Commit Graph
51 Commits
Author SHA1 Message Date
df0b580dd6 Pluggable permissions (#5728)
* Data model draft

* Refactor query and assignment usages of old permissions

* Backend UI

* API serializer

* Big string replace

* Docs, tests and fixes for teams api

* Update docs for device auth

* Eliminate old names

* Make tests pass

* Use new permissions, remove inconsistencies

* Add test for translations

* Show plugin permissions

* Add permission for seating plans

* Fix plugin activation

* Fix failing test

* Refactor to permission groups

* Update doc/api/resources/devices.rst

Co-authored-by: luelista <weller@rami.io>

* Update doc/api/resources/events.rst

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/api/serializers/organizer.py

Co-authored-by: luelista <weller@rami.io>

* Fix typo

* Fix python version compat

* Replacement after rebase

* Add proper permission handling for exports

* Docs for exporters

* Runtime linting of permission names

* Fix typos

* Show export page even without orders permission

* More legacy compat

* Do not strongly validate before plugins are loaded

* Rebase migration

* Add permission for outgoing mails

* Review notes

* Update doc/api/resources/teams.rst

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Clean up logic around exporters

* Review and failures

* Fix migration leading to forbidden combination

* Handle permissions on event copying

* Remove print-statements

* Make test clearer

* Review feedback

* Add AnyPermissionOf

* migration safety

---------

Co-authored-by: luelista <weller@rami.io>
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-03-17 14:43:56 +01:00
Raphael MichelandRaphael Michel 9a69b76880 API: Expose history of check-ins (Z#23206049) 2025-10-30 10:45:01 +01:00
Raphael MichelandGitHub 177a7d07fc Update license header (#5540) 2025-10-10 15:32:46 +02:00
Martin GrossandGitHub 39e5711e95 API/Organizer: Allow Device-Token access to Organizer settings; expose mf0aes_random_uid (#5326) 2025-09-26 14:41:11 +02:00
05c74b7ad6 Pluggable invoice transmission methods (#5020)
* Flexible invoice transmission

* UI work

* Add peppol and output

* API support

* Profile integration

* Simplify form for individuals

* Remove sent_to_customer usage

* more steps

* Revert "Bank transfer: Allow to send the invoice direclty to the accounting department (#2975)"

This reverts commit cea6c340be.

* minor fixes

* Fixes after rebase

* update stati

* Backend view

* Transmit and show status

* status, retransmission

* API retransmission

* More fields

* API docs

* Plugin docs

* Update migration

* Add missing license headers

* Remove dead code, fix current tests

* Run isort

* Update regex

* Rebase migration

* Fix migration

* Add tests, fix bugs

* Rebase migration

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Make migration reversible

* Add TransmissionType.enforce_transmission

* Fix registries API usage after rebase

* Remove code I forgot to delete

* Update transmission status display depending on type

* Add testmode_supported

* Update src/pretix/static/pretixbase/js/addressform.js

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/static/pretixbase/js/addressform.js

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/static/pretixbase/js/addressform.js

Co-authored-by: luelista <weller@rami.io>

* New mechanism for non-required invoice forms

* Update src/pretix/base/invoicing/transmission.py

Co-authored-by: luelista <weller@rami.io>

* Declare testmode_supported for email

* Make transmission_email_other an implementation detail

* Fix failing tests and add new ones

* Update src/pretix/base/services/invoices.py

Co-authored-by: luelista <weller@rami.io>

* Add emails to email history

* Fix comma error

* More generic default email text

* Cleanup

* Remove "email invoices" button and refine logic

* Rebase migration

* Fix edge case

---------

Co-authored-by: luelista <weller@rami.io>
2025-08-19 17:59:45 +02:00
a51a6123f5 Organizer-level plugins (#5305)
* Add version notes to the docs

* Adapt signal handling

* Add UI

* Add API

* API and tests

* Fix registry

* Update doc/development/api/plugins.rst

Co-authored-by: Felix Rindt <felix@rindt.me>

* Fix failing tests

* Apply suggestions from code review

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/control/templates/pretixcontrol/organizers/plugin_events.html

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/control/templates/pretixcontrol/organizers/plugins.html

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/control/templates/pretixcontrol/organizers/plugins.html

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/control/navigation.py

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/control/urls.py

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @wiffbi

* REbase migration

* Fix review note

* Fix test cases

* Remove plugin from all events if disabled on org level

* Update doc/development/api/plugins.rst

* Unify registries

* Rebase migration

---------

Co-authored-by: Felix Rindt <felix@rindt.me>
Co-authored-by: Richard Schreiber <schreiber@rami.io>
Co-authored-by: luelista <weller@rami.io>
2025-08-19 11:33:34 +02:00
a381adac33 API: Add transactions (#5292)
* API: Add transactions

* Apply suggestions from code review

Co-authored-by: Richard Schreiber <schreiber@rami.io>

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-07-08 14:11:53 +02:00
dc1973f4ff Add API endpoint /seats to event (Z#23159536) (#4321)
* add API endpoint /seats to event

* fix logging

* add Seat annotations

* add seats endpoint for subevents

* return ids of occupying objects instead of boolean flags

* wip

* include orderposition instead of order in seat info

* add API documentation

* Apply suggestions from code review

Co-authored-by: Raphael Michel <michel@rami.io>

* Apply suggestions from code review

* Clarify API docs

* add api examples

* add test cases

* require can_view_orders permission for retrieving seats

* improve permission handling

* Revert "improve permission handling"

This reverts commit f32b532cc6.

* improve permission handling (minimal version)

* formatting

* add permission tests

* fix bug

* update permission checks

* Apply suggestions from code review

Co-authored-by: Raphael Michel <michel@rami.io>

* add tests for permission checks

* add tests for expand=voucher and expand=cartposition

* remove unused parameter

* test query count

* codestyle

---------

Co-authored-by: Raphael Michel <michel@rami.io>
2024-08-02 09:17:46 +02:00
4fb5c6bef0 New implementation of sales channels (#4111)
Co-authored-by: Martin Gross <gross@rami.io>
2024-06-30 19:24:30 +02:00
b3298c91c3 Event settings: Extend product metadata (Z#23116647) (#3241)
Co-authored-by: Richard Schreiber <schreiber@rami.io>
Co-authored-by: Raphael Michel <michel@rami.io>
2023-05-26 14:09:41 +02:00
Raphael MichelandGitHub 6902725f3c New check-in features (#3022) 2023-02-09 09:46:46 +01:00
Raphael MichelandGitHub 6fee0ac0a9 Discounts (#2510) 2022-04-27 14:43:16 +02:00
f8927396d3 API: Add endpoints for automated email rules (#2178)
Co-authored-by: Raphael Michel <michel@rami.io>
2021-11-03 11:49:01 +01:00
Raphael MichelandGitHub c7ef79be90 Store all check-in attempts, not only successful ones (#2074) 2021-06-05 13:00:58 +02:00
Raphael MichelandGitHub 8e79eb570e Customer accounts & Memberships (#2024) 2021-05-04 16:56:06 +02:00
Raphael MichelandGitHub a93287207b pretix Community Edition moves to AGPLv3-based license (#2023) 2021-04-12 10:33:47 +02:00
55d8639ecc REST API: Add organizer-level settings (#1866)
Co-authored-by: Martin Gross <gross@rami.io>
2020-12-03 15:19:11 +01:00
Raphael MichelandGitHub 99c3981e2d Gift card API: Allow to inspect transactions (#1868) 2020-12-02 16:10:05 +01:00
Raphael MichelandGitHub d08c811f3a Fix #1780 -- Trigger exports through API (#1839) 2020-11-05 18:30:12 +01:00
Raphael MichelandGitHub 22bba28bea Add pluggable ticket secret generators (#1809) 2020-10-19 15:00:55 +02:00
Raphael MichelandGitHub c78e88a1ba Allow to create devices through the API (#1785) 2020-09-25 18:16:18 +02:00
Raphael Michel 90e70eae25 Fix test (see 45f120b0c) 2020-06-12 13:58:49 +02:00
Raphael MichelandGitHub fd1c964c92 Fix #1378 -- API: Allow to access and modify (some) event setti… (#1569)
* API: Allow to access event settings

* Convert most "general" settings

* Smaller fixes

* Add more settings

* Relative dates, nulling

* Fix a test failure

* Fix wrong attribute access
2020-02-04 17:06:23 +01:00
Raphael MichelandGitHub 5e61342ff5 Add an API for teams (#1562)
* Add Team resource to API

* Add team memer endpoints

* Add team invites endpoint

* Add token endpoints
2020-01-25 15:22:50 +01:00
Raphael MichelandGitHub bbc70447a2 Allow to create vouchers for *all* products (#1504) 2019-11-27 14:57:09 +01:00
Raphael Michel b07d9d167d Add an API 2019-10-17 16:04:22 +02:00
Raphael MichelandGitHub a6c72abe75 Change semantics of changing orders (#1260)
* Change semantics of changing orders

This basically does two things to the "Change products" view of orders and the
OrderChangeManager program API:

1) It decouples changing items or subevents from changing prices.
   OrderChangeManager.change_item() and .change_subevent() no longer
   touch the price of a position. Instead .change_price() needs to be
   called explicitly. However, a client-side JavaScript component now
   *proposes* a new price based on the changed item or subevent.

2) The user interface now exposes the possibility of doing multiple
   things at the same time, i.e. changing the item, subevent and price
   in the same operation. OrderChangeManager already allowed this
   before.

(1) is basically a consequence of (2), while (2) is a prerequesite for
e.g. the `seating` branch, where changing the subevent will always
require changing the seat.

* Add tests for price calculation API
2019-04-30 09:51:19 +02:00
Raphael Michel cc4602c308 API Auth: Respect staff sessions 2019-04-26 16:24:13 +02:00
Raphael Michel 19a2f4163a Add a few permission tests 2019-04-04 18:17:56 +02:00
Raphael MichelandGitHub c2d03f5e6b Fix #526 -- Add a webhook system (#1073)
- [x] Data model
- [x] UI
- [x] Fire hooks
- [x] Unit tests
- [x] Display logs
- [x] API to modify hooks
- [x] Documentation
- [x] More hooks!
2018-11-08 16:38:05 +01:00
Raphael Michel 0369deb72d Fix permission for access to root event resource 2018-09-27 10:01:57 +02:00
Raphael Michel 63ba393c12 Proper permission handling and testing 2018-09-25 12:29:05 +02:00
Raphael Michel 1ba4047b1b API-level tests 2018-09-25 10:28:07 +02:00
Raphael Michel f60a99c357 Tests 2018-08-14 11:31:41 +02:00
Raphael Michel 779756f1ab API: Allow to delete order positions 2018-08-13 18:09:10 +02:00
Raphael Michel 18a378976b Fix #571 -- Partial payments and refunds 2018-08-06 12:24:36 +02:00
Raphael Michel 118259a96b Add permission test for creating orders 2018-05-16 12:23:17 +02:00
Raphael MichelandGitHub b2f92acbf6 Refs #654 -- API: Writable invoice operations (#886)
* Invoices

* Update invoices.rst
2018-04-29 14:29:03 +02:00
Raphael MichelandGitHub 6f30ecb365 Refs #654 -- Writable API methods for waiting list entries (#885)
* Refs #654 -- Writable API methods for waiting list entries

* Update test_waitinglist.py
2018-04-29 14:28:32 +02:00
Ture GjørupandRaphael Michel 7bb18f6fad Refs #654 -- API: Writable event endpoints (#756)
* MKBDIGI-185: Added update/create to events

* MKBDIGI-185: Added validation for 'slug, 'live' on event endpoint

* MKBDIGI-185: Code formatting

* MKBDIGI-185: Added 'plugins' to 'event' endpoint

* MKBDIGI-185: Merge migrations

* MKBDIGI-185: Cleaned up static methods

* EBILL-5: Added delete endpoint for event

* EBILL-5: Merge migrations

* EBILL-5: Fixed imports

* EBILL-5: Changed plugins to only list plugins enabled for the event

* EBILL-5: Added clone event endpoint

* EBILL-5: Removed permissions check API test for events

* EBILL-5: Merged master, updated migrations

* EBILL-5: Updated api permissions check for CRUD on events

* EBILL-5: Removed 'unique_together' constraint on event model

* EBILL-5: Removed call to changed static methods in test

* EBILL-5: Changed Event 'has_paid_things'  to a property for consistency

* EBILL-5: Fixed created response code in documentation

* EBILL-6: Documentation fixes

* EBILL-6: Fixed typo

* EBILL-6: Fixed permissions

* EBILL-6: Added note on copying settings to documentation

* EBILL-6: Created model method for deleting sub objects on event before delete

* EBILL-6: Fixed typo

* EBILL-6: Re-added meta_data as read-only

* EBILL-6: Fixed permissions test

* EBILL-6: Added plugins issues check before live. Moved issues property from form to Event model.

* EBILL-6: Upped version number in documentation

* Add write support for MetaDataField

* EBILL-6: Expanded documentation for the clone endpoint, made behaviour of 'is_public' similar to 'plugins' for consistency

* EBILL-6: Re-added EventCRUDPermission

* EBILL-16: Updated documentation with permission model for the API

* EBILL-16: Added 'has_subevents' validation to ensure it cannot be changed once event is created.

* EBILL-16: Fixed event clone not differentiating between "not set" and "deliberately set to False"

* EBILL-16: Fixed event live validation

* EBILL-16: Added logging of live activated/deactivated

* EBILL-16: Fixed create event bug when no 'meta_data' supplied

* EBILL-16: Typo fixed

* EBILL-16: Added log display for "event created"

* EBILL-16: Enabling a plugin now calls 'installed' if applicable and log entries are added

* EBILL-16: Updated tests for events

* Do not allow enabling restricted plugins via the API

* Remove unused code
2018-04-25 17:13:09 +02:00
Ture GjørupandRaphael Michel b564fe8a0d Refs #654 -- API: Writable category endpoints (#818)
* EBILL-5: Added POST, PATCH, PUT and DELETE for categories

* EBILL-5: Fixed item category not removed on category delete
2018-03-16 14:50:22 +01:00
Ture GjørupandRaphael Michel 8eaada992f Refs #654 -- API: Writable item endpoints (#676)
* MKBDIGI-184: Basic create added for API items endpoint

* MKBDIGI-184: Starting endpoint for GET /api/v1/organizers/(organizer)/events/(event)/items/(id)/variations/

* MKBDIGI-184: endpoint for GET /api/v1/organizers/(organizer)/events/(event)/items/(id)/variations/

* MKBDIGI-184: Completed endpoint for variations

* MKBDIGI-184: Added endpoint for addons

* MKBDIGI-184: Added Item validation

* MKBDIGI-184: Added check for order/cart positions on item variation destroy.

* MKBDIGI-184: Fixed check for order/cart positions on item variation destroy.

* MKBDIGI-184: Updated tests, validation for addons

* MKBDIGI-184: Documentation feedback corrections

* MKBDIGI-184: Added documentation for item add-ons

* MKBDIGI-184: Code formatting fixes

* MKBDIGI-184: Feedback fixes

* MKBDIGI-184: Updated tests for delete item

* MKBDIGI-184: Cleaned up tests

* MKBDIGI-184: Added additional test URLs

* MKBDIGI-184: Documentation fixes

* MKBDIGI-184: Fixed read-only fields/Documentation

* MKBDIGI-184: Documentation fixes

* MKBDIGI-184: Added helper for dict merge for 3.4 compatibility

* MKBDIGI-184: Validation updates

* MKBDIGI-184: Fixed permissions test error. Changed to HTTP 404 for POST to addons endpoint

* MKBDIGI-184: Implemented nested variations and add-ons for POST on the item endpoint.
2018-02-01 15:43:51 +01:00
Raphael MichelandGitHub 353dce789d Fix #515 -- Add check-in lists (#693)
* Data model and migration

* Some backwards compatibility

* CRUD for checkin lists

* Show and perform checkins

* Correct numbers in table and dashboard widget

* event creation and cloning

* Allow to link specific exports and pass options per query

* Play with the CSV export

* PDF export

* Collapse exports by default

* Improve PDF exporter

* Addon stuff

* Subevent stuff, pretixdroid tests

* pretixdroid tests

* Add CRUD API

* Test compatibility

* Fix test

* DB-independent sorting behavior

* Add CRUD and coyp tests

* Re-enable pretixdroid plugin

* pretixdroid config

* Tests & fixes
2017-12-04 18:12:23 +01:00
Raphael Michel 364ea9ca29 [SECURITY] Respect session timeout in API 2017-11-25 19:18:40 +01:00
Ture GjørupandRaphael Michel e4167380b9 API: Write methods for quotas (#657)
* MKBDIGI-183: Added quotas API write methods

* MKBDIGI-183: Fixed code formatting

* MKBDIGI-183: Added test for permission requirements

* MKBDIGI-183: Documentation corrections

* MKBDIGI-183: Removed redundant create/update locks

* MKBDIGI-183: Added quota validation to check that items and variations corresponds to each other

* MKBDIGI-183: Added quota validation to check that item belong to the same event as the endpoint

* MKBDIGI-183: Added subevent validation to check that subevent belong to the same event as the endpoint

* MKBDIGI-183: Added subevent validation to check that subevent is null for non-series events

* MKBDIGI-183: Changed validation error text

* MKBDIGI-183: Added logging for subevents

* MKBDIGI-183: Fixed code formatting

* MKBDIGI-183: Fixed validation error in API test

* MKBDIGI-183: Fixed documentation errors

* MKBDIGI-183: Fixed typos in validation messages

* MKBDIGI-183: Refactored validation loop vars check

* MKBDIGI-183: Updated error strings in test assersions

* MKBDIGI-183: Fixed logging for API quota update to account changing subevents
2017-11-16 18:39:10 +01:00
Raphael Michel df7fbe5a66 Add missing parameter to API permission test 2017-10-27 13:33:18 +02:00
Raphael MichelandGitHub c16dd0c9b6 Refs #654 -- API: Status operations on orders resource (#640)
* API: Write operations on orders resource

* Add order API endpoint /extend/
2017-10-27 13:31:31 +02:00
Raphael MichelandGitHub be6496e569 API: Writeable methods for vouchers (#639) 2017-10-12 14:09:44 +02:00
Raphael Michel a0e7bd3996 API: Add write operations to taxrules resource 2017-10-11 00:09:53 +02:00
Raphael Michel f342e46f53 API: Require can_change_items for more endpoints 2017-10-10 22:58:32 +02:00