chore(ui/permissions): hide “Create Organizer” in admin tickets page, allow creation in common organizers view #890

Saksham-Sirohi · 2025-10-01T18:50:42Z

fixes #651 to enext

sourcery-ai

The pull request #890 has too many files changed.

The GitHub API will only let us fetch up to 300 changed files, and this pull request has 3968.

mariobehling · 2025-10-02T10:29:48Z

So, as we proceed I think we need to have this in a bit more advanced way. In the admin section of the platform (e.g. https://wikimedia.eventyay.com/tickets/control/admin/global/settings/) there should be a section "Organizer Creation" with the following tick boxes.

Organizer Creation

By default system admins can always create organizer. Additionally the following roles are permitted to create organizers:

All registered users can create organizers.

All accounts with with payment information can create organizers.

For the second option test that accounts have payment info on file.

mariobehling · 2025-10-08T16:53:13Z

Following the above comment which requires to add an option for create organiser permissions in /tickets/control/admin/global/settings/ should follow the PR at #794. We need this PR to be made against the enext branch first.

mariobehling

Please make the required changes to display the create organizer option depending on the platform configuration.

Saksham-Sirohi · 2025-11-01T20:05:45Z

@mariobehling updated pr please take a look

Copilot

Pull Request Overview

This PR implements configurable permissions for organizer creation by introducing a new OrganizerCreationPermissionMixin that allows system administrators to control who can create organizers through global settings. Previously, only users with active staff sessions could create organizers.

Key changes:

Added OrganizerCreationPermissionMixin with configurable permission logic based on global settings
Introduced two new global settings: allow_all_users_create_organizer and allow_payment_users_create_organizer
Updated OrganizerCreate and OrganizerList views to use the new permission mixin and display create buttons conditionally

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
app/eventyay/control/permissions.py	Added `OrganizerCreationPermissionMixin` with `_can_create_organizer` and `_user_has_payment_info` helper methods
app/eventyay/control/forms/global_settings.py	Added two new boolean fields for controlling organizer creation permissions
app/eventyay/control/views/organizer_views/organizer_view.py	Integrated permission mixin into `OrganizerCreate` and `OrganizerList` views with permission checks in dispatch
app/eventyay/control/templates/pretixcontrol/organizers/index.html	Conditionally display create button based on `can_create_organizer` context variable
app/eventyay/eventyay_common/views/organizer.py	Integrated permission mixin into `OrganizerCreate` and `OrganizerList` views with permission checks in dispatch
app/eventyay/eventyay_common/templates/eventyay_common/organizers/index.html	Changed from `staff_session` to `can_create_organizer` for displaying create button

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-11-01T23:03:40Z

app/eventyay/control/permissions.py

+        allow_all_users = gs.settings.get('allow_all_users_create_organizer', None, as_type=bool)
+        allow_payment_users = gs.settings.get('allow_payment_users_create_organizer', None, as_type=bool)
+
+        # If neither option is explicitly set, default to allowing all users (permissive default)
+        if allow_all_users is None and allow_payment_users is None:
+            return True
+
+        # If all users are allowed
+        if allow_all_users:
+            return True


The permission logic could lead to unexpected behavior when both settings are enabled. If both allow_all_users_create_organizer and allow_payment_users_create_organizer are set to True, the function returns True for all users at line 197, making the second check redundant. Consider documenting this precedence or simplifying the logic to make the relationship between these settings clearer (e.g., treat allow_all_users as overriding allow_payment_users).

Copilot · 2025-11-01T23:03:40Z

app/eventyay/control/permissions.py

+        for organizer in user_organizers:
+            billing = OrganizerBillingModel.objects.filter(
+                organizer=organizer,
+                stripe_customer_id__isnull=False
+            ).exclude(stripe_customer_id='').first()
+            if billing:
+                return True
+
+        return False


The N+1 query pattern in _user_has_payment_info will execute one query per organizer. This can be optimized using a single query with exists(). Consider replacing lines 226-232 with: return OrganizerBillingModel.objects.filter(organizer__in=user_organizers, stripe_customer_id__isnull=False).exclude(stripe_customer_id='').exists(). This will execute a single database query instead of potentially many.

Suggested change

for organizer in user_organizers:

billing = OrganizerBillingModel.objects.filter(

organizer=organizer,

stripe_customer_id__isnull=False

).exclude(stripe_customer_id='').first()

if billing:

return True

return False

return OrganizerBillingModel.objects.filter(

organizer__in=user_organizers,

stripe_customer_id__isnull=False

).exclude(stripe_customer_id='').exists()

Copilot · 2025-11-01T23:03:41Z

app/eventyay/eventyay_common/views/organizer.py

+            messages.error(
+                request,
+                _('You do not have permission to create organizers. Please contact an administrator.')
+            )


The error message is duplicated - shown both as a user-facing message via messages.error() and as the exception message in PermissionDenied(). Since PermissionDenied typically triggers error handling that may display its message, this could result in duplicate messages to the user. Consider removing the messages.error() call and relying on exception handling to display the error, or ensure the exception handler doesn't display the PermissionDenied message.

Suggested change

messages.error(

request,

_('You do not have permission to create organizers. Please contact an administrator.')

)

Copilot · 2025-11-01T23:03:41Z

app/eventyay/control/views/organizer_views/organizer_view.py

+            messages.error(
+                request,
+                _('You do not have permission to create organizers. Please contact an administrator.')
+            )


The error message is duplicated - shown both as a user-facing message via messages.error() and as the exception message in PermissionDenied(). Since PermissionDenied typically triggers error handling that may display its message, this could result in duplicate messages to the user. Consider removing the messages.error() call and relying on exception handling to display the error, or ensure the exception handler doesn't display the PermissionDenied message.

Suggested change

messages.error(

request,

_('You do not have permission to create organizers. Please contact an administrator.')

)

sourcery-ai bot reviewed Oct 1, 2025

View reviewed changes

Saksham-Sirohi changed the base branch from development to enext October 1, 2025 18:55

Saksham-Sirohi requested review from Gagan-Ram, Sak1012, hongquan and mariobehling October 1, 2025 18:55

Sak1012 approved these changes Oct 2, 2025

View reviewed changes

mariobehling changed the title ~~chore:Organizer creation~~ chore: Organizer creation Oct 2, 2025

Gagan-Ram approved these changes Oct 3, 2025

View reviewed changes

mariobehling mentioned this pull request Oct 6, 2025

Chore: remove Create Organizer option in tickets area and enable all users in the common area to create organizers #757

Closed

mariobehling changed the title ~~chore: Organizer creation~~ chore(ui/permissions): hide “Create Organizer” in admin tickets page, allow creation in common organizers view Oct 6, 2025

mariobehling requested changes Oct 10, 2025

View reviewed changes

mariobehling requested review from Gagan-Ram and Sak1012 October 10, 2025 06:46

Saksham-Sirohi force-pushed the organizer-creation branch from 110ebaa to 473f9fa Compare October 28, 2025 14:29

Saksham-Sirohi added 2 commits November 2, 2025 00:53

modified create a organier option

b214ec9

add permissions options

1c07d83

Saksham-Sirohi force-pushed the organizer-creation branch from 473f9fa to 221dd1a Compare November 1, 2025 19:51

settings panel fix

896f553

Saksham-Sirohi force-pushed the organizer-creation branch from 221dd1a to 896f553 Compare November 1, 2025 20:04

Saksham-Sirohi requested a review from mariobehling November 1, 2025 20:05

mariobehling requested a review from Copilot November 1, 2025 22:59

Merge branch 'enext' into organizer-creation

b146753

Copilot AI reviewed Nov 1, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(ui/permissions): hide “Create Organizer” in admin tickets page, allow creation in common organizers view #890

chore(ui/permissions): hide “Create Organizer” in admin tickets page, allow creation in common organizers view #890

Saksham-Sirohi commented Oct 1, 2025

Uh oh!

sourcery-ai bot left a comment

Uh oh!

mariobehling commented Oct 2, 2025 •

edited

Loading

Organizer Creation

Uh oh!

mariobehling commented Oct 8, 2025

Uh oh!

mariobehling left a comment

Uh oh!

Saksham-Sirohi commented Nov 1, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Nov 1, 2025

Uh oh!

Copilot AI Nov 1, 2025

Uh oh!

Copilot AI Nov 1, 2025

Uh oh!

Copilot AI Nov 1, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

chore(ui/permissions): hide “Create Organizer” in admin tickets page, allow creation in common organizers view #890

Are you sure you want to change the base?

chore(ui/permissions): hide “Create Organizer” in admin tickets page, allow creation in common organizers view #890

Conversation

Saksham-Sirohi commented Oct 1, 2025

Uh oh!

sourcery-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

mariobehling commented Oct 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Organizer Creation

Uh oh!

mariobehling commented Oct 8, 2025

Uh oh!

mariobehling left a comment

Choose a reason for hiding this comment

Uh oh!

Saksham-Sirohi commented Nov 1, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Nov 1, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 1, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 1, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 1, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

mariobehling commented Oct 2, 2025 •

edited

Loading