+        ),
+        migrations.AddField(
+            model_name='orderposition',
+            name='pseudonymization_id',
+            field=models.CharField(db_index=True, max_length=16, null=True, unique=True),
+        ),
+        migrations.RunPython(
+            code=set_pids,
+            reverse_code=django.db.migrations.operations.special.RunPython.noop,
+        ),
+        migrations.AlterField(
+            model_name='orderposition',
+            name='pseudonymization_id',
+            field=models.CharField(db_index=True, default='', max_length=16, unique=True),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name='logentry',
+            name='oauth_application',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT,
+                                    to=settings.OAUTH2_PROVIDER_APPLICATION_MODEL),
+        ),
+    ]

src/pretix/base/migrations/0091_auto_20180513_1641.py

@@ -0,0 +1,20 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.11 on 2018-05-13 16:41
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0090_auto_20180509_0917'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='order',
+            name='last_modified',
+            field=models.DateTimeField(auto_now=True, db_index=True),
+        ),
+    ]

src/pretix/base/migrations/0092_auto_20180511_1224.py

@@ -0,0 +1,23 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.11 on 2018-05-11 12:24
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('pretixbase', '0091_auto_20180513_1641'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='item',
+            name='original_price',
+            field=models.DecimalField(blank=True, decimal_places=2,
+                                      help_text='If set, this will be displayed next to the current price to show '
+                                                'that the current price is a discounted one. This is just a cosmetic '
+                                                'setting and will not actually impact pricing.',
+                                      max_digits=7, null=True, verbose_name='Original price'),
+        ),
+    ]

src/pretix/base/migrations/0093_auto_20180528_1432.py

@@ -0,0 +1,44 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.13 on 2018-05-28 14:32
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+from django.utils.crypto import get_random_string
+
+
+def set_pids(apps, schema_editor):
+    OrderPosition = apps.get_model('pretixbase', 'OrderPosition')  # noqa
+    taken = set()
+    charset = list('ABCDEFGHJKLMNPQRSTUVWXYZ3789')
+    for op in OrderPosition.objects.iterator():
+        while True:
+            code = get_random_string(length=10, allowed_chars=charset)
+            if code not in taken:
+                op.pseudonymization_id = code
+                taken.add(code)
+                break
+        op.save(update_fields=['pseudonymization_id'])
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('pretixbase', '0092_auto_20180511_1224'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='orderposition',
+            name='pseudonymization_id',
+            field=models.CharField(db_index=True, max_length=16, null=True, unique=True),
+        ),
+        migrations.RunPython(
+            set_pids,
+            migrations.RunPython.noop,
+        ),
+        migrations.AlterField(
+            model_name='orderposition',
+            name='pseudonymization_id',
+            field=models.CharField(db_index=True, default='', max_length=16, unique=True),
+            preserve_default=False,
+        ),
+    ]

src/pretix/base/migrations/0094_auto_20180604_1119.py

@@ -0,0 +1,15 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.13 on 2018-06-04 11:19
+from __future__ import unicode_literals
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('pretixbase', '0093_auto_20180528_1432'),
+        ('pretixapi', '0001_initial')
+    ]
+
+    operations = [
+    ]

src/pretix/base/migrations/0095_auto_20180604_1129.py

@@ -0,0 +1,21 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.13 on 2018-06-04 11:29
+from __future__ import unicode_literals
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('pretixbase', '0094_auto_20180604_1119'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='logentry',
+            name='oauth_application',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT,
+                                    to='pretixapi.OAuthApplication'),
+        ),
+    ]

src/pretix/base/migrations/0096_auto_20180722_0801.py

@@ -0,0 +1,81 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.13 on 2018-07-22 08:01
+from __future__ import unicode_literals
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0095_auto_20180604_1129'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='OrderPayment',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('local_id', models.PositiveIntegerField()),
+                ('state', models.CharField(choices=[('created', 'created'), ('pending', 'pending'), ('confirmed', 'confirmed'), ('canceled', 'canceled'), ('failed', 'failed'), ('refunded', 'refunded')], max_length=190)),
+                ('amount', models.DecimalField(decimal_places=2, max_digits=10, verbose_name='Amount')),
+                ('created', models.DateTimeField(auto_now_add=True)),
+                ('payment_date', models.DateTimeField(blank=True, null=True)),
+                ('provider', models.CharField(blank=True, max_length=255, null=True, verbose_name='Payment provider')),
+                ('info', models.TextField(blank=True, null=True, verbose_name='Payment information')),
+                ('migrated', models.BooleanField(default=False)),
+            ],
+            options={
+                'ordering': ('local_id',),
+            },
+        ),
+        migrations.CreateModel(
+            name='OrderRefund',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('local_id', models.PositiveIntegerField()),
+                ('state', models.CharField(choices=[('external', 'started externally'), ('created', 'created'), ('transit', 'in transit'), ('done', 'done'), ('failed', 'failed'), ('canceled', 'canceled')], max_length=190)),
+                ('source', models.CharField(choices=[('admin', 'Organizer'), ('buyer', 'Customer'), ('external', 'External')], max_length=190)),
+                ('amount', models.DecimalField(decimal_places=2, max_digits=10, verbose_name='Amount')),
+                ('created', models.DateTimeField(auto_now_add=True)),
+                ('execution_date', models.DateTimeField(blank=True, null=True)),
+                ('provider', models.CharField(blank=True, max_length=255, null=True, verbose_name='Payment provider')),
+                ('info', models.TextField(blank=True, null=True, verbose_name='Payment information')),
+                ('order', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='refunds', to='pretixbase.Order', verbose_name='Order')),
+                ('payment', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT, related_name='refunds', to='pretixbase.OrderPayment')),
+            ],
+            options={
+                'ordering': ('local_id',),
+            },
+        ),
+        migrations.AlterModelOptions(
+            name='quota',
+            options={'ordering': ('name',), 'verbose_name': 'Quota', 'verbose_name_plural': 'Quotas'},
+        ),
+        migrations.AlterField(
+            model_name='orderfee',
+            name='fee_type',
+            field=models.CharField(choices=[('payment', 'Payment fee'), ('shipping', 'Shipping fee'), ('service', 'Service fee'), ('other', 'Other fees'), ('giftcard', 'Gift card')], max_length=100),
+        ),
+        migrations.AlterField(
+            model_name='team',
+            name='can_change_organizer_settings',
+            field=models.BooleanField(default=False, help_text='Someone with this setting can get access to most data of all of your events, i.e. via privacy reports, so be careful who you add to this team!', verbose_name='Can change organizer settings'),
+        ),
+        migrations.AlterField(
+            model_name='user',
+            name='require_2fa',
+            field=models.BooleanField(default=False, verbose_name='Two-factor authentication is required to log in'),
+        ),
+        migrations.AddField(
+            model_name='orderpayment',
+            name='fee',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, related_name='payments', to='pretixbase.OrderFee'),
+        ),
+        migrations.AddField(
+            model_name='orderpayment',
+            name='order',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='payments', to='pretixbase.Order', verbose_name='Order'),
+        ),
+    ]

src/pretix/base/migrations/0097_auto_20180722_0804.py

@@ -0,0 +1,118 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.13 on 2018-07-22 08:04
+from __future__ import unicode_literals
+
+from django.db import migrations
+
+
+def create_payments(apps, schema_editor):
+    Order = apps.get_model('pretixbase', 'Order')  # noqa
+    OrderPayment = apps.get_model('pretixbase', 'OrderPayment')  # noqa
+    OrderRefund = apps.get_model('pretixbase', 'OrderRefund')  # noqa
+    payments = []
+    refunds = []
+    for o in Order.objects.filter(payments__isnull=True).iterator():
+        if o.status == 'n' or o.status == 'e':
+            payments.append(OrderPayment(
+                local_id=1,
+                state='created',
+                amount=o.total,
+                order=o,
+                provider=o.payment_provider,
+                info=o.payment_info,
+                migrated=True,
+                fee=o.fees.filter(fee_type="payment", internal_type=o.payment_provider).first(),
+            ))
+            pass
+        elif o.status == 'p':
+            payments.append(OrderPayment(
+                local_id=1,
+                state='confirmed',
+                amount=o.total,
+                order=o,
+                provider=o.payment_provider,
+                payment_date=o.payment_date,
+                info=o.payment_info,
+                migrated=True,
+                fee=o.fees.filter(fee_type="payment", internal_type=o.payment_provider).first(),
+            ))
+        elif o.status == 'r':
+            p = OrderPayment.objects.create(
+                local_id=1,
+                state='refunded',
+                amount=o.total,
+                order=o,
+                provider=o.payment_provider,
+                payment_date=o.payment_date,
+                info=o.payment_info,
+                migrated=True,
+                fee=o.fees.filter(fee_type="payment", internal_type=o.payment_provider).first(),
+            )
+            refunds.append(OrderRefund(
+                local_id=1,
+                state='done',
+                amount=o.total,
+                order=o,
+                provider=o.payment_provider,
+                info=o.payment_info,
+                source='admin',
+                payment=p
+            ))
+        elif o.status == 'c':
+            payments.append(OrderPayment(
+                local_id=1,
+                state='canceled',
+                amount=o.total,
+                order=o,
+                provider=o.payment_provider,
+                payment_date=o.payment_date,
+                info=o.payment_info,
+                migrated=True,
+                fee=o.fees.filter(fee_type="payment", internal_type=o.payment_provider).first(),
+            ))
+
+        if len(payments) > 500:
+            OrderPayment.objects.bulk_create(payments)
+            payments.clear()
+        if len(refunds) > 500:
+            OrderRefund.objects.bulk_create(refunds)
+            refunds.clear()
+    if len(payments) > 0:
+        OrderPayment.objects.bulk_create(payments)
+    if len(refunds) > 0:
+        OrderRefund.objects.bulk_create(refunds)
+
+
+def notifications(apps, schema_editor):
+    NotificationSetting = apps.get_model('pretixbase', 'NotificationSetting')
+    for n in NotificationSetting.objects.filter(action_type='pretix.event.action_required'):
+        n.pk = None
+        n.action_type = 'pretix.event.order.refund.created.externally'
+        n.save()
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('pretixbase', '0096_auto_20180722_0801'),
+    ]
+
+    operations = [
+        migrations.RunPython(create_payments, migrations.RunPython.noop),
+        migrations.RunPython(notifications, migrations.RunPython.noop),
+        migrations.RemoveField(
+            model_name='order',
+            name='payment_date',
+        ),
+        migrations.RemoveField(
+            model_name='order',
+            name='payment_info',
+        ),
+        migrations.RemoveField(
+            model_name='order',
+            name='payment_manual',
+        ),
+        migrations.RemoveField(
+            model_name='order',
+            name='payment_provider',
+        ),
+    ]

src/pretix/base/migrations/0098_auto_20180731_1243.py

@@ -0,0 +1,56 @@
+# Generated by Django 2.0.7 on 2018-07-31 12:43
+
+import django.core.validators
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+import pretix.base.validators
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0097_auto_20180722_0804'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='logentry',
+            options={'ordering': ('-datetime', '-id')},
+        ),
+        migrations.AlterField(
+            model_name='orderpayment',
+            name='fee',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='payments', to='pretixbase.OrderFee'),
+        ),
+        migrations.AlterField(
+            model_name='organizer',
+            name='slug',
+            field=models.SlugField(help_text='Should be short, only contain lowercase letters, numbers, dots, and dashes. Every slug can only be used once. This is being used in URLs to refer to your organizer accounts and your events.', unique=True, validators=[django.core.validators.RegexValidator(message='The slug may only contain letters, numbers, dots and dashes.', regex='^[a-zA-Z0-9.-]+$'), pretix.base.validators.OrganizerSlugBlacklistValidator()], verbose_name='Short form'),
+        ),
+        migrations.AlterField(
+            model_name='staffsession',
+            name='user',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, to=settings.AUTH_USER_MODEL),
+        ),
+        migrations.AlterField(
+            model_name='staffsessionauditlog',
+            name='impersonating',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT, to=settings.AUTH_USER_MODEL),
+        ),
+        migrations.AlterField(
+            model_name='staffsessionauditlog',
+            name='session',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='logs', to='pretixbase.StaffSession'),
+        ),
+        migrations.AlterField(
+            model_name='user',
+            name='locale',
+            field=models.CharField(choices=[('en', 'English'), ('de', 'German'), ('de-informal', 'German (informal)'), ('nl', 'Dutch'), ('da', 'Danish'), ('tr', 'Turkish'), ('pt-br', 'Portuguese (Brazil)')], default='en', max_length=50, verbose_name='Language'),
+        ),
+        migrations.AlterUniqueTogether(
+            name='event',
+            unique_together={('organizer', 'slug')},
+        ),
+    ]

src/pretix/base/migrations/0098_auto_20180731_1243_squashed_0100_item_require_approval.py

@@ -0,0 +1,82 @@
+# Generated by Django 2.0.8 on 2018-09-11 14:54
+
+import django.core.validators
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+import pretix.base.validators
+
+
+class Migration(migrations.Migration):
+
+    replaces = [('pretixbase', '0098_auto_20180731_1243'), ('pretixbase', '0099_auto_20180807_0841'), ('pretixbase', '0100_item_require_approval')]
+
+    dependencies = [
+        ('pretixbase', '0097_auto_20180722_0804'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='logentry',
+            options={'ordering': ('-datetime', '-id')},
+        ),
+        migrations.AlterField(
+            model_name='orderpayment',
+            name='fee',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='payments', to='pretixbase.OrderFee'),
+        ),
+        migrations.AlterField(
+            model_name='organizer',
+            name='slug',
+            field=models.SlugField(help_text='Should be short, only contain lowercase letters, numbers, dots, and dashes. Every slug can only be used once. This is being used in URLs to refer to your organizer accounts and your events.', unique=True, validators=[django.core.validators.RegexValidator(message='The slug may only contain letters, numbers, dots and dashes.', regex='^[a-zA-Z0-9.-]+$'), pretix.base.validators.OrganizerSlugBlacklistValidator()], verbose_name='Short form'),
+        ),
+        migrations.AlterField(
+            model_name='staffsession',
+            name='user',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, to=settings.AUTH_USER_MODEL),
+        ),
+        migrations.AlterField(
+            model_name='staffsessionauditlog',
+            name='impersonating',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT, to=settings.AUTH_USER_MODEL),
+        ),
+        migrations.AlterField(
+            model_name='staffsessionauditlog',
+            name='session',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='logs', to='pretixbase.StaffSession'),
+        ),
+        migrations.AlterField(
+            model_name='user',
+            name='locale',
+            field=models.CharField(choices=[('en', 'English'), ('de', 'German'), ('de-informal', 'German (informal)'), ('nl', 'Dutch'), ('da', 'Danish'), ('tr', 'Turkish'), ('pt-br', 'Portuguese (Brazil)')], default='en', max_length=50, verbose_name='Language'),
+        ),
+        migrations.AlterUniqueTogether(
+            name='event',
+            unique_together={('organizer', 'slug')},
+        ),
+        migrations.AlterModelOptions(
+            name='waitinglistentry',
+            options={'ordering': ('-priority', 'created'), 'verbose_name': 'Waiting list entry', 'verbose_name_plural': 'Waiting list entries'},
+        ),
+        migrations.AddField(
+            model_name='waitinglistentry',
+            name='priority',
+            field=models.IntegerField(default=0),
+        ),
+        migrations.AlterField(
+            model_name='waitinglistentry',
+            name='voucher',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, related_name='waitinglistentries', to='pretixbase.Voucher', verbose_name='Assigned voucher'),
+        ),
+        migrations.AddField(
+            model_name='item',
+            name='require_approval',
+            field=models.BooleanField(default=False, help_text='If this product is part of an order, the order will be put into an "approval" state and will need to be confirmed by you before it can be paid and completed. You can use this e.g. for discounted tickets that are only available to specific groups.', verbose_name='Buying this product requires approval.'),
+        ),
+        migrations.AddField(
+            model_name='order',
+            name='require_approval',
+            field=models.BooleanField(default=False),
+        ),
+    ]

src/pretix/base/migrations/0099_auto_20180807_0841.py

@@ -0,0 +1,28 @@
+# Generated by Django 2.1 on 2018-08-07 08:41
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0098_auto_20180731_1243'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='waitinglistentry',
+            options={'ordering': ('-priority', 'created'), 'verbose_name': 'Waiting list entry', 'verbose_name_plural': 'Waiting list entries'},
+        ),
+        migrations.AddField(
+            model_name='waitinglistentry',
+            name='priority',
+            field=models.IntegerField(default=0),
+        ),
+        migrations.AlterField(
+            model_name='waitinglistentry',
+            name='voucher',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, related_name='waitinglistentries', to='pretixbase.Voucher', verbose_name='Assigned voucher'),
+        ),
+    ]

src/pretix/base/migrations/0099_auto_20180912_1035.py

@@ -0,0 +1,45 @@
+# Generated by Django 2.1 on 2018-09-12 10:35
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+import pretix.base.models.devices
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0098_auto_20180731_1243_squashed_0100_item_require_approval'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Device',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('device_id', models.PositiveIntegerField()),
+                ('unique_serial', models.CharField(default=pretix.base.models.devices.generate_serial, max_length=190, unique=True)),
+                ('initialization_token', models.CharField(default=pretix.base.models.devices.generate_initialization_token, max_length=190, unique=True)),
+                ('api_token', models.CharField(max_length=190, null=True, unique=True)),
+                ('all_events', models.BooleanField(default=False, verbose_name='All events (including newly created ones)')),
+                ('name', models.CharField(max_length=190, verbose_name='Name')),
+                ('created', models.DateTimeField(auto_now_add=True, verbose_name='Setup date')),
+                ('initialized', models.DateTimeField(null=True, verbose_name='Initialization date')),
+                ('hardware_brand', models.CharField(blank=True, max_length=190, null=True)),
+                ('hardware_model', models.CharField(blank=True, max_length=190, null=True)),
+                ('software_brand', models.CharField(blank=True, max_length=190, null=True)),
+                ('software_version', models.CharField(blank=True, max_length=190, null=True)),
+                ('limit_events', models.ManyToManyField(blank=True, to='pretixbase.Event', verbose_name='Limit to events')),
+                ('organizer', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='devices', to='pretixbase.Organizer')),
+            ],
+        ),
+        migrations.AlterUniqueTogether(
+            name='device',
+            unique_together={('organizer', 'device_id')},
+        ),
+        migrations.AddField(
+            model_name='logentry',
+            name='device',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT, to='pretixbase.Device'),
+        ),
+    ]

src/pretix/base/migrations/0100_item_require_approval.py

@@ -0,0 +1,23 @@
+# Generated by Django 2.1 on 2018-08-09 15:17
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0099_auto_20180807_0841'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='item',
+            name='require_approval',
+            field=models.BooleanField(default=False, help_text='If this product is part of an order, the order will be put into an "approval" state and will need to be confirmed by you before it can be paid and completed. You can use this e.g. for discounted tickets that are only available to specific groups.', verbose_name='Buying this product requires approval.'),
+        ),
+        migrations.AddField(
+            model_name='order',
+            name='require_approval',
+            field=models.BooleanField(default=False),
+        ),
+    ]

src/pretix/base/models/__init__.py

@@ -2,6 +2,7 @@ from ..settings import GlobalSettingsObject_SettingsStore
 from .auth import U2FDevice, User
 from .base import CachedFile, LoggedModel, cachedfile_name
 from .checkin import Checkin, CheckinList
+from .devices import Device
 from .event import (
     Event, Event_SettingsStore, EventLock, EventMetaProperty, EventMetaValue,
     RequiredAction, SubEvent, SubEventMetaValue, generate_invite_token,
@@ -15,9 +16,9 @@ from .log import LogEntry
 from .notifications import NotificationSetting
 from .orders import (
     AbstractPosition, CachedCombinedTicket, CachedTicket, CartPosition,
-    InvoiceAddress, Order, OrderPosition, QuestionAnswer,
-    cachedcombinedticket_name, cachedticket_name, generate_position_secret,
-    generate_secret,
+    InvoiceAddress, Order, OrderFee, OrderPayment, OrderPosition, OrderRefund,
+    QuestionAnswer, cachedcombinedticket_name, cachedticket_name,
+    generate_position_secret, generate_secret,
 )
 from .organizer import (
     Organizer, Organizer_SettingsStore, Team, TeamAPIToken, TeamInvite,

src/pretix/base/models/auth.py

@@ -25,13 +25,13 @@ class UserManager(BaseUserManager):
     model documentation to see what's so special about our user model.
     """
 
-    def create_user(self, email: str, password: str=None, **kwargs):
+    def create_user(self, email: str, password: str = None, **kwargs):
         user = self.model(email=email, **kwargs)
         user.set_password(password)
         user.save()
         return user
 
-    def create_superuser(self, email: str, password: str=None):  # NOQA
+    def create_superuser(self, email: str, password: str = None):  # NOQA
         # Not used in the software but required by Django
         if password is None:
             raise Exception("You must provide a password")
@@ -93,7 +93,7 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
                                 verbose_name=_('Timezone'))
     require_2fa = models.BooleanField(
         default=False,
-        verbose_name=_('Two-factor authentification is required to log in')
+        verbose_name=_('Two-factor authentication is required to log in')
     )
     notifications_send = models.BooleanField(
         default=True,
@@ -340,7 +340,7 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
 
 
 class StaffSession(models.Model):
-    user = models.ForeignKey('User')
+    user = models.ForeignKey('User', on_delete=models.PROTECT)
     date_start = models.DateTimeField(auto_now_add=True)
     date_end = models.DateTimeField(null=True, blank=True)
     session_key = models.CharField(max_length=255)
@@ -351,11 +351,11 @@ class StaffSession(models.Model):
 
 
 class StaffSessionAuditLog(models.Model):
-    session = models.ForeignKey('StaffSession', related_name='logs')
+    session = models.ForeignKey('StaffSession', related_name='logs', on_delete=models.PROTECT)
     datetime = models.DateTimeField(auto_now_add=True)
     url = models.CharField(max_length=255)
     method = models.CharField(max_length=255)
-    impersonating = models.ForeignKey('User', null=True, blank=True)
+    impersonating = models.ForeignKey('User', null=True, blank=True, on_delete=models.PROTECT)
 
     class Meta:
         ordering = ('datetime',)

src/pretix/base/models/base.py

@@ -36,7 +36,7 @@ def cached_file_delete(sender, instance, **kwargs):
 
 class LoggingMixin:
 
-    def log_action(self, action, data=None, user=None, api_token=None, save=True):
+    def log_action(self, action, data=None, user=None, api_token=None, auth=None, save=True):
         """
         Create a LogEntry object that is related to this object.
         See the LogEntry documentation for details.
@@ -47,6 +47,9 @@ class LoggingMixin:
         """
         from .log import LogEntry
         from .event import Event
+        from .devices import Device
+        from pretix.api.models import OAuthAccessToken, OAuthApplication
+        from .organizer import TeamAPIToken
         from ..notifications import get_all_notification_types
         from ..services.notifications import notify
 
@@ -57,7 +60,20 @@ class LoggingMixin:
             event = self.event
         if user and not user.is_authenticated:
             user = None
-        logentry = LogEntry(content_object=self, user=user, action_type=action, event=event, api_token=api_token)
+
+        kwargs = {}
+        if isinstance(auth, OAuthAccessToken):
+            kwargs['oauth_application'] = auth.application
+        elif isinstance(auth, OAuthApplication):
+            kwargs['oauth_application'] = auth
+        elif isinstance(auth, TeamAPIToken):
+            kwargs['api_token'] = auth
+        elif isinstance(auth, Device):
+            kwargs['device'] = auth
+        elif isinstance(api_token, TeamAPIToken):
+            kwargs['api_token'] = api_token
+
+        logentry = LogEntry(content_object=self, user=user, action_type=action, event=event, **kwargs)
         if data:
             logentry.data = json.dumps(data, cls=CustomJSONEncoder)
         if save:
@@ -83,4 +99,4 @@ class LoggedModel(models.Model, LoggingMixin):
 
         return LogEntry.objects.filter(
             content_type=ContentType.objects.get_for_model(type(self)), object_id=self.pk
-        ).select_related('user', 'event')
+        ).select_related('user', 'event', 'oauth_application', 'api_token', 'device')

src/pretix/base/models/checkin.py

@@ -8,12 +8,12 @@ from pretix.base.models import LoggedModel
 
 
 class CheckinList(LoggedModel):
-    event = models.ForeignKey('Event', related_name='checkin_lists')
+    event = models.ForeignKey('Event', related_name='checkin_lists', on_delete=models.CASCADE)
     name = models.CharField(max_length=190)
     all_products = models.BooleanField(default=True, verbose_name=_("All products (including newly created ones)"))
     limit_products = models.ManyToManyField('Item', verbose_name=_("Limit to products"), blank=True)
     subevent = models.ForeignKey('SubEvent', null=True, blank=True,
-                                 verbose_name=pgettext_lazy('subevent', 'Date'))
+                                 verbose_name=pgettext_lazy('subevent', 'Date'), on_delete=models.CASCADE)
     include_pending = models.BooleanField(verbose_name=pgettext_lazy('checkin', 'Include pending orders'),
                                           default=False,
                                           help_text=_('With this option, people will be able to check in even if the '
@@ -157,7 +157,7 @@ class Checkin(models.Model):
     """
     A check-in object is created when a person enters the event.
     """
-    position = models.ForeignKey('pretixbase.OrderPosition', related_name='checkins')
+    position = models.ForeignKey('pretixbase.OrderPosition', related_name='checkins', on_delete=models.CASCADE)
     datetime = models.DateTimeField(default=now)
     nonce = models.CharField(max_length=190, null=True, blank=True)
     list = models.ForeignKey(
@@ -168,3 +168,11 @@ class Checkin(models.Model):
         return "<Checkin: pos {} on list '{}' at {}>".format(
             self.position, self.list, self.datetime
         )
+
+    def save(self, **kwargs):
+        self.position.order.touch()
+        super().save(**kwargs)
+
+    def delete(self, **kwargs):
+        self.position.order.touch()
+        super().delete(**kwargs)