Voucher API: Add search parameter (Z#23240589)

* Event calendar: consider events without products "not available" for filtering

Also, drop the help text of the flag that is no longer accurate.

* Update src/pretix/presale/views/organizer.py

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

---------

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

doc/api/resources/vouchers.rst

@@ -116,6 +116,7 @@ Endpoints
 
    :query integer page: The page number in case of a multi-page result set, default is 1
    :query string code: Only show the voucher with the given voucher code.
+   :query string search: Only show the voucher with the given query found in the code, tag, or comment.
    :query integer max_usages: Only show vouchers with the given maximal number of usages.
    :query integer redeemed: Only show vouchers with the given number of redemptions. Note that this doesn't tell you if
                             the voucher can still be redeemed, as this also depends on ``max_usages``. See the

src/pretix/api/views/voucher.py

@@ -40,6 +40,7 @@ with scopes_disabled():
     class VoucherFilter(FilterSet):
         active = BooleanFilter(method='filter_active')
         code = CharFilter(lookup_expr='iexact')
+        search = CharFilter(method='search_qs')
 
         class Meta:
             model = Voucher
@@ -54,6 +55,9 @@ with scopes_disabled():
                 return queryset.filter(Q(redeemed__gte=F('max_usages')) |
                                        (Q(valid_until__isnull=False) & Q(valid_until__lte=now())))
 
+        def search_qs(self, qs, name, value):
+            return qs.filter(Q(code__icontains=value) | Q(tag__icontains=value) | Q(comment__icontains=value))
+
 
 class VoucherViewSet(viewsets.ModelViewSet):
     serializer_class = VoucherSerializer

src/pretix/base/forms/questions.py

@@ -899,7 +899,7 @@ class BaseQuestionsForm(forms.Form):
             field.widget.attrs['data-question-dependency-values'] = escapejson_attr(json.dumps(q.dependency_values))
             if q.type != 'M':
                 field.widget.attrs['required'] = q.required and not self.all_optional
-                field._required = q.required and not self.all_optional
+            field._required = q.required and not self.all_optional
             field.required = False
         return field
 
@@ -1497,7 +1497,8 @@ class BaseInvoiceAddressForm(forms.ModelForm):
             pass  # Skip re-validation if it is validated
         elif self.validate_vat_id and vat_id_applicable:
             try:
-                normalized_id = validate_vat_id(data.get('vat_id'), str(data.get('country')))
+                requester_id = self.request.event.settings.invoice_address_from_vat_id
+                normalized_id = validate_vat_id(data.get('vat_id'), str(data.get('country')), requester_id)
                 self.instance.vat_id_validated = bool(normalized_id)
                 self.instance.vat_id = data['vat_id'] = normalized_id
             except VATIDFinalError as e:

src/pretix/base/services/tax.py

@@ -343,6 +343,66 @@ def _validate_vat_id_EU(vat_id, country_code):
         return vat_id
 
 
+def _validate_vat_id_EU_fallback_germany(vat_id, country_code, requester_id):
+    # We can skip most static validation checks because _validate_vat_id_EU always runs before
+    vat_id = normalize_vat_id(vat_id, country_code)
+
+    # The VIES service of the European commission is overused and down due to rate limits A LOT. There is another
+    # API by German BZSt, but it only works if the requester is German and the requested is not.
+    # https://www.bzst.de/DE/Unternehmen/Identifikationsnummern/Umsatzsteuer-Identifikationsnummer/AuslaendischeUSt-IdNr/auslaendische_ust_idnr_node.html
+    try:
+        r = requests.post(
+            "https://api.evatr.vies.bzst.de/app/v1/abfrage",
+            json={
+                "anfragendeUstid": requester_id,
+                "angefragteUstid": vat_id,
+            },
+            timeout=10,
+        )
+        d = r.json()
+        if r.status_code == 200:
+            if d['status'] in ('evatr-0000', 'evatr-2008'):
+                # evatr-0000: Die angefragte Ust-IdNr. ist zum Anfragezeitpunkt gültig.
+                # evatr-2008: Die angefragte Ust-IdNr. ist zum Anfragezeitpunkt gültig.
+                #             Für die qualifizierte Bestätigungsanfrage liegt einer Besonderheit vor.
+                #             Für Rückfragen wenden Sie sich an das BZSt.
+                return vat_id
+            # evatr-2002: Die angefragte USt-IdNr. ist zum Anfragezeitpunkt nicht gültig.
+            #             Sie ist erst gültig ab dem Datum im Feld gueltigAb.
+            # evatr-2006: Die angefragte Ust-IdNr. ist zum Anfragezeitpunkt nicht gültig.
+            #             Sie war gültig im Zeitraum, der durch die Werte in den Feldern gueltigAb und gueltigBis beschrieben ist.
+            raise VATIDFinalError(error_messages['invalid'])
+        elif r.status_code == 400:
+            if d['status'] in ('evatr-0002', 'evatr-0004', 'evatr-0008'):
+                # evatr-0002: Mindestens eins der Pflichtfelder ist nicht besetzt.
+                # evatr-0004: Die anfragende DE Ust-IdNr. ist syntaktisch falsch. Sie passt nicht in das deutsche Erzeugungsschema.
+                # evatr-0008: Die maximale Anzahl von qualifizierten Bestätigungsabfragen für diese Session wurde erreicht.
+                #             Bitte starten Sie erneut mit einer einfachen Bestätigungsabfrage.
+                raise VATIDTemporaryError(error_messages['unavailable'])
+            # evatr-0005: Die angegebene angefragte Ust-IdNr. ist syntaktisch falsch.
+            # evatr-0012: Die angefrage USt-IdNr. ist syntaktisch falsch. Sie passt nicht in das Erzeugungsschema.
+            # evatr-2003: Das angegebene Länderkennzeichen der angefragten USt-IdNr. ist nicht gültig.
+            raise VATIDFinalError(error_messages['invalid'])
+        elif r.status_code == 403:
+            # evatr-0006: Die anfragende DE USt-IdNr. ist nicht berechtigt eine DE Ust-IdNr. anzufragen.
+            # evatr-0007: Fehlerhafter Aufruf.
+            raise VATIDTemporaryError(error_messages['unavailable'])
+        elif r.status_code == 404:
+            if d['status'] in ('evatr-2005'):
+                # evatr-2005: Die angegebene eigene DE Ust-IdNr. ist zum Anfragezeitpunkt nicht gültig.
+                raise VATIDTemporaryError(error_messages['unavailable'])
+            # evatr-2001: Die angefragte USt-IdNr. ist zum Anfragezeitpunkt nicht vergeben.
+            raise VATIDFinalError(error_messages['invalid'])
+        else:  # 500, 503
+            raise VATIDTemporaryError(error_messages['unavailable'])
+    except requests.RequestException:
+        logger.exception('VAT ID checking failed for country {}'.format(country_code))
+        raise VATIDTemporaryError(error_messages['unavailable'])
+    except ValueError:  # JSON parsing failed
+        logger.exception('VAT ID checking failed for country {}'.format(country_code))
+        raise VATIDTemporaryError(error_messages['unavailable'])
+
+
 def _validate_vat_id_CH(vat_id, country_code):
     if vat_id[:3] != 'CHE':
         raise VATIDFinalError(error_messages['country_mismatch'])
@@ -394,12 +454,18 @@ def _validate_vat_id_CH(vat_id, country_code):
         return vat_id
 
 
-def validate_vat_id(vat_id, country_code):
+def validate_vat_id(vat_id, country_code, requester_id=None):
     if not vat_id:
         return vat_id
     country_code = str(country_code)
     if is_eu_country(country_code):
-        return _validate_vat_id_EU(vat_id, country_code)
+        try:
+            return _validate_vat_id_EU(vat_id, country_code)
+        except VATIDTemporaryError:
+            if requester_id and requester_id.startswith("DE") and not vat_id.startswith("DE"):
+                return _validate_vat_id_EU_fallback_germany(vat_id, country_code, requester_id)
+            else:
+                raise
     elif country_code == 'CH':
         return _validate_vat_id_CH(vat_id, country_code)
     elif country_code == 'NO':

src/pretix/base/settings.py

@@ -1930,8 +1930,6 @@ DEFAULTS = {
         'serializer_class': serializers.BooleanField,
         'form_kwargs': dict(
             label=_("Hide all unavailable dates from calendar or list views"),
-            help_text=_("This option currently only affects the calendar of this event series, not the organizer-wide "
-                        "calendar.")
         )
     },
     'event_calendar_future_only': {

src/pretix/base/views/mixins.py

@@ -135,6 +135,8 @@ class BaseQuestionsViewMixin:
                             question_field.initial = getattr(question_field, 'initial', None) or src['initial']
                     if 'validators' in src:
                         question_field.validators += src['validators']
+                    if 'label' in src:
+                        question_field.label = src['label']
 
             if len(form.fields) > 0:
                 formlist.append(form)

src/pretix/control/views/orders.py

@@ -1646,7 +1646,8 @@ class OrderCheckVATID(OrderView):
                 return redirect(self.get_order_url())
 
             try:
-                normalized_id = validate_vat_id(ia.vat_id, str(ia.country))
+                requester_id = self.request.event.settings.invoice_address_from_vat_id
+                normalized_id = validate_vat_id(ia.vat_id, str(ia.country), requester_id)
                 with transaction.atomic():
                     ia.vat_id_validated = True
                     ia.vat_id = normalized_id

src/pretix/plugins/paypal2/views.py

@@ -494,6 +494,7 @@ def webhook(request, *args, **kwargs):
     elif payment.state in (OrderPayment.PAYMENT_STATE_PENDING, OrderPayment.PAYMENT_STATE_CREATED,
                            OrderPayment.PAYMENT_STATE_CANCELED, OrderPayment.PAYMENT_STATE_FAILED):
         if sale['status'] == 'COMPLETED':
+            any_captures = False
             all_captures_completed = True
             any_pending_review = False
             any_failed = None
@@ -505,6 +506,7 @@ def webhook(request, *args, **kwargs):
                     except ReferencedPayPalObject.MultipleObjectsReturned:
                         pass
 
+                    any_captures = True
                     if capture['status'] in ('COMPLETED', 'REFUNDED', 'PARTIALLY_REFUNDED'):
                         pass
                     elif capture['status'] in ("DECLINED", "FAILED"):
@@ -516,7 +518,7 @@ def webhook(request, *args, **kwargs):
                             any_pending_review = True
                     else:
                         raise ValueError("Unknown paypal capture state: {}".format(capture['status']))
-            if all_captures_completed:
+            if any_captures and all_captures_completed:
                 try:
                     payment.confirm()
                     prov.log_payment_duration(payment)

src/pretix/presale/checkoutflow.py

@@ -840,6 +840,8 @@ class QuestionsStep(CartQuestionsViewMixin, CartMixin, TemplateFlowStep):
                     f.fields[fname].disabled = val['disabled']
                 if 'validators' in val and fname in f.fields:
                     f.fields[fname].validators += val['validators']
+                if 'label' in val and fname in f.fields:
+                    f.fields[fname].label = val['label']
 
         return f
 
@@ -944,6 +946,8 @@ class QuestionsStep(CartQuestionsViewMixin, CartMixin, TemplateFlowStep):
                     f.fields[fname].disabled = val['disabled']
                 if 'validators' in val and fname in f.fields:
                     f.fields[fname].validators += val['validators']
+                if 'label' in val and fname in f.fields:
+                    f.fields[fname].label = val['label']
 
         return f
 

src/pretix/presale/signals.py

@@ -233,7 +233,7 @@ Arguments: ``request``, ``order``
 This signal allows you to override fields of the contact form that is presented during checkout
 and by default only asks for the email address. It is also being used for the invoice address
 form. You are supposed to return a dictionary of dictionaries with globally unique keys. The
-value-dictionary should contain one or more of the following keys: ``initial``, ``disabled``,
+value-dictionary should contain one or more of the following keys: ``label``, ``initial``, ``disabled``,
 ``validators``. The key of the dictionary should be the name of the form field.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event. A ``request``
@@ -264,9 +264,9 @@ Arguments: ``position``, ``request``
 This signal allows you to override fields of the questions form that is presented during checkout
 and by default only asks for the questions configured in the backend. You are supposed to return a
 dictionary of dictionaries with globally unique keys. The value-dictionary should contain one or
-more of the following keys: ``initial``, ``disabled``, ``validators``. The key of the dictionary
-should be the form field name for system fields (e.g. ``company``), or the question's ``identifier``
-for user-defined questions.
+more of the following keys: ``label``, ``initial``, ``disabled``, ``validators``. The key of the
+dictionary should be the form field name for system fields (e.g. ``company``), or the question's
+``identifier`` for user-defined questions.
 
 The ``position`` keyword argument will contain a ``CartPosition`` or ``OrderPosition`` object.
 

src/pretix/presale/views/event.py

@@ -79,7 +79,7 @@ from pretix.presale.signals import seatingframe_html_head
 from pretix.presale.views.organizer import (
     EventListMixin, add_subevents_for_days, days_for_template,
     filter_qs_by_attr, filter_subevents_with_plugins, has_before_after,
-    weeks_for_template,
+    should_hide_subevent, weeks_for_template,
 )
 
 from . import (
@@ -443,12 +443,10 @@ class EventIndex(EventViewMixin, EventListMixin, CartMixin, TemplateView):
                 )
             )
             subevents = filter_subevents_with_plugins(list(subevents), self.request.sales_channel)
-            context['subevent_list'] = subevents
-            if self.request.event.settings.event_list_available_only and not voucher:
-                context['subevent_list'] = [
-                    se for se in subevents
-                    if not se.presale_has_ended and (se.best_availability_state is None or se.best_availability_state >= Quota.AVAILABILITY_RESERVED)
-                ]
+            context['subevent_list'] = [
+                se for se in subevents
+                if not should_hide_subevent(self.request.event.settings, se, voucher)
+            ]
             context['visible_events'] = len(subevents) > 0
         return context
 

src/pretix/presale/views/organizer.py

@@ -601,6 +601,32 @@ def filter_subevents_with_plugins(subevents, sales_channel=None):
     return subevents
 
 
+def should_hide_subevent(settings, subevent, voucher=None):
+    hide = False
+    if settings.event_list_available_only:
+        hide = (
+            # Presale is over → the subevent is not available → hide
+            subevent.presale_has_ended or
+            # Not a single product is available on this sales channel → hide
+            # Note that means there could be products which are ignored for calendar availability (Quota.ignore_for_event_availability)
+            # or products only visible with a voucher. However, for customers with these scenarios, the event_list_available_only
+            # makes only very little sense as it would never do anything, so the flag can just be removed -- or the products should
+            # be made visible so people know why there are no products. In case a voucher is already entered on the calendar view,
+            # this is already respected and subevents are shown correctly.
+            subevent.best_availability_state is None or
+            (
+                # Sold out → hide, unless we have a voucher active that can bypass all quotas
+                (not voucher or not voucher.allow_ignore_quota) and
+                subevent.best_availability_state < Quota.AVAILABILITY_RESERVED
+            )
+        )
+
+    if settings.event_calendar_future_only:
+        if (subevent.date_to or subevent.date_from) < time_machine_now():
+            hide = True
+    return hide
+
+
 def add_subevents_for_days(qs, before, after, ebd, timezones, sales_channel, event=None, cart_namespace=None,
                            voucher=None):
     qs = qs.filter(active=True, is_public=True).filter(
@@ -640,19 +666,8 @@ def add_subevents_for_days(qs, before, after, ebd, timezones, sales_channel, eve
             kwargs['cart_namespace'] = cart_namespace
 
         s = event.settings if event else se.event.settings
-
-        if s.event_list_available_only:
-            hide = se.presale_has_ended or (
-                (not voucher or not voucher.allow_ignore_quota) and
-                se.best_availability_state is not None and
-                se.best_availability_state < Quota.AVAILABILITY_RESERVED
-            )
-            if hide:
-                continue
-
-        if s.event_calendar_future_only:
-            if (se.date_to or se.date_from) < time_machine_now():
-                continue
+        if should_hide_subevent(s, se, voucher):
+            continue
 
         timezones.add(s.timezone)
         tz = ZoneInfo(s.timezone)

src/pretix/presale/views/widget.py

@@ -75,7 +75,7 @@ from pretix.presale.views.cart import get_or_create_cart_id
 from pretix.presale.views.organizer import (
     EventListMixin, add_events_for_days, add_subevents_for_days,
     days_for_template, filter_qs_by_attr, filter_subevents_with_plugins,
-    weeks_for_template,
+    should_hide_subevent, weeks_for_template,
 )
 
 logger = logging.getLogger(__name__)
@@ -757,14 +757,10 @@ class WidgetAPIProductList(EventListMixin, View):
                         evs = evs[:limit]
 
                 tz = request.event.timezone
-                if self.request.event.settings.event_list_available_only:
-                    evs = [
-                        se for se in evs
-                        if not se.presale_has_ended and (
-                            se.best_availability_state is not None and
-                            se.best_availability_state >= Quota.AVAILABILITY_RESERVED
-                        )
-                    ]
+                evs = [
+                    se for se in evs
+                    if not should_hide_subevent(self.request.event.settings, se)
+                ]
 
                 data['events'] = [
                     {

src/pretix/static/pretixpresale/js/widget/widget.js

@@ -345,7 +345,7 @@ Vue.component('pricebox', {
         + '       :min="display_price_nonlocalized" :value="suggested_price_nonlocalized" :name="field_name"'
         + '       step="any" v-bind:aria-labelledby="aria_labelledby" v-bind:aria-describedby="price_desc_id">'
         + '</div>'
-        + '<small class="pretix-widget-pricebox-tax" :id="price_desc_id" v-if="price.rate != \'0\' && price.gross != \'0.00\'">'
+        + '<small class="pretix-widget-pricebox-tax" :id="price_desc_id" v-if="show_taxline">'
         + '{{ taxline }}'
         + '</small>'
         + '</div>'),
@@ -422,6 +422,10 @@ Vue.component('pricebox', {
                 return '<span class="pretix-widget-pricebox-currency">' + this.$root.currency + "</span> " + this.display_price;
             }
         },
+        show_taxline: function () {
+            // rate can either be "0.00" or "0" => parseFloat to check
+            return Number.parseFloat(this.price.rate) && Number.parseFloat(this.price.gross);
+        },
         taxline: function () {
             if (this.$root.display_net_prices) {
                 if (this.price.includes_mixed_tax_rate) {

src/pretix/static/pretixpresale/widget/src/components/PriceBox.vue

@@ -86,7 +86,8 @@ const taxline = computed(() => {
 	}
 })
 
-const showTaxline = computed(() => props.price.rate !== '0' && props.price.gross !== '0.00')
+// rate can either be "0.00" or "0" => parseFloat to check
+const showTaxline = computed(() => Number.parseFloat(props.price.rate) && Number.parseFloat(props.price.gross))
 </script>
 <template lang="pug">
 .pretix-widget-pricebox

src/tests/api/test_vouchers.py

@@ -115,6 +115,15 @@ def test_voucher_list(token_client, organizer, event, voucher, item, quota, sube
     )
     assert [] == resp.data['results']
 
+    resp = token_client.get(
+        '/api/v1/organizers/{}/events/{}/vouchers/?search={}'.format(organizer.slug, event.slug, voucher.code[:3])
+    )
+    assert [res] == resp.data['results']
+    resp = token_client.get(
+        '/api/v1/organizers/{}/events/{}/vouchers/?code=RAvRcnbDehWD59oywV5x'.format(organizer.slug, event.slug)
+    )
+    assert [] == resp.data['results']
+
     resp = token_client.get(
         '/api/v1/organizers/{}/events/{}/vouchers/?max_usages=1'.format(organizer.slug, event.slug)
     )

src/tests/plugins/paypal2/test_webhook.py

@@ -299,6 +299,30 @@ def get_test_order_review_pending():
                        'method': 'GET'}]}
 
 
+def get_test_empty_captures():
+    return {'id': '806440346Y391300T',
+            'intent': 'CAPTURE',
+            'status': 'COMPLETED',
+            'purchase_units': [{'reference_id': 'default',
+                                'amount': {'currency_code': 'EUR', 'value': '43.59'},
+                                'payee': {'email_address': 'dummy-facilitator@dummy.dummy',
+                                          'merchant_id': 'G6R2B9YXADKWW'},
+                                'description': 'Order JWJGC for PayPal v2',
+                                'custom_id': 'Order PAYPALV2-JWJGC',
+                                'soft_descriptor': 'MARTINFACIL',
+                                'payments': {'captures': []}
+                                }],
+            'payer': {'name': {'given_name': 'test', 'surname': 'buyer'},
+                      'email_address': 'dummy@dummy.dummy',
+                      'payer_id': 'Q739JNKWH67HE',
+                      'address': {'country_code': 'DE'}},
+            'create_time': '2022-04-28T11:59:59Z',
+            'update_time': '2022-04-28T12:00:22Z',
+            'links': [{'href': 'https://api.sandbox.paypal.com/v2/checkout/orders/806440346Y391300T',
+                       'rel': 'self',
+                       'method': 'GET'}]}
+
+
 class Object():
     pass
 
@@ -456,6 +480,100 @@ def test_webhook_all_good(env, client, monkeypatch):
     assert order.status == Order.STATUS_PAID
 
 
+@pytest.mark.django_db
+def test_webhook_empty_captures(env, client, monkeypatch):
+    order = env[1]
+    with scopes_disabled():
+        p = order.payments.first()
+        p.state = OrderPayment.PAYMENT_STATE_PENDING
+        p.save()
+        order.status = Order.STATUS_PENDING
+        order.save()
+
+    pp_order = Result(get_test_empty_captures())
+    monkeypatch.setattr("paypalcheckoutsdk.orders.OrdersGetRequest", lambda *args: pp_order)
+    monkeypatch.setattr("pretix.plugins.paypal2.payment.PaypalMethod.init_api", init_api)
+
+    with scopes_disabled():
+        ReferencedPayPalObject.objects.create(order=order, payment=order.payments.first(),
+                                              reference="806440346Y391300T")
+
+    client.post('/_paypal/webhook/', json.dumps(
+        {
+            "id": "WH-4T867178D0574904F-7TT11736YU643990P",
+            "create_time": "2022-04-28T12:00:37.077Z",
+            "resource_type": "checkout-order",
+            "event_type": "CHECKOUT.ORDER.COMPLETED",
+            "summary": "Checkout Order Completed",
+            "resource": {
+                "update_time": "2022-04-28T12:00:22Z",
+                "create_time": "2022-04-28T11:59:59Z",
+                "purchase_units": [
+                    {
+                        "reference_id": "default",
+                        "amount": {
+                            "currency_code": "EUR",
+                            "value": "43.59"
+                        },
+                        "payee": {
+                            "email_address": "dummy-facilitator@dummy.dummy",
+                            "merchant_id": "G6R2B9YXADKWW"
+                        },
+                        "description": "Order JWJGC for PayPal v2",
+                        "custom_id": "Order PAYPALV2-JWJGC",
+                        "soft_descriptor": "MARTINFACIL",
+                        "payments": {
+                            "captures": []
+                        }
+                    }
+                ],
+                "links": [
+                    {
+                        "href": "https://api.sandbox.paypal.com/v2/checkout/orders/806440346Y391300T",
+                        "rel": "self",
+                        "method": "GET"
+                    }
+                ],
+                "id": "806440346Y391300T",
+                "intent": "CAPTURE",
+                "payer": {
+                    "name": {
+                        "given_name": "test",
+                        "surname": "buyer"
+                    },
+                    "email_address": "dummy@dummy.dummy",
+                    "payer_id": "Q739JNKWH67HE",
+                    "address": {
+                        "country_code": "DE"
+                    }
+                },
+                "status": "COMPLETED"
+            },
+            "status": "SUCCESS",
+            "links": [
+                {
+                    "href": "https://api.sandbox.paypal.com/v1/notifications/webhooks-events/WH-4T867178D0574904F-7TT11736YU643990P",
+                    "rel": "self",
+                    "method": "GET",
+                    "encType": "application/json"
+                },
+                {
+                    "href": "https://api.sandbox.paypal.com/v1/notifications/webhooks-events/WH-4T867178D0574904F-7TT11736YU643990P/resend",
+                    "rel": "resend",
+                    "method": "POST",
+                    "encType": "application/json"
+                }
+            ],
+            "event_version": "1.0",
+            "resource_version": "2.0"
+        }
+    ), content_type='application_json')
+
+    order = env[1]
+    order.refresh_from_db()
+    assert order.status == Order.STATUS_PENDING
+
+
 @pytest.mark.django_db
 def test_webhook_mark_paid(env, client, monkeypatch):
     order = env[1]

vite.config.ts

@@ -31,6 +31,9 @@ export default defineConfig({
 			// Allow serving source files from sibling plugin directories
 			allow: ['src', ...pluginDirs],
 		},
+		cors: {
+			origin: /^https?:\/\/(?:(?:[^:]+\.)?localhost|127\.0\.0\.1|\[::1\]|[^:]+\.pretix\.(dev|work))(?::\d+)?$/
+		},
 	},
 	build: {
 		manifest: true,