Refs #654 -- REST API: Allow to cycle order secrets

src/pretix/api/views/order.py

@@ -29,6 +29,7 @@ from pretix.api.serializers.order import (
 from pretix.base.models import (
     CachedCombinedTicket, CachedTicket, Device, Event, Invoice, Order,
     OrderPayment, OrderPosition, OrderRefund, Quota, TeamAPIToken,
+    generate_position_secret, generate_secret,
 )
 from pretix.base.payment import PaymentException
 from pretix.base.services.invoices import (
@@ -341,6 +342,24 @@ class OrderViewSet(viewsets.ModelViewSet):
             status=status.HTTP_201_CREATED
         )
 
+    @detail_route(methods=['POST'])
+    @transaction.atomic
+    def regenerate_secrets(self, request, **kwargs):
+        order = self.get_object()
+        order.secret = generate_secret()
+        for op in order.all_positions.all():
+            op.secret = generate_position_secret()
+            op.save()
+        order.save(update_fields=['secret'])
+        CachedTicket.objects.filter(order_position__order=order).delete()
+        CachedCombinedTicket.objects.filter(order=order).delete()
+        order.log_action(
+            'pretix.event.order.secret.changed',
+            user=self.request.user,
+            auth=self.request.auth,
+        )
+        return self.retrieve(request, [], **kwargs)
+
     @detail_route(methods=['POST'])
     def extend(self, request, **kwargs):
         new_date = request.data.get('expires', None)

src/tests/api/test_orders.py

@@ -2688,3 +2688,18 @@ def test_order_create_invoice(token_client, organizer, event, order):
     )
     assert resp.status_code == 400
     assert resp.data == {'detail': 'You cannot generate an invoice for this order.'}
+
+
+@pytest.mark.django_db
+def test_order_regenerate_secrets(token_client, organizer, event, order):
+    s = order.secret
+    ps = order.positions.first().secret
+    resp = token_client.post(
+        '/api/v1/organizers/{}/events/{}/orders/{}/regenerate_secrets/'.format(
+            organizer.slug, event.slug, order.code
+        ), format='json', data={}
+    )
+    assert resp.status_code == 200
+    order.refresh_from_db()
+    assert s != order.secret
+    assert ps != order.positions.first().secret