Commit Graph

35 Commits

Author SHA1 Message Date
Raphael Michel
fa48e55f0f Allow pretixPOS to access more API endpoints 2021-04-16 17:07:59 +02:00
Raphael Michel
1b41fa1f3b Device security policy: Fix wrong url name 2021-04-16 10:35:21 +02:00
Raphael Michel
a93287207b pretix Community Edition moves to AGPLv3-based license (#2023) 2021-04-12 10:33:47 +02:00
Raphael Michel
2d4249ab31 Device security profiles: Allow POS access to cashier list 2021-03-30 09:34:52 +02:00
Raphael Michel
92a50cb2d1 Web-based check-in interface (#1985) 2021-03-30 09:34:11 +02:00
Aksh Gupta
88ba7ab53a Refactor code quality issues (#2001) 2021-03-16 19:13:02 +01:00
Raphael Michel
5ae839f62e Security Profile: Allow badge layouts for POS 2021-03-16 19:01:43 +01:00
Raphael Michel
81f37d9ce5 PDF layout: Allow to show photos from questions (#1919) 2021-02-08 17:48:06 +01:00
Raphael Michel
89da0847ca Device security policy: Allow order payments for POS 2021-02-02 15:54:05 +01:00
Raphael Michel
65e3efa5a3 API: Clarify session validity codepaths 2021-01-20 12:37:34 +01:00
Raphael Michel
3388c3ab09 Add file upload to security profiles 2021-01-20 12:37:29 +01:00
Raphael Michel
bd9d8ce0ad Device profiles: Fix missing listed URL for pretixPOS 2020-11-24 16:47:55 +01:00
Raphael Michel
695a800811 Add seating views to POS device profile 2020-11-13 17:00:34 +01:00
Raphael Michel
987597b298 Add event selection endpoint (#1827)
* Add event selection endpoint

* Minor fixes

* Add filter by gate
2020-10-24 19:20:07 +02:00
Raphael Michel
7b46292da3 Fix incorrect device security profiles 2020-10-23 18:52:39 +02:00
Raphael Michel
0482920a01 Clarify "full" security profile 2020-10-23 11:24:18 +02:00
Raphael Michel
22bba28bea Add pluggable ticket secret generators (#1809) 2020-10-19 15:00:55 +02:00
Raphael Michel
f5d93eaffa s/WhiteList/AllowList/g 2020-10-14 11:23:47 +02:00
Raphael Michel
810f3d7d31 Minor improvements to security profiles 2020-10-13 18:02:56 +02:00
Raphael Michel
e8f3ad633a Add device security profiles (#1806) 2020-10-13 17:40:25 +02:00
Raphael Michel
3cbcf663e5 OAuth: Add profile-only access 2020-09-28 16:01:59 +02:00
Raphael Michel
d85ddb5bda Integrate django-scopes (#1319)
* Install django-scopes

* Fix tests.api

* Update tasks and cronjobs

* Fix remaining tests

* Remove unused import

* Fix tests after rebase

* Disable scopes for get_Events_with_any_permission

* Disable scopes for a management command
2019-06-17 10:46:55 +02:00
Raphael Michel
cc4602c308 API Auth: Respect staff sessions 2019-04-26 16:24:13 +02:00
Raphael Michel
2d37c6d94d Make device token revokation more explicit 2019-04-02 09:36:07 +02:00
Raphael Michel
0369deb72d Fix permission for access to root event resource 2018-09-27 10:01:57 +02:00
Raphael Michel
6d01c99d38 Auth mechanism 2018-09-25 10:28:07 +02:00
Raphael Michel
69d10489b8 Implement OAuth2 provider (#927)
- [x] Application management
  - [x] Link
  - [ ] Tests
- [x] Authorize flow
  - [x] Tests
- [x] Refresh token handling
  - [x] Tests
- [x] Revocation endpoint
  - [x] Tests
  - [x] Mitigate: https://github.com/jazzband/django-oauth-toolkit/issues/585
- [x] API authenticator / permission driver
  - [x] Test
- [x] Enforce organizer restriction
  - [x] Tests
- [x] Enforce scope restriction
  - [x] Tests
- [x] Show current applications to user
  - [x] Revoke
  - [x] Tests
- [x] Log new authorizations
  - [x] notify user
- [x] Ensure other grant types are not available
- [x] Documentation
- [x] check if revoking access toking, then refreshing gets rid of organizer constraint
- [x] Show logentry foo
2018-06-05 12:58:04 +02:00
Ture Gjørup
7bb18f6fad Refs #654 -- API: Writable event endpoints (#756)
* MKBDIGI-185: Added update/create to events

* MKBDIGI-185: Added validation for 'slug, 'live' on event endpoint

* MKBDIGI-185: Code formatting

* MKBDIGI-185: Added 'plugins' to 'event' endpoint

* MKBDIGI-185: Merge migrations

* MKBDIGI-185: Cleaned up static methods

* EBILL-5: Added delete endpoint for event

* EBILL-5: Merge migrations

* EBILL-5: Fixed imports

* EBILL-5: Changed plugins to only list plugins enabled for the event

* EBILL-5: Added clone event endpoint

* EBILL-5: Removed permissions check API test for events

* EBILL-5: Merged master, updated migrations

* EBILL-5: Updated api permissions check for CRUD on events

* EBILL-5: Removed 'unique_together' constraint on event model

* EBILL-5: Removed call to changed static methods in test

* EBILL-5: Changed Event 'has_paid_things'  to a property for consistency

* EBILL-5: Fixed created response code in documentation

* EBILL-6: Documentation fixes

* EBILL-6: Fixed typo

* EBILL-6: Fixed permissions

* EBILL-6: Added note on copying settings to documentation

* EBILL-6: Created model method for deleting sub objects on event before delete

* EBILL-6: Fixed typo

* EBILL-6: Re-added meta_data as read-only

* EBILL-6: Fixed permissions test

* EBILL-6: Added plugins issues check before live. Moved issues property from form to Event model.

* EBILL-6: Upped version number in documentation

* Add write support for MetaDataField

* EBILL-6: Expanded documentation for the clone endpoint, made behaviour of 'is_public' similar to 'plugins' for consistency

* EBILL-6: Re-added EventCRUDPermission

* EBILL-16: Updated documentation with permission model for the API

* EBILL-16: Added 'has_subevents' validation to ensure it cannot be changed once event is created.

* EBILL-16: Fixed event clone not differentiating between "not set" and "deliberately set to False"

* EBILL-16: Fixed event live validation

* EBILL-16: Added logging of live activated/deactivated

* EBILL-16: Fixed create event bug when no 'meta_data' supplied

* EBILL-16: Typo fixed

* EBILL-16: Added log display for "event created"

* EBILL-16: Enabling a plugin now calls 'installed' if applicable and log entries are added

* EBILL-16: Updated tests for events

* Do not allow enabling restricted plugins via the API

* Remove unused code
2018-04-25 17:13:09 +02:00
Raphael Michel
6df0147fe9 Remove unused method 2018-03-16 15:27:02 +01:00
Raphael Michel
072f2a0ee9 Pin sessions to the user agent in use 2018-02-19 13:02:55 +01:00
Raphael Michel
364ea9ca29 [SECURITY] Respect session timeout in API 2017-11-25 19:18:40 +01:00
Raphael Michel
30c7319811 Remvoe obsolete code 2017-11-25 19:18:40 +01:00
Raphael Michel
c16dd0c9b6 Refs #654 -- API: Status operations on orders resource (#640)
* API: Write operations on orders resource

* Add order API endpoint /extend/
2017-10-27 13:31:31 +02:00
Raphael Michel
f342e46f53 API: Require can_change_items for more endpoints 2017-10-10 22:58:32 +02:00
Raphael Michel
b2d4bea1d0 Refs #314 -- Read-only REST API (#513)
* initial commit

* API auth

* Hierarchical URLs

* Add session auth

* Strong hierarchy

* Add filters

* Add i18n fields, questions

* More viewsets and serializers

* Ticket download

* Add OrderPosition serializer

* View-level permissions

* More tests

* More tests

* Add basic API docs

* Add REST API to docs frontpage

* Tests for order endpoints

* Add invoice tests

* Voucher and waitinglist tests

* Doc draft

* order docs

* Docs on all viewsets

* Disable DRF docs, style sphinx, style browsable API

* Fix tests

* deprecated imports

* Test foo

* Attendee names

* Fix migration problems

* Remove browsable API, plugin integration

* Doc fixes
2017-06-19 11:16:04 +02:00