Anna Sirota
ba96ba9937
The following has changed:
* Products have their own /tickets/book/../ URLs
* Products only show up in product table if featured
* Products should link to Stripe prices instead of payment links
* Products have `taxes` field, which is a list of tax rules:
* this field is used to display VAT lines in invoices
* Tickets store Stripe checkout session data (to too many API calls)
* Ticket page shows Stripe's product image, if available
* Stripe webhook endpoint created, expecting the following events:
* `checkout.session.completed`
* `checkout.session.async_payment_succeeded`
* `payment_intent.requires_action`
* `charge.refunded`
* Full refund will un-claim everyone who claimed the affected ticket
* Invoice PDFs:
* with Stripe's bank transfer instructions
* refund date and amount
* CSV report supports Stripe-paid tickets
* CSV has new columns: VAT and refund
40 lines
1.4 KiB
Python
40 lines
1.4 KiB
Python
import logging
|
|
|
|
from django.contrib.auth.mixins import AccessMixin
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
class TicketClaimedOrBoughtRequiredMixin(AccessMixin):
|
|
"""Verify that current user has claimed or bought this ticket."""
|
|
|
|
def dispatch(self, request, *args, **kwargs):
|
|
ticket = self.get_object()
|
|
self.attendee = None
|
|
is_claimed_by = ticket.is_claimed_by(user_id=request.user.pk)
|
|
if ticket.user_id == request.user.pk or is_claimed_by:
|
|
if is_claimed_by:
|
|
self.attendee = request.user
|
|
return super().dispatch(request, *args, **kwargs)
|
|
logger.warning(
|
|
'User %s is attempting to access ticket %s, but they have no access to it',
|
|
request.user.pk,
|
|
ticket.pk,
|
|
)
|
|
return self.handle_no_permission()
|
|
|
|
|
|
class TicketBoughtRequiredMixin(AccessMixin):
|
|
"""Verify that current user has bought this ticket."""
|
|
|
|
def dispatch(self, request, *args, **kwargs):
|
|
ticket = self.get_object()
|
|
if ticket.user_id == request.user.pk or request.user.has_perm('tickets.view_ticket'):
|
|
return super().dispatch(request, *args, **kwargs)
|
|
logger.warning(
|
|
'User %s is attempting to access ticket %s, but they have no access to it',
|
|
request.user.pk,
|
|
ticket.pk,
|
|
)
|
|
return self.handle_no_permission()
|