CGM_Public/pretix_original
2
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-05-05 15:14:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

Refactor query and assignment usages of old permissions

Browse Source
This commit is contained in:
Raphael Michel
2025-12-17 15:56:34 +01:00
committed by Raphael Michel
parent 5767f15709
commit a5f4aebba8
59 changed files with 206 additions and 209 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
src/tests/api/conftest.py
View File

@@ -106,17 +106,8 @@ def team(organizer):
return Team.objects.create(
organizer=organizer,
name="Test-Team",
can_change_teams=True,
can_manage_gift_cards=True,
can_change_items=True,
can_create_events=True,
can_change_event_settings=True,
can_change_vouchers=True,
can_view_vouchers=True,
can_change_orders=True,
can_manage_customers=True,
can_manage_reusable_media=True,
can_change_organizer_settings=True
all_event_permissions=True,
all_organizer_permissions=True,
)
@@ -140,8 +131,8 @@ def user():
@pytest.fixture
@scopes_disabled()
def user_client(client, team, user):
team.can_view_orders = True
team.can_view_vouchers = True
team.limit_event_permissions["event.orders:read"] = True
team.limit_event_permissions["event.vouchers:read"] = True
team.all_events = True
team.save()
team.members.add(user)
@@ -152,8 +143,8 @@ def user_client(client, team, user):
@pytest.fixture
@scopes_disabled()
def token_client(client, team):
team.can_view_orders = True
team.can_view_vouchers = True
team.limit_event_permissions["event.orders:read"] = True
team.limit_event_permissions["event.vouchers:read"] = True
team.all_events = True
team.save()
t = team.tokens.create(name='Foo')

5
src/tests/api/test_checkin.py
View File

@@ -1358,9 +1358,8 @@ def test_checkin_pdf_data_requires_permission(token_client, event, team, organiz
))
assert resp.data['results'][0].get('pdf_data')
with scopes_disabled():
team.can_view_orders = False
team.can_change_orders = False
team.can_checkin_orders = True
team.limit_event_permissions = {"event.orders:checkin": True}
team.all_event_permissions = False
team.save()
resp = token_client.get('/api/v1/organizers/{}/events/{}/checkinlists/{}/positions/?search=z3fsn8jyu&pdf_data=true'.format(
organizer.slug, event.slug, clist_all.pk

10
src/tests/api/test_checkinrpc.py
View File

@@ -984,9 +984,8 @@ def test_search_multiple_lists(token_client, organizer, clist_all, clist_event2,
@pytest.mark.django_db
def test_without_permission(token_client, event, team, organizer, clist_all, order):
with scopes_disabled():
team.can_view_orders = False
team.can_change_orders = False
team.can_checkin_orders = False
team.limit_event_permissions = {}
team.all_event_permissions = False
team.save()
resp = token_client.get(
'/api/v1/organizers/{}/checkinrpc/search/?list={}&search=dummy.test&ordering=attendee_name'.format(organizer.slug, clist_all.pk))
@@ -1043,9 +1042,8 @@ def test_checkin_only_permission(token_client, event, team, organizer, clist_all
assert resp.data['position'].get('pdf_data')
with scopes_disabled():
team.can_view_orders = False
team.can_change_orders = False
team.can_checkin_orders = True
team.limit_event_permissions = {"event.orders:checkin": True}
team.all_event_permissions = False
team.save()
# With limited permissions, I can not search with a 2-character query

15
src/tests/api/test_events.py
View File

@@ -243,7 +243,8 @@ def test_event_create(team, token_client, organizer, event, meta_prop):
{"key": "Workshop", "label": {"en": "Workshop"}},
]
meta_prop.save()
team.can_change_organizer_settings = False
team.limit_organizer_permissions = {"organizer.events:create": True}
team.all_organizer_permissions = False
team.save()
organizer.meta_properties.create(
name="protected", protected=True
@@ -581,16 +582,8 @@ def test_event_create_with_clone_across_organizers(user, user_client, organizer,
target_org = Organizer.objects.create(name='Dummy', slug='dummy2')
team = target_org.teams.create(
name="Test-Team",
can_change_teams=True,
can_manage_gift_cards=True,
can_change_items=True,
can_create_events=True,
can_change_event_settings=True,
can_change_vouchers=True,
can_view_vouchers=True,
can_change_orders=True,
can_manage_customers=True,
can_change_organizer_settings=True
all_event_permissions=True,
all_organizer_permissions=True,
)
team.members.add(user)

14
src/tests/api/test_exporters.py
View File

@@ -280,7 +280,8 @@ def test_org_level_export(token_client, organizer, team, event):
}, format='json')
assert resp.status_code == 202
team.can_manage_gift_cards = False
team.limit_organizer_permissions = {"organizer.events:create": True}
team.all_organizer_permissions = False
team.save()
resp = token_client.post('/api/v1/organizers/{}/exporters/giftcardlist/run/'.format(organizer.slug), data={
@@ -339,7 +340,8 @@ def test_event_scheduled_export_list_token(token_client, organizer, event, user,
assert resp.status_code == 200
assert [res] == resp.data['results']
team.can_change_event_settings = False
team.limit_organizer_permissions = {"organizer.events:create": True}
team.all_organizer_permissions = False
team.save()
# Token can no longer sees it an gets error message
@@ -361,7 +363,7 @@ def test_event_scheduled_export_list_user(user_client, organizer, event, user, t
resp = user_client.get('/api/v1/organizers/{}/events/{}/scheduled_exports/'.format(organizer.slug, event.slug))
assert [res] == resp.data['results']
team.can_change_event_settings = False
team.limit_event_permissions["event.settings.general:write"] = False
team.save()
# Owner still can
@@ -498,7 +500,8 @@ def test_org_scheduled_export_list_token(token_client, organizer, user, team, or
assert resp.status_code == 200
assert [res] == resp.data['results']
team.can_change_organizer_settings = False
team.limit_organizer_permissions = {"organizer.events:create": True}
team.all_organizer_permissions = False
team.save()
# Token can no longer sees it an gets error message
@@ -521,7 +524,8 @@ def test_org_scheduled_export_list_user(user_client, organizer, user, team, org_
resp = user_client.get('/api/v1/organizers/{}/scheduled_exports/'.format(organizer.slug))
assert [res] == resp.data['results']
team.can_change_organizer_settings = False
team.limit_organizer_permissions = {"organizer.events:create": True}
team.all_organizer_permissions = False
team.save()
# Owner still can

19
src/tests/api/test_oauth.py
View File

@@ -53,8 +53,13 @@ def organizer():
@pytest.fixture
def admin_team(organizer):
return Team.objects.create(organizer=organizer, can_change_teams=True, name='Admin team', all_events=True,
can_create_events=True)
return Team.objects.create(
organizer=organizer,
name='Admin team',
all_events=True,
all_event_permissions=True,
all_organizer_permissions=True,
)
@pytest.fixture
@@ -387,7 +392,7 @@ def test_token_from_code(client, admin_user, organizer, application: OAuthApplic
@pytest.mark.django_db
def test_use_token_for_access_one_organizer(client, admin_user, organizer, application: OAuthApplication):
o2 = Organizer.objects.create(name='A', slug='a')
t2 = Team.objects.create(organizer=o2, can_change_teams=True, name='Admin team', all_events=True)
t2 = Team.objects.create(organizer=o2, all_organizer_permissions=True, name='Admin team', all_events=True)
t2.members.add(admin_user)
client.login(email='dummy@dummy.dummy', password='dummy')
@@ -434,7 +439,13 @@ def test_use_token_for_access_one_organizer(client, admin_user, organizer, appli
@pytest.mark.django_db
def test_use_token_for_access_two_organizers(client, admin_user, organizer, application: OAuthApplication):
o2 = Organizer.objects.create(name='A', slug='a')
t2 = Team.objects.create(organizer=o2, can_change_teams=True, name='Admin team', all_events=True)
t2 = Team.objects.create(
organizer=o2,
all_event_permissions=True,
all_organizer_permissions=True,
name='Admin team',
all_events=True
)
t2.members.add(admin_user)
client.login(email='dummy@dummy.dummy', password='dummy')

6
src/tests/api/test_permissions.py
View File

@@ -281,9 +281,9 @@ event_permission_root_urls = [
@pytest.fixture
def token_client(client, team):
team.can_view_orders = True
team.can_view_vouchers = True
team.can_change_items = True
team.limit_event_permissions["event.orders:read"] = True
team.limit_event_permissions["event.vouchers:read"] = True
team.limit_event_permissions["event.items:write"] = True
team.save()
t = team.tokens.create(name='Foo')
client.credentials(HTTP_AUTHORIZATION='Token ' + t.token)

3
src/tests/api/test_subevents.py
View File

@@ -260,7 +260,8 @@ def test_all_subevents_list_filter(token_client, organizer, event, subevent):
def test_subevent_create(team, token_client, organizer, event, subevent, meta_prop, item):
meta_prop.choices = [{"key": "Conference", "label": {"en": "Conference"}}, {"key": "Workshop", "label": {"en": "Workshop"}}]
meta_prop.save()
team.can_change_organizer_settings = False
team.limit_organizer_permissions = {"organizer.events:create": True}
team.all_organizer_permissions = False
team.save()
organizer.meta_properties.create(
name="protected", protected=True

3
src/tests/api/test_transactions.py
View File

@@ -242,7 +242,8 @@ def test_organizer_list(token_client, team, organizer, event, order, item, taxru
assert resp.data["count"] == 0
team.all_events = True
team.can_view_orders = False
team.limit_organizer_permissions = {"event.vouchers:read": True}
team.all_organizer_permissions = False
team.save()
resp = token_client.get(

7
src/tests/base/test_export.py
View File

@@ -48,7 +48,7 @@ def event():
@pytest.fixture
def team(event):
return event.organizer.teams.create(all_events=True, can_view_orders=True)
return event.organizer.teams.create(all_events=True, all_event_permissions=True)
@pytest.fixture
@@ -143,7 +143,7 @@ def test_event_fail_user_no_permission(event, user, team):
s.error_counter = 0
s.save()
team.can_view_orders = False
team.limit_event_permissions["event.orders:read"] = False
team.save()
run_scheduled_exports(None)
@@ -273,7 +273,8 @@ def test_organizer_fail_user_does_not_have_specific_permission(event, user, team
s.error_counter = 0
s.save()
team.can_manage_customers = False
team.all_event_permissions = False
team.limit_event_permissions = {"organizer.giftcards:write": True}
team.save()
run_scheduled_exports(None)

4
src/tests/base/test_notifications.py
View File

@@ -65,7 +65,7 @@ def order(event):
@pytest.fixture
def team(event):
return event.organizer.teams.create(all_events=True, can_view_orders=True)
return event.organizer.teams.create(all_events=True, all_event_permissions=True)
@pytest.fixture
@@ -142,7 +142,7 @@ def test_notification_ignore_same_user(event, order, user, monkeypatch_on_commit
@pytest.mark.django_db
def test_notification_ignore_insufficient_permissions(event, order, user, team, monkeypatch_on_commit):
djmail.outbox = []
team.can_view_orders = False
team.limit_event_permissions["event.orders:read"] = False
team.save()
user.notification_settings.create(
method='mail', event=event, action_type='pretix.event.order.paid', enabled=True

28
src/tests/base/test_permissions.py
View File

@@ -119,7 +119,7 @@ def test_specific_event_permission_limited(event, user):
user._teamcache = {}
assert not user.has_event_permission(event.organizer, event, 'can_change_orders')
team = Team.objects.create(organizer=event.organizer, can_change_orders=True)
team = Team.objects.create(organizer=event.organizer, limit_event_permissions={"event.orders:write": True})
user._teamcache = {}
assert not user.has_event_permission(event.organizer, event, 'can_change_orders')
@@ -135,7 +135,7 @@ def test_specific_event_permission_limited(event, user):
assert user.has_event_permission(event.organizer, event, ('can_change_orders', 'can_change_event_settings'))
assert not user.has_event_permission(event.organizer, event, ('can_change_teams', 'can_change_event_settings'))
team.can_change_orders = False
team.limit_event_permissions = {}
team.save()
user._teamcache = {}
assert not user.has_event_permission(event.organizer, event, 'can_change_orders')
@@ -146,7 +146,7 @@ def test_specific_event_permission_all(event, user):
user._teamcache = {}
assert not user.has_event_permission(event.organizer, event, 'can_change_orders')
team = Team.objects.create(organizer=event.organizer, can_change_orders=True)
team = Team.objects.create(organizer=event.organizer, limit_event_permissions={"event.orders:write": True})
user._teamcache = {}
assert not user.has_event_permission(event.organizer, event, 'can_change_orders')
@@ -159,7 +159,7 @@ def test_specific_event_permission_all(event, user):
user._teamcache = {}
assert user.has_event_permission(event.organizer, event, 'can_change_orders')
team.can_change_orders = False
team.limit_event_permissions = {}
team.save()
user._teamcache = {}
assert not user.has_event_permission(event.organizer, event, 'can_change_orders')
@@ -167,9 +167,9 @@ def test_specific_event_permission_all(event, user):
@pytest.mark.django_db
def test_event_permissions_multiple_teams(event, user):
team1 = Team.objects.create(organizer=event.organizer, can_change_orders=True, all_events=True)
team2 = Team.objects.create(organizer=event.organizer, can_change_vouchers=True)
team3 = Team.objects.create(organizer=event.organizer, can_change_event_settings=True)
team1 = Team.objects.create(organizer=event.organizer, limit_event_permissions={"event.orders:write": True}, all_events=True)
team2 = Team.objects.create(organizer=event.organizer, limit_event_permissions={"event.vouchers:write": True})
team3 = Team.objects.create(organizer=event.organizer, limit_event_permissions={"event.settings.general:write": True})
event2 = Event.objects.create(
organizer=event.organizer, name='Dummy', slug='dummy2',
date_from=now()
@@ -207,7 +207,7 @@ def test_specific_organizer_permission(event, user):
user._teamcache = {}
assert not user.has_organizer_permission(event.organizer, 'can_create_events')
team = Team.objects.create(organizer=event.organizer, can_create_events=True)
team = Team.objects.create(organizer=event.organizer, limit_organizer_permissions={"organizer.events:create": True})
user._teamcache = {}
assert not user.has_organizer_permission(event.organizer, 'can_create_events')
@@ -219,12 +219,12 @@ def test_specific_organizer_permission(event, user):
@pytest.mark.django_db
def test_organizer_permissions_multiple_teams(event, user):
team1 = Team.objects.create(organizer=event.organizer, can_change_organizer_settings=True)
team2 = Team.objects.create(organizer=event.organizer, can_create_events=True)
team1 = Team.objects.create(organizer=event.organizer, limit_organizer_permissions={"organizer.settings.general:write": True})
team2 = Team.objects.create(organizer=event.organizer, limit_organizer_permissions={"organizer.events:create": True})
team1.members.add(user)
team2.members.add(user)
orga2 = Organizer.objects.create(slug='d2', name='d2')
team3 = Team.objects.create(organizer=orga2, can_change_teams=True)
team3 = Team.objects.create(organizer=orga2, limit_organizer_permissions={"organizer.teams:write": True})
team3.members.add(user)
assert user.has_organizer_permission(event.organizer, 'can_create_events')
@@ -266,9 +266,9 @@ def test_list_of_events(event, user, admin, admin_request):
assert not user.get_events_with_any_permission()
team1 = Team.objects.create(organizer=event.organizer, can_change_orders=True, all_events=True)
team2 = Team.objects.create(organizer=event.organizer, can_change_vouchers=True)
team3 = Team.objects.create(organizer=orga2, can_change_event_settings=True)
team1 = Team.objects.create(organizer=event.organizer, limit_event_permissions={"event.orders:write": True}, all_events=True)
team2 = Team.objects.create(organizer=event.organizer, limit_event_permissions={"event.vouchers:write": True})
team3 = Team.objects.create(organizer=orga2, limit_event_permissions={"event.settings.general:write": True})
team1.members.add(user)
team2.members.add(user)
team3.members.add(user)

2
src/tests/control/test_auth.py
View File

@@ -1123,7 +1123,7 @@ class Obligatory2FATest(TestCase):
session.save()
organizer = Organizer.objects.create(name='Dummy', slug='dummy')
team = Team.objects.create(organizer=organizer, can_change_teams=True, name='Admin team')
team = Team.objects.create(organizer=organizer, all_event_permissions=True, name='Admin team')
team.members.add(self.user)
self.user.require_2fa = False
self.user.save()

10
src/tests/control/test_checkins.py
View File

@@ -61,7 +61,7 @@ def dashboard_env():
item_ticket = Item.objects.create(event=event, name="Ticket", default_price=23, admission=True)
item_mascot = Item.objects.create(event=event, name="Mascot", default_price=10, admission=False)
t = Team.objects.create(organizer=o, can_view_orders=True, can_change_orders=True)
t = Team.objects.create(organizer=o, all_event_permissions=True)
t.members.add(user)
t.limit_events.add(event)
@@ -139,7 +139,7 @@ def checkin_list_env():
# permission
orga = Organizer.objects.create(name='Dummy', slug='dummy')
user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
team = Team.objects.create(organizer=orga, can_view_orders=True, can_change_orders=True)
team = Team.objects.create(organizer=orga, all_event_permissions=True)
team.members.add(user)
# event
@@ -321,7 +321,7 @@ def test_manual_checkins_revert_requires_order_change_permission(client, checkin
client.login(email='dummy@dummy.dummy', password='dummy')
with scopes_disabled():
assert not checkin_list_env[5][3].checkins.exists()
Team.objects.update(can_change_orders=False, can_checkin_orders=True)
Team.objects.update(all_event_permissions=False, limit_event_permissions={"event.orders:checkin": True})
client.post('/control/event/dummy/dummy/checkinlists/{}/bulk_action'.format(checkin_list_env[6].pk), {
'checkin': [checkin_list_env[5][3].pk]
})
@@ -363,7 +363,7 @@ def checkin_list_with_addon_env():
# permission
orga = Organizer.objects.create(name='Dummy', slug='dummy')
user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
team = Team.objects.create(organizer=orga, can_view_orders=True, can_change_orders=True)
team = Team.objects.create(organizer=orga, all_event_permissions=True)
team.members.add(user)
# event
@@ -466,7 +466,7 @@ class CheckinListFormTest(SoupTest):
date_from=datetime(2013, 12, 26, tzinfo=timezone.utc),
)
self.event1.settings.timezone = 'Europe/Berlin'
t = Team.objects.create(organizer=self.orga1, can_change_event_settings=True, can_view_orders=True)
t = Team.objects.create(organizer=self.orga1, all_event_permissions=True)
t.members.add(self.user)
t.limit_events.add(self.event1)
self.client.login(email='dummy@dummy.dummy', password='dummy')

2
src/tests/control/test_customer.py
View File

@@ -85,7 +85,7 @@ def order(event, customer):
def admin_user(organizer):
u = User.objects.create_user('dummy@dummy.dummy', 'dummy')
admin_team = Team.objects.create(
organizer=organizer, can_manage_customers=True, can_change_organizer_settings=True,
organizer=organizer, all_organizer_permissions=True,
name='Admin team'
)
admin_team.members.add(u)

9
src/tests/control/test_events.py
View File

@@ -76,13 +76,11 @@ class EventsTest(SoupTest):
date_from=datetime.datetime(2014, 9, 5, tzinfo=datetime.timezone.utc),
)
self.team1 = Team.objects.create(organizer=self.orga1, can_create_events=True, can_change_event_settings=True,
can_change_items=True)
self.team1 = Team.objects.create(organizer=self.orga1, all_organizer_permissions=True, all_event_permissions=True)
self.team1.members.add(self.user)
self.team1.limit_events.add(self.event1)
self.team2 = Team.objects.create(organizer=self.orga1, can_change_event_settings=True, can_change_items=True,
can_change_orders=True, can_change_vouchers=True)
self.team2 = Team.objects.create(organizer=self.orga1, all_event_permissions=True)
self.team2.members.add(self.user)
self.client.login(email='dummy@dummy.dummy', password='dummy')
@@ -1276,8 +1274,7 @@ class EventDeletionTest(SoupTest):
has_subevents=False
)
t = Team.objects.create(organizer=self.orga1, can_create_events=True, can_change_event_settings=True,
can_change_items=True)
t = Team.objects.create(organizer=self.orga1, all_organizer_permissions=True, all_event_permissions=True)
t.members.add(self.user)
t.limit_events.add(self.event1)
self.ticket = self.event1.items.create(name='Early-bird ticket',

9
src/tests/control/test_export.py
View File

@@ -40,8 +40,7 @@ def env():
)
event.settings.set("ticketoutput_testdummy__enabled", True)
user = User.objects.create_user("dummy@dummy.dummy", "dummy")
t = Team.objects.create(organizer=o, can_view_orders=True, can_change_orders=True, can_manage_customers=True,
can_change_event_settings=True)
t = Team.objects.create(organizer=o, all_event_permissions=True)
t.members.add(user)
t.limit_events.add(event)
@@ -163,7 +162,7 @@ def test_event_export_schedule(client, env):
@pytest.mark.django_db(transaction=True)
def test_event_limited_permission(client, env):
env[2].can_change_event_settings = False
env[2].limit_event_permissions = []
env[2].save()
user2 = User.objects.create_user("dummy2@dummy.dummy", "dummy")
@@ -199,7 +198,7 @@ def test_event_limited_permission(client, env):
response = client.get(f"/control/event/dummy/dummy/orders/export/{s2.pk}/delete")
assert response.status_code == 404
env[2].can_change_event_settings = True
env[2].limit_event_permissions = {"event:settings.general:write": True}
env[2].save()
response = client.get("/control/event/dummy/dummy/orders/export/")
assert b"RULE1" in response.content
@@ -366,7 +365,7 @@ def test_organizer_limited_permission(client, env):
response = client.post(f"/control/organizer/dummy/export/{s2.pk}/run")
assert response.status_code == 404
env[2].can_change_organizer_settings = True
env[2].limit_event_permissions = {"event:settings.general:write": True}
env[2].save()
response = client.get("/control/organizer/dummy/export/")
assert b"RULE1" in response.content

4
src/tests/control/test_giftcards.py
View File

@@ -213,8 +213,8 @@ def test_typeahead(organizer, admin_user, client, gift_card):
assert d == {"results": [{"id": gift_card.pk, "text": gift_card.secret}], "pagination": {"more": False}}
# Unprivileged user can only do exact match
team.can_manage_gift_cards = False
team.can_manage_reusable_media = True
team.all_organizer_permissions = False
team.limit_organizer_permissions = {"organizer.reusablemedia:write": True, "organizer.reusablemedia:read": True}
team.save()
r = client.get('/control/organizer/dummy/giftcards/select2?query=' + gift_card.secret[0:3])

2
src/tests/control/test_items.py
View File

@@ -57,7 +57,7 @@ class ItemFormTest(SoupTest):
date_from=datetime.datetime(2013, 12, 26, tzinfo=datetime.timezone.utc),
)
self.item1 = Item.objects.create(event=self.event1, name="Standard", default_price=0, position=1)
t = Team.objects.create(organizer=self.orga1, can_change_event_settings=True, can_change_items=True)
t = Team.objects.create(organizer=self.orga1, all_event_permissions=True)
t.members.add(self.user)
t.limit_events.add(self.event1)
self.client.login(email='dummy@dummy.dummy', password='dummy')

2
src/tests/control/test_mail_settings_preview.py
View File

@@ -47,7 +47,7 @@ class MailSettingPreviewTest(SoupTest):
)
self.locale_event.settings.locales = ['en', 'de-informal']
self.locale_event.save()
t = Team.objects.create(organizer=self.orga1, can_change_items=True, can_change_event_settings=True)
t = Team.objects.create(organizer=self.orga1, all_event_permissions=True)
t.members.add(self.user)
t.limit_events.add(self.locale_event)
t.limit_events.add(self.event1)

3
src/tests/control/test_modelimport.py
View File

@@ -35,8 +35,7 @@ def env():
date_from=now(), plugins='pretix.plugins.banktransfer,pretix.plugins.paypal'
)
user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
t = Team.objects.create(organizer=event.organizer, can_view_orders=True, can_change_orders=True,
can_change_vouchers=True)
t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
t.members.add(user)
t.limit_events.add(event)
return event, user

4
src/tests/control/test_orders.py
View File

@@ -67,7 +67,7 @@ def env():
)
event.settings.set('ticketoutput_testdummy__enabled', True)
user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
t = Team.objects.create(organizer=o, can_view_orders=True, can_change_orders=True, can_manage_customers=True)
t = Team.objects.create(organizer=o, all_event_permissions=True)
t.members.add(user)
t.limit_events.add(event)
o = Order.objects.create(
@@ -1422,7 +1422,7 @@ class OrderChangeTests(SoupTest):
self.quota.items.add(self.ticket)
self.quota.items.add(self.shirt)
user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
t = Team.objects.create(organizer=o, can_view_orders=True, can_change_orders=True)
t = Team.objects.create(organizer=o, all_event_permissions=True)
t.members.add(user)
t.limit_events.add(self.event)
self.client.login(email='dummy@dummy.dummy', password='dummy')

2
src/tests/control/test_orders_bulk.py
View File

@@ -56,7 +56,7 @@ def env():
)
event.settings.set('ticketoutput_testdummy__enabled', True)
user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
t = Team.objects.create(organizer=o, can_view_orders=True, can_change_orders=True, can_manage_customers=True)
t = Team.objects.create(organizer=o, all_event_permissions=True)
t.members.add(user)
t.limit_events.add(event)
ticket = Item.objects.create(event=event, name='Early-bird ticket',

3
src/tests/control/test_organizer.py
View File

@@ -51,8 +51,7 @@ class OrganizerTest(SoupTest):
plugins='pretix.plugins.banktransfer,tests.testdummy'
)
t = Team.objects.create(organizer=self.orga1, can_create_events=True, can_change_event_settings=True,
can_change_items=True, can_change_organizer_settings=True)
t = Team.objects.create(organizer=self.orga1, all_organizer_permissions=True, all_event_permissions=True)
t.members.add(self.user)
t.limit_events.add(self.event1)

6
src/tests/control/test_reusable_media.py
View File

@@ -122,7 +122,7 @@ def test_typeahead(organizer, admin_user, client, gift_card):
# Privileged user can search
team.all_events = True
team.can_view_orders = True
team.limit_event_permissions["event.orders:read"] = True
team.save()
r = client.get('/control/organizer/dummy/ticket_select2?query=' + op.secret[0:3])
@@ -140,7 +140,7 @@ def test_typeahead(organizer, admin_user, client, gift_card):
# Unprivileged user can only do exact match
team.all_events = True
team.can_view_orders = False
team.limit_event_permissions["event.orders:read"] = False
team.save()
r = client.get('/control/organizer/dummy/ticket_select2?query=' + op.secret[0:3])
@@ -154,7 +154,7 @@ def test_typeahead(organizer, admin_user, client, gift_card):
assert d == {"results": [{'event': 'Dummy', 'id': op.pk, 'text': 'FOO-1 (Early-bird ticket)'}], "pagination": {"more": False}}
team.all_events = False
team.can_view_orders = True
team.limit_event_permissions["event.orders:read"] = True
team.save()
r = client.get('/control/organizer/dummy/ticket_select2?query=' + op.secret[0:3])

14
src/tests/control/test_search.py
View File

@@ -86,7 +86,7 @@ class OrderSearchTest(SoupTest):
attendee_name_parts={'full_name': "Mark", "_scheme": "full"}
)
self.team = Team.objects.create(organizer=self.orga1, can_view_orders=True)
self.team = Team.objects.create(organizer=self.orga1, limit_event_permissions={"event.orders:read": True})
self.team.members.add(self.user)
self.team.limit_events.add(self.event1)
@@ -98,7 +98,7 @@ class OrderSearchTest(SoupTest):
assert 'DEFFO2' not in resp
def test_team_limit_event_wrong_permission(self):
self.team.can_view_orders = False
self.team.limit_event_permissions["event.orders:read"] = False
self.team.save()
resp = self.client.get('/control/search/orders/').content.decode()
assert 'ABCFO1' not in resp
@@ -113,7 +113,7 @@ class OrderSearchTest(SoupTest):
def test_team_all_events_wrong_permission(self):
self.team.all_events = True
self.team.can_view_orders = False
self.team.limit_event_permissions["event.orders:read"] = False
self.team.save()
resp = self.client.get('/control/search/orders/').content.decode()
assert 'ABCFO1' not in resp
@@ -270,8 +270,8 @@ class PaymentSearchTest(SoupTest):
info="{test payment order 2}"
)
self.team = Team.objects.create(organizer=self.orga1, can_view_orders=True)
self.team2 = Team.objects.create(organizer=self.orga2, can_view_orders=True)
self.team = Team.objects.create(organizer=self.orga1, limit_event_permissions={"event.orders:read": True})
self.team2 = Team.objects.create(organizer=self.orga2, limit_event_permissions={"event.orders:read": True})
self.team.members.add(self.user)
self.team.limit_events.add(self.event1)
@@ -283,7 +283,7 @@ class PaymentSearchTest(SoupTest):
assert 'DEFFO2' not in resp
def test_team_limit_event_wrong_permission(self):
self.team.can_view_orders = False
self.team.limit_event_permissions["event.orders:read"] = False
self.team.save()
resp = self.client.get('/control/search/payments/').content.decode()
assert 'ABCFO1' not in resp
@@ -298,7 +298,7 @@ class PaymentSearchTest(SoupTest):
def test_team_all_events_wrong_permission(self):
self.team.all_events = True
self.team.can_view_orders = False
self.team.limit_event_permissions["event.orders:read"] = False
self.team.save()
resp = self.client.get('/control/search/payments/').content.decode()
assert 'ABCFO1' not in resp

3
src/tests/control/test_shredders.py
View File

@@ -58,8 +58,7 @@ class EventShredderTest(SoupTest):
plugins='pretix.plugins.banktransfer,pretix.plugins.stripe,tests.testdummy'
)
t = Team.objects.create(organizer=self.orga1, can_create_events=True, can_change_event_settings=True,
can_change_items=True, can_change_orders=True)
t = Team.objects.create(organizer=self.orga1, all_organizer_permissions=True, all_event_permissions=True)
t.members.add(self.user)
t.limit_events.add(self.event1)
self.order = Order.objects.create(

3
src/tests/control/test_subevents.py
View File

@@ -45,8 +45,7 @@ class SubEventsTest(SoupTest):
has_subevents=True
)
t = Team.objects.create(organizer=self.orga1, can_create_events=True, can_change_event_settings=True,
can_change_items=True)
t = Team.objects.create(organizer=self.orga1, all_organizer_permissions=True, all_event_permissions=True)
t.members.add(self.user)
t.limit_events.add(self.event1)
self.ticket = self.event1.items.create(name='Early-bird ticket',

2
src/tests/control/test_taxrates.py
View File

@@ -41,7 +41,7 @@ class TaxRateFormTest(SoupTest):
organizer=self.orga1, name='30C3', slug='30c3',
date_from=datetime.datetime(2013, 12, 26, tzinfo=datetime.timezone.utc),
)
t = Team.objects.create(organizer=self.orga1, can_change_event_settings=True, can_change_items=True)
t = Team.objects.create(organizer=self.orga1, all_organizer_permissions=True, all_event_permissions=True)
t.members.add(self.user)
t.limit_events.add(self.event1)
self.client.login(email='dummy@dummy.dummy', password='dummy')

4
src/tests/control/test_teams.py
View File

@@ -56,7 +56,7 @@ def event(organizer):
@pytest.fixture
def admin_team(organizer):
return Team.objects.create(organizer=organizer, can_change_teams=True, name='Admin team')
return Team.objects.create(organizer=organizer, all_organizer_permissions=True, all_event_permissions=True, name='Admin team')
@pytest.fixture
@@ -216,7 +216,7 @@ def test_team_remove_last_admin(event, admin_user, admin_team, client):
with scopes_disabled():
assert admin_user in admin_team.members.all()
t2.can_change_teams = True
t2.limit_organizer_permissions = {"organizer.teams:write": True}
t2.save()
resp = client.post('/control/organizer/dummy/team/{}/'.format(admin_team.pk), {
'remove-member': admin_user.pk

2
src/tests/control/test_user.py
View File

@@ -478,7 +478,7 @@ class UserSettingsNotificationsTest(SoupTest):
organizer=o, name='Dummy', slug='dummy',
date_from=now(), plugins='pretix.plugins.banktransfer'
)
t = o.teams.create(can_change_orders=True, all_events=True)
t = o.teams.create(limit_event_permissions={"event.orders:write": True}, all_events=True)
t.members.add(self.user)
def test_toggle_all(self):

5
src/tests/control/test_views.py
View File

@@ -110,9 +110,8 @@ def logged_in_client(client, event):
user = User.objects.create_superuser('dummy@dummy.dummy', 'dummy')
t = Team.objects.create(
organizer=event.organizer,
all_events=True, can_create_events=True, can_change_teams=True,
can_change_organizer_settings=True, can_change_event_settings=True, can_change_items=True,
can_view_orders=True, can_change_orders=True, can_view_vouchers=True, can_change_vouchers=True
all_event_permissions=True,
all_organizer_permissions=True,
)
t.members.add(user)
client.force_login(user)

2
src/tests/control/test_vouchers.py
View File

@@ -58,7 +58,7 @@ class VoucherFormTest(SoupTestMixin, TransactionTestCase):
organizer=self.orga, name='30C3', slug='30c3',
date_from=datetime.datetime(2013, 12, 26, tzinfo=datetime.timezone.utc),
)
t = Team.objects.create(organizer=self.orga, can_view_vouchers=True, can_change_vouchers=True)
t = Team.objects.create(organizer=self.orga, all_event_permissions=True)
t.members.add(self.user)
t.limit_events.add(self.event)
self.client.login(email='dummy@dummy.dummy', password='dummy')

2
src/tests/control/test_waitinglist.py
View File

@@ -75,7 +75,7 @@ def env():
event=event, item=item2, email='valid@example.org', voucher=v
)
t = Team.objects.create(organizer=o, can_view_orders=True, can_change_orders=True)
t = Team.objects.create(organizer=o, all_event_permissions=True)
t.members.add(user)
t.limit_events.add(event)
return event, user, o, item1

14
src/tests/plugins/autocheckin/conftest.py
View File

@@ -68,18 +68,8 @@ def team(organizer):
organizer=organizer,
name="Test-Team",
all_events=True,
can_change_teams=True,
can_manage_gift_cards=True,
can_change_items=True,
can_create_events=True,
can_change_event_settings=True,
can_change_vouchers=True,
can_view_vouchers=True,
can_view_orders=True,
can_change_orders=True,
can_manage_customers=True,
can_manage_reusable_media=True,
can_change_organizer_settings=True,
all_organizer_permissions=True,
all_event_permissions=True,
)

16
src/tests/plugins/autocheckin/test_control.py
View File

@@ -46,24 +46,16 @@ class AutoCheckinFormTest(SoupTest):
)
t = Team.objects.create(
organizer=self.orga1,
can_change_event_settings=True,
can_view_orders=True,
can_change_items=True,
all_organizer_permissions=True,
all_event_permissions=True,
all_events=True,
can_create_events=True,
can_change_orders=True,
can_change_vouchers=True,
)
t.members.add(self.user)
t = Team.objects.create(
organizer=self.orga2,
can_change_event_settings=True,
can_view_orders=True,
can_change_items=True,
all_organizer_permissions=True,
all_event_permissions=True,
all_events=True,
can_create_events=True,
can_change_orders=True,
can_change_vouchers=True,
)
t.members.add(self.user)
self.client.login(email="dummy@dummy.dummy", password="dummy")

4
src/tests/plugins/badges/test_control.py
View File

@@ -53,9 +53,7 @@ class BadgeLayoutFormTest(SoupTest):
date_from=datetime.datetime(2013, 12, 26, tzinfo=datetime.timezone.utc),
)
self.item1 = Item.objects.create(event=self.event1, name="Standard", default_price=0, position=1)
t = Team.objects.create(organizer=self.orga1, can_change_event_settings=True, can_view_orders=True,
can_change_items=True, all_events=True, can_create_events=True,
can_change_orders=True, can_change_vouchers=True)
t = Team.objects.create(organizer=self.orga1, all_events=True, all_event_permissions=True, all_organizer_permissions=True)
t.members.add(self.user)
t.limit_events.add(self.event1)
self.client.login(email='dummy@dummy.dummy', password='dummy')

5
src/tests/plugins/banktransfer/test_actions.py
View File

@@ -41,7 +41,7 @@ def env():
date_from=now(), plugins='pretix.plugins.banktransfer'
)
user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
t = Team.objects.create(organizer=event.organizer, can_view_orders=True, can_change_orders=True)
t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
t.members.add(user)
t.limit_events.add(event)
o1 = Order.objects.create(
@@ -274,7 +274,8 @@ def test_assign_order_organizer_no_permission(env, client):
state=BankTransaction.STATE_NOMATCH,
amount=23, date='unknown')
team = env[1].teams.first()
team.can_change_orders = False
team.limit_event_permissions = {}
team.all_event_permissions = False
team.save()
client.login(email='dummy@dummy.dummy', password='dummy')
r = client.post('/control/organizer/{}/banktransfer/action/'.format(env[0].organizer.slug), {

2
src/tests/plugins/banktransfer/test_api.py
View File

@@ -42,7 +42,7 @@ def env():
date_from=now(), plugins='pretix.plugins.banktransfer'
)
user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
t = Team.objects.create(organizer=event.organizer, can_view_orders=True, can_change_orders=True)
t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
t.members.add(user)
t.limit_events.add(event)
o1 = Order.objects.create(

2
src/tests/plugins/banktransfer/test_import.py
View File

@@ -61,7 +61,7 @@ def env():
event.settings.invoice_numbers_prefix = 'INV-'
event.settings.invoice_numbers_counter_length = 3
user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
t = Team.objects.create(organizer=event.organizer, can_view_orders=True, can_change_orders=True)
t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
t.members.add(user)
t.limit_events.add(event)
o1 = Order.objects.create(

2
src/tests/plugins/banktransfer/test_refund.py
View File

@@ -40,7 +40,7 @@ def env():
date_from=now(), plugins='pretix.plugins.banktransfer,pretix.plugins.paypal'
)
user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
t = Team.objects.create(organizer=event.organizer, can_view_orders=True, can_change_orders=True)
t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
t.members.add(user)
t.limit_events.add(event)
order = Order.objects.create(

2
src/tests/plugins/banktransfer/test_refund_export.py
View File

@@ -41,7 +41,7 @@ def env():
date_from=now(), plugins='pretix.plugins.banktransfer,pretix.plugins.paypal'
)
user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
t = Team.objects.create(organizer=event.organizer, can_view_orders=True, can_change_orders=True)
t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
t.members.add(user)
t.limit_events.add(event)
order = Order.objects.create(

2
src/tests/plugins/paypal/test_webhook.py
View File

@@ -41,7 +41,7 @@ def env():
organizer=o, name='Dummy', slug='dummy', plugins='pretix.plugins.paypal',
date_from=now(), live=True
)
t = Team.objects.create(organizer=event.organizer, can_view_orders=True, can_change_orders=True)
t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
t.members.add(user)
t.limit_events.add(event)
o1 = Order.objects.create(

2
src/tests/plugins/paypal2/test_webhook.py
View File

@@ -42,7 +42,7 @@ def env():
organizer=o, name='Dummy', slug='dummy', plugins='pretix.plugins.paypal2',
date_from=now(), live=True
)
t = Team.objects.create(organizer=event.organizer, can_view_orders=True, can_change_orders=True)
t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
t.members.add(user)
t.limit_events.add(event)
o1 = Order.objects.create(

2
src/tests/plugins/sendmail/test_sendmail.py
View File

@@ -47,7 +47,7 @@ from pretix.base.models import Checkin, Item, Order, OrderPosition, Team, User
def logged_in_client(client, event):
"""Returns a logged client"""
user = User.objects.create_superuser('dummy@dummy.dummy', 'dummy')
t = Team.objects.create(organizer=event.organizer, can_view_orders=True, can_change_orders=True)
t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
t.members.add(user)
t.limit_events.add(event)
client.force_login(user)

2
src/tests/plugins/stripe/test_webhook.py
View File

@@ -41,7 +41,7 @@ def env():
organizer=o, name='Dummy', slug='dummy', plugins='pretix.plugins.stripe',
date_from=now(), live=True
)
t = Team.objects.create(organizer=event.organizer, can_view_orders=True, can_change_orders=True)
t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
t.members.add(user)
t.limit_events.add(event)
o1 = Order.objects.create(

2
src/tests/plugins/ticketoutputpdf/test_api.py
View File

@@ -43,7 +43,7 @@ def env():
organizer=o, name='Dummy', slug='dummy',
date_from=now(), plugins='pretix.plugins.banktransfer'
)
t = Team.objects.create(organizer=event.organizer, can_view_orders=True)
t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
t.limit_events.add(event)
item1 = Item.objects.create(event=event, name="Ticket", default_price=23)
tl = event.ticket_layouts.create(

4
src/tests/plugins/ticketoutputpdf/test_control.py
View File

@@ -54,9 +54,7 @@ class TicketLayoutFormTest(SoupTest):
date_from=datetime.datetime(2013, 12, 26, tzinfo=datetime.timezone.utc),
)
self.item1 = Item.objects.create(event=self.event1, name="Standard", default_price=0, position=1)
t = Team.objects.create(organizer=self.orga1, can_change_event_settings=True, can_view_orders=True,
can_change_items=True, all_events=True, can_create_events=True,
can_change_vouchers=True, can_change_orders=True)
t = Team.objects.create(organizer=self.orga1, all_event_permissions=True)
t.members.add(self.user)
t.limit_events.add(self.event1)
self.client.login(email='dummy@dummy.dummy', password='dummy')

2
src/tests/plugins/ticketoutputpdf/test_defaults_and_copy.py
View File

@@ -36,7 +36,7 @@ def env():
date_from=now(), plugins='pretix.plugins.ticketoutputpdf'
)
user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
t = Team.objects.create(organizer=event.organizer, can_create_events=True, can_change_event_settings=True, can_change_items=True)
t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
t.members.add(user)
t.limit_events.add(event)
item1 = Item.objects.create(event=event, name="Ticket", default_price=23)

3
src/tests/presale/test_timemachine.py
View File

@@ -28,8 +28,7 @@ class TimemachineTestMixin:
@scopes_disabled()
def _login_with_permission(self, orga):
self.user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
self.team1 = Team.objects.create(organizer=orga, can_create_events=True, can_change_event_settings=True,
can_change_items=True, all_events=True)
self.team1 = Team.objects.create(organizer=orga, all_event_permissions=True, all_events=True)
self.team1.members.add(self.user)
self.client.login(email='dummy@dummy.dummy', password='dummy')