Repository: fossasia/open-event-server

Issue:
Ticket PDF should exist for each attendee
Ticket PDF is currently associated with an order which should instead be associated with an attendee as each attendee should have a ticket


Discussion:
Taking this up!
@iamareebjamal - The ticket holder table has the column `pdf_url` which holds the value of the Ticket PDF. Can you explain me more here?
There is a single endpoint to download tickets for an order - https://github.com/fossasia/open-event-server/blob/47eb8e2adb18fc4b31ca8ea6c68f8b45ba36328a/app/api/custom/orders.py#L35-L38

This means I cannot download it for individual attendees
To clarify: Feature-wise we need both a) a way to download all tickets in an order in one PDF and b) a way to download each ticket and share access of different tickets within an order with the (intended) ticket holder. 

Who has access to tickets? 
1. The account/person who has made the order has access to all tickets of an order.
2. Different tickets within an order can be bought for different people. Each person has their own email address (and possibly existing account on the system, e.g. eventyay). So, each person should have access to the ticket(s) associated with their email address, but they should not have access to other tickets within the same order.
Other questions that need to be handled in subsequent issues (this is getting rather complex permission-wise):
* Who has access to the order invoice? -> Only the person ordering the tickets has access. Other people should be able to see the button "invoice" on their complete ticket/order page, but when they click on it (coming from the "My Tickets" page), they should see a message "Only the account that made the order is able to access this invoice."
* If a user has access to their tickets, they should not be able to see the list of all other tickets that are within that order, if they are not the account that made the order (the owner of the order). In that case show a message, e.g. with a star at the bottom of the table and within the box - something like `*Only the person or account that made the order is able to see all tickets in this order.`

Resolving patch:
diff --git a/app/api/helpers/order.py b/app/api/helpers/order.py
--- a/app/api/helpers/order.py
+++ b/app/api/helpers/order.py
@@ -88,21 +88,15 @@ def create_pdf_tickets_for_holder(order):
         order.tickets_pdf_url = pdf
 
         for holder in order.ticket_holders:
-            if (not holder.user) or holder.user.id != order.user_id:
-                # holder is not the order buyer.
-                pdf = create_save_pdf(
-                    render_template(
-                        'pdf/ticket_attendee.html', order=order, holder=holder
-                    ),
-                    UPLOAD_PATHS['pdf']['tickets_all'],
-                    dir_path='/static/uploads/pdf/tickets/',
-                    identifier=order.identifier,
-                    extra_identifiers={'extra_identifier': holder.id},
-                    upload_dir='generated/tickets/',
-                )
-            else:
-                # holder is the order buyer.
-                pdf = order.tickets_pdf_url
+            # create attendee pdf for every ticket holder
+            pdf = create_save_pdf(
+                render_template('pdf/ticket_attendee.html', order=order, holder=holder),
+                UPLOAD_PATHS['pdf']['tickets_all'],
+                dir_path='/static/uploads/pdf/tickets/',
+                identifier=order.identifier,
+                extra_identifiers={'extra_identifier': holder.id},
+                upload_dir='generated/tickets/',
+            )
             holder.pdf_url = pdf
             save_to_db(holder)
 


Test patch: