holding, validation improvements, perms

backend/clubs/migrations/0093_auto_20220706_0548.py

@@ -0,0 +1,51 @@
+# Generated by Django 3.2.8 on 2022-07-06 09:48
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+        ("clubs", "0092_auto_20220211_1732"),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name="ticket",
+            name="held",
+        ),
+        migrations.AddField(
+            model_name="ticket",
+            name="holder",
+            field=models.ForeignKey(
+                blank=True,
+                null=True,
+                on_delete=django.db.models.deletion.SET_NULL,
+                related_name="held_tickets",
+                to=settings.AUTH_USER_MODEL,
+            ),
+        ),
+        migrations.AlterField(
+            model_name="cart",
+            name="owner",
+            field=models.OneToOneField(
+                on_delete=django.db.models.deletion.CASCADE,
+                related_name="cart",
+                to=settings.AUTH_USER_MODEL,
+            ),
+        ),
+        migrations.AlterField(
+            model_name="ticket",
+            name="owner",
+            field=models.ForeignKey(
+                blank=True,
+                null=True,
+                on_delete=django.db.models.deletion.SET_NULL,
+                related_name="owned_tickets",
+                to=settings.AUTH_USER_MODEL,
+            ),
+        ),
+    ]

backend/clubs/models.py

@@ -1695,6 +1695,19 @@ class Cart(models.Model):
     )
 
 
+class TicketManager(models.Manager):
+
+    # Update holds for all tickets
+    def update_holds(self):
+        expired_tickets = self.select_for_update().filter(
+            holder__isnull=False, holding_expiration__lte=timezone.now()
+        )
+        with transaction.atomic():
+            for ticket in expired_tickets:
+                ticket.holder = None
+            self.bulk_update(expired_tickets, ["holder"])
+
+
 class Ticket(models.Model):
     """
     Represents an instance of a ticket for an event
@@ -1721,6 +1734,7 @@ class Ticket(models.Model):
     )
     holding_expiration = models.DateTimeField(null=True, blank=True)
     carts = models.ManyToManyField(Cart, related_name="tickets", blank=True)
+    objects = TicketManager()
 
     def get_qr(self):
         """

backend/clubs/permissions.py

@@ -188,7 +188,7 @@ def has_permission(self, request, view):
 
 class EventPermission(permissions.BasePermission):
     """
-    Officers and above can create/update/delete events.
+    Officers and above can create/update/delete events and view ticket buyers.
     Everyone else can view and list events.
     """
 
@@ -224,7 +224,14 @@ def has_object_permission(self, request, view, obj):
 
             if not old_type == FAIR_TYPE and new_type == FAIR_TYPE:
                 return False
-
+        elif view.action in ["buyers", "create_tickets"]:
+            if not request.user.is_authenticated:
+                return False
+            membership = find_membership_helper(request.user, obj.club)
+            return membership is not None and membership.role <= Membership.ROLE_OFFICER
+        elif view.action in ["add_to_cart", "remove_from_cart"]:
+            return request.user.is_authenticated
+        print("action", view.action)
         return True