Repository: fossasia/open-event-server

Issue:
Ticket PDF should exist for each attendee
Ticket PDF is currently associated with an order which should instead be associated with an attendee as each attendee should have a ticket


Discussion:
Taking this up!
@iamareebjamal - The ticket holder table has the column `pdf_url` which holds the value of the Ticket PDF. Can you explain me more here?
There is a single endpoint to download tickets for an order - https://github.com/fossasia/open-event-server/blob/47eb8e2adb18fc4b31ca8ea6c68f8b45ba36328a/app/api/custom/orders.py#L35-L38

This means I cannot download it for individual attendees
To clarify: Feature-wise we need both a) a way to download all tickets in an order in one PDF and b) a way to download each ticket and share access of different tickets within an order with the (intended) ticket holder. 

Who has access to tickets? 
1. The account/person who has made the order has access to all tickets of an order.
2. Different tickets within an order can be bought for different people. Each person has their own email address (and possibly existing account on the system, e.g. eventyay). So, each person should have access to the ticket(s) associated with their email address, but they should not have access to other tickets within the same order.
Other questions that need to be handled in subsequent issues (this is getting rather complex permission-wise):
* Who has access to the order invoice? -> Only the person ordering the tickets has access. Other people should be able to see the button "invoice" on their complete ticket/order page, but when they click on it (coming from the "My Tickets" page), they should see a message "Only the account that made the order is able to access this invoice."
* If a user has access to their tickets, they should not be able to see the list of all other tickets that are within that order, if they are not the account that made the order (the owner of the order). In that case show a message, e.g. with a star at the bottom of the table and within the box - something like `*Only the person or account that made the order is able to see all tickets in this order.`

Resolving patch:
diff --git a/app/api/attendees.py b/app/api/attendees.py
--- a/app/api/attendees.py
+++ b/app/api/attendees.py
@@ -142,6 +142,8 @@ def query(self, view_kwargs):
             ):
                 raise ForbiddenError({'source': ''}, 'Access Forbidden')
             query_ = query_.join(Order).filter(Order.id == order.id)
+            if current_user.id != order.user_id:
+                query_ = query_.filter(TicketHolder.user == current_user)
 
         if view_kwargs.get('ticket_id'):
             ticket = safe_query_kwargs(Ticket, view_kwargs, 'ticket_id')
diff --git a/app/api/schema/orders.py b/app/api/schema/orders.py
--- a/app/api/schema/orders.py
+++ b/app/api/schema/orders.py
@@ -107,7 +107,7 @@ def initial_values(self, data):
     )
 
     attendees = Relationship(
-        attribute='ticket_holders',
+        attribute='filtered_ticket_holders',
         self_view='v1.order_attendee',
         self_view_kwargs={'order_identifier': '<identifier>'},
         related_view='v1.attendee_list',
diff --git a/app/models/order.py b/app/models/order.py
--- a/app/models/order.py
+++ b/app/models/order.py
@@ -1,5 +1,6 @@
 import time
 
+from flask_jwt_extended import current_user
 from sqlalchemy.sql import func
 
 from app.api.helpers.db import get_new_identifier
@@ -154,6 +155,13 @@ def invoice_pdf_path(self) -> str:
             + '.pdf'
         )
 
+    @property
+    def filtered_ticket_holders(self):
+        query_ = TicketHolder.query.filter_by(order_id=self.id, deleted_at=None)
+        if current_user.id != self.user_id:
+            query_ = query_.filter(TicketHolder.user == current_user)
+        return query_.all()
+
     @property
     def site_view_link(self) -> str:
         frontend_url = get_settings()['frontend_url']


Test patch: