Set and enforce order limit on ticket purchases (#654)

* Set & enforce order limit on ticket purchases

* Add migration

* Default tix order limit to 10

* Consolidate migrations

* Check each carted event's order limit

* Move limit validation to `add_to_cart`

* Fix typo 😔

* Address nits with validation logic

* Minor refactor

backend/clubs/migrations/0102_event_ticket_order_limit.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.0.4 on 2024-04-14 22:08
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("clubs", "0101_merge_20240414_1708"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="event",
+            name="ticket_order_limit",
+            field=models.IntegerField(default=10),
+        ),
+    ]

backend/clubs/models.py

@@ -924,6 +924,7 @@ class Event(models.Model):
     parent_recurring_event = models.ForeignKey(
         RecurringEvent, on_delete=models.CASCADE, blank=True, null=True
     )
+    ticket_order_limit = models.IntegerField(default=10)
 
     OTHER = 0
     RECRUITMENT = 1

backend/clubs/views.py

@@ -2396,6 +2396,19 @@ def add_to_cart(self, request, *args, **kwargs):
         cart, _ = Cart.objects.get_or_create(owner=self.request.user)
 
         quantities = request.data.get("quantities")
+
+        num_requested = sum(item["count"] for item in quantities)
+        num_carted = cart.tickets.filter(event=event).count()
+
+        if num_requested + num_carted > event.ticket_order_limit:
+            return Response(
+                {
+                    "detail": f"Order exceeds the maximum ticket limit of "
+                    f"{event.ticket_order_limit}."
+                },
+                status=status.HTTP_403_FORBIDDEN,
+            )
+
         for item in quantities:
             type = item["type"]
             count = item["count"]
@@ -2573,6 +2586,9 @@ def create_tickets(self, request, *args, **kwargs):
                                             type: string
                                         count:
                                             type: integer
+                            order_limit:
+                                type: int
+                                required: false
         responses:
             "200":
                 content:
@@ -2599,6 +2615,11 @@ def create_tickets(self, request, *args, **kwargs):
 
         Ticket.objects.bulk_create(tickets)
 
+        order_limit = request.data.get("order_limit", None)
+        if order_limit is not None:
+            event.ticket_order_limit = order_limit
+            event.save()
+
         return Response({"detail": "success"})
 
     @action(detail=True, methods=["post"])
@@ -4764,14 +4785,23 @@ def initiate_checkout(self, request, *args, **kwargs):
         """
         cart = get_object_or_404(Cart, owner=self.request.user)
 
+        if not cart.tickets.exists():
+            return Response(
+                {
+                    "success": False,
+                    "detail": "No tickets selected for checkout.",
+                },
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
         # skip_locked is important here because if any of the tickets in cart
         # are locked, we shouldn't block.
         tickets = cart.tickets.select_for_update(skip_locked=True).filter(
             Q(holder__isnull=True) | Q(holder=self.request.user), owner__isnull=True
         )
 
         # Assert that the filter succeeded in freezing all the tickets for checkout
-        if tickets.count() != cart.tickets.all().count():
+        if tickets.count() != cart.tickets.count():
             return Response(
                 {
                     "success": False,