Pluggable permissions (#5728)

* Data model draft

* Refactor query and assignment usages of old permissions

* Backend UI

* API serializer

* Big string replace

* Docs, tests and fixes for teams api

* Update docs for device auth

* Eliminate old names

* Make tests pass

* Use new permissions, remove inconsistencies

* Add test for translations

* Show plugin permissions

* Add permission for seating plans

* Fix plugin activation

* Fix failing test

* Refactor to permission groups

* Update doc/api/resources/devices.rst

Co-authored-by: luelista <weller@rami.io>

* Update doc/api/resources/events.rst

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/api/serializers/organizer.py

Co-authored-by: luelista <weller@rami.io>

* Fix typo

* Fix python version compat

* Replacement after rebase

* Add proper permission handling for exports

* Docs for exporters

* Runtime linting of permission names

* Fix typos

* Show export page even without orders permission

* More legacy compat

* Do not strongly validate before plugins are loaded

* Rebase migration

* Add permission for outgoing mails

* Review notes

* Update doc/api/resources/teams.rst

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Clean up logic around exporters

* Review and failures

* Fix migration leading to forbidden combination

* Handle permissions on event copying

* Remove print-statements

* Make test clearer

* Review feedback

* Add AnyPermissionOf

* migration safety

---------

Co-authored-by: luelista <weller@rami.io>
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

src/tests/plugins/autocheckin/conftest.py

@@ -68,18 +68,8 @@ def team(organizer):
         organizer=organizer,
         name="Test-Team",
         all_events=True,
-        can_change_teams=True,
-        can_manage_gift_cards=True,
-        can_change_items=True,
-        can_create_events=True,
-        can_change_event_settings=True,
-        can_change_vouchers=True,
-        can_view_vouchers=True,
-        can_view_orders=True,
-        can_change_orders=True,
-        can_manage_customers=True,
-        can_manage_reusable_media=True,
-        can_change_organizer_settings=True,
+        all_organizer_permissions=True,
+        all_event_permissions=True,
     )
 
 

src/tests/plugins/autocheckin/test_control.py

@@ -46,24 +46,16 @@ class AutoCheckinFormTest(SoupTest):
         )
         t = Team.objects.create(
             organizer=self.orga1,
-            can_change_event_settings=True,
-            can_view_orders=True,
-            can_change_items=True,
+            all_organizer_permissions=True,
+            all_event_permissions=True,
             all_events=True,
-            can_create_events=True,
-            can_change_orders=True,
-            can_change_vouchers=True,
         )
         t.members.add(self.user)
         t = Team.objects.create(
             organizer=self.orga2,
-            can_change_event_settings=True,
-            can_view_orders=True,
-            can_change_items=True,
+            all_organizer_permissions=True,
+            all_event_permissions=True,
             all_events=True,
-            can_create_events=True,
-            can_change_orders=True,
-            can_change_vouchers=True,
         )
         t.members.add(self.user)
         self.client.login(email="dummy@dummy.dummy", password="dummy")

src/tests/plugins/badges/test_control.py

@@ -53,9 +53,7 @@ class BadgeLayoutFormTest(SoupTest):
             date_from=datetime.datetime(2013, 12, 26, tzinfo=datetime.timezone.utc),
         )
         self.item1 = Item.objects.create(event=self.event1, name="Standard", default_price=0, position=1)
-        t = Team.objects.create(organizer=self.orga1, can_change_event_settings=True, can_view_orders=True,
-                                can_change_items=True, all_events=True, can_create_events=True,
-                                can_change_orders=True, can_change_vouchers=True)
+        t = Team.objects.create(organizer=self.orga1, all_events=True, all_event_permissions=True, all_organizer_permissions=True)
         t.members.add(self.user)
         t.limit_events.add(self.event1)
         self.client.login(email='dummy@dummy.dummy', password='dummy')

src/tests/plugins/banktransfer/test_actions.py

@@ -41,7 +41,7 @@ def env():
         date_from=now(), plugins='pretix.plugins.banktransfer'
     )
     user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
-    t = Team.objects.create(organizer=event.organizer, can_view_orders=True, can_change_orders=True)
+    t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
     t.members.add(user)
     t.limit_events.add(event)
     o1 = Order.objects.create(
@@ -274,7 +274,8 @@ def test_assign_order_organizer_no_permission(env, client):
                                            state=BankTransaction.STATE_NOMATCH,
                                            amount=23, date='unknown')
     team = env[1].teams.first()
-    team.can_change_orders = False
+    team.limit_event_permissions = {}
+    team.all_event_permissions = False
     team.save()
     client.login(email='dummy@dummy.dummy', password='dummy')
     r = client.post('/control/organizer/{}/banktransfer/action/'.format(env[0].organizer.slug), {
@@ -290,7 +291,12 @@ def test_assign_order_organizer_no_permission_for_event(env, client):
                                            state=BankTransaction.STATE_NOMATCH,
                                            amount=23, date='unknown')
     team = env[1].teams.first()
-    team.limit_events.clear()
+    event2 = Event.objects.create(
+        organizer=env[0].organizer, name='Dummy2', slug='dummy2',
+        date_from=now(), plugins='pretix.plugins.banktransfer'
+    )
+    with scopes_disabled():
+        team.limit_events.set([event2])
     client.login(email='dummy@dummy.dummy', password='dummy')
     r = json.loads(client.post('/control/organizer/{}/banktransfer/action/'.format(env[0].organizer.slug), {
         'action_{}'.format(trans.pk): 'assign:{}-{}'.format(env[0].slug.upper(), env[2].code),

src/tests/plugins/banktransfer/test_api.py

@@ -42,7 +42,7 @@ def env():
         date_from=now(), plugins='pretix.plugins.banktransfer'
     )
     user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
-    t = Team.objects.create(organizer=event.organizer, can_view_orders=True, can_change_orders=True)
+    t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
     t.members.add(user)
     t.limit_events.add(event)
     o1 = Order.objects.create(

src/tests/plugins/banktransfer/test_import.py

@@ -61,7 +61,7 @@ def env():
     event.settings.invoice_numbers_prefix = 'INV-'
     event.settings.invoice_numbers_counter_length = 3
     user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
-    t = Team.objects.create(organizer=event.organizer, can_view_orders=True, can_change_orders=True)
+    t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
     t.members.add(user)
     t.limit_events.add(event)
     o1 = Order.objects.create(

src/tests/plugins/banktransfer/test_refund.py

@@ -40,7 +40,7 @@ def env():
         date_from=now(), plugins='pretix.plugins.banktransfer,pretix.plugins.paypal'
     )
     user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
-    t = Team.objects.create(organizer=event.organizer, can_view_orders=True, can_change_orders=True)
+    t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
     t.members.add(user)
     t.limit_events.add(event)
     order = Order.objects.create(

src/tests/plugins/banktransfer/test_refund_export.py

@@ -41,7 +41,7 @@ def env():
         date_from=now(), plugins='pretix.plugins.banktransfer,pretix.plugins.paypal'
     )
     user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
-    t = Team.objects.create(organizer=event.organizer, can_view_orders=True, can_change_orders=True)
+    t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
     t.members.add(user)
     t.limit_events.add(event)
     order = Order.objects.create(

src/tests/plugins/paypal/test_settings.py

@@ -51,7 +51,7 @@ def env(client):
     event.settings.set('attendee_names_asked', False)
     event.settings.set('payment_paypal__enabled', True)
     user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
-    t = Team.objects.create(organizer=event.organizer, can_change_event_settings=True)
+    t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
     t.members.add(user)
     t.limit_events.add(event)
     client.force_login(user)

src/tests/plugins/paypal/test_webhook.py

@@ -41,7 +41,7 @@ def env():
         organizer=o, name='Dummy', slug='dummy', plugins='pretix.plugins.paypal',
         date_from=now(), live=True
     )
-    t = Team.objects.create(organizer=event.organizer, can_view_orders=True, can_change_orders=True)
+    t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
     t.members.add(user)
     t.limit_events.add(event)
     o1 = Order.objects.create(

src/tests/plugins/paypal2/test_settings.py

@@ -51,7 +51,7 @@ def env(client):
     event.settings.set('attendee_names_asked', False)
     event.settings.set('payment_paypal__enabled', True)
     user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
-    t = Team.objects.create(organizer=event.organizer, can_change_event_settings=True)
+    t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
     t.members.add(user)
     t.limit_events.add(event)
     client.force_login(user)

src/tests/plugins/paypal2/test_webhook.py

@@ -42,7 +42,7 @@ def env():
         organizer=o, name='Dummy', slug='dummy', plugins='pretix.plugins.paypal2',
         date_from=now(), live=True
     )
-    t = Team.objects.create(organizer=event.organizer, can_view_orders=True, can_change_orders=True)
+    t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
     t.members.add(user)
     t.limit_events.add(event)
     o1 = Order.objects.create(

src/tests/plugins/sendmail/test_sendmail.py

@@ -47,7 +47,7 @@ from pretix.base.models import Checkin, Item, Order, OrderPosition, Team, User
 def logged_in_client(client, event):
     """Returns a logged client"""
     user = User.objects.create_superuser('dummy@dummy.dummy', 'dummy')
-    t = Team.objects.create(organizer=event.organizer, can_view_orders=True, can_change_orders=True)
+    t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
     t.members.add(user)
     t.limit_events.add(event)
     client.force_login(user)

src/tests/plugins/stripe/test_settings.py

@@ -74,7 +74,7 @@ def env(client):
     event.settings.set('attendee_names_asked', False)
     event.settings.set('payment_stripe__enabled', True)
     user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
-    t = Team.objects.create(organizer=event.organizer, can_change_event_settings=True)
+    t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
     t.members.add(user)
     t.limit_events.add(event)
     client.force_login(user)

src/tests/plugins/stripe/test_webhook.py

@@ -41,7 +41,7 @@ def env():
         organizer=o, name='Dummy', slug='dummy', plugins='pretix.plugins.stripe',
         date_from=now(), live=True
     )
-    t = Team.objects.create(organizer=event.organizer, can_view_orders=True, can_change_orders=True)
+    t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
     t.members.add(user)
     t.limit_events.add(event)
     o1 = Order.objects.create(

src/tests/plugins/ticketoutputpdf/test_api.py

@@ -43,7 +43,7 @@ def env():
         organizer=o, name='Dummy', slug='dummy',
         date_from=now(), plugins='pretix.plugins.banktransfer'
     )
-    t = Team.objects.create(organizer=event.organizer, can_view_orders=True)
+    t = Team.objects.create(organizer=event.organizer, all_event_permissions=True)
     t.limit_events.add(event)
     item1 = Item.objects.create(event=event, name="Ticket", default_price=23)
     tl = event.ticket_layouts.create(

src/tests/plugins/ticketoutputpdf/test_control.py

@@ -54,9 +54,7 @@ class TicketLayoutFormTest(SoupTest):
             date_from=datetime.datetime(2013, 12, 26, tzinfo=datetime.timezone.utc),
         )
         self.item1 = Item.objects.create(event=self.event1, name="Standard", default_price=0, position=1)
-        t = Team.objects.create(organizer=self.orga1, can_change_event_settings=True, can_view_orders=True,
-                                can_change_items=True, all_events=True, can_create_events=True,
-                                can_change_vouchers=True, can_change_orders=True)
+        t = Team.objects.create(organizer=self.orga1, all_event_permissions=True, all_organizer_permissions=True)
         t.members.add(self.user)
         t.limit_events.add(self.event1)
         self.client.login(email='dummy@dummy.dummy', password='dummy')

src/tests/plugins/ticketoutputpdf/test_defaults_and_copy.py

@@ -36,7 +36,7 @@ def env():
         date_from=now(), plugins='pretix.plugins.ticketoutputpdf'
     )
     user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
-    t = Team.objects.create(organizer=event.organizer, can_create_events=True, can_change_event_settings=True, can_change_items=True)
+    t = Team.objects.create(organizer=event.organizer, all_event_permissions=True, all_organizer_permissions=True)
     t.members.add(user)
     t.limit_events.add(event)
     item1 = Item.objects.create(event=event, name="Ticket", default_price=23)