Add Checkin API and Badge Preview and Download Feature

deployment/docker/nginx.conf

@@ -24,21 +24,26 @@ http {
 	server_names_hash_bucket_size 64;
 
 	include /etc/nginx/mime.types;
-	default_type application/octet-stream;
-	add_header X-Content-Type-Options nosniff;
+    default_type application/octet-stream;
 
 	access_log /var/log/nginx/access.log private;
 	error_log /var/log/nginx/error.log;
-	add_header Referrer-Policy same-origin;
 
 	gzip on;
 	gzip_disable "msie6";
-	gzip_types text/plain text/html text/css application/json application/javascript application/x-javascript text/javascript text/xml application/xml application/rss+xml application/atom+xml application/rdf+xml image/svg+xml;
+	gzip_types text/plain text/css application/json application/javascript application/x-javascript text/javascript text/xml application/xml application/rss+xml application/atom+xml application/rdf+xml image/svg+xml;
 	gzip_vary on;
 	gzip_proxied any;
 	gzip_comp_level 6;
 	gzip_buffers 16 8k;
 
+    map $http_origin $allowed_origin {
+        default "";
+        "https://access.eventyay.com" "https://access.eventyay.com";
+        "https://checkin.eventyay.com" "https://checkin.eventyay.com";
+        "https://another-domain.eventyay.com" "https://another-domain.eventyay.com";
+    }
+
 	include /etc/nginx/conf.d/*.conf;
 
     server {
@@ -48,6 +53,15 @@ http {
         index index.php index.html;
         root /var/www;
 
+        add_header X-Content-Type-Options nosniff always;
+        add_header Referrer-Policy same-origin always;
+
+
+        add_header 'Access-Control-Allow-Origin' $allowed_origin always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE' always;
+        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,exhibitor' always;
+
         location /media/ {
             alias /data/media/;
             expires 7d;
@@ -68,11 +82,19 @@ http {
             add_header Cache-Control "public";
         }
         location / {
+            if ($request_method = 'OPTIONS') {
+                add_header 'Access-Control-Allow-Origin' $allowed_origin always;
+                add_header 'Access-Control-Allow-Credentials' 'true' always;
+                add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE' always;
+                add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,exhibitor' always;
+                add_header 'Access-Control-Max-Age' 1728000;
+                add_header 'Content-Type' 'text/plain charset=UTF-8';
+                add_header 'Content-Length' 0;
+                return 204;
+            }
             proxy_pass http://unix:/tmp/pretix.sock:/;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        	proxy_set_header Host $http_host;
+            proxy_set_header Host $http_host;
         }
     }
 }
-
-

pyproject.toml

@@ -32,6 +32,7 @@ dependencies = [
         'django-filter==24.2',
         'django-scopes==2.0.*',
         'django-localflavor==4.0',
+        'django-cors-headers',
         'reportlab==4.2.*',
         'Pillow==10.4.*',
         'pypdf==4.2.*',

src/pretix/api/serializers/checkin.py

@@ -5,7 +5,7 @@
 from pretix.api.serializers.event import SubEventSerializer
 from pretix.api.serializers.i18n import I18nAwareModelSerializer
 from pretix.base.channels import get_all_sales_channels
-from pretix.base.models import CheckinList
+from pretix.base.models import Checkin, CheckinList
 
 
 class CheckinListSerializer(I18nAwareModelSerializer):
@@ -14,9 +14,12 @@ class CheckinListSerializer(I18nAwareModelSerializer):
 
     class Meta:
         model = CheckinList
-        fields = ('id', 'name', 'all_products', 'limit_products', 'subevent', 'checkin_count', 'position_count',
-                  'include_pending', 'auto_checkin_sales_channels', 'allow_multiple_entries', 'allow_entry_after_exit',
-                  'rules', 'exit_all_at')
+        fields = (
+            'id', 'name', 'all_products', 'limit_products', 'subevent',
+            'checkin_count', 'position_count', 'include_pending',
+            'auto_checkin_sales_channels', 'allow_multiple_entries',
+            'allow_entry_after_exit', 'rules', 'exit_all_at'
+        )
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -57,3 +60,34 @@ def validate(self, data):
         CheckinList.validate_rules(data.get('rules'))
 
         return data
+
+
+class CheckinRedeemInputSerializer(serializers.Serializer):
+    lists = serializers.PrimaryKeyRelatedField(required=True, many=True, queryset=CheckinList.objects.none())
+    secret = serializers.CharField(required=True, allow_null=False)
+    force = serializers.BooleanField(default=False, required=False)
+    source_type = serializers.ChoiceField(choices=['barcode'], default='barcode')
+    type = serializers.ChoiceField(choices=Checkin.CHECKIN_TYPES, default=Checkin.TYPE_ENTRY)
+    ignore_unpaid = serializers.BooleanField(default=False, required=False)
+    questions_supported = serializers.BooleanField(default=True, required=False)
+    nonce = serializers.CharField(required=False, allow_null=True)
+    datetime = serializers.DateTimeField(required=False, allow_null=True)
+    answers = serializers.JSONField(required=False, allow_null=True)
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields['lists'].child_relation.queryset = CheckinList.objects.filter(
+            event__in=self.context['events']
+        ).select_related('event')
+
+
+class MiniCheckinListSerializer(I18nAwareModelSerializer):
+    event = serializers.SlugRelatedField(slug_field='slug', read_only=True)
+    subevent = serializers.PrimaryKeyRelatedField(read_only=True)
+
+    class Meta:
+        model = CheckinList
+        fields = ('id', 'name', 'event', 'subevent', 'include_pending')
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)

src/pretix/api/urls.py

@@ -86,6 +86,8 @@
         include(question_router.urls)),
     url(r'^organizers/(?P<organizer>[^/]+)/events/(?P<event>[^/]+)/checkinlists/(?P<list>[^/]+)/',
         include(checkinlist_router.urls)),
+    url(r'^organizers/(?P<organizer>[^/]+)/checkin/redeem/$', checkin.CheckinRedeemView.as_view(),
+        name="checkin.redeem"),
     url(r'^organizers/(?P<organizer>[^/]+)/events/(?P<event>[^/]+)/orders/(?P<order>[^/]+)/', include(order_router.urls)),
     url(r"^oauth/authorize$", oauth.AuthorizationView.as_view(), name="authorize"),
     url(r"^oauth/token$", oauth.TokenView.as_view(), name="token"),