Approvals

src/pretix/control/forms/event.py

@@ -784,6 +784,34 @@ class MailSettingsForm(SettingsForm):
         help_text=_("This email will be sent out this many days before the order event starts. If the "
                     "field is empty, the mail will never be sent.")
     )
+    mail_text_order_placed_require_approval = I18nFormField(
+        label=_("Received order"),
+        required=False,
+        widget=I18nTextarea,
+        help_text=_("Available placeholders: {event}, {total_with_currency}, {total}, {currency}, {date}, "
+                    "{url}, {invoice_name}, {invoice_company}"),
+        validators=[PlaceholderValidator(['{event}', '{total_with_currency}', '{total}', '{currency}', '{date}',
+                                          '{url}', '{invoice_name}', '{invoice_company}'])]
+    )
+    mail_text_order_approved = I18nFormField(
+        label=_("Approved order"),
+        required=False,
+        widget=I18nTextarea,
+        help_text=_("This will only be sent out for non-free orders. Free orders will receive the free order "
+                    "template from above instead. Available placeholders: {event}, {total_with_currency}, {total}, "
+                    "{currency}, {date}, {payment_info}, {url}, {invoice_name}, {invoice_company}"),
+        validators=[PlaceholderValidator(['{event}', '{total_with_currency}', '{total}', '{currency}', '{date}',
+                                          '{url}', '{invoice_name}', '{invoice_company}'])]
+    )
+    mail_text_order_denied = I18nFormField(
+        label=_("Denied order"),
+        required=False,
+        widget=I18nTextarea,
+        help_text=_("Available placeholders: {event}, {total_with_currency}, {total}, {currency}, {date}, "
+                    "{comment}, {url}, {invoice_name}, {invoice_company}"),
+        validators=[PlaceholderValidator(['{event}', '{total_with_currency}', '{total}', '{currency}', '{date}',
+                                          '{comment}', '{url}', '{invoice_name}', '{invoice_company}'])]
+    )
     smtp_use_custom = forms.BooleanField(
         label=_("Use custom SMTP server"),
         help_text=_("All mail related to your event will be sent over the smtp server specified by you."),

src/pretix/control/forms/filter.py

@@ -206,6 +206,7 @@ class EventOrderFilterForm(OrderFilterForm):
             ('ne', _('Pending or expired')),
             ('c', _('Canceled')),
             ('r', _('Refunded')),
+            ('pa', _('Approval pending')),
             ('overpaid', _('Overpaid')),
             ('underpaid', _('Underpaid')),
         ),
@@ -275,13 +276,20 @@ class EventOrderFilterForm(OrderFilterForm):
             qs = qs.filter(
                 Q(~Q(status__in=(Order.STATUS_REFUNDED, Order.STATUS_CANCELED)) & Q(pending_sum_t__lt=0))
                 | Q(Q(status__in=(Order.STATUS_REFUNDED, Order.STATUS_CANCELED)) & Q(pending_sum_rc__lt=0))
-                | Q(Q(status__in=(Order.STATUS_EXPIRED, Order.STATUS_PENDING)) & Q(pending_sum_t__lte=0))
+                | Q(Q(status__in=(Order.STATUS_EXPIRED, Order.STATUS_PENDING)) & Q(pending_sum_t__lt=0))
+                | Q(Q(status__in=(Order.STATUS_EXPIRED, Order.STATUS_PENDING)) & Q(pending_sum_t__lte=0)
+                    & Q(require_approval=False))
             )
         elif fdata.get('status') == 'underpaid':
             qs = qs.filter(
                 status=Order.STATUS_PAID,
                 pending_sum_t__gt=0
             )
+        elif fdata.get('status') == 'pa':
+            qs = qs.filter(
+                status=Order.STATUS_PENDING,
+                require_approval=True
+            )
 
         return qs
 

src/pretix/control/logdisplay.py

@@ -165,6 +165,8 @@ def pretixcontrol_logentry_display(sender: Event, logentry: LogEntry, **kwargs):
         'pretix.event.order.refunded': _('The order has been refunded.'),
         'pretix.event.order.canceled': _('The order has been canceled.'),
         'pretix.event.order.placed': _('The order has been created.'),
+        'pretix.event.order.approved': _('The order has been approved.'),
+        'pretix.event.order.denied': _('The order has been denied.'),
         'pretix.event.order.contact.changed': _('The email address has been changed from "{old_email}" '
                                                 'to "{new_email}".'),
         'pretix.event.order.locale.changed': _('The order locale has been changed.'),
@@ -185,7 +187,13 @@ def pretixcontrol_logentry_display(sender: Event, logentry: LogEntry, **kwargs):
         'pretix.event.order.email.order_changed': _('An email has been sent to notify the user that the order has been changed.'),
         'pretix.event.order.email.order_free': _('An email has been sent to notify the user that the order has been received.'),
         'pretix.event.order.email.order_paid': _('An email has been sent to notify the user that payment has been received.'),
+        'pretix.event.order.email.order_denied': _('An email has been sent to notify the user that the order has been denied.'),
+        'pretix.event.order.email.order_approved': _('An email has been sent to notify the user that the order has '
+                                                     'been approved.'),
         'pretix.event.order.email.order_placed': _('An email has been sent to notify the user that the order has been received and requires payment.'),
+        'pretix.event.order.email.order_placed_require_approval': _('An email has been sent to notify the user that '
+                                                                    'the order has been received and requires '
+                                                                    'approval.'),
         'pretix.event.order.email.resend': _('An email with a link to the order detail page has been resent to the user.'),
         'pretix.event.order.payment.confirmed': _('Payment {local_id} has been confirmed.'),
         'pretix.event.order.payment.canceled': _('Payment {local_id} has been canceled.'),

src/pretix/control/templates/pretixcontrol/event/index.html

@@ -34,6 +34,15 @@
                     class="btn btn-primary">{% trans "Show pending refunds" %}</a>
         </div>
     {% endif %}
+    {% if has_pending_approvals %}
+        <div class="alert alert-warning">
+            {% blocktrans trimmed %}
+                This event contains <strong>pending approvals</strong> that you should take care of.
+            {% endblocktrans %}
+            <a href="{% url "control:event.orders" event=request.event.slug organizer=request.event.organizer.slug %}?status=pa"
+                    class="btn btn-primary">{% trans "Show orders pending approval" %}</a>
+        </div>
+    {% endif %}
     {% if actions|length > 0 %}
         <div class="panel panel-danger">
             <div class="panel-heading">

src/pretix/control/templates/pretixcontrol/event/mail.html

@@ -45,6 +45,9 @@
 
                 {% blocktrans asvar title_download_tickets_reminder %}Reminder to download tickets{% endblocktrans %}
                 {% include "pretixcontrol/event/mail_settings_fragment.html" with pid="ticket_reminder" title=title_download_tickets_reminder items="mail_days_download_reminder,mail_text_download_reminder" exclude="mail_days_download_reminder" %}
+
+                {% blocktrans asvar title_require_approval %}Order approval process{% endblocktrans %}
+                {% include "pretixcontrol/event/mail_settings_fragment.html" with pid="ticket_reminder" title=title_require_approval  items="mail_text_order_placed_require_approval,mail_text_order_approved,mail_text_order_denied" %}
             </div>
         </fieldset>
         <fieldset>

src/pretix/control/templates/pretixcontrol/order/approve.html

@@ -0,0 +1,31 @@
+{% extends "pretixcontrol/event/base.html" %}
+{% load i18n %}
+{% block title %}
+    {% trans "Approve order" %}
+{% endblock %}
+{% block content %}
+    <h1>
+        {% trans "Approve order" %}
+    </h1>
+    <p>{% blocktrans trimmed %}
+        Do you really want to approve this order?
+    {% endblocktrans %}</p>
+
+    <form method="post" href="">
+        {% csrf_token %}
+        <div class="row checkout-button-row">
+            <div class="col-md-4">
+                <a class="btn btn-block btn-default btn-lg"
+                        href="{% url "control:event.order" event=request.event.slug organizer=request.event.organizer.slug code=order.code %}">
+                    {% trans "No, take me back" %}
+                </a>
+            </div>
+            <div class="col-md-4 col-md-offset-4">
+                <button class="btn btn-block btn-primary btn-lg" type="submit">
+                    {% trans "Yes, approve order" %}
+                </button>
+            </div>
+            <div class="clearfix"></div>
+        </div>
+    </form>
+{% endblock %}

src/pretix/control/templates/pretixcontrol/order/deny.html

@@ -0,0 +1,41 @@
+{% extends "pretixcontrol/event/base.html" %}
+{% load i18n %}
+{% block title %}
+    {% trans "Deny order" %}
+{% endblock %}
+{% block content %}
+    <h1>
+        {% trans "Deny order" %}
+    </h1>
+    <p>{% blocktrans trimmed %}
+        Do you really want to cancel this order? You cannot revert this action.
+    {% endblocktrans %}</p>
+
+    <form method="post" href="">
+        {% csrf_token %}
+        <div class="checkbox">
+            <label>
+                <input type="checkbox" name="send_email" value="on" checked="checked">
+                {% trans "Notify user by e-mail" %}
+            </label>
+        </div>
+        <p>
+            <label>{% trans "Comment (will be sent to the user)" %}</label>
+            <textarea name="comment" class="form-control" rows="5"></textarea>
+        </p>
+        <div class="row checkout-button-row">
+            <div class="col-md-4">
+                <a class="btn btn-block btn-default btn-lg"
+                        href="{% url "control:event.order" event=request.event.slug organizer=request.event.organizer.slug code=order.code %}">
+                    {% trans "No, take me back" %}
+                </a>
+            </div>
+            <div class="col-md-4 col-md-offset-4">
+                <button class="btn btn-block btn-danger btn-lg" type="submit">
+                    {% trans "Yes, deny order" %}
+                </button>
+            </div>
+            <div class="clearfix"></div>
+        </div>
+    </form>
+{% endblock %}

src/pretix/control/templates/pretixcontrol/order/index.html

@@ -24,27 +24,40 @@
             {% csrf_token %}
             <div class="btn-toolbar" role="toolbar">
                 <div class="btn-group" role="group">
-                    {% if order.status == 'n' or order.status == 'e' %}
-                        <a href="{% url "control:event.order.transition" event=request.event.slug organizer=request.event.organizer.slug code=order.code %}?status=p"
-                                class="btn {% if overpaid >= 0 %}btn-primary{% else %}btn-default{% endif %}">
-                            {% trans "Mark as paid" %}
+                    {% if order.require_approval and order.status == 'n' %}
+                        <a href="{% url "control:event.order.approve" event=request.event.slug organizer=request.event.organizer.slug code=order.code %}"
+                                class="btn btn-primary">
+                            <span class="fa fa-thumbs-up"></span>
+                            {% trans "Approve" %}
                         </a>
-                        <a href="{% url "control:event.order.extend" event=request.event.slug organizer=request.event.organizer.slug code=order.code %}" class="btn btn-default">
-                            {% trans "Extend payment term" %}
-                        </a>
-                    {% endif %}
-                    {% if order.cancel_allowed %}
-                        <a href="{% url "control:event.order.transition" event=request.event.slug organizer=request.event.organizer.slug code=order.code %}?status=c" class="btn btn-default">
-                            {% trans "Cancel order" %}
-                        </a>
-                    {% endif %}
-                    {% if order.status == 'p' %}
-                        <button name="status" value="n" class="btn btn-default">{% trans "Mark as not paid" %}</button>
-                    {% endif %}
-                    {% if overpaid|add:order.total != 0 %}
-                        <a href="{% url "control:event.order.refunds.start" event=request.event.slug organizer=request.event.organizer.slug code=order.code %}" class="btn btn-default">
-                            {% trans "Create a refund" %}
+                        <a href="{% url "control:event.order.deny" event=request.event.slug organizer=request.event.organizer.slug code=order.code %}"
+                                class="btn btn-danger">
+                            <span class="fa fa-thumbs-down"></span>
+                            {% trans "Deny" %}
                         </a>
+                    {% else %}
+                        {% if order.status == 'n' or order.status == 'e' %}
+                            <a href="{% url "control:event.order.transition" event=request.event.slug organizer=request.event.organizer.slug code=order.code %}?status=p"
+                                    class="btn {% if overpaid >= 0 %}btn-primary{% else %}btn-default{% endif %}">
+                                {% trans "Mark as paid" %}
+                            </a>
+                            <a href="{% url "control:event.order.extend" event=request.event.slug organizer=request.event.organizer.slug code=order.code %}" class="btn btn-default">
+                                {% trans "Extend payment term" %}
+                            </a>
+                        {% endif %}
+                        {% if order.cancel_allowed %}
+                            <a href="{% url "control:event.order.transition" event=request.event.slug organizer=request.event.organizer.slug code=order.code %}?status=c" class="btn btn-default">
+                                {% trans "Cancel order" %}
+                            </a>
+                        {% endif %}
+                        {% if order.status == 'p' %}
+                            <button name="status" value="n" class="btn btn-default">{% trans "Mark as not paid" %}</button>
+                        {% endif %}
+                        {% if overpaid|add:order.total != 0 %}
+                            <a href="{% url "control:event.order.refunds.start" event=request.event.slug organizer=request.event.organizer.slug code=order.code %}" class="btn btn-default">
+                                {% trans "Create a refund" %}
+                            </a>
+                        {% endif %}
                     {% endif %}
 
                     <a href="{% eventurl request.event "presale:event.order" order=order.code secret=order.secret %}"

src/pretix/control/templates/pretixcontrol/orders/fragment_order_status.html

@@ -1,7 +1,11 @@
 {% load i18n %}
 {% load bootstrap3 %}
 {% if order.status == "n" %}
-    <span class="label label-warning {{ class }}">{% trans "Pending" %}</span>
+    {% if order.require_approval %}
+        <span class="label label-warning {{ class }}">{% trans "Approval pending" %}</span>
+    {% else %}
+        <span class="label label-warning {{ class }}">{% trans "Pending" %}</span>
+    {% endif %}
 {% elif order.status == "p" %}
     <span class="label label-success {{ class }}">{% trans "Paid" %}</span>
 {% elif order.status == "e" %} {# expired #}

src/pretix/control/urls.py

@@ -192,6 +192,10 @@ urlpatterns = [
             name='event.order.comment'),
         url(r'^orders/(?P<code>[0-9A-Z]+)/change$', orders.OrderChange.as_view(),
             name='event.order.change'),
+        url(r'^orders/(?P<code>[0-9A-Z]+)/approve', orders.OrderApprove.as_view(),
+            name='event.order.approve'),
+        url(r'^orders/(?P<code>[0-9A-Z]+)/deny$', orders.OrderDeny.as_view(),
+            name='event.order.deny'),
         url(r'^orders/(?P<code>[0-9A-Z]+)/info', orders.OrderModifyInformation.as_view(),
             name='event.order.info'),
         url(r'^orders/(?P<code>[0-9A-Z]+)/sendmail$', orders.OrderSendMail.as_view(),

src/pretix/control/views/dashboards.py

@@ -269,12 +269,18 @@ def event_index(request, organizer, event):
     ctx['has_overpaid_orders'] = Order.annotate_overpayments(request.event.orders).filter(
         Q(~Q(status__in=(Order.STATUS_REFUNDED, Order.STATUS_CANCELED)) & Q(pending_sum_t__lt=0))
         | Q(Q(status__in=(Order.STATUS_REFUNDED, Order.STATUS_CANCELED)) & Q(pending_sum_rc__lt=0))
-        | Q(Q(status__in=(Order.STATUS_EXPIRED, Order.STATUS_PENDING)) & Q(pending_sum_t__lte=0))
+        | Q(Q(status__in=(Order.STATUS_EXPIRED, Order.STATUS_PENDING)) & Q(pending_sum_t__lt=0))
+        | Q(Q(status__in=(Order.STATUS_EXPIRED, Order.STATUS_PENDING)) & Q(pending_sum_t__lte=0)
+            & Q(require_approval=False))
     ).exists()
     ctx['has_pending_refunds'] = OrderRefund.objects.filter(
         order__event=request.event,
         state__in=(OrderRefund.REFUND_STATE_CREATED, OrderRefund.REFUND_STATE_EXTERNAL)
-    )
+    ).exists()
+    ctx['has_pending_approvals'] = request.event.orders.filter(
+        status=Order.STATUS_PENDING,
+        require_approval=True
+    ).exists()
 
     for a in ctx['actions']:
         a.display = a.display(request)

src/pretix/control/views/event.py

@@ -541,7 +541,13 @@ class MailSettingsPreview(EventPermissionRequiredMixin, View):
             'mail_text_order_canceled': ['code', 'event', 'url'],
             'mail_text_order_custom_mail': ['expire_date', 'event', 'code', 'date', 'url',
                                             'invoice_name', 'invoice_company'],
-            'mail_text_download_reminder': ['event', 'url']
+            'mail_text_download_reminder': ['event', 'url'],
+            'mail_text_order_placed_require_approval': ['total', 'currency', 'date', 'invoice_company',
+                                                        'total_with_currency', 'event', 'url', 'invoice_name'],
+            'mail_text_order_approved': ['total', 'currency', 'date', 'invoice_company',
+                                         'total_with_currency', 'event', 'url', 'invoice_name'],
+            'mail_text_order_denied': ['total', 'currency', 'date', 'invoice_company',
+                                       'total_with_currency', 'event', 'url', 'invoice_name'],
         }
 
     @cached_property
@@ -566,6 +572,7 @@ class MailSettingsPreview(EventPermissionRequiredMixin, View):
             'code': '68CYU2H6ZTP3WLK5',
             'invoice_name': _('John Doe'),
             'invoice_company': _('Sample Corporation'),
+            'common': _('An individial text with a reason can be inserted here.'),
             'payment_info': _('Please transfer money to this bank account: 9999-9999-9999-9999')
         }
 

src/pretix/control/views/orders.py

@@ -44,8 +44,8 @@ from pretix.base.services.invoices import (
 from pretix.base.services.locking import LockTimeoutException
 from pretix.base.services.mail import SendMailException, render_mail
 from pretix.base.services.orders import (
-    OrderChangeManager, OrderError, cancel_order, extend_order,
-    mark_order_expired, mark_order_refunded,
+    OrderChangeManager, OrderError, approve_order, cancel_order, deny_order,
+    extend_order, mark_order_expired, mark_order_refunded,
 )
 from pretix.base.services.stats import order_overview
 from pretix.base.signals import register_data_exporters
@@ -228,6 +228,46 @@ class OrderComment(OrderView):
         return HttpResponseNotAllowed(['POST'])
 
 
+class OrderApprove(OrderView):
+    permission = 'can_change_orders'
+
+    def post(self, *args, **kwargs):
+        if self.order.require_approval:
+            try:
+                approve_order(self.order, user=self.request.user)
+            except OrderError as e:
+                messages.error(self.request, str(e))
+            else:
+                messages.success(self.request, _('The order has been approved.'))
+        return redirect(self.get_order_url())
+
+    def get(self, *args, **kwargs):
+        return render(self.request, 'pretixcontrol/order/approve.html', {
+            'order': self.order,
+        })
+
+
+class OrderDeny(OrderView):
+    permission = 'can_change_orders'
+
+    def post(self, *args, **kwargs):
+        if self.order.require_approval:
+            try:
+                deny_order(self.order, user=self.request.user,
+                           comment=self.request.POST.get('comment'),
+                           send_mail=self.request.POST.get('send_email') == 'on')
+            except OrderError as e:
+                messages.error(self.request, str(e))
+            else:
+                messages.success(self.request, _('The order has been denied and is therefore now canceled.'))
+        return redirect(self.get_order_url())
+
+    def get(self, *args, **kwargs):
+        return render(self.request, 'pretixcontrol/order/deny.html', {
+            'order': self.order,
+        })
+
+
 class OrderPaymentCancel(OrderView):
     permission = 'can_change_orders'