feat: Allow order amount override from maintainers (#7377)

app/api/custom/orders.py

@@ -157,6 +157,13 @@ def create_order():
         raise e
 
     validate_attendees({attendee.id for attendee in attendees})
+
+    if data.get('amount') is not None and (
+        current_user.is_staff or has_access('is_coorganizer', event_id=event.id)
+    ):
+        # If organizer or admin has overrided the amount of order
+        order_amount['total'] = data['amount']
+
     order = Order(
         amount=order_amount['total'],
         event=event,

app/api/custom/schema/order_amount.py

@@ -10,3 +10,4 @@ class TicketSchema(Schema):
 class OrderAmountInputSchema(Schema):
     tickets = fields.Nested(TicketSchema, many=True)
     discount_code = fields.Integer(load_from='discount-code')
+    amount = fields.Float(allow_none=True)

tests/all/integration/api/helpers/order/test_create_order.py

@@ -1,7 +1,10 @@
 import json
 
+from app.api.helpers.db import get_or_create
 from app.models.order import Order
+from app.models.role import Role
 from app.models.ticket_holder import TicketHolder
+from app.models.users_events_role import UsersEventsRoles
 from tests.factories.attendee import AttendeeFactoryBase
 from tests.factories.discount_code import DiscountCodeTicketSubFactory
 from tests.factories.event import EventFactoryBasic
@@ -66,6 +69,64 @@ def test_create_order_without_discount(client, db, jwt):
         assert ticket_holder.event_id is not None
 
 
+def test_create_order_override_amount(client, db, admin_jwt):
+    tickets = _create_tickets([10, 20], event=EventFactoryBasic(), quantity=2)
+    db.session.commit()
+
+    response = client.post(
+        '/v1/orders/create-order',
+        content_type='application/json',
+        headers=admin_jwt,
+        data=json.dumps({'amount': 0, 'tickets': _create_ticket_dict(tickets, [1, 2])}),
+    )
+
+    assert response.status_code == 200
+    order_dict = json.loads(response.data)
+    order = Order.query.get(order_dict['data']['id'])
+    assert order_dict['data']['attributes']['amount'] == 0.0
+    assert order.amount == 0.0
+
+
+def test_create_order_override_amount_organizer(client, db, user, jwt):
+    event = EventFactoryBasic()
+    tickets = _create_tickets([10, 20], event=event, quantity=2)
+    role, _ = get_or_create(Role, name='owner', title_name='Owner')
+    UsersEventsRoles(user=user, event=event, role=role)
+    db.session.commit()
+
+    response = client.post(
+        '/v1/orders/create-order',
+        content_type='application/json',
+        headers=jwt,
+        data=json.dumps({'amount': 0, 'tickets': _create_ticket_dict(tickets, [1, 2])}),
+    )
+
+    assert response.status_code == 200
+    order_dict = json.loads(response.data)
+    order = Order.query.get(order_dict['data']['id'])
+    assert order_dict['data']['attributes']['amount'] == 0
+    assert order.amount == 0
+
+
+def test_create_order_override_amount_ignore(client, db, jwt):
+    # For normal user, amount parameter should be ignored
+    tickets = _create_tickets([10, 20], event=EventFactoryBasic(), quantity=2)
+    db.session.commit()
+
+    response = client.post(
+        '/v1/orders/create-order',
+        content_type='application/json',
+        headers=jwt,
+        data=json.dumps({'amount': 0, 'tickets': _create_ticket_dict(tickets, [1, 2])}),
+    )
+
+    assert response.status_code == 200
+    order_dict = json.loads(response.data)
+    order = Order.query.get(order_dict['data']['id'])
+    assert order_dict['data']['attributes']['amount'] == 50.0
+    assert order.amount == 50.0
+
+
 def test_throw_ticket_sold_out(client, db, jwt):
     event = EventFactoryBasic()
     tickets = _create_tickets([10, 20], event=event, quantity=2)