Implement OAuth2 provider (#927)

- [x] Application management - [x] Link - [ ] Tests - [x] Authorize flow - [x] Tests - [x] Refresh token handling - [x] Tests - [x] Revocation endpoint - [x] Tests - [x] Mitigate: https://github.com/jazzband/django-oauth-toolkit/issues/585 - [x] API authenticator / permission driver - [x] Test - [x] Enforce organizer restriction - [x] Tests - [x] Enforce scope restriction - [x] Tests - [x] Show current applications to user - [x] Revoke - [x] Tests - [x] Log new authorizations - [x] notify user - [x] Ensure other grant types are not available - [x] Documentation - [x] check if revoking access toking, then refreshing gets rid of organizer constraint - [x] Show logentry foo
2026-08-21 12:36:26 +00:00 · 2018-06-05 12:58:04 +02:00
parent df031b2222
commit 69d10489b8
53 changed files with 1786 additions and 116 deletions
@@ -16,7 +16,6 @@ from pretix.api.serializers.order import OrderPositionSerializer
 from pretix.api.views import RichOrderingFilter
 from pretix.api.views.order import OrderPositionFilter
 from pretix.base.models import Checkin, CheckinList, Order, OrderPosition
-from pretix.base.models.organizer import TeamAPIToken
 from pretix.base.services.checkin import (
    CheckInError, RequiredQuestionsError, perform_checkin,
 )
@@ -49,7 +48,7 @@ class CheckinListViewSet(viewsets.ModelViewSet):
        serializer.instance.log_action(
            'pretix.event.checkinlist.added',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=self.request.data
        )

@@ -63,7 +62,7 @@ class CheckinListViewSet(viewsets.ModelViewSet):
        serializer.instance.log_action(
            'pretix.event.checkinlist.changed',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=self.request.data
        )

@@ -71,7 +70,7 @@ class CheckinListViewSet(viewsets.ModelViewSet):
        instance.log_action(
            'pretix.event.checkinlist.deleted',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
        )
        super().perform_destroy(instance)

@@ -12,7 +12,6 @@ from pretix.api.serializers.event import (
 from pretix.api.views import ConditionalListView
 from pretix.base.models import Event, ItemCategory, TaxRule
 from pretix.base.models.event import SubEvent
-from pretix.base.models.organizer import TeamAPIToken
 from pretix.helpers.dicts import merge_dicts


@@ -39,7 +38,7 @@ class EventViewSet(viewsets.ModelViewSet):
            serializer.instance.log_action(
                log_action,
                user=self.request.user,
-                api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                auth=self.request.auth,
                data=self.request.data
            )

@@ -52,7 +51,7 @@ class EventViewSet(viewsets.ModelViewSet):
                serializer.instance.log_action(
                    'pretix.event.plugins.' + action,
                    user=self.request.user,
-                    api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                    auth=self.request.auth,
                    data={'plugin': module}
                )

@@ -61,7 +60,7 @@ class EventViewSet(viewsets.ModelViewSet):
            serializer.instance.log_action(
                'pretix.event.changed',
                user=self.request.user,
-                api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                auth=self.request.auth,
                data=self.request.data
            )

@@ -70,7 +69,7 @@ class EventViewSet(viewsets.ModelViewSet):
        serializer.instance.log_action(
            'pretix.event.added',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=self.request.data
        )

@@ -115,7 +114,7 @@ class CloneEventViewSet(viewsets.ModelViewSet):
        serializer.instance.log_action(
            'pretix.event.added',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=self.request.data
        )

@@ -151,7 +150,7 @@ class TaxRuleViewSet(ConditionalListView, viewsets.ModelViewSet):
        serializer.instance.log_action(
            'pretix.event.taxrule.changed',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=self.request.data
        )

@@ -160,7 +159,7 @@ class TaxRuleViewSet(ConditionalListView, viewsets.ModelViewSet):
        serializer.instance.log_action(
            'pretix.event.taxrule.added',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=self.request.data
        )

@@ -171,6 +170,6 @@ class TaxRuleViewSet(ConditionalListView, viewsets.ModelViewSet):
        instance.log_action(
            'pretix.event.taxrule.deleted',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
        )
        super().perform_destroy(instance)
@@ -18,7 +18,6 @@ from pretix.base.models import (
    Item, ItemAddOn, ItemCategory, ItemVariation, Question, QuestionOption,
    Quota,
 )
-from pretix.base.models.organizer import TeamAPIToken
 from pretix.helpers.dicts import merge_dicts


@@ -54,7 +53,7 @@ class ItemViewSet(ConditionalListView, viewsets.ModelViewSet):
        serializer.instance.log_action(
            'pretix.event.item.added',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=self.request.data
        )

@@ -69,7 +68,7 @@ class ItemViewSet(ConditionalListView, viewsets.ModelViewSet):
        serializer.instance.log_action(
            'pretix.event.item.changed',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=self.request.data
        )

@@ -82,7 +81,7 @@ class ItemViewSet(ConditionalListView, viewsets.ModelViewSet):
        instance.log_action(
            'pretix.event.item.deleted',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
        )
        super().perform_destroy(instance)

@@ -114,7 +113,7 @@ class ItemVariationViewSet(viewsets.ModelViewSet):
        item.log_action(
            'pretix.event.item.variation.added',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=merge_dicts(self.request.data, {'ORDER': serializer.instance.position}, {'id': serializer.instance.pk},
                             {'value': serializer.instance.value})
        )
@@ -124,7 +123,7 @@ class ItemVariationViewSet(viewsets.ModelViewSet):
        serializer.instance.item.log_action(
            'pretix.event.item.variation.changed',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=merge_dicts(self.request.data, {'ORDER': serializer.instance.position}, {'id': serializer.instance.pk},
                             {'value': serializer.instance.value})
        )
@@ -141,7 +140,7 @@ class ItemVariationViewSet(viewsets.ModelViewSet):
        instance.item.log_action(
            'pretix.event.item.variation.deleted',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data={
                'value': instance.value,
                'id': self.kwargs['pk']
@@ -175,7 +174,7 @@ class ItemAddOnViewSet(viewsets.ModelViewSet):
        item.log_action(
            'pretix.event.item.addons.added',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=merge_dicts(self.request.data, {'ORDER': serializer.instance.position}, {'id': serializer.instance.pk})
        )

@@ -184,7 +183,7 @@ class ItemAddOnViewSet(viewsets.ModelViewSet):
        serializer.instance.base_item.log_action(
            'pretix.event.item.addons.changed',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=merge_dicts(self.request.data, {'ORDER': serializer.instance.position}, {'id': serializer.instance.pk})
        )

@@ -193,7 +192,7 @@ class ItemAddOnViewSet(viewsets.ModelViewSet):
        instance.base_item.log_action(
            'pretix.event.item.addons.removed',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data={'category': instance.addon_category.pk}
        )

@@ -222,7 +221,7 @@ class ItemCategoryViewSet(ConditionalListView, viewsets.ModelViewSet):
        serializer.instance.log_action(
            'pretix.event.category.added',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=self.request.data
        )

@@ -236,7 +235,7 @@ class ItemCategoryViewSet(ConditionalListView, viewsets.ModelViewSet):
        serializer.instance.log_action(
            'pretix.event.category.changed',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=self.request.data
        )

@@ -247,7 +246,7 @@ class ItemCategoryViewSet(ConditionalListView, viewsets.ModelViewSet):
        instance.log_action(
            'pretix.event.category.deleted',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
        )
        super().perform_destroy(instance)

@@ -275,7 +274,7 @@ class QuestionViewSet(ConditionalListView, viewsets.ModelViewSet):
        serializer.instance.log_action(
            'pretix.event.question.added',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=self.request.data
        )

@@ -289,7 +288,7 @@ class QuestionViewSet(ConditionalListView, viewsets.ModelViewSet):
        serializer.instance.log_action(
            'pretix.event.question.changed',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=self.request.data
        )

@@ -297,7 +296,7 @@ class QuestionViewSet(ConditionalListView, viewsets.ModelViewSet):
        instance.log_action(
            'pretix.event.question.deleted',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
        )
        super().perform_destroy(instance)

@@ -327,7 +326,7 @@ class QuestionOptionViewSet(viewsets.ModelViewSet):
        q.log_action(
            'pretix.event.question.option.added',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=merge_dicts(self.request.data, {'ORDER': serializer.instance.position}, {'id': serializer.instance.pk})
        )

@@ -336,7 +335,7 @@ class QuestionOptionViewSet(viewsets.ModelViewSet):
        serializer.instance.question.log_action(
            'pretix.event.question.option.changed',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=merge_dicts(self.request.data, {'ORDER': serializer.instance.position}, {'id': serializer.instance.pk})
        )

@@ -344,7 +343,7 @@ class QuestionOptionViewSet(viewsets.ModelViewSet):
        instance.question.log_action(
            'pretix.event.question.option.deleted',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data={'id': instance.pk}
        )
        super().perform_destroy(instance)
@@ -374,14 +373,14 @@ class QuotaViewSet(ConditionalListView, viewsets.ModelViewSet):
        serializer.instance.log_action(
            'pretix.event.quota.added',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=self.request.data
        )
        if serializer.instance.subevent:
            serializer.instance.subevent.log_action(
                'pretix.subevent.quota.added',
                user=self.request.user,
-                api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                auth=self.request.auth,
                data=self.request.data
            )

@@ -397,7 +396,7 @@ class QuotaViewSet(ConditionalListView, viewsets.ModelViewSet):
        serializer.instance.log_action(
            'pretix.event.quota.changed',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=self.request.data
        )
        if current_subevent == request_subevent:
@@ -405,7 +404,7 @@ class QuotaViewSet(ConditionalListView, viewsets.ModelViewSet):
                current_subevent.log_action(
                    'pretix.subevent.quota.changed',
                    user=self.request.user,
-                    api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                    auth=self.request.auth,
                    data=self.request.data
                )
        else:
@@ -413,14 +412,14 @@ class QuotaViewSet(ConditionalListView, viewsets.ModelViewSet):
                request_subevent.log_action(
                    'pretix.subevent.quota.added',
                    user=self.request.user,
-                    api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                    auth=self.request.auth,
                    data=self.request.data
                )
            if current_subevent is not None:
                current_subevent.log_action(
                    'pretix.subevent.quota.deleted',
                    user=self.request.user,
-                    api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                    auth=self.request.auth,
                )
        serializer.instance.rebuild_cache()

@@ -428,13 +427,13 @@ class QuotaViewSet(ConditionalListView, viewsets.ModelViewSet):
        instance.log_action(
            'pretix.event.quota.deleted',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
        )
        if instance.subevent:
            instance.subevent.log_action(
                'pretix.subevent.quota.deleted',
                user=self.request.user,
-                api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                auth=self.request.auth,
            )
        super().perform_destroy(instance)

@@ -0,0 +1,92 @@
+import logging
+
+from django import forms
+from django.conf import settings
+from django.utils.translation import ugettext as _
+from oauth2_provider.exceptions import OAuthToolkitError
+from oauth2_provider.forms import AllowForm
+from oauth2_provider.views import (
+    AuthorizationView as BaseAuthorizationView,
+    RevokeTokenView as BaseRevokeTokenView, TokenView as BaseTokenView,
+)
+
+from pretix.api.models import OAuthApplication
+from pretix.base.models import Organizer
+
+logger = logging.getLogger(__name__)
+
+
+class OAuthAllowForm(AllowForm):
+    organizers = forms.ModelMultipleChoiceField(
+        queryset=Organizer.objects.none(),
+        widget=forms.CheckboxSelectMultiple
+    )
+
+    def __init__(self, *args, **kwargs):
+        user = kwargs.pop('user')
+        super().__init__(*args, **kwargs)
+        self.fields['organizers'].queryset = Organizer.objects.filter(
+            pk__in=user.teams.values_list('organizer', flat=True))
+
+
+class AuthorizationView(BaseAuthorizationView):
+    template_name = "pretixcontrol/auth/oauth_authorization.html"
+    form_class = OAuthAllowForm
+
+    def get_form_kwargs(self):
+        kwargs = super().get_form_kwargs()
+        kwargs['user'] = self.request.user
+        return kwargs
+
+    def get_context_data(self, **kwargs):
+        ctx = super().get_context_data(**kwargs)
+        ctx['settings'] = settings
+        return ctx
+
+    def create_authorization_response(self, request, scopes, credentials, allow, organizers):
+        credentials["organizers"] = organizers
+        return super().create_authorization_response(request, scopes, credentials, allow)
+
+    def form_valid(self, form):
+        client_id = form.cleaned_data["client_id"]
+        application = OAuthApplication.objects.get(client_id=client_id)
+        credentials = {
+            "client_id": form.cleaned_data.get("client_id"),
+            "redirect_uri": form.cleaned_data.get("redirect_uri"),
+            "response_type": form.cleaned_data.get("response_type", None),
+            "state": form.cleaned_data.get("state", None),
+        }
+        scopes = form.cleaned_data.get("scope")
+        allow = form.cleaned_data.get("allow")
+
+        try:
+            uri, headers, body, status = self.create_authorization_response(
+                request=self.request, scopes=scopes, credentials=credentials, allow=allow,
+                organizers=form.cleaned_data.get("organizers")
+            )
+        except OAuthToolkitError as error:
+            return self.error_response(error, application)
+
+        self.success_url = uri
+        logger.debug("Success url for the request: {0}".format(self.success_url))
+
+        msgs = [
+            _('The application "{application_name}" has been authorized to access your account.').format(
+                application_name=application.name
+            )
+        ]
+        self.request.user.send_security_notice(msgs)
+        self.request.user.log_action('pretix.user.oauth.authorized', user=self.request.user, data={
+            'application_id': application.pk,
+            'application_name': application.name,
+        })
+
+        return self.redirect(self.success_url, application)
+
+
+class TokenView(BaseTokenView):
+    pass
+
+
+class RevokeTokenView(BaseRevokeTokenView):
+    pass
@@ -17,12 +17,14 @@ from rest_framework.filters import OrderingFilter
 from rest_framework.mixins import CreateModelMixin
 from rest_framework.response import Response

+from pretix.api.models import OAuthAccessToken
 from pretix.api.serializers.order import (
    InvoiceSerializer, OrderCreateSerializer, OrderPositionSerializer,
    OrderSerializer,
 )
-from pretix.base.models import Invoice, Order, OrderPosition, Quota
-from pretix.base.models.organizer import TeamAPIToken
+from pretix.base.models import (
+    Invoice, Order, OrderPosition, Quota, TeamAPIToken,
+)
 from pretix.base.services.invoices import (
    generate_cancellation, generate_invoice, invoice_pdf, invoice_qualified,
    regenerate_invoice,
@@ -124,7 +126,7 @@ class OrderViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
                mark_order_paid(
                    order, manual=True,
                    user=request.user if request.user.is_authenticated else None,
-                    api_token=(request.auth if isinstance(request.auth, TeamAPIToken) else None),
+                    auth=request.auth,
                )
            except Quota.QuotaExceededException as e:
                return Response({'detail': str(e)}, status=status.HTTP_400_BAD_REQUEST)
@@ -151,7 +153,8 @@ class OrderViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
        cancel_order(
            order,
            user=request.user if request.user.is_authenticated else None,
-            api_token=(request.auth if isinstance(request.auth, TeamAPIToken) else None),
+            api_token=request.auth if isinstance(request.auth, TeamAPIToken) else None,
+            oauth_application=request.auth.application if isinstance(request.auth, OAuthAccessToken) else None,
            send_mail=send_mail
        )
        return self.retrieve(request, [], **kwargs)
@@ -172,7 +175,7 @@ class OrderViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
        order.log_action(
            'pretix.event.order.unpaid',
            user=request.user if request.user.is_authenticated else None,
-            api_token=(request.auth if isinstance(request.auth, TeamAPIToken) else None),
+            auth=request.auth,
        )
        return self.retrieve(request, [], **kwargs)

@@ -189,7 +192,7 @@ class OrderViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
        mark_order_expired(
            order,
            user=request.user if request.user.is_authenticated else None,
-            api_token=(request.auth if isinstance(request.auth, TeamAPIToken) else None),
+            auth=request.auth,
        )
        return self.retrieve(request, [], **kwargs)

@@ -243,7 +246,7 @@ class OrderViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
                new_date=new_date,
                force=force,
                user=request.user if request.user.is_authenticated else None,
-                api_token=(request.auth if isinstance(request.auth, TeamAPIToken) else None),
+                auth=request.auth,
            )
            return self.retrieve(request, [], **kwargs)
        except OrderError as e:
@@ -263,7 +266,7 @@ class OrderViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
            order.log_action(
                'pretix.event.order.placed',
                user=request.user if request.user.is_authenticated else None,
-                api_token=(request.auth if isinstance(request.auth, TeamAPIToken) else None),
+                auth=request.auth,
            )
        order_placed.send(self.request.event, order=order)

@@ -437,7 +440,7 @@ class InvoiceViewSet(viewsets.ReadOnlyModelViewSet):
                    'invoice': inv.pk
                },
                user=self.request.user,
-                api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                auth=self.request.auth,
            )
            return Response(status=204)

@@ -460,6 +463,6 @@ class InvoiceViewSet(viewsets.ReadOnlyModelViewSet):
                    'invoice': inv.pk
                },
                user=self.request.user,
-                api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                auth=self.request.auth,
            )
            return Response(status=204)
@@ -1,5 +1,6 @@
 from rest_framework import viewsets

+from pretix.api.models import OAuthAccessToken
 from pretix.api.serializers.organizer import OrganizerSerializer
 from pretix.base.models import Organizer

@@ -14,6 +15,12 @@ class OrganizerViewSet(viewsets.ReadOnlyModelViewSet):
        if self.request.user.is_authenticated():
            if self.request.user.has_active_staff_session(self.request.session.session_key):
                return Organizer.objects.all()
+            elif isinstance(self.request.auth, OAuthAccessToken):
+                return Organizer.objects.filter(
+                    pk__in=self.request.user.teams.values_list('organizer', flat=True)
+                ).filter(
+                    pk__in=self.request.auth.organizers.values_list('pk', flat=True)
+                )
            else:
                return Organizer.objects.filter(pk__in=self.request.user.teams.values_list('organizer', flat=True))
        else:
@@ -9,7 +9,6 @@ from rest_framework.filters import OrderingFilter

 from pretix.api.serializers.voucher import VoucherSerializer
 from pretix.base.models import Voucher
-from pretix.base.models.organizer import TeamAPIToken


 class VoucherFilter(FilterSet):
@@ -51,7 +50,7 @@ class VoucherViewSet(viewsets.ModelViewSet):
        serializer.instance.log_action(
            'pretix.voucher.added',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=self.request.data
        )

@@ -69,7 +68,7 @@ class VoucherViewSet(viewsets.ModelViewSet):
        serializer.instance.log_action(
            'pretix.voucher.changed',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
            data=self.request.data
        )

@@ -80,6 +79,6 @@ class VoucherViewSet(viewsets.ModelViewSet):
        instance.log_action(
            'pretix.voucher.deleted',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
        )
        super().perform_destroy(instance)
@@ -7,7 +7,7 @@ from rest_framework.filters import OrderingFilter
 from rest_framework.response import Response

 from pretix.api.serializers.waitinglist import WaitingListSerializer
-from pretix.base.models import TeamAPIToken, WaitingListEntry
+from pretix.base.models import WaitingListEntry
 from pretix.base.models.waitinglist import WaitingListException


@@ -45,7 +45,7 @@ class WaitingListViewSet(viewsets.ModelViewSet):
        serializer.instance.log_action(
            'pretix.event.orders.waitinglist.added',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
        )

    def perform_update(self, serializer):
@@ -55,7 +55,7 @@ class WaitingListViewSet(viewsets.ModelViewSet):
        serializer.instance.log_action(
            'pretix.event.orders.waitinglist.changed',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
        )

    def perform_destroy(self, instance):
@@ -65,7 +65,7 @@ class WaitingListViewSet(viewsets.ModelViewSet):
        instance.log_action(
            'pretix.event.orders.waitinglist.deleted',
            user=self.request.user,
-            api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+            auth=self.request.auth,
        )
        super().perform_destroy(instance)

@@ -74,7 +74,7 @@ class WaitingListViewSet(viewsets.ModelViewSet):
        try:
            self.get_object().send_voucher(
                user=self.request.user,
-                api_token=(self.request.auth if isinstance(self.request.auth, TeamAPIToken) else None),
+                auth=self.request.auth,
            )
        except WaitingListException as e:
            raise ValidationError(str(e))