From badbb64f4f092724e6c12e93f7edf02b7721bb43 Mon Sep 17 00:00:00 2001
From: Mira Weller <weller@rami.io>
Date: Fri, 26 Jul 2024 20:05:03 +0200
Subject: [PATCH] add validation to ItemCategorySerializer

---
 src/pretix/api/serializers/item.py | 12 ++++++++++
 src/tests/api/test_items.py        | 38 ++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+)

diff --git a/src/pretix/api/serializers/item.py b/src/pretix/api/serializers/item.py
index 85e274bb41..96ba8a4fa8 100644
--- a/src/pretix/api/serializers/item.py
+++ b/src/pretix/api/serializers/item.py
@@ -447,6 +447,18 @@ class ItemCategorySerializer(I18nAwareModelSerializer):
             'cross_selling_condition', 'cross_selling_match_products'
         )
 
+    def validate(self, data):
+        data = super().validate(data)
+
+        full_data = self.to_internal_value(self.to_representation(self.instance)) if self.instance else {}
+        full_data.update(data)
+
+        if full_data.get('is_addon') and full_data.get('cross_selling_mode'):
+            raise ValidationError('is_addon and cross_selling_mode are mutually exclusive')
+
+        return data
+
+
 
 class QuestionOptionSerializer(I18nAwareModelSerializer):
     identifier = serializers.CharField(allow_null=True)
diff --git a/src/tests/api/test_items.py b/src/tests/api/test_items.py
index 219aea7757..3d440e74d7 100644
--- a/src/tests/api/test_items.py
+++ b/src/tests/api/test_items.py
@@ -214,6 +214,44 @@ def test_category_update(token_client, organizer, event, team, category):
         assert ItemCategory.objects.get(pk=category.pk).name == {"en": "Test"}
 
 
+@pytest.mark.django_db
+def test_category_update_cross_selling_options(token_client, organizer, event, team, category):
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/events/{}/categories/{}/'.format(organizer.slug, event.slug, category.pk),
+        {
+            "cross_selling_mode": "both",
+        },
+        format='json'
+    )
+    assert resp.status_code == 200
+    with scopes_disabled():
+        assert ItemCategory.objects.get(pk=category.pk).cross_selling_mode == 'both'
+
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/events/{}/categories/{}/'.format(organizer.slug, event.slug, category.pk),
+        {
+            "cross_selling_mode": "something",
+        },
+        format='json'
+    )
+    assert resp.status_code == 400
+    with scopes_disabled():
+        assert ItemCategory.objects.get(pk=category.pk).cross_selling_mode == 'both'
+
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/events/{}/categories/{}/'.format(organizer.slug, event.slug, category.pk),
+        {
+            "is_addon": True,
+        },
+        format='json'
+    )
+    assert resp.status_code == 400
+    assert 'mutually exclusive' in str(resp.data)
+    with scopes_disabled():
+        assert ItemCategory.objects.get(pk=category.pk).cross_selling_mode == 'both'
+        assert ItemCategory.objects.get(pk=category.pk).is_addon is False
+
+
 @pytest.mark.django_db
 def test_category_update_wrong_event(token_client, organizer, event2, category):
     resp = token_client.patch(