Add API endpoint /seats to event (Z#23159536) (#4321)

* add API endpoint /seats to event

* fix logging

* add Seat annotations

* add seats endpoint for subevents

* return ids of occupying objects instead of boolean flags

* wip

* include orderposition instead of order in seat info

* add API documentation

* Apply suggestions from code review

Co-authored-by: Raphael Michel <michel@rami.io>

* Apply suggestions from code review

* Clarify API docs

* add api examples

* add test cases

* require can_view_orders permission for retrieving seats

* improve permission handling

* Revert "improve permission handling"

This reverts commit f32b532cc6.

* improve permission handling (minimal version)

* formatting

* add permission tests

* fix bug

* update permission checks

* Apply suggestions from code review

Co-authored-by: Raphael Michel <michel@rami.io>

* add tests for permission checks

* add tests for expand=voucher and expand=cartposition

* remove unused parameter

* test query count

* codestyle

---------

Co-authored-by: Raphael Michel <michel@rami.io>

src/tests/api/test_cart.py

@@ -685,6 +685,7 @@ def seat(event, organizer, item):
 @pytest.mark.django_db
 def test_cartpos_create_with_seat(token_client, organizer, event, item, quota, seat, question):
     res = copy.deepcopy(CARTPOS_CREATE_PAYLOAD)
+    res['expires'] = now() + datetime.timedelta(hours=1)
     res['item'] = item.pk
     res['seat'] = seat.seat_guid
     resp = token_client.post(
@@ -697,6 +698,14 @@ def test_cartpos_create_with_seat(token_client, organizer, event, item, quota, s
         p = CartPosition.objects.get(pk=resp.data['id'])
     assert p.seat == seat
 
+    resp = token_client.get('/api/v1/organizers/{}/events/{}/seats/{}/'.format(organizer.slug, event.slug, seat.pk))
+    assert resp.status_code == 200
+    assert resp.data['cartposition'] == p.pk
+
+    resp = token_client.get('/api/v1/organizers/{}/events/{}/seats/{}/?expand=cartposition'.format(organizer.slug, event.slug, seat.pk))
+    assert resp.status_code == 200
+    assert resp.data['cartposition']['id'] == p.pk
+
 
 @pytest.mark.django_db
 def test_cartpos_create_with_blocked_seat(token_client, organizer, event, item, quota, seat, question):