Refs #654 -- Add writable API for subevents (#1217)

- [x] Write operations for subevents
- [x] Tests
- [x] Documentation

src/pretix/api/views/event.py

@@ -217,9 +217,10 @@ class SubEventFilter(FilterSet):
             return queryset.exclude(expr)
 
 
-class SubEventViewSet(ConditionalListView, viewsets.ReadOnlyModelViewSet):
+class SubEventViewSet(ConditionalListView, viewsets.ModelViewSet):
     serializer_class = SubEventSerializer
     queryset = ItemCategory.objects.none()
+    write_permission = 'can_change_event_settings'
     filter_backends = (DjangoFilterBackend, filters.OrderingFilter)
     filterset_class = SubEventFilter
 
@@ -240,6 +241,42 @@ class SubEventViewSet(ConditionalListView, viewsets.ReadOnlyModelViewSet):
             'subeventitem_set', 'subeventitemvariation_set'
         )
 
+    def perform_update(self, serializer):
+        super().perform_update(serializer)
+
+        serializer.instance.log_action(
+            'pretix.subevent.changed',
+            user=self.request.user,
+            auth=self.request.auth,
+            data=self.request.data
+        )
+
+    def perform_create(self, serializer):
+        serializer.save(event=self.request.event)
+        serializer.instance.log_action(
+            'pretix.subevent.added',
+            user=self.request.user,
+            auth=self.request.auth,
+            data=self.request.data
+        )
+
+    def perform_destroy(self, instance):
+        if not instance.allow_delete():
+            raise PermissionDenied('The sub-event can not be deleted as it has already been used in orders. Please set'
+                                   ' \'active\' to false instead to hide it from users.')
+        try:
+            with transaction.atomic():
+                instance.log_action(
+                    'pretix.subevent.deleted',
+                    user=self.request.user,
+                    auth=self.request.auth,
+                    data=self.request.data
+                )
+                super().perform_destroy(instance)
+        except ProtectedError:
+            raise PermissionDenied('The sub-event could not be deleted as some constraints (e.g. data created by '
+                                   'plug-ins) do not allow it.')
+
 
 class TaxRuleViewSet(ConditionalListView, viewsets.ModelViewSet):
     serializer_class = TaxRuleSerializer