db50c3f15c
Extends stock event.registration with a signed QR ticket system, built to
complement rather than duplicate Odoo 19's existing barcode/badge
infrastructure. ticket_ref ('TIX-{event}-{seq}') and a QR code encoding
"ticket_ref|hmac_token" are added; the HMAC is signed with Odoo's own
per-database secret (ir.config_parameter 'database.secret', the same
mechanism core uses for password-reset tokens), so a copied/edited
ticket_ref without the matching signature is rejected as forged. A "Event
Ticket (QR)" PDF report is auto-attached to the core registration
confirmation email by adding it to event.event_subscription's
report_template_ids - no override of core mail-sending logic needed.
Adds the missing piece core doesn't provide: a mobile-friendly staff
check-in page at /event/checkin (gated on event.group_event_registration_desk),
built as a v19 "Interaction" (registry.category("public.interactions"),
the current replacement for legacy publicWidget) with manual ticket-ref
entry always available and camera scanning via the browser's native
BarcodeDetector API - avoiding a third-party CDN dependency and its
security/offline-reliability tradeoffs. Guards against forged tokens and
double check-in; a live per-event registered-vs-checked-in dashboard.
Two more real Odoo 19 surprises hit here: event.event has no more `state`
field at all (replaced by a stage_id/event.stage kanban system - my
check-in page's event picker now filters by date_end instead), and a
route type='json' should be type='jsonrpc' (json still works but is
deprecated).
Verified against a live Odoo 19 + Postgres 16 container: 9/9 tests pass
(ticket generation/uniqueness, valid/duplicate/forged/tampered token
handling, manual lookup), plus a full manual live run over HTTP - created
an event and registration via JSON-RPC, confirmed ticket_ref generation,
authenticated a session, hit /event/checkin/scan for a real check-in and
duplicate rejection, confirmed dashboard counts update, and loaded the
actual /event/checkin page (title, camera-button markup, and our JS
present in the served frontend bundle).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
68 lines
2.8 KiB
Python
68 lines
2.8 KiB
Python
from odoo.tests.common import TransactionCase, tagged
|
|
|
|
|
|
@tagged('post_install', '-at_install')
|
|
class TestEventCheckin(TransactionCase):
|
|
|
|
def setUp(self):
|
|
super().setUp()
|
|
self.event = self.env['event.event'].create({
|
|
'name': 'Checkin Test Event',
|
|
'date_begin': '2030-01-01 10:00:00',
|
|
'date_end': '2030-01-01 18:00:00',
|
|
})
|
|
self.registration = self.env['event.registration'].create({
|
|
'event_id': self.event.id,
|
|
'name': 'Checkin Attendee',
|
|
})
|
|
|
|
def test_valid_token_checks_in(self):
|
|
qr_value = self.registration._get_ticket_qr_value()
|
|
status, found = self.env['event.registration']._verify_scanned_token(qr_value)
|
|
self.assertEqual(status, 'ok')
|
|
found.action_check_in()
|
|
self.assertTrue(found.checked_in)
|
|
self.assertTrue(found.check_in_time)
|
|
self.assertEqual(found.check_in_user_id, self.env.user)
|
|
self.assertEqual(found.state, 'done')
|
|
|
|
def test_duplicate_check_in_detected(self):
|
|
qr_value = self.registration._get_ticket_qr_value()
|
|
status, found = self.env['event.registration']._verify_scanned_token(qr_value)
|
|
found.action_check_in()
|
|
|
|
status_again, _found_again = self.env['event.registration']._verify_scanned_token(qr_value)
|
|
self.assertEqual(status_again, 'already')
|
|
|
|
def test_forged_token_rejected(self):
|
|
forged_value = f"{self.registration.ticket_ref}|0000000000000000"
|
|
status, found = self.env['event.registration']._verify_scanned_token(forged_value)
|
|
self.assertEqual(status, 'invalid')
|
|
self.assertFalse(found.checked_in)
|
|
|
|
def test_tampered_ticket_ref_rejected(self):
|
|
real_token = self.registration._compute_ticket_token()
|
|
other_event = self.env['event.event'].create({
|
|
'name': 'Other Event',
|
|
'date_begin': '2030-02-01 10:00:00',
|
|
'date_end': '2030-02-01 18:00:00',
|
|
})
|
|
other_registration = self.env['event.registration'].create({
|
|
'event_id': other_event.id,
|
|
'name': 'Other Attendee',
|
|
})
|
|
# Attacker takes a valid token and pastes it onto a different ticket_ref.
|
|
forged_value = f"{other_registration.ticket_ref}|{real_token}"
|
|
status, found = self.env['event.registration']._verify_scanned_token(forged_value)
|
|
self.assertEqual(status, 'invalid')
|
|
|
|
def test_manual_lookup_bypasses_signature(self):
|
|
status, found = self.env['event.registration']._lookup_by_ticket_ref(self.registration.ticket_ref)
|
|
self.assertEqual(status, 'ok')
|
|
self.assertEqual(found, self.registration)
|
|
|
|
def test_manual_lookup_unknown_ref(self):
|
|
status, found = self.env['event.registration']._lookup_by_ticket_ref('NOT-A-REAL-REF')
|
|
self.assertEqual(status, 'not_found')
|
|
self.assertFalse(found)
|