wip

# Conflicts:
#	src/pretix/base/services/orders.py

src/pretix/api/views/order.py

@@ -381,12 +381,15 @@ class EventOrderViewSet(OrderViewSetMixin, viewsets.ModelViewSet):
                 resp = HttpResponse(ct.file.file.read(), content_type='text/uri-list')
                 return resp
             else:
-                resp = FileResponse(ct.file.file, content_type=ct.type)
-                resp['Content-Disposition'] = 'attachment; filename="{}-{}-{}{}"'.format(
-                    self.request.event.slug.upper(), order.code,
-                    provider.identifier, ct.extension
+                return FileResponse(
+                    ct.file.file,
+                    filename='{}-{}-{}{}'.format(
+                        self.request.event.slug.upper(), order.code,
+                        provider.identifier, ct.extension
+                    ),
+                    as_attachment=True,
+                    content_type=ct.type
                 )
-                return resp
 
     @action(detail=True, methods=['POST'])
     def mark_paid(self, request, **kwargs):
@@ -1303,14 +1306,17 @@ class EventOrderPositionViewSet(OrderPositionViewSetMixin, viewsets.ModelViewSet
             raise NotFound()
 
         ftype, ignored = mimetypes.guess_type(answer.file.name)
-        resp = FileResponse(answer.file, content_type=ftype or 'application/binary')
-        resp['Content-Disposition'] = 'attachment; filename="{}-{}-{}-{}"'.format(
-            self.request.event.slug.upper(),
-            pos.order.code,
-            pos.positionid,
-            os.path.basename(answer.file.name).split('.', 1)[1]
+        return FileResponse(
+            answer.file,
+            filename='{}-{}-{}-{}'.format(
+                self.request.event.slug.upper(),
+                pos.order.code,
+                pos.positionid,
+                os.path.basename(answer.file.name).split('.', 1)[1]
+            ),
+            as_attachment=True,
+            content_type=ftype or 'application/binary'
         )
-        return resp
 
     @action(detail=True, url_name="printlog", url_path="printlog", methods=["POST"])
     def printlog(self, request, **kwargs):
@@ -1365,15 +1371,18 @@ class EventOrderPositionViewSet(OrderPositionViewSetMixin, viewsets.ModelViewSet
             if hasattr(image_file, 'seek'):
                 image_file.seek(0)
 
-        resp = FileResponse(image_file, content_type=ftype or 'application/binary')
-        resp['Content-Disposition'] = 'attachment; filename="{}-{}-{}-{}.{}"'.format(
-            self.request.event.slug.upper(),
-            pos.order.code,
-            pos.positionid,
-            key,
-            extension,
+        return FileResponse(
+            image_file,
+            filename='{}-{}-{}-{}.{}'.format(
+                self.request.event.slug.upper(),
+                pos.order.code,
+                pos.positionid,
+                key,
+                extension,
+            ),
+            as_attachment=True,
+            content_type=ftype or 'application/binary'
         )
-        return resp
 
     @action(detail=True, url_name='download', url_path='download/(?P<output>[^/]+)')
     def download(self, request, output, **kwargs):
@@ -1399,12 +1408,15 @@ class EventOrderPositionViewSet(OrderPositionViewSetMixin, viewsets.ModelViewSet
                 resp = HttpResponse(ct.file.file.read(), content_type='text/uri-list')
                 return resp
             else:
-                resp = FileResponse(ct.file.file, content_type=ct.type)
-                resp['Content-Disposition'] = 'attachment; filename="{}-{}-{}-{}{}"'.format(
-                    self.request.event.slug.upper(), pos.order.code, pos.positionid,
-                    provider.identifier, ct.extension
+                return FileResponse(
+                    ct.file.file,
+                    filename='{}-{}-{}-{}{}'.format(
+                        self.request.event.slug.upper(), pos.order.code, pos.positionid,
+                        provider.identifier, ct.extension
+                    ),
+                    as_attachment=True,
+                    content_type=ct.type
                 )
-                return resp
 
     @action(detail=True, methods=['POST'])
     def regenerate_secrets(self, request, **kwargs):
@@ -1986,9 +1998,12 @@ class InvoiceViewSet(viewsets.ReadOnlyModelViewSet):
         if not invoice.file:
             raise RetryException()
 
-        resp = FileResponse(invoice.file.file, content_type='application/pdf')
-        resp['Content-Disposition'] = 'attachment; filename="{}.pdf"'.format(invoice.number)
-        return resp
+        return FileResponse(
+            invoice.file.file,
+            filename='{}.pdf'.format(invoice.number),
+            as_attachment=True,
+            content_type='application/pdf'
+        )
 
     @action(detail=True, methods=['POST'])
     def transmit(self, request, **kwargs):

src/pretix/base/email.py

@@ -251,7 +251,7 @@ def create_connection(address, timeout=socket.getdefaulttimeout(),
     for res in socket.getaddrinfo(host, port, 0, socket.SOCK_STREAM):
         af, socktype, proto, canonname, sa = res
 
-        if not settings.get("MAIL_CUSTOM_SMTP_ALLOW_PRIVATE_NETWORKS", False):
+        if not getattr(settings, "MAIL_CUSTOM_SMTP_ALLOW_PRIVATE_NETWORKS", False):
             ip_addr = ipaddress.ip_address(sa[0])
             if ip_addr.is_multicast:
                 raise socket.error(f"Request to multicast address {sa[0]} blocked")

src/pretix/base/models/cancellation.py

@@ -0,0 +1,234 @@
+
+from dataclasses import dataclass
+from decimal import Decimal
+from functools import reduce
+from typing import Callable, Dict, List, Literal, Optional, Set
+
+from django.core.exceptions import ValidationError
+from django.core.validators import MaxValueValidator, MinValueValidator
+from django.db import models
+from django.db.models import Prefetch
+from django.utils.translation import gettext_lazy as _
+
+from pretix.base.decimal import round_decimal
+from pretix.base.models import Event, Item, ItemVariation, Order, OrderPosition
+from pretix.base.reldate import ModelRelativeDateTimeField
+from pretix.base.timemachine import time_machine_now
+
+
+@dataclass(frozen=True)
+class CancellationCheckResult:
+    cancellation_possible: bool
+    reason: str
+
+
+# Maps Check identifier → cancellation check result
+CancellationCheckResultsById = Dict[str, CancellationCheckResult]
+
+
+CheckFn = Callable[[Order, Set[OrderPosition], Optional[OrderPosition]], CancellationCheckResultsById]
+
+FeeType = Literal['position_fee', 'process_fee']
+
+
+class Ruling:
+    """
+    A Ruling is the result of applying a CancellationRule onto an Order or OrderPosition.
+    """
+    rule_id: int
+    results: CancellationCheckResultsById
+    fee_type: FeeType
+    fee: Decimal
+    cancellation_possible: bool
+
+    def __init__(
+            self,
+            rule_id: int,
+            results: CancellationCheckResultsById,
+            fee_type: FeeType,
+            fee: Decimal
+    ):
+        self.rule_id = rule_id
+        self.results = results
+        self.fee_type = fee_type
+        self.fee = fee
+        self.cancellation_possible = all(ruling.cancellation_possible for ruling in results.values())
+
+    @classmethod
+    def from_absolute_fee(
+            cls,
+            rule_id: int,
+            results: CancellationCheckResultsById,
+            fee_type: FeeType,
+            absolute_fee: Decimal
+    ) -> "Ruling":
+        """
+        Constructs a Ruling with an absolute fee.
+        :param rule_id: Id of the rule
+        :param results: CheckResult object
+        :param fee_type: If the fee is calculated for a position or process fee
+        :param absolute_fee: amount of the fee
+        :return:
+        """
+        return Ruling(rule_id=rule_id, results=results, fee_type=fee_type, fee=absolute_fee)
+
+    @classmethod
+    def from_relative_fee(
+            cls,
+            rule_id: int,
+            results: CancellationCheckResultsById,
+            fee_type: Literal['position_fee'],
+            reference_price: Decimal,
+            percentage: Decimal,
+            currency: str
+    ) -> "Ruling":
+        """
+        Constructs a Ruling with an absolute fee.
+        :param rule_id: ID of the rule
+        :param results: CheckResult object
+        :param fee_type: Must be a position_fee as the fee can only be in reference to a position
+        :param reference_price: Price of the position to reference
+        :param percentage: Percentage of the reference_price set as the fee
+        :param currency: Currency of the reference_price, used for correct rounding of the fee
+        :return:
+        """
+        if fee_type == "process_fee":
+            raise ValidationError("Process fee cannot be used with relative fees")
+
+        return Ruling(
+            rule_id=rule_id,
+            results=results,
+            fee_type=fee_type,
+            fee=round_decimal(reference_price * (percentage / 100), currency)
+        )
+
+    def __lt__(self, other):
+        if not isinstance(other, Ruling):
+            return NotImplemented
+
+        if self.fee_type != other.fee_type:
+            return NotImplemented
+
+        if self.cancellation_possible == other.cancellation_possible:
+            return self.fee < other.fee
+        else:
+            return self.cancellation_possible and not other.cancellation_possible
+
+
+class CancellationRule(models.Model):
+    event = models.ForeignKey(
+        Event,
+        verbose_name=_("Event"),
+        related_name="orders",
+        on_delete=models.CASCADE
+    )
+
+    all_products = models.BooleanField(
+        verbose_name=_("All products and variations"),
+        default=True,
+    )
+    limit_products = models.ManyToManyField(Item, verbose_name=_("Products"), blank=True)
+    limit_variations = models.ManyToManyField(
+        ItemVariation, blank=True, verbose_name=_("Variations")
+    )
+
+
+    allowed_until = ModelRelativeDateTimeField(null=True, blank=True)
+    except_after = ModelRelativeDateTimeField(null=True, blank=True)
+
+    fee_percentage_per_item = models.DecimalField(
+        max_digits=5,
+        decimal_places=2,
+        validators=[MinValueValidator("0.00"), MaxValueValidator("100.00")],
+        verbose_name=_("Fee Percentage per OrderPosition"),
+        default=Decimal("0.00"),
+    )  # wird als sum() kombiniert
+    fee_absolute_per_item = models.DecimalField(
+        max_digits=13,
+        decimal_places=2,
+        verbose_name=_("Absolute fee per OrderPosition"),
+        default=Decimal("0.00"),
+    )  # wird als sum() kombiniert
+
+    fee_cancellation_process = models.DecimalField(
+        max_digits=13,
+        decimal_places=2,
+        verbose_name=_("Absolute fee per Cancellation"),
+        default=Decimal("0.00"),
+    )  # wird als max() kombiniert
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.checks: List[CheckFn] = [self._check_time_window]
+
+
+    # TODO implement order status check
+
+    def _check_time_window(self, order: Order, keep: Set[OrderPosition], position: OrderPosition) -> CancellationCheckResultsById:
+        check_id = "TIME_WINDOW"
+
+        if not self.allowed_until and not self.allowed_until:
+            return {check_id: CancellationCheckResult(
+                cancellation_possible=True,
+                reason="No time window specified",
+            )}
+
+        relevant_event = position.subevent or position.event
+        in_allowed_until = time_machine_now() < self.allowed_until.datetime(
+            relevant_event) if self.allowed_until else False
+        in_exemption = time_machine_now() > self.except_after.datetime(
+            relevant_event) if self.except_after else False
+
+        if in_allowed_until and not in_exemption:
+            except_after_message = f" and not after {self.except_after.datetime(relevant_event)}" if self.except_after else ""
+            return {check_id: CancellationCheckResult(
+                cancellation_possible=True,
+                reason=f"Cancellation in required time window before {self.allowed_until.datetime(relevant_event)}{except_after_message}",
+            )}
+        elif in_allowed_until and in_exemption:
+            return {check_id: CancellationCheckResult(
+                cancellation_possible=False,
+                reason=f"Cancellation in exemption period after {self.except_after.datetime(relevant_event)}",
+            )}
+        else:
+            return {check_id: CancellationCheckResult(
+                cancellation_possible=False,
+                reason=f"Cancellation after time window ending on {self.allowed_until.datetime(relevant_event)}",
+            )}
+
+    def check(self, system_check_results: List[CancellationCheckResult], order: Order, keep: Set[OrderPosition], position: OrderPosition) -> Optional[Ruling]:
+        if not self.all_products and position.item_id not in self.limit_products.values_list('pk', flat=True):
+            return None
+
+        if not self.all_products and position.variation_id not in self.limit_variations.values_list('pk', flat=True):
+            return None
+
+        check_results = [check(order, keep, position) for check in self.checks]
+
+        if self.fee_percentage_per_item and self.fee_absolute_per_item:
+            raise NotImplementedError("Should never be reached")
+        elif self.fee_absolute_per_item != Decimal(0.00):
+            return Ruling.from_absolute_fee(
+                    rule_id=self.id,
+                    results=reduce(lambda a, b: a | b, [*system_check_results, *check_results], {}),
+                    fee_type='position_fee',
+                    absolute_fee=self.fee_absolute_per_item
+                )
+        else:
+            return Ruling.from_relative_fee(
+                    rule_id=self.id,
+                    results=reduce(lambda a, b: a | b, [*system_check_results, *check_results], {}),
+                    fee_type='position_fee',
+                    reference_price=position.price,
+                    percentage=self.fee_absolute_per_item,
+                    currency=order.event.currency
+                )
+
+
+class CancellationCheck:
+    id: str
+    prefetches: List[Prefetch] = []
+    related_selects: List[str] = []
+
+    def check(self, order: Order, keep: Set[OrderPosition], order_position: OrderPosition) -> CancellationCheckResult:
+        raise NotImplementedError()

src/pretix/base/services/invoices.py

@@ -58,6 +58,7 @@ from pretix.base.invoicing.transmission import (
 from pretix.base.models import (
     ExchangeRate, Invoice, InvoiceAddress, InvoiceLine, Order, OrderFee,
 )
+from pretix.base.models.orders import OrderPayment
 from pretix.base.models.tax import EU_CURRENCIES
 from pretix.base.services.tasks import (
     TransactionAwareProfiledEventTask, TransactionAwareTask,
@@ -102,7 +103,7 @@ def build_invoice(invoice: Invoice) -> Invoice:
         introductory = invoice.event.settings.get('invoice_introductory_text', as_type=LazyI18nString)
         additional = invoice.event.settings.get('invoice_additional_text', as_type=LazyI18nString)
         footer = invoice.event.settings.get('invoice_footer_text', as_type=LazyI18nString)
-        if lp and lp.payment_provider:
+        if lp and lp.payment_provider and lp.state not in (OrderPayment.PAYMENT_STATE_FAILED, OrderPayment.PAYMENT_STATE_CANCELED):
             if 'payment' in inspect.signature(lp.payment_provider.render_invoice_text).parameters:
                 payment = str(lp.payment_provider.render_invoice_text(invoice.order, lp))
             else:

src/pretix/base/services/orders.py

@@ -41,8 +41,9 @@ from collections import Counter, defaultdict, namedtuple
 from datetime import datetime, time, timedelta
 from decimal import Decimal
 from functools import reduce
+from itertools import chain
 from time import sleep
-from typing import List, Optional
+from typing import Dict, List, Optional, Set
 
 from celery.exceptions import MaxRetriesExceededError
 from django.conf import settings
@@ -50,9 +51,10 @@ from django.core.cache import cache
 from django.core.exceptions import ValidationError
 from django.db import transaction
 from django.db.models import (
-    Count, Exists, F, IntegerField, Max, Min, OuterRef, Q, QuerySet, Sum,
-    Value,
+    Count, Exists, F, IntegerField, Max, Min, OuterRef, Prefetch, Q, QuerySet,
+    Sum, Value,
 )
+from django.db.models import Prefetch
 from django.db.models.functions import Coalesce, Greatest
 from django.db.transaction import get_connection
 from django.dispatch import receiver
@@ -67,10 +69,14 @@ from pretix.base.email import get_email_context
 from pretix.base.i18n import get_language_without_region, language
 from pretix.base.media import MEDIA_TYPES
 from pretix.base.models import (
-    CartPosition, Device, Event, GiftCard, Item, ItemVariation, LogEntry,
+    CartPosition, Checkin, Device, Event, GiftCard, Item, ItemVariation,
     Membership, Order, OrderPayment, OrderPosition, Quota, Seat,
     SeatCategoryMapping, User, Voucher,
 )
+from pretix.base.models.cancellation import (
+    CancellationCheckResult, CancellationCheckResultsById, CancellationRule,
+    Ruling, CancellationCheck
+)
 from pretix.base.models.event import SubEvent
 from pretix.base.models.orders import (
     BlockedTicketSecret, InvoiceAddress, OrderFee, OrderRefund,
@@ -103,11 +109,11 @@ from pretix.base.signals import (
     order_approved, order_canceled, order_changed, order_denied, order_expired,
     order_expiry_changed, order_fee_calculation, order_paid, order_placed,
     order_reactivated, order_split, order_valid_if_pending, periodic_task,
-    validate_order,
+    self_service_cancellation_checks, validate_order,
 )
 from pretix.base.timemachine import time_machine_now, time_machine_now_assigned
 from pretix.celery_app import app
-from pretix.helpers import OF_SELF
+from pretix.helpers import OF_SELF, ensure_no_queries
 from pretix.helpers.models import modelcopy
 from pretix.helpers.periodic import minimum_interval
 from pretix.testutils.middleware import debugflags_var
@@ -1618,7 +1624,7 @@ class OrderChangeManager:
     MembershipOperation = namedtuple('MembershipOperation', ('position', 'membership'))
     CancelOperation = namedtuple('CancelOperation', ('position', 'price_diff'))
     AddOperation = namedtuple('AddOperation', ('item', 'variation', 'price', 'addon_to', 'subevent', 'seat', 'membership',
-                                               'valid_from', 'valid_until', 'is_bundled', 'result', 'count'))
+                                               'valid_from', 'valid_until', 'is_bundled', 'result'))
     SplitOperation = namedtuple('SplitOperation', ('position',))
     FeeValueOperation = namedtuple('FeeValueOperation', ('fee', 'value', 'price_diff'))
     AddFeeOperation = namedtuple('AddFeeOperation', ('fee', 'price_diff'))
@@ -1632,24 +1638,16 @@ class OrderChangeManager:
     ForceRecomputeOperation = namedtuple('ForceRecomputeOperation', tuple())
 
     class AddPositionResult:
-        _positions: Optional[List[OrderPosition]]
+        _position: Optional[OrderPosition]
 
         def __init__(self):
-            self._positions = None
+            self._position = None
 
         @property
         def position(self) -> OrderPosition:
-            if self._positions is None:
+            if self._position is None:
                 raise RuntimeError("Order position has not been created yet. Call commit() first on OrderChangeManager.")
-            if len(self._positions) != 1:
-                raise RuntimeError("More than one position created.")
-            return self._positions[0]
-
-        @property
-        def positions(self) -> List[OrderPosition]:
-            if self._positions is None:
-                raise RuntimeError("Order position has not been created yet. Call commit() first on OrderChangeManager.")
-            return self._positions
+            return self._position
 
     def __init__(self, order: Order, user=None, auth=None, notify=True, reissue_invoice=True, allow_blocked_seats=False):
         self.order = order
@@ -1856,12 +1854,8 @@ class OrderChangeManager:
 
     def add_position(self, item: Item, variation: ItemVariation, price: Decimal, addon_to: OrderPosition = None,
                      subevent: SubEvent = None, seat: Seat = None, membership: Membership = None,
-                     valid_from: datetime = None, valid_until: datetime = None, count: int = 1) -> 'OrderChangeManager.AddPositionResult':
-        if count < 1:
-            raise ValueError("Count must be positive")
+                     valid_from: datetime = None, valid_until: datetime = None) -> 'OrderChangeManager.AddPositionResult':
         if isinstance(seat, str):
-            if count > 1:
-                raise ValueError("Cannot combine count > 1 with seat")
             if not seat:
                 seat = None
             else:
@@ -1915,14 +1909,14 @@ class OrderChangeManager:
         if self.order.event.settings.invoice_include_free or price.gross != Decimal('0.00'):
             self._invoice_dirty = True
 
-        self._totaldiff_guesstimate += price.gross * count
-        self._quotadiff.update({q: count for q in new_quotas})
+        self._totaldiff_guesstimate += price.gross
+        self._quotadiff.update(new_quotas)
         if seat:
             self._seatdiff.update([seat])
 
         result = self.AddPositionResult()
         self._operations.append(self.AddOperation(item, variation, price, addon_to, subevent, seat, membership,
-                                                  valid_from, valid_until, is_bundled, result, count))
+                                                  valid_from, valid_until, is_bundled, result))
         return result
 
     def split(self, position: OrderPosition):
@@ -2542,35 +2536,29 @@ class OrderChangeManager:
                     secret_dirty.remove(position)
                 position.save(update_fields=['canceled', 'secret'])
             elif isinstance(op, self.AddOperation):
-                new_pos = []
-                new_logs = []
-                for i in range(op.count):
-                    pos = OrderPosition.objects.create(
-                        item=op.item, variation=op.variation, addon_to=op.addon_to,
-                        price=op.price.gross, order=self.order, tax_rate=op.price.rate, tax_code=op.price.code,
-                        tax_value=op.price.tax, tax_rule=op.item.tax_rule,
-                        positionid=nextposid, subevent=op.subevent, seat=op.seat,
-                        used_membership=op.membership, valid_from=op.valid_from, valid_until=op.valid_until,
-                        is_bundled=op.is_bundled,
-                    )
-                    nextposid += 1
-                    new_pos.append(pos)
-                    new_logs.append(self.order.log_action('pretix.event.order.changed.add', user=self.user, auth=self.auth, data={
-                        'position': pos.pk,
-                        'item': op.item.pk,
-                        'variation': op.variation.pk if op.variation else None,
-                        'addon_to': op.addon_to.pk if op.addon_to else None,
-                        'price': op.price.gross,
-                        'positionid': pos.positionid,
-                        'membership': pos.used_membership_id,
-                        'subevent': op.subevent.pk if op.subevent else None,
-                        'seat': op.seat.pk if op.seat else None,
-                        'valid_from': op.valid_from.isoformat() if op.valid_from else None,
-                        'valid_until': op.valid_until.isoformat() if op.valid_until else None,
-                    }, save=False))
-
-                op.result._positions = new_pos
-                LogEntry.bulk_create_and_postprocess(new_logs)
+                pos = OrderPosition.objects.create(
+                    item=op.item, variation=op.variation, addon_to=op.addon_to,
+                    price=op.price.gross, order=self.order, tax_rate=op.price.rate, tax_code=op.price.code,
+                    tax_value=op.price.tax, tax_rule=op.item.tax_rule,
+                    positionid=nextposid, subevent=op.subevent, seat=op.seat,
+                    used_membership=op.membership, valid_from=op.valid_from, valid_until=op.valid_until,
+                    is_bundled=op.is_bundled,
+                )
+                nextposid += 1
+                self.order.log_action('pretix.event.order.changed.add', user=self.user, auth=self.auth, data={
+                    'position': pos.pk,
+                    'item': op.item.pk,
+                    'variation': op.variation.pk if op.variation else None,
+                    'addon_to': op.addon_to.pk if op.addon_to else None,
+                    'price': op.price.gross,
+                    'positionid': pos.positionid,
+                    'membership': pos.used_membership_id,
+                    'subevent': op.subevent.pk if op.subevent else None,
+                    'seat': op.seat.pk if op.seat else None,
+                    'valid_from': op.valid_from.isoformat() if op.valid_from else None,
+                    'valid_until': op.valid_until.isoformat() if op.valid_until else None,
+                })
+                op.result._position = pos
             elif isinstance(op, self.SplitOperation):
                 position = position_cache.setdefault(op.position.pk, op.position)
                 split_positions.append(position)
@@ -2895,7 +2883,7 @@ class OrderChangeManager:
         return total
 
     def _check_order_size(self):
-        if (len(self.order.positions.all()) + sum([op.count for op in self._operations if isinstance(op, self.AddOperation)])) > settings.PRETIX_MAX_ORDER_SIZE:
+        if (len(self.order.positions.all()) + len([op for op in self._operations if isinstance(op, self.AddOperation)])) > settings.PRETIX_MAX_ORDER_SIZE:
             raise OrderError(
                 self.error_messages['max_order_size'] % {
                     'max': settings.PRETIX_MAX_ORDER_SIZE,
@@ -2956,7 +2944,7 @@ class OrderChangeManager:
         ]) + len([
             o for o in self._operations if isinstance(o, self.SplitOperation)
         ])
-        adds = sum([o.count for o in self._operations if isinstance(o, self.AddOperation)])
+        adds = len([o for o in self._operations if isinstance(o, self.AddOperation)])
         if current > 0 and current - cancels + adds < 1:
             raise OrderError(self.error_messages['complete_cancel'])
 
@@ -3003,18 +2991,17 @@ class OrderChangeManager:
             elif isinstance(op, self.CancelOperation) and op.position in positions_to_fake_cart:
                 fake_cart.remove(positions_to_fake_cart[op.position])
             elif isinstance(op, self.AddOperation):
-                for i in range(op.count):
-                    cp = CartPosition(
-                        event=self.event,
-                        item=op.item,
-                        variation=op.variation,
-                        used_membership=op.membership,
-                        subevent=op.subevent,
-                        seat=op.seat,
-                    )
-                    cp.override_valid_from = op.valid_from
-                    cp.override_valid_until = op.valid_until
-                    fake_cart.append(cp)
+                cp = CartPosition(
+                    event=self.event,
+                    item=op.item,
+                    variation=op.variation,
+                    used_membership=op.membership,
+                    subevent=op.subevent,
+                    seat=op.seat,
+                )
+                cp.override_valid_from = op.valid_from
+                cp.override_valid_until = op.valid_until
+                fake_cart.append(cp)
         try:
             validate_memberships_in_order(self.order.customer, fake_cart, self.event, lock=True, ignored_order=self.order, testmode=self.order.testmode)
         except ValidationError as e:
@@ -3525,3 +3512,154 @@ def signal_listener_issue_media(sender: Event, order: Order, **kwargs):
                         'customer': order.customer_id,
                     }
                 )
+
+
+class OrderPositionNotUsedCheck(CancellationCheck):
+    id = "SYSTEM_TICKET_NOT_USED"
+    prefetches = [
+        Prefetch(
+            'checkins',
+            queryset=Checkin.objects.filter(list__consider_tickets_used=True),
+            to_attr='used_checkins'  # stores result in a list attribute
+        )
+    ]
+    related_selects = []
+
+    def check(self, order: Order, keep: Set[OrderPosition], order_position: OrderPosition) -> CancellationCheckResultsById:
+        if order_position.checkins.filter(list__consider_tickets_used=True).exists():
+            return {self.id: CancellationCheckResult(
+                cancellation_possible=False,
+                reason="Order position was used",
+            )}
+        else:
+            return {self.id: CancellationCheckResult(
+                cancellation_possible=True,
+                reason="Order position not yet used",
+            )}
+
+
+@receiver(self_service_cancellation_checks, dispatch_uid="pretixbase_not_used")
+def cancellation_checks_not_used(sender: Event):
+    return OrderPositionNotUsedCheck()
+
+
+class NotDiscountedCheck(CancellationCheck):
+    """
+    Check that ensures that orders containing discounted order_positions cannot
+    be canceled partially.
+    This is a stop-gap solution until the `discount_grouper` attribute for
+    AbstractPositions is introduced, allowing us to be more grannular
+    """
+
+    id = "SYSTEM_NO_DISCOUNTED_ORDER_POSITIONS"
+    prefetches = [
+    ]
+    related_selects = []
+
+    def check(self, order: Order, keep: Set[OrderPosition], order_position: OrderPosition) -> CancellationCheckResultsById:
+        cancellations = Set(order.positions).difference(keep)
+
+        if order_position in cancellations:
+            if order_position.discount_id is None:
+                return {self.id: CancellationCheckResult(
+                    cancellation_possible=True,
+                    reason=_("Order position was bought without discount"),
+                )}
+            else:
+                return {self.id: CancellationCheckResult(
+                    cancellation_possible=False,
+                    reason=_("Order position was bought with a discount"),
+                )}
+        else:
+            return {self.id: CancellationCheckResult(
+                cancellation_possible=False,
+                reason=_("Order position not canceled - check not applicable"),
+            )}
+
+
+@receiver(self_service_cancellation_checks, dispatch_uid="pretixbase_not_discountend")
+def cancellation_checks_not_discounted(sender: Event):
+    return NotDiscountedCheck()
+
+
+# TODO weitere System Checks
+# OrderPositions mit Item.min_per_order dürfen nur storniert werden, wenn genug übrig bleiben oder alle des gleichen Items storniert werden
+# OrderPositions mit addon_to != None dürfen nur über den bestehenden Add-On-Flow storniert werden
+# OrderPositions mit is_bundled dürfen nur mit der Parent-Position zusammen storniert werden
+
+# TODO transaktion
+def self_service_cancel(order: Order, keep: Set[OrderPosition], dry_run: bool):
+    """
+
+    :param order:
+    :param keep:
+    :param dry_run:
+    :return:
+    """
+    cancellation_checks: List[CancellationCheck] = [resp for recv, resp in self_service_cancellation_checks.send(event=order.event)]
+
+    position_rules = CancellationRule.objects.filter(event=order.event).filter("fee_cancellation_process" == Decimal("0.00")).all()
+    process_rules = CancellationRule.objects.filter(event=order.event).filter("fee_cancellation_process" != Decimal("0.00")).all()
+
+    # Todo get prefetches/selects from rules as well
+    prefetches = list(chain.from_iterable([cc.prefetches for cc in cancellation_checks]))
+    related_selects = list(chain.from_iterable(cc.related_selects for cc in cancellation_checks))
+
+    per_position_rulings: Dict[int, List[Ruling]] = {}
+
+    prefetched_order = Order.objects.select_related(related_selects).prefetch_related(*prefetches).get(pk=order.pk)
+    # All queries should be done by now
+    with ensure_no_queries():
+        for position in prefetched_order.positions:
+            position_rulings = []
+
+            system_check_results = [cc.check(prefetched_order, keep, position) for cc in cancellation_checks]
+
+            for rule in position_rules:
+                check_results = [check(prefetched_order, keep, position) for check in rule.checks]
+
+                if rule.fee_percentage_per_item and rule.fee_absolute_per_item:
+                    raise NotImplementedError("Should never be reached")
+                elif rule.fee_absolute_per_item != Decimal(0.00):
+                    position_rulings.append(
+                        Ruling.from_absolute_fee(
+                            rule_id=rule.id,
+                            results=reduce(lambda a, b: a | b, [*system_check_results, *check_results], {}),
+                            fee_type='position_fee',
+                            absolute_fee=rule.fee_absolute_per_item
+                        )
+                    )
+                else:
+                    position_rulings.append(
+                        Ruling.from_relative_fee(
+                            rule_id=rule.id,
+                            results=reduce(lambda a, b: a | b, [*system_check_results, *check_results], {}),
+                            fee_type='position_fee',
+                            reference_price=position.price,
+                            percentage=rule.fee_absolute_per_item,
+                            currency=order.event.currency
+                        )
+                    )
+            position_rulings.sort()
+            per_position_rulings[position.id] = position_rulings
+        effective_position_rulings = [op_rulings[0] for op_rulings in per_position_rulings.values()]
+
+        process_rulings: List[Ruling] = []
+
+        for rule in process_rules:
+            check_results = [check(prefetched_order, keep, position) for check in rule.checks]
+
+            process_rulings.append(Ruling.from_absolute_fee(
+                rule_id=rule.id,
+                results=reduce(lambda a, b: a | b, [*check_results], {}),
+                fee_type='process_fee',
+                absolute_fee=rule.fee_cancellation_process
+            ))
+
+        process_rulings.sort()
+
+        effective_process_ruling = process_rulings[0]
+
+        cancellation_possible = all([r.cancellation_possible for r in effective_position_rulings])
+
+    # TODO zusammenführen der Rulings

src/pretix/base/signals.py

@@ -1206,3 +1206,11 @@ This signal is sent out each time the information for a Device is modified.
 Both the original and updated versions of the Device are included to allow
 receivers to see what has been updated.
 """
+
+self_service_cancellation_checks = EventPluginSignal()
+"""
+This signal is sent out to collect checks to approve or deny a self service cancellation.
+You are expected to return a class instance that implements CancellationCheck.
+It is is expected that that the CheckFn will not issue any further queries.
+As with all event-plugin signals, the ``sender`` keyword argument will contain the event.
+"""

src/pretix/control/views/event.py

@@ -763,12 +763,7 @@ class InvoicePreview(EventPermissionRequiredMixin, View):
     def get(self, request, *args, **kwargs):
         fname, ftype, fcontent = build_preview_invoice_pdf(request.event)
         resp = HttpResponse(fcontent, content_type=ftype)
-        if settings.DEBUG:
-            # attachment is more secure as we're dealing with user-generated stuff here, but inline is much more convenient during debugging
-            resp['Content-Disposition'] = 'inline; filename="{}"'.format(fname)
-            resp._csp_ignore = True
-        else:
-            resp['Content-Disposition'] = 'attachment; filename="{}"'.format(fname)
+        resp['Content-Disposition'] = 'inline; filename="{}"'.format(fname)
         return resp
 
 

src/pretix/control/views/global_settings.py

@@ -300,5 +300,4 @@ class SysReportView(AdministratorPermissionRequiredMixin, TemplateView):
             resp = HttpResponse(data)
             resp['Content-Type'] = mime
             resp['Content-Disposition'] = 'inline; filename="{}"'.format(name)
-            resp._csp_ignore = True
             return resp

src/pretix/control/views/orders.py

@@ -710,22 +710,26 @@ class OrderDownload(AsyncAction, OrderView):
                 resp = HttpResponseRedirect(value.file.file.read())
                 return resp
             else:
-                resp = FileResponse(value.file.file, content_type=value.type)
-                resp['Content-Disposition'] = 'attachment; filename="{}-{}-{}-{}{}"'.format(
-                    self.request.event.slug.upper(), self.order.code, self.order_position.positionid,
-                    self.output.identifier, value.extension
+                return FileResponse(
+                    value.file.file,
+                    filename='{}-{}-{}-{}{}'.format(
+                        self.request.event.slug.upper(), self.order.code, self.order_position.positionid,
+                        self.output.identifier, value.extension
+                    ),
+                    content_type=value.type
                 )
-                return resp
         elif isinstance(value, CachedCombinedTicket):
             if value.type == 'text/uri-list':
                 resp = HttpResponseRedirect(value.file.file.read())
                 return resp
             else:
-                resp = FileResponse(value.file.file, content_type=value.type)
-                resp['Content-Disposition'] = 'attachment; filename="{}-{}-{}{}"'.format(
-                    self.request.event.slug.upper(), self.order.code, self.output.identifier, value.extension
+                return FileResponse(
+                    value.file.file,
+                    filename='{}-{}-{}{}'.format(
+                        self.request.event.slug.upper(), self.order.code, self.output.identifier, value.extension
+                    ),
+                    content_type=value.type
                 )
-                return resp
         else:
             return redirect(self.get_self_url())
 
@@ -1831,15 +1835,15 @@ class InvoiceDownload(EventPermissionRequiredMixin, View):
             return redirect(self.get_order_url())
 
         try:
-            resp = FileResponse(self.invoice.file.file, content_type='application/pdf')
+            return FileResponse(
+                self.invoice.file.file,
+                filename='{}.pdf'.format(re.sub("[^a-zA-Z0-9-_.]+", "_", self.invoice.number)),
+                content_type='application/pdf'
+            )
         except FileNotFoundError:
             invoice_pdf_task.apply(args=(self.invoice.pk,))
             return self.get(request, *args, **kwargs)
 
-        resp['Content-Disposition'] = 'inline; filename="{}.pdf"'.format(re.sub("[^a-zA-Z0-9-_.]+", "_", self.invoice.number))
-        resp._csp_ignore = True  # Some browser's PDF readers do not work with CSP
-        return resp
-
 
 class OrderExtend(OrderView):
     permission = 'event.orders:write'

src/pretix/control/views/pdf.py

@@ -263,12 +263,7 @@ class BaseEditorView(EventPermissionRequiredMixin, TemplateView):
 
             resp = HttpResponse(data, content_type=mimet)
             ftype = fname.split(".")[-1]
-            if settings.DEBUG:
-                # attachment is more secure as we're dealing with user-generated stuff here, but inline is much more convenient during debugging
-                resp['Content-Disposition'] = 'inline; filename="ticket-preview.{}"'.format(ftype)
-                resp._csp_ignore = True
-            else:
-                resp['Content-Disposition'] = 'attachment; filename="ticket-preview.{}"'.format(ftype)
+            resp['Content-Disposition'] = 'inline; filename="ticket-preview.{}"'.format(ftype)
             return resp
         elif "data" in request.POST:
             if cf:
@@ -309,6 +304,5 @@ class FontsCSSView(TemplateView):
 class PdfView(TemplateView):
     def get(self, request, *args, **kwargs):
         cf = get_object_or_404(CachedFile, id=kwargs.get("filename"), filename="background_preview.pdf")
-        resp = FileResponse(cf.file, content_type='application/pdf')
-        resp['Content-Disposition'] = 'attachment; filename="{}"'.format(cf.filename)
+        resp = FileResponse(cf.file, filename=cf.filename, content_type='application/pdf')
         return resp

src/pretix/helpers/database.py

@@ -20,6 +20,7 @@
 # <https://www.gnu.org/licenses/>.
 #
 import contextlib
+import logging
 
 from django.conf import settings
 from django.core.exceptions import FieldDoesNotExist, ImproperlyConfigured
@@ -29,6 +30,8 @@ from django.db.models import (
 )
 from django.utils.functional import lazy
 
+logger = logging.getLogger(__name__)
+
 
 class DummyRollbackException(Exception):
     pass
@@ -280,3 +283,21 @@ def get_deterministic_ordering(model, ordering):
             # on the primary key to provide total ordering.
             ordering.append("-pk")
     return ordering
+
+
+@contextlib.contextmanager
+def ensure_no_queries():
+    """
+    Ensures that no database queries are being made in that context.
+    Raises a RuntimeError if running in DEBUG mode, otherwise logs
+    an error.
+    :return:
+    """
+    def blocker(*args, **kwargs):
+        if settings.DEBUG:
+            raise RuntimeError(f"Unexpected DB query: {args[0]}")
+        else:
+            logger.error("Unexpected DB query: %s", args[0])
+
+    with connection.execute_wrapper(blocker):
+        yield

src/pretix/locale/da/LC_MESSAGES/django.po

@@ -4,16 +4,16 @@ msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-03-30 11:22+0000\n"
-"PO-Revision-Date: 2026-03-05 20:00+0000\n"
+"PO-Revision-Date: 2026-04-13 14:01+0000\n"
 "Last-Translator: Mie Frydensbjerg <mif@aarhus.dk>\n"
-"Language-Team: Danish <https://translate.pretix.eu/projects/pretix/pretix/da/"
-">\n"
+"Language-Team: Danish <https://translate.pretix.eu/projects/pretix/pretix/"
+"da/>\n"
 "Language: da\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 5.16.1\n"
+"X-Generator: Weblate 5.16.2\n"
 
 #: pretix/_base_settings.py:87
 msgid "English"
@@ -36078,7 +36078,6 @@ msgstr "Book nu"
 #: pretix/presale/templates/pretixpresale/fragment_event_list_status.html:38
 #: pretix/presale/templates/pretixpresale/fragment_week_calendar.html:74
 #: pretix/presale/views/widget.py:463
-#, fuzzy
 msgid "Fully booked"
 msgstr "Fuldt booket"
 

src/pretix/plugins/paypal2/views.py

@@ -216,7 +216,7 @@ class PayView(PaypalOrderView, TemplateView):
 
 
 @scopes_disabled()
-@event_permission_required('event.settings.general:write')
+@event_permission_required('event.settings.payment:write')
 def isu_return(request, *args, **kwargs):
     getparams = ['merchantId', 'merchantIdInPayPal', 'permissionsGranted', 'accountStatus', 'consentStatus', 'productIntentID', 'isEmailConfirmed']
     sessionparams = ['payment_paypal_isu_event', 'payment_paypal_isu_tracking_id']
@@ -526,7 +526,7 @@ def webhook(request, *args, **kwargs):
     return HttpResponse(status=200)
 
 
-@event_permission_required('event.settings.general:write')
+@event_permission_required('event.settings.payment:write')
 @require_POST
 def isu_disconnect(request, **kwargs):
     del request.event.settings.payment_paypal_connect_refresh_token

src/pretix/presale/urls.py

@@ -91,6 +91,9 @@ event_patterns = [
     re_path(r'w/(?P<cart_namespace>[a-zA-Z0-9]{16})/cart/add',
             csrf_exempt(pretix.presale.views.cart.CartAdd.as_view()),
             name='event.cart.add'),
+    re_path(r'w/(?P<cart_namespace>[a-zA-Z0-9]{16})/cart/create',
+            csrf_exempt(pretix.presale.views.cart.CartCreate.as_view()),
+            name='event.cart.create'),
 
     re_path(r'unlock/(?P<hash>[a-z0-9]{64})/$', pretix.presale.views.user.UnlockHashView.as_view(),
             name='event.payment.unlock'),

src/pretix/presale/views/cart.py

@@ -555,6 +555,18 @@ class CartClear(EventViewMixin, CartActionMixin, AsyncAction, View):
                        request.sales_channel.identifier, time_machine_now(default=None))
 
 
+@method_decorator(allow_cors_if_namespaced, 'dispatch')
+class CartCreate(EventViewMixin, CartActionMixin, View):
+    def get(self, request, *args, **kwargs):
+        if 'ajax' in self.request.GET:
+            cart_id = get_or_create_cart_id(self.request, create=True)
+            return JsonResponse({
+                'cart_id': cart_id,
+            })
+        else:
+            return redirect_to_url(self.get_success_url())
+
+
 @method_decorator(allow_frame_if_namespaced, 'dispatch')
 class CartExtendReservation(EventViewMixin, CartActionMixin, AsyncAction, View):
     task = extend_cart_reservation
@@ -843,9 +855,13 @@ class AnswerDownload(EventViewMixin, View):
             return Http404()
 
         ftype, _ = mimetypes.guess_type(answer.file.name)
-        resp = FileResponse(answer.file, content_type=ftype or 'application/binary')
-        resp['Content-Disposition'] = 'attachment; filename="{}-cart-{}"'.format(
+        filename = '{}-cart-{}'.format(
             self.request.event.slug.upper(),
             os.path.basename(answer.file.name).split('.', 1)[1]
-        ).encode("ascii", "ignore")
+        )
+        resp = FileResponse(
+            answer.file,
+            filename=filename,
+            content_type=ftype or 'application/binary'
+        )
         return resp

src/pretix/presale/views/order.py

@@ -1220,30 +1220,26 @@ class OrderDownloadMixin:
                 resp = HttpResponseRedirect(value.file.file.read())
                 return resp
             else:
-                resp = FileResponse(value.file.file, content_type=value.type)
-                if self.order_position.subevent:
-                    # Subevent date in filename improves accessibility e.g. for screen reader users
-                    resp['Content-Disposition'] = 'attachment; filename="{}-{}-{}-{}-{}{}"'.format(
-                        self.request.event.slug.upper(), self.order.code, self.order_position.positionid,
-                        self.order_position.subevent.date_from.strftime('%Y_%m_%d'),
-                        self.output.identifier, value.extension
-                    )
-                else:
-                    resp['Content-Disposition'] = 'attachment; filename="{}-{}-{}-{}{}"'.format(
-                        self.request.event.slug.upper(), self.order.code, self.order_position.positionid,
-                        self.output.identifier, value.extension
-                    )
-                return resp
+                name_parts = (
+                    self.request.event.slug.upper(),
+                    self.order.code,
+                    str(self.order_position.positionid),
+                    self.order_position.subevent.date_from.strftime('%Y_%m_%d') if self.order_position.subevent else None,
+                    self.output.identifier
+                )
+                filename = "-".join(filter(None, name_parts)) + value.extension
+                return FileResponse(value.file.file, filename=filename, content_type=value.type)
         elif isinstance(value, CachedCombinedTicket):
             if value.type == 'text/uri-list':
                 resp = HttpResponseRedirect(value.file.file.read())
                 return resp
             else:
-                resp = FileResponse(value.file.file, content_type=value.type)
-                resp['Content-Disposition'] = 'attachment; filename="{}-{}-{}{}"'.format(
-                    self.request.event.slug.upper(), self.order.code, self.output.identifier, value.extension
+                return FileResponse(
+                    value.file.file,
+                    filename="{}-{}-{}{}".format(
+                        self.request.event.slug.upper(), self.order.code, self.output.identifier, value.extension),
+                    content_type=value.type
                 )
-                return resp
         else:
             return redirect(self.get_self_url())
 
@@ -1383,13 +1379,14 @@ class InvoiceDownload(EventViewMixin, OrderDetailMixin, View):
             return redirect(self.get_order_url())
 
         try:
-            resp = FileResponse(invoice.file.file, content_type='application/pdf')
+            return FileResponse(
+                invoice.file.file,
+                filename='{}.pdf'.format(re.sub("[^a-zA-Z0-9-_.]+", "_", invoice.number)),
+                content_type='application/pdf'
+            )
         except FileNotFoundError:
             invoice_pdf_task.apply(args=(invoice.pk,))
             return self.get(request, *args, **kwargs)
-        resp['Content-Disposition'] = 'inline; filename="{}.pdf"'.format(re.sub("[^a-zA-Z0-9-_.]+", "_", invoice.number))
-        resp._csp_ignore = True  # Some browser's PDF readers do not work with CSP
-        return resp
 
 
 class OrderChangeMixin:

src/pretix/static/pretixpresale/js/widget/widget.js

@@ -110,6 +110,10 @@ var setCookie = function (cname, cvalue, exdays) {
     var d = new Date();
     d.setTime(d.getTime() + (exdays * 24 * 60 * 60 * 1000));
     var expires = "expires=" + d.toUTCString();
+    if (!cvalue) {
+        var expires = "expires=Thu, 01 Jan 1970 00:00:00 GMT";
+        cvalue = "";
+    }
     document.cookie = cname + "=" + cvalue + ";" + expires + ";path=/";
 };
 var getCookie = function (name) {
@@ -726,17 +730,16 @@ var shared_methods = {
     buy_callback: function (data) {
         if (data.redirect) {
             if (data.cart_id) {
-                this.$root.cart_id = data.cart_id;
-                setCookie(this.$root.cookieName, data.cart_id, 30);
+                this.$root.set_cart_id(data.cart_id);
             }
             if (data.redirect.substr(0, 1) === '/') {
                 data.redirect = this.$root.target_url.replace(/^([^\/]+:\/\/[^\/]+)\/.*$/, "$1") + data.redirect;
             }
             var url = data.redirect;
             if (url.indexOf('?')) {
-                url = url + '&iframe=1&locale=' + lang + '&take_cart_id=' + this.$root.cart_id;
+                url = url + '&iframe=1&locale=' + lang + '&take_cart_id=' + encodeURIComponent(this.$root.get_cart_id());
             } else {
-                url = url + '?iframe=1&locale=' + lang + '&take_cart_id=' + this.$root.cart_id;
+                url = url + '?iframe=1&locale=' + lang + '&take_cart_id=' + encodeURIComponent(this.$root.get_cart_id());
             }
             url += this.$root.consent_parameter;
             if (this.$root.additionalURLParams) {
@@ -779,15 +782,24 @@ var shared_methods = {
         }
     },
     resume: function () {
+        if (!this.$root.get_cart_id() && this.$root.keep_cart) {
+            // create an empty cart whose id we can persist
+            this.$root.create_cart(this.resume)
+            return;
+        }
         var redirect_url;
         redirect_url = this.$root.target_url + 'w/' + widget_id + '/';
-        if (this.$root.subevent && !this.$root.cart_id) {
+        if (this.$root.subevent && this.$root.is_button && this.$root.items.length === 0) {
             // button with subevent but no items
             redirect_url += this.$root.subevent + '/';
         }
         redirect_url += '?iframe=1&locale=' + lang;
-        if (this.$root.cart_id) {
-            redirect_url += '&take_cart_id=' + this.$root.cart_id;
+        if (this.$root.get_cart_id()) {
+            redirect_url += '&take_cart_id=' + encodeURIComponent(this.$root.get_cart_id());
+            if (this.$root.keep_cart) {
+                // make sure the cart-id is used, even if the cart is currently empty
+                redirect_url += '&ajax=1'
+            }
         }
         if (this.$root.widget_data) {
             redirect_url += '&widget_data=' + encodeURIComponent(this.$root.widget_data_json);
@@ -1864,12 +1876,11 @@ var shared_root_methods = {
         if (this.$root.variation_filter) {
             url += '&variations=' + encodeURIComponent(this.$root.variation_filter);
         }
-        var cart_id = getCookie(this.cookieName);
         if (this.$root.voucher_code) {
             url += '&voucher=' + encodeURIComponent(this.$root.voucher_code);
         }
-        if (cart_id) {
-            url += "&cart_id=" + encodeURIComponent(cart_id);
+        if (this.$root.get_cart_id()) {
+            url += "&cart_id=" + encodeURIComponent(this.$root.get_cart_id());
         }
         if (this.$root.date !== null) {
             url += "&date=" + this.$root.date.substr(0, 7);
@@ -1939,7 +1950,6 @@ var shared_root_methods = {
                 root.display_add_to_cart = data.display_add_to_cart;
                 root.waiting_list_enabled = data.waiting_list_enabled;
                 root.show_variations_expanded = data.show_variations_expanded || !!root.variation_filter;
-                root.cart_id = cart_id;
                 root.cart_exists = data.cart_exists;
                 root.vouchers_exist = data.vouchers_exist;
                 root.has_seating_plan = data.has_seating_plan;
@@ -2004,8 +2014,8 @@ var shared_root_methods = {
         if (this.$root.voucher_code) {
             redirect_url += '&voucher=' + encodeURIComponent(this.$root.voucher_code);
         }
-        if (this.$root.cart_id) {
-            redirect_url += '&take_cart_id=' + this.$root.cart_id;
+        if (this.$root.get_cart_id()) {
+            redirect_url += '&take_cart_id=' + encodeURIComponent(this.$root.get_cart_id());
         }
         if (this.$root.widget_data) {
             redirect_url += '&widget_data=' + encodeURIComponent(this.$root.widget_data_json);
@@ -2027,7 +2037,28 @@ var shared_root_methods = {
         this.$root.subevent = event.subevent;
         this.$root.loading++;
         this.$root.reload();
-    }
+    },
+    create_cart: function(callback) {
+        var url = this.$root.target_url + 'w/' + widget_id + '/cart/create?ajax=1';
+
+        this.$root.overlay.frame_loading = true;
+        api._getJSON(url, (data) => {
+            this.$root.set_cart_id(data.cart_id);
+            this.$root.overlay.frame_loading = false;
+            callback()
+        }, () => {
+            this.$root.overlay.error_message = strings['cart_error'];
+            this.$root.overlay.frame_loading = false;
+        })
+    },
+    get_cart_id: function() {
+        if (this.$root.keep_cart) {
+            return getCookie(this.$root.cookieName);
+        }
+    },
+    set_cart_id: function(newValue) {
+        setCookie(this.$root.cookieName, newValue, 30);
+    },
 };
 
 var shared_root_computed = {
@@ -2049,9 +2080,8 @@ var shared_root_computed = {
     },
     voucherFormTarget: function () {
         var form_target = this.target_url + 'w/' + widget_id + '/redeem?iframe=1&locale=' + lang;
-        var cookie = getCookie(this.cookieName);
-        if (cookie) {
-            form_target += "&take_cart_id=" + cookie;
+        if (this.get_cart_id()) {
+            form_target += "&take_cart_id=" + encodeURIComponent(this.get_cart_id());
         }
         if (this.subevent) {
             form_target += "&subevent=" + this.subevent;
@@ -2091,9 +2121,8 @@ var shared_root_computed = {
             checkout_url += '?' + this.$root.additionalURLParams;
         }
         var form_target = this.target_url + 'w/' + widget_id + '/cart/add?iframe=1&next=' + encodeURIComponent(checkout_url);
-        var cookie = getCookie(this.cookieName);
-        if (cookie) {
-            form_target += "&take_cart_id=" + cookie;
+        if (this.get_cart_id()) {
+            form_target += "&take_cart_id=" + encodeURIComponent(this.get_cart_id());
         }
         form_target += this.$root.consent_parameter
         return form_target
@@ -2329,6 +2358,7 @@ var create_widget = function (element, html_id=null) {
                 has_seating_plan: false,
                 has_seating_plan_waitinglist: false,
                 meta_filter_fields: [],
+                keep_cart: true,
             }
         },
         created: function () {
@@ -2366,6 +2396,7 @@ var create_button = function (element, html_id=null) {
     var raw_items = element.attributes.items ? element.attributes.items.value : "";
     var skip_ssl = element.attributes["skip-ssl-check"] ? true : false;
     var disable_iframe = element.attributes["disable-iframe"] ? true : false;
+    var keep_cart = element.attributes["keep-cart"] ? true : false;
     var button_text = element.innerHTML;
     var widget_data = JSON.parse(JSON.stringify(window.PretixWidget.widget_data));
     for (var i = 0; i < element.attributes.length; i++) {
@@ -2417,7 +2448,8 @@ var create_button = function (element, html_id=null) {
                 widget_data: widget_data,
                 widget_id: 'pretix-widget-' + widget_id,
                 html_id: html_id,
-                button_text: button_text
+                button_text: button_text,
+                keep_cart: keep_cart || items.length > 0,
             }
         },
         created: function () {
@@ -2426,7 +2458,7 @@ var create_button = function (element, html_id=null) {
             observer.observe(this.$el, observerOptions);
         },
         computed: shared_root_computed,
-        methods: shared_root_methods
+        methods: shared_root_methods,
     });
     create_overlay(app);
     return app;
@@ -2492,13 +2524,14 @@ window.PretixWidget.open = function (target_url, voucher, subevent, items, widge
                 frame_dismissed: false,
                 widget_data: all_widget_data,
                 widget_id: 'pretix-widget-' + widget_id,
-                button_text: ""
+                button_text: "",
+                keep_cart: true
             }
         },
         created: function () {
         },
         computed: shared_root_computed,
-        methods: shared_root_methods
+        methods: shared_root_methods,
     });
     create_overlay(app);
     app.$nextTick(function () {

src/tests/base/test_mail.py

@@ -610,7 +610,7 @@ PRIVATE_IPS_RES = [
 
 
 @contextmanager
-def test_mail_connection(res, should_connect, use_ssl):
+def assert_mail_connection(res, should_connect, use_ssl):
     with (
         mock.patch('socket.socket') as mock_socket,
         mock.patch('socket.getaddrinfo', return_value=res),
@@ -638,14 +638,14 @@ def test_mail_connection(res, should_connect, use_ssl):
 def test_private_smtp_ip(res, use_ssl, settings):
     settings.EMAIL_CUSTOM_SMTP_BACKEND = 'pretix.base.email.CheckPrivateNetworkSmtpBackend'
     settings.MAIL_CUSTOM_SMTP_ALLOW_PRIVATE_NETWORKS = False
-    with test_mail_connection(res=res, should_connect=False, use_ssl=use_ssl), pytest.raises(match="Request to .* blocked"):
+    with assert_mail_connection(res=res, should_connect=False, use_ssl=use_ssl), pytest.raises(match="Request to .* blocked"):
         connection = djmail.get_connection(backend=settings.EMAIL_CUSTOM_SMTP_BACKEND,
                                            host="localhost",
                                            use_ssl=use_ssl)
         connection.open()
 
     settings.MAIL_CUSTOM_SMTP_ALLOW_PRIVATE_NETWORKS = True
-    with test_mail_connection(res=res, should_connect=True, use_ssl=use_ssl):
+    with assert_mail_connection(res=res, should_connect=True, use_ssl=use_ssl):
         connection = djmail.get_connection(backend=settings.EMAIL_CUSTOM_SMTP_BACKEND,
                                            host="localhost",
                                            use_ssl=use_ssl)
@@ -662,7 +662,7 @@ def test_public_smtp_ip(use_ssl, allow_private, settings):
     settings.EMAIL_CUSTOM_SMTP_BACKEND = 'pretix.base.email.CheckPrivateNetworkSmtpBackend'
     settings.MAIL_CUSTOM_SMTP_ALLOW_PRIVATE_NETWORKS = allow_private
 
-    with test_mail_connection(res=[(socket.AF_INET, socket.SOCK_STREAM, 6, '', ('8.8.8.8', 443))], should_connect=True, use_ssl=use_ssl):
+    with assert_mail_connection(res=[(socket.AF_INET, socket.SOCK_STREAM, 6, '', ('8.8.8.8', 443))], should_connect=True, use_ssl=use_ssl):
         connection = djmail.get_connection(backend=settings.EMAIL_CUSTOM_SMTP_BACKEND,
                                            host="localhost",
                                            use_ssl=use_ssl)
@@ -702,7 +702,7 @@ def test_send_mail_private_ip(res, use_ssl, allow_private_networks, env):
         m.refresh_from_db()
         return m
 
-    with test_mail_connection(res=res, should_connect=allow_private_networks, use_ssl=use_ssl):
+    with assert_mail_connection(res=res, should_connect=allow_private_networks, use_ssl=use_ssl):
         m = send_mail()
         if allow_private_networks:
             assert m.status == OutgoingMail.STATUS_SENT

src/tests/base/test_self_service_cancellation.py

@@ -0,0 +1,216 @@
+from datetime import date, datetime, timedelta
+from decimal import Decimal
+from zoneinfo import ZoneInfo
+
+import pytest
+from django.utils.timezone import make_aware, now
+from django_scopes import scope
+from freezegun import freeze_time
+
+from pretix.base.models import Event, Item, Order, OrderPosition, Organizer
+from pretix.base.models.cancellation import CancellationRule, OrderDiff
+
+NOW = now()
+DAYS_UNTIL_EVENT=60
+EVENT_START = NOW+timedelta(days=DAYS_UNTIL_EVENT)
+
+
+
+@pytest.fixture()
+def event():
+    o = Organizer.objects.create(name='Dummy', slug='dummy', plugins='pretix.plugins.banktransfer')
+    event = Event.objects.create(
+        organizer=o, name='Dummy', slug='dummy',
+        date_from=EVENT_START,
+        plugins='pretix.plugins.banktransfer'
+    )
+    return event
+
+@pytest.fixture()
+def item1(event):
+    return Item.objects.create(event=event, name='Early-bird item1',
+                                 default_price=Decimal('23.00'), admission=True)
+
+@pytest.fixture()
+def order(event):
+    return Order.objects.create(
+        code='FOO', event=event, email='dummy@dummy.test',
+        status=Order.STATUS_PENDING, locale='en',
+        datetime=NOW,
+        total=0,
+        sales_channel=event.organizer.sales_channels.get(identifier="web"),
+    )
+
+
+@pytest.mark.django_db
+def test_status_rule(event, item1, order):
+    with scope(organizer=event.organizer, event=event):
+        op = OrderPosition.objects.create(
+            order=order, item=item1, variation=None,
+            price=Decimal("0.00"), attendee_name_parts={'full_name': "Peter"}, positionid=1
+        )
+
+        cancellation_rule = CancellationRule.objects.create(
+            organizer=event.organizer, event=event,
+            allowed_if_in_order_status=Order.STATUS_PENDING
+        )
+        cancellation_rule.items.set([item1])
+
+        diff = OrderDiff.cancel_all(order)
+
+        assert cancellation_rule._check_order_status(diff=diff, order_position=op) == {
+            'ORDER_STATUS': CheckRes(
+                cancellation_possible=True,
+                reason="Order in required status: 'n'",
+            ),
+        }
+
+        cancellation_rule = CancellationRule.objects.create(
+            organizer=event.organizer, event=event,
+            allowed_if_in_order_status=Order.STATUS_PAID
+        )
+        cancellation_rule.items.set([item1])
+
+        assert cancellation_rule._check_order_status(diff=diff, order_position=op) == {
+            'ORDER_STATUS': CheckRes(
+                cancellation_possible=False,
+                reason="Order in status 'n' cannot be canceled",
+            ),
+        }
+
+
+@pytest.mark.django_db
+def test_timing(event, item1, order):
+    with scope(organizer=event.organizer, event=event):
+        order.status = Order.STATUS_PAID
+        order.save()
+
+        OrderPosition.objects.create(
+            order=order, item=item1, variation=None,
+            price=Decimal("0.00"), attendee_name_parts={'full_name': "Peter"}, positionid=1
+        )
+
+        cr1 = CancellationRule.objects.create(
+            organizer=event.organizer, event=event,
+            allowed_until=now() + timedelta(hours=1),
+        )
+        cr1.items.set([item1])
+
+
+        diff = OrderDiff.cancel_all(order)
+
+        with freeze_time(now()):
+            possible, verdicts = CancellationRule.objects.all().cancellation_possible(diff)
+            assert possible == True
+
+        with freeze_time(now()+timedelta(hours=2)):
+            possible, verdicts=CancellationRule.objects.all().cancellation_possible(diff)
+            assert possible == False
+
+
+@pytest.mark.django_db
+def test_multiple_limits(event, item1, order):
+    with (scope(organizer=event.organizer, event=event)):
+        order.status = Order.STATUS_PAID
+        order.save()
+
+        OrderPosition.objects.create(
+            order=order, item=item1, variation=None,
+            price=Decimal("100.00"), attendee_name_parts={'full_name': "Peter"}, positionid=1
+        )
+
+        # free in the first hour after booking
+        cr1=CancellationRule.objects.create(
+            organizer=event.organizer, event=event,
+            allowed_until=NOW + timedelta(hours=1),
+        )
+        cr1.items.set([item1])
+
+        # free until 30 days before event
+        cr2 = CancellationRule.objects.create(
+            organizer=event.organizer, event=event,
+            allowed_until=EVENT_START - timedelta(days=30),
+        )
+        cr2.items.set([item1])
+
+        # 50% until 14 days before event
+        cr3 = CancellationRule.objects.create(
+            organizer=event.organizer, event=event,
+            allowed_until=EVENT_START - timedelta(days=14),
+            fee_percentage_per_item=Decimal(50.0)
+        )
+        cr3.items.set([item1])
+
+        # 80% until 7 days before event
+        cr4 = CancellationRule.objects.create(
+            organizer=event.organizer, event=event,
+            allowed_until=EVENT_START - timedelta(days=7),
+            fee_percentage_per_item=Decimal(80.0)
+        )
+        cr4.items.set([item1])
+
+        # 100% until 1 day before event
+        cr5 = CancellationRule.objects.create(
+            organizer=event.organizer, event=event,
+            allowed_until=EVENT_START - timedelta(days=1),
+            fee_percentage_per_item=Decimal(100)
+        )
+        cr5.items.set([item1])
+
+        # Cancellation is not allowed at all, but rule doesn't match the item
+        CancellationRule.objects.create(
+            organizer=event.organizer, event=event,
+            allowed_until=NOW,
+            fee_percentage_per_item=Decimal(100)
+        )
+
+
+        diff = OrderDiff.cancel_all(order)
+
+        possible_trace = []
+        cost_trace = []
+
+        for days in range(DAYS_UNTIL_EVENT):
+            today = NOW + timedelta(days=days)
+            with freeze_time(today):
+                possible, verdicts=CancellationRule.objects.all().cancellation_possible(
+                    diff)
+                possible_trace.append(possible)
+                cost_trace.append(verdicts[0].total_fee)
+
+        assert possible_trace == [True] * 59 + [False]
+        assert cost_trace == [Decimal("0.0000")] * 30 + \
+                             [Decimal("50.0000")] * 16 + \
+                             [Decimal("80.0000")] * 7 + \
+                             [Decimal("100.0000")] * 6 + \
+                             [Decimal("0.0000")]
+
+
+
+
+@pytest.mark.django_db
+def test_cancellation_rule_query_set(event, item1, order):
+    with scope(organizer=event.organizer, event=event):
+        OrderPosition.objects.create(
+            order=order, item=item1, variation=None,
+            price=Decimal("0.00"), attendee_name_parts={'full_name': "Peter"}, positionid=1
+        )
+
+        cr1 = CancellationRule.objects.create(
+            organizer=event.organizer, event=event,
+            allowed_if_in_order_status=Order.STATUS_PENDING, fee_absolute_per_order=Decimal('10.00'),
+        )
+        cr1.items.set([item1])
+
+
+        cr2 = CancellationRule.objects.create(
+            organizer=event.organizer, event=event,
+            allowed_if_in_order_status=Order.STATUS_PAID
+        )
+        cr2.items.set([item1])
+
+        diff = OrderDiff.cancel_all(order)
+
+        possible, verdicts = CancellationRule.objects.all().cancellation_possible(diff)
+
+        assert  possible == True