Refs #654 -- API: Writable event endpoints (#756)

* MKBDIGI-185: Added update/create to events * MKBDIGI-185: Added validation for 'slug, 'live' on event endpoint * MKBDIGI-185: Code formatting * MKBDIGI-185: Added 'plugins' to 'event' endpoint * MKBDIGI-185: Merge migrations * MKBDIGI-185: Cleaned up static methods * EBILL-5: Added delete endpoint for event * EBILL-5: Merge migrations * EBILL-5: Fixed imports * EBILL-5: Changed plugins to only list plugins enabled for the event * EBILL-5: Added clone event endpoint * EBILL-5: Removed permissions check API test for events * EBILL-5: Merged master, updated migrations * EBILL-5: Updated api permissions check for CRUD on events * EBILL-5: Removed 'unique_together' constraint on event model * EBILL-5: Removed call to changed static methods in test * EBILL-5: Changed Event 'has_paid_things' to a property for consistency * EBILL-5: Fixed created response code in documentation * EBILL-6: Documentation fixes * EBILL-6: Fixed typo * EBILL-6: Fixed permissions * EBILL-6: Added note on copying settings to documentation * EBILL-6: Created model method for deleting sub objects on event before delete * EBILL-6: Fixed typo * EBILL-6: Re-added meta_data as read-only * EBILL-6: Fixed permissions test * EBILL-6: Added plugins issues check before live. Moved issues property from form to Event model. * EBILL-6: Upped version number in documentation * Add write support for MetaDataField * EBILL-6: Expanded documentation for the clone endpoint, made behaviour of 'is_public' similar to 'plugins' for consistency * EBILL-6: Re-added EventCRUDPermission * EBILL-16: Updated documentation with permission model for the API * EBILL-16: Added 'has_subevents' validation to ensure it cannot be changed once event is created. * EBILL-16: Fixed event clone not differentiating between "not set" and "deliberately set to False" * EBILL-16: Fixed event live validation * EBILL-16: Added logging of live activated/deactivated * EBILL-16: Fixed create event bug when no 'meta_data' supplied * EBILL-16: Typo fixed * EBILL-16: Added log display for "event created" * EBILL-16: Enabling a plugin now calls 'installed' if applicable and log entries are added * EBILL-16: Updated tests for events * Do not allow enabling restricted plugins via the API * Remove unused code
2026-05-03 14:54:04 +00:00 · 2018-04-25 17:13:09 +02:00
parent 1a0e2031d2
commit 7bb18f6fad
12 changed files with 1264 additions and 60 deletions
--- a/src/tests/api/conftest.py
+++ b/src/tests/api/conftest.py
@@ -27,7 +27,8 @@ def event(organizer, meta_prop):
    e = Event.objects.create(
        organizer=organizer, name='Dummy', slug='dummy',
        date_from=datetime(2017, 12, 27, 10, 0, 0, tzinfo=UTC),
-        plugins='pretix.plugins.banktransfer,pretix.plugins.ticketoutputpdf'
+        plugins='pretix.plugins.banktransfer,pretix.plugins.ticketoutputpdf',
+        is_public=True
    )
    e.meta_values.create(property=meta_prop, value="Conference")
    return e
@@ -60,6 +61,7 @@ def team(organizer):
    return Team.objects.create(
        organizer=organizer,
        can_change_items=True,
+        can_create_events=True,
        can_change_event_settings=True,
        can_change_vouchers=True,
        can_view_vouchers=True,
--- a/src/tests/api/test_events.py
+++ b/src/tests/api/test_events.py
@@ -1,4 +1,77 @@
+from datetime import datetime, timedelta
+from decimal import Decimal
+from unittest import mock
+
 import pytest
+from django_countries.fields import Country
+from pytz import UTC
+
+from pretix.base.models import (
+    CartPosition, Event, InvoiceAddress, Order, OrderPosition,
+)
+from pretix.base.models.orders import OrderFee
+
+
+@pytest.fixture
+def variations(item):
+    v = list()
+    v.append(item.variations.create(value="ChildA1"))
+    v.append(item.variations.create(value="ChildA2"))
+    return v
+
+
+@pytest.fixture
+def order(event, item, taxrule):
+    testtime = datetime(2017, 12, 1, 10, 0, 0, tzinfo=UTC)
+
+    with mock.patch('django.utils.timezone.now') as mock_now:
+        mock_now.return_value = testtime
+        o = Order.objects.create(
+            code='FOO', event=event, email='dummy@dummy.test',
+            status=Order.STATUS_PENDING, secret="k24fiuwvu8kxz3y1",
+            datetime=datetime(2017, 12, 1, 10, 0, 0, tzinfo=UTC),
+            expires=datetime(2017, 12, 10, 10, 0, 0, tzinfo=UTC),
+            total=23, payment_provider='banktransfer', locale='en'
+        )
+        o.fees.create(fee_type=OrderFee.FEE_TYPE_PAYMENT, value=Decimal('0.25'), tax_rate=Decimal('19.00'),
+                      tax_value=Decimal('0.05'), tax_rule=taxrule)
+        InvoiceAddress.objects.create(order=o, company="Sample company", country=Country('NZ'))
+        return o
+
+
+@pytest.fixture
+def order_position(item, order, taxrule, variations):
+    op = OrderPosition.objects.create(
+        order=order,
+        item=item,
+        variation=variations[0],
+        tax_rule=taxrule,
+        tax_rate=taxrule.rate,
+        tax_value=Decimal("3"),
+        price=Decimal("23"),
+        attendee_name="Peter",
+        secret="z3fsn8jyufm5kpk768q69gkbyr5f4h6w"
+    )
+    return op
+
+
+@pytest.fixture
+def cart_position(event, item, variations):
+    testtime = datetime(2017, 12, 1, 10, 0, 0, tzinfo=UTC)
+
+    with mock.patch('django.utils.timezone.now') as mock_now:
+        mock_now.return_value = testtime
+        c = CartPosition.objects.create(
+            event=event,
+            item=item,
+            datetime=datetime.now(),
+            expires=datetime.now() + timedelta(days=1),
+            variation=variations[0],
+            price=Decimal("23"),
+            cart_id="z3fsn8jyufm5kpk768q69gkbyr5f4h6w"
+        )
+        return c
+

 TEST_EVENT_RES = {
    "name": {"en": "Dummy"},
@@ -7,22 +80,473 @@ TEST_EVENT_RES = {
    "date_from": "2017-12-27T10:00:00Z",
    "date_to": None,
    "date_admission": None,
-    "is_public": False,
+    "is_public": True,
    "presale_start": None,
    "presale_end": None,
    "location": None,
    "slug": "dummy",
    "has_subevents": False,
-    "meta_data": {"type": "Conference"}
+    "meta_data": {"type": "Conference"},
+    'plugins': {
+        'pretix.plugins.banktransfer',
+        'pretix.plugins.ticketoutputpdf'
+    }
 }


+@pytest.fixture
+def item(event):
+    return event.items.create(name="Budget Ticket", default_price=23)
+
+
+@pytest.fixture
+def free_item(event):
+    return event.items.create(name="Free Ticket", default_price=0)
+
+
+@pytest.fixture
+def free_quota(event, free_item):
+    q = event.quotas.create(name="Budget Quota", size=200)
+    q.items.add(free_item)
+    return q
+
+
@pytest.mark.django_db
 def test_event_list(token_client, organizer, event):
    resp = token_client.get('/api/v1/organizers/{}/events/'.format(organizer.slug))
    assert resp.status_code == 200
    print(resp.data)
-    assert TEST_EVENT_RES == dict(resp.data['results'][0])
+    assert TEST_EVENT_RES == resp.data['results'][0]
+
+
+@pytest.mark.django_db
+def test_event_get(token_client, organizer, event):
+    resp = token_client.get('/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug))
+    assert resp.status_code == 200
+    print(resp.data)
+    assert TEST_EVENT_RES == resp.data
+
+
+@pytest.mark.django_db
+def test_event_create(token_client, organizer, event, meta_prop):
+    resp = token_client.post(
+        '/api/v1/organizers/{}/events/'.format(organizer.slug),
+        {
+            "name": {
+                "de": "Demo Konference 2020 Test",
+                "en": "Demo Conference 2020 Test"
+            },
+            "live": False,
+            "currency": "EUR",
+            "date_from": "2017-12-27T10:00:00Z",
+            "date_to": "2017-12-28T10:00:00Z",
+            "date_admission": None,
+            "is_public": False,
+            "presale_start": None,
+            "presale_end": None,
+            "location": None,
+            "slug": "2030",
+            "meta_data": {
+                meta_prop.name: "Conference"
+            }
+        },
+        format='json'
+    )
+    assert resp.status_code == 201
+    assert organizer.events.get(slug="2030").meta_values.filter(
+        property__name=meta_prop.name, value="Conference"
+    ).exists()
+
+    resp = token_client.post(
+        '/api/v1/organizers/{}/events/'.format(organizer.slug),
+        {
+            "name": {
+                "de": "Demo Konference 2020 Test",
+                "en": "Demo Conference 2020 Test"
+            },
+            "live": False,
+            "currency": "EUR",
+            "date_from": "2017-12-27T10:00:00Z",
+            "date_to": "2017-12-28T10:00:00Z",
+            "date_admission": None,
+            "is_public": False,
+            "presale_start": None,
+            "presale_end": None,
+            "location": None,
+            "slug": "2020",
+            "meta_data": {
+                "foo": "bar"
+            }
+        },
+        format='json'
+    )
+    assert resp.status_code == 400
+    assert resp.content.decode() == '{"meta_data":["Meta data property \'foo\' does not exist."]}'
+
+    resp = token_client.post(
+        '/api/v1/organizers/{}/events/'.format(organizer.slug),
+        {
+            "name": {
+                "de": "Demo Konference 2020 Test",
+                "en": "Demo Conference 2020 Test"
+            },
+            "live": False,
+            "currency": "EUR",
+            "date_from": "2017-12-27T10:00:00Z",
+            "date_to": "2017-12-28T10:00:00Z",
+            "date_admission": None,
+            "is_public": False,
+            "presale_start": None,
+            "presale_end": None,
+            "location": None,
+            "slug": event.slug,
+            "meta_data": {
+                "type": "Conference"
+            }
+        },
+        format='json'
+    )
+    assert resp.status_code == 400
+    assert resp.content.decode() == '{"slug":["This slug has already been used for a different event."]}'
+
+    resp = token_client.post(
+        '/api/v1/organizers/{}/events/'.format(organizer.slug),
+        {
+            "name": {
+                "de": "Demo Konference 2020 Test",
+                "en": "Demo Conference 2020 Test"
+            },
+            "live": True,
+            "currency": "EUR",
+            "date_from": "2017-12-27T10:00:00Z",
+            "date_to": "2017-12-28T10:00:00Z",
+            "date_admission": None,
+            "is_public": False,
+            "presale_start": None,
+            "presale_end": None,
+            "location": None,
+            "slug": "2031",
+            "meta_data": {
+                "type": "Conference"
+            }
+        },
+        format='json'
+    )
+    assert resp.status_code == 400
+    assert resp.content.decode() == '{"live":["Events cannot be created as \'live\'. Quotas and payment must be added ' \
+                                    'to the event before sales can go live."]}'
+
+
+@pytest.mark.django_db
+def test_event_create_with_clone(token_client, organizer, event, meta_prop):
+    resp = token_client.post(
+        '/api/v1/organizers/{}/events/{}/clone/'.format(organizer.slug, event.slug),
+        {
+            "name": {
+                "de": "Demo Konference 2020 Test",
+                "en": "Demo Conference 2020 Test"
+            },
+            "live": False,
+            "currency": "EUR",
+            "date_from": "2018-12-27T10:00:00Z",
+            "date_to": "2018-12-28T10:00:00Z",
+            "date_admission": None,
+            "is_public": False,
+            "presale_start": None,
+            "presale_end": None,
+            "location": None,
+            "slug": "2030",
+            "meta_data": {
+                "type": "Conference"
+            },
+            "plugins": [
+                "pretix.plugins.ticketoutputpdf"
+            ]
+        },
+        format='json'
+    )
+
+    assert resp.status_code == 201
+    cloned_event = Event.objects.get(organizer=organizer.pk, slug='2030')
+    assert cloned_event.plugins == 'pretix.plugins.ticketoutputpdf'
+    assert cloned_event.is_public is False
+    assert organizer.events.get(slug="2030").meta_values.filter(
+        property__name=meta_prop.name, value="Conference"
+    ).exists()
+
+    resp = token_client.post(
+        '/api/v1/organizers/{}/events/{}/clone/'.format(organizer.slug, event.slug),
+        {
+            "name": {
+                "de": "Demo Konference 2020 Test",
+                "en": "Demo Conference 2020 Test"
+            },
+            "live": False,
+            "currency": "EUR",
+            "date_from": "2018-12-27T10:00:00Z",
+            "date_to": "2018-12-28T10:00:00Z",
+            "date_admission": None,
+            "presale_start": None,
+            "presale_end": None,
+            "location": None,
+            "slug": "2031",
+            "meta_data": {
+                "type": "Conference"
+            }
+        },
+        format='json'
+    )
+
+    assert resp.status_code == 201
+    cloned_event = Event.objects.get(organizer=organizer.pk, slug='2031')
+    assert cloned_event.plugins == "pretix.plugins.banktransfer,pretix.plugins.ticketoutputpdf"
+    assert cloned_event.is_public is True
+    assert organizer.events.get(slug="2031").meta_values.filter(
+        property__name=meta_prop.name, value="Conference"
+    ).exists()
+
+    resp = token_client.post(
+        '/api/v1/organizers/{}/events/{}/clone/'.format(organizer.slug, event.slug),
+        {
+            "name": {
+                "de": "Demo Konference 2020 Test",
+                "en": "Demo Conference 2020 Test"
+            },
+            "live": False,
+            "currency": "EUR",
+            "date_from": "2018-12-27T10:00:00Z",
+            "date_to": "2018-12-28T10:00:00Z",
+            "date_admission": None,
+            "presale_start": None,
+            "presale_end": None,
+            "location": None,
+            "slug": "2032",
+            "plugins": []
+        },
+        format='json'
+    )
+
+    assert resp.status_code == 201
+    cloned_event = Event.objects.get(organizer=organizer.pk, slug='2032')
+    assert cloned_event.plugins == ""
+
+
+@pytest.mark.django_db
+def test_event_put_with_clone(token_client, organizer, event, meta_prop):
+    resp = token_client.put(
+        '/api/v1/organizers/{}/events/{}/clone/'.format(organizer.slug, event.slug),
+        {},
+        format='json'
+    )
+
+    assert resp.status_code == 405
+
+
+@pytest.mark.django_db
+def test_event_patch_with_clone(token_client, organizer, event, meta_prop):
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/events/{}/clone/'.format(organizer.slug, event.slug),
+        {},
+        format='json'
+    )
+
+    assert resp.status_code == 405
+
+
+@pytest.mark.django_db
+def test_event_delete_with_clone(token_client, organizer, event, meta_prop):
+    resp = token_client.delete(
+        '/api/v1/organizers/{}/events/{}/clone/'.format(organizer.slug, event.slug),
+        {},
+        format='json'
+    )
+
+    assert resp.status_code == 405
+
+
+@pytest.mark.django_db
+def test_event_update(token_client, organizer, event, item, meta_prop):
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug),
+        {
+            "date_from": "2018-12-27T10:00:00Z",
+            "date_to": "2018-12-28T10:00:00Z",
+            "currency": "DKK",
+        },
+        format='json'
+    )
+    assert resp.status_code == 200
+    event = Event.objects.get(organizer=organizer.pk, slug=resp.data['slug'])
+    assert event.currency == "DKK"
+    assert organizer.events.get(slug=resp.data['slug']).meta_values.filter(
+        property__name=meta_prop.name, value="Conference"
+    ).exists()
+
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug),
+        {
+            "date_from": "2017-12-27T10:00:00Z",
+            "date_to": "2017-12-26T10:00:00Z"
+        },
+        format='json'
+    )
+    assert resp.status_code == 400
+    assert resp.content.decode() == '{"non_field_errors":["The event cannot end before it starts."]}'
+
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug),
+        {
+            "presale_start": "2017-12-27T10:00:00Z",
+            "presale_end": "2017-12-26T10:00:00Z"
+        },
+        format='json'
+    )
+    assert resp.status_code == 400
+    assert resp.content.decode() == '{"non_field_errors":["The event\'s presale cannot end before it starts."]}'
+
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug),
+        {
+            "slug": "testing"
+        },
+        format='json'
+    )
+    assert resp.status_code == 400
+    assert resp.content.decode() == '{"slug":["The event slug cannot be changed."]}'
+
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug),
+        {
+            "has_subevents": True
+        },
+        format='json'
+    )
+    assert resp.status_code == 400
+    assert resp.content.decode() == '{"has_subevents":["Once created an event cannot change between an series and a ' \
+                                    'single event."]}'
+
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug),
+        {
+            "meta_data": {
+                meta_prop.name: "Workshop"
+            }
+        },
+        format='json'
+    )
+    assert resp.status_code == 200
+    assert organizer.events.get(slug=resp.data['slug']).meta_values.filter(
+        property__name=meta_prop.name, value="Workshop"
+    ).exists()
+
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug),
+        {
+            "meta_data": {
+            }
+        },
+        format='json'
+    )
+    assert resp.status_code == 200
+    assert not organizer.events.get(slug=resp.data['slug']).meta_values.filter(
+        property__name=meta_prop.name
+    ).exists()
+
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug),
+        {
+            "meta_data": {
+                "test": "test"
+            }
+        },
+        format='json'
+    )
+    assert resp.status_code == 400
+    assert resp.content.decode() == '{"meta_data":["Meta data property \'test\' does not exist."]}'
+
+
+@pytest.mark.django_db
+def test_event_update_live_no_product(token_client, organizer, event):
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug),
+        {
+            "live": True
+        },
+        format='json'
+    )
+    assert resp.status_code == 400
+    assert resp.content.decode() == '{"live":["You need to configure at least one quota to sell anything."]}'
+
+
+@pytest.mark.django_db
+def test_event_update_live_no_payment_method(token_client, organizer, event, item):
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug),
+        {
+            "live": True
+        },
+        format='json'
+    )
+    assert resp.status_code == 400
+    assert resp.content.decode() == '{"live":["You have configured at least one paid product but have not enabled any ' \
+                                    'payment methods."]}'
+
+
+@pytest.mark.django_db
+def test_event_update_live_free_product(token_client, organizer, event, free_item, free_quota):
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug),
+        {
+            "live": True
+        },
+        format='json'
+    )
+    assert resp.status_code == 200
+
+
+@pytest.mark.django_db
+def test_event_update_plugins(token_client, organizer, event, free_item, free_quota):
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug),
+        {
+            "plugins": [
+                "pretix.plugins.ticketoutputpdf",
+                "pretix.plugins.pretixdroid"
+            ]
+        },
+        format='json'
+    )
+    assert resp.status_code == 200
+    assert resp.data.get('plugins') == {
+        "pretix.plugins.ticketoutputpdf",
+        "pretix.plugins.pretixdroid"
+    }
+
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug),
+        {
+            "plugins": {
+                "pretix.plugins.banktransfer"
+            }
+        },
+        format='json'
+    )
+    assert resp.status_code == 200
+    assert resp.data.get('plugins') == {
+        "pretix.plugins.banktransfer"
+    }
+
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug),
+        {
+            "plugins": {
+                "pretix.plugins.test"
+            }
+        },
+        format='json'
+    )
+    assert resp.status_code == 400
+    assert resp.content.decode() == '{"plugins":["Unknown plugin: \'pretix.plugins.test\'."]}'


@pytest.mark.django_db
@@ -32,3 +556,28 @@ def test_event_detail(token_client, organizer, event, team):
    resp = token_client.get('/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug))
    assert resp.status_code == 200
    assert TEST_EVENT_RES == resp.data
+
+
+@pytest.mark.django_db
+def test_event_delete(token_client, organizer, event):
+    resp = token_client.delete('/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug))
+    assert resp.status_code == 204
+    assert not organizer.events.filter(pk=event.id).exists()
+
+
+@pytest.mark.django_db
+def test_event_with_order_position_not_delete(token_client, organizer, event, item, order_position):
+    resp = token_client.delete('/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug))
+    assert resp.status_code == 403
+    assert resp.content.decode() == '{"detail":"The event can not be deleted as it already contains orders. Please ' \
+                                    'set \'live\' to false to hide the event and take the shop offline instead."}'
+    assert organizer.events.filter(pk=event.id).exists()
+
+
+@pytest.mark.django_db
+def test_event_with_cart_position_not_delete(token_client, organizer, event, item, cart_position):
+    resp = token_client.delete('/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug))
+    assert resp.status_code == 403
+    assert resp.content.decode() == '{"detail":"The event could not be deleted as some constraints (e.g. data ' \
+                                    'created by plug-ins) do not allow it."}'
+    assert organizer.events.filter(pk=event.id).exists()
--- a/src/tests/api/test_permissions.py
+++ b/src/tests/api/test_permissions.py
@@ -20,7 +20,7 @@ event_urls = [
    'checkinlists/',
 ]

-event_permission_urls = [
+event_permission_sub_urls = [
    ('get', 'can_view_orders', 'orders/', 200),
    ('get', 'can_view_orders', 'orderpositions/', 200),
    ('get', 'can_view_vouchers', 'vouchers/', 200),
@@ -68,6 +68,15 @@ event_permission_urls = [
    ('put', 'can_change_event_settings', 'checkinlists/1/', 404),
    ('patch', 'can_change_event_settings', 'checkinlists/1/', 404),
    ('delete', 'can_change_event_settings', 'checkinlists/1/', 404),
+    ('post', 'can_create_events', 'clone/', 400),
+]
+
+
+event_permission_root_urls = [
+    ('post', 'can_create_events', 400),
+    ('put', 'can_change_event_settings', 400),
+    ('patch', 'can_change_event_settings', 200),
+    ('delete', 'can_change_event_settings', 204),
 ]


@@ -137,8 +146,8 @@ def test_event_not_existing(token_client, organizer, url, event):


@pytest.mark.django_db
-@pytest.mark.parametrize("urlset", event_permission_urls)
-def test_token_event_permission_allowed(token_client, team, organizer, event, urlset):
+@pytest.mark.parametrize("urlset", event_permission_sub_urls)
+def test_token_event_subresources_permission_allowed(token_client, team, organizer, event, urlset):
    team.all_events = True
    setattr(team, urlset[1], True)
    team.save()
@@ -148,8 +157,8 @@ def test_token_event_permission_allowed(token_client, team, organizer, event, ur


@pytest.mark.django_db
-@pytest.mark.parametrize("urlset", event_permission_urls)
-def test_token_event_permission_not_allowed(token_client, team, organizer, event, urlset):
+@pytest.mark.parametrize("urlset", event_permission_sub_urls)
+def test_token_event_subresources_permission_not_allowed(token_client, team, organizer, event, urlset):
    team.all_events = True
    setattr(team, urlset[1], False)
    team.save()
@@ -161,6 +170,32 @@ def test_token_event_permission_not_allowed(token_client, team, organizer, event
        assert resp.status_code in (404, 403)


+@pytest.mark.django_db
+@pytest.mark.parametrize("urlset", event_permission_root_urls)
+def test_token_event_permission_allowed(token_client, team, organizer, event, urlset):
+    team.all_events = True
+    setattr(team, urlset[1], True)
+    team.save()
+    if urlset[0] == 'post':
+        resp = getattr(token_client, urlset[0])('/api/v1/organizers/{}/events/'.format(organizer.slug))
+    else:
+        resp = getattr(token_client, urlset[0])('/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug))
+    assert resp.status_code == urlset[2]
+
+
+@pytest.mark.django_db
+@pytest.mark.parametrize("urlset", event_permission_root_urls)
+def test_token_event_permission_not_allowed(token_client, team, organizer, event, urlset):
+    team.all_events = True
+    setattr(team, urlset[1], False)
+    team.save()
+    if urlset[0] == 'post':
+        resp = getattr(token_client, urlset[0])('/api/v1/organizers/{}/events/'.format(organizer.slug))
+    else:
+        resp = getattr(token_client, urlset[0])('/api/v1/organizers/{}/events/{}/'.format(organizer.slug, event.slug))
+    assert resp.status_code == 403
+
+
@pytest.mark.django_db
 def test_log_out_after_absolute_timeout(user_client, team, organizer, event):
    session = user_client.session