Make it possible for pizza admins to create orders for users other than themselves

website/pizzas/api/serializers.py

+from django.utils.translation import ugettext_lazy as _
 from rest_framework import serializers
+from rest_framework.exceptions import ValidationError
 
 from pizzas.models import Product, PizzaEvent, Order
 
@@ -29,3 +31,13 @@ class AdminOrderSerializer(serializers.ModelSerializer):
     class Meta:
         model = Order
         fields = ('pk', 'paid', 'product', 'name', 'member')
+
+    def validate(self, attrs):
+        if attrs['member'] and attrs['name']:
+            raise ValidationError({
+                'member': _('Either specify a member or a name'),
+                'name': _('Either specify a member or a name'),
+            })
+        if not (attrs['member'] or attrs['name']):
+            attrs['member'] = self.context['request'].member
+        return super().validate(attrs)

website/pizzas/api/viewsets.py

@@ -72,7 +72,10 @@ class OrderViewset(ModelViewSet):
             if serializer.validated_data.get('name'):
                 serializer.save(pizza_event=PizzaEvent.current())
             else:
-                serializer.save(member=self.request.member,
-                                pizza_event=PizzaEvent.current())
+                if self.request.user.has_perm('pizzas.change_order'):
+                    serializer.save(pizza_event=PizzaEvent.current())
+                else:
+                    serializer.save(member=self.request.member,
+                                    pizza_event=PizzaEvent.current())
         except IntegrityError:
             raise ValidationError('Something went wrong when saving the order')