Fix #32 -- Add a PayPal webhook listener

src/pretix/plugins/paypal/views.py

@@ -1,10 +1,19 @@
+import json
 import logging
 
+import paypalrestsdk
 from django.contrib import messages
-from django.shortcuts import redirect
+from django.db import transaction
+from django.http import HttpResponse
+from django.shortcuts import get_object_or_404, redirect
+from django.urls import reverse
 from django.utils.translation import ugettext_lazy as _
+from django.views.decorators.csrf import csrf_exempt
+from django.views.decorators.http import require_POST
 
-from pretix.base.models import Order
+from pretix.base.models import Order, RequiredAction
+from pretix.base.services.orders import mark_order_paid, mark_order_refunded
+from pretix.control.permissions import event_permission_required
 from pretix.multidomain.urlreverse import eventreverse
 from pretix.plugins.paypal.payment import Paypal
 from pretix.presale.utils import event_view
@@ -49,3 +58,78 @@ def success(request, *args, **kwargs):
 def abort(request, *args, **kwargs):
     messages.error(request, _('It looks like you canceled the PayPal payment'))
     return redirect(eventreverse(request.event, 'presale:event.checkout', kwargs={'step': 'payment'}))
+
+
+@csrf_exempt
+@require_POST
+@event_view(require_live=False)
+def webhook(request, *args, **kwargs):
+    event_body = request.body.decode('utf-8').strip()
+    event_json = json.loads(event_body)
+
+    prov = Paypal(request.event)
+    prov.init_api()
+
+    # We do not check the signature, we just use it as a trigger to look the charge up.
+    if event_json['resource_type'] != 'sale':
+        return HttpResponse("Not interested in this resource type", status=200)
+
+    try:
+        sale = paypalrestsdk.Sale.find(event_json['resource']['id'])
+    except:
+        logger.exception('PayPal error on webhook. Event data: %s' % str(event_json))
+        return HttpResponse('Sale not found', status=500)
+
+    orders = Order.objects.filter(event=request.event, payment_provider='paypal',
+                                  payment_info__icontains=sale['id'])
+    order = None
+    for o in orders:
+        payment_info = json.loads(o.payment_info)
+        for res in payment_info['transactions'][0]['related_resources']:
+            for k, v in res.items():
+                if k == 'sale' and v['id'] == sale['id']:
+                    order = o
+                    break
+
+    if not order:
+        return HttpResponse('Order not found', status=200)
+
+    order.log_action('pretix.plugins.paypal.event', data=event_json)
+
+    if order.status == Order.STATUS_PAID and sale['state'] in ('partially_refunded', 'refunded'):
+        RequiredAction.objects.create(
+            event=request.event, action_type='pretix.plugins.paypal.refund', data=json.dumps({
+                'order': order.code,
+                'sale': sale['id']
+            })
+        )
+    elif order.status == Order.STATUS_PENDING and sale['state'] == 'completed':
+        mark_order_paid(order, user=None)
+
+    return HttpResponse(status=200)
+
+
+@event_permission_required('can_view_orders')
+@require_POST
+def refund(request, **kwargs):
+    with transaction.atomic():
+        action = get_object_or_404(RequiredAction, event=request.event, pk=kwargs.get('id'),
+                                   action_type='pretix.plugins.paypal.refund', done=False)
+        data = json.loads(action.data)
+        action.done = True
+        action.user = request.user
+        action.save()
+        order = get_object_or_404(Order, event=request.event, code=data['order'])
+        if order.status != Order.STATUS_PAID:
+            messages.error(request, _('The order cannot be marked as refunded as it is not marked as paid!'))
+        else:
+            mark_order_refunded(order, user=request.user)
+            messages.success(
+                request, _('The order has been marked as refunded and the issue has been marked as resolved!')
+            )
+
+    return redirect(reverse('control:event.order', kwargs={
+        'organizer': request.event.organizer.slug,
+        'event': request.event.slug,
+        'code': data['order']
+    }))