Caelondia

Third system release, as used on Remcon 2024. This year we've had a new venue and most of the changes were on the "physical layer", so to speak - the system side mostly received refinements on what was already there. But there's some new stuff too!

Upgrade Guide

• Important: This is the final version that can still be installed in a "classic" fashion using a plain local deployment. Future versions will be released and deployed using containers.
• After upgrading to Caelondia, you must run an additional allauth-2fa -> allauth.mfa migration from the command line: python manage.py migrate_2fa
• Automatic database migrations will remove:
  • Tickets: vaccination proofs
  • Applications: Legacy (text field) applications

Crew Panel

• Instead of a single green button there's now a black bar with all the crew modules available to a specific account.
• Accounts can be now granted crew panel permissions on a per-module basis. (Per-event permissions are not there yet.)
• The crew bar has handy shortcuts for looking up tickets and jumping to the Django Admin.

Mod Queue

• A minimal ticket moderation queue was added that allows orgs to sort out inappropriate images and nicknames set during personalization.
• Tickets can be easily "depersonalized" - images and nicknames are removed and ticket previews are regenerated.
• All tickets have handy shortcuts to the owner/crew/admin panel too.

Organizations

• It's now possible to create "organizations" - groups of tickets and billing details bound to a specific owner/application.
• Org owner can create as many tickets of a specific type as are allocated for an organization. The tickets are automatically marked as paid for and all that.
• Billing details can be added too - this makes B2B payment handling much smoother.
• Everything comes with a nice new dashboard in the crew panel.
• This year we've provisionally used this system for vendors - with great success! Accreditation process was much smoother thanks to this system, and we have significant expansion plans for this module.

Tickets

• We now track each ticket's "contributed value" - how much money was actually collected for a given ticket into the event budget pool. This is used for live budget tracking with the Prometheus/Grafana integration.
• There is now a single ticket "ready" status (while previously we had two, the other being "pay on site").
• Tickets and ticket types can now have "flags" - these can be used by ticket renderers to generate an appropriate access list on the physical ticket and in external systems for automation.
• Private/accreditation note fields were added to tickets and applications.
• Unpaid tickets can be now automatically cancelled after a specified period.
• Separate personalization deadlines can be now set independently of the ticket sale date.
• Tickets can be now stopped during accreditation to force a coordinator to take a look.
• Tickets can now have an "issued identifier" to make it easier for the crew to hand over the appropriate physical badge, instead of relying on its type.
• The accreditation process and panel was slightly revamped for readability. Tables have extra colors and icons for quicker navigation.
• Vaccination proofs were removed as they're no longer needed.

Ticket Renderers

• The primary renderer was rewritten to use Playwright-driven browser automation instead of a plain j2 + Chromium script due to odd rendering race conditions.
• More helper scripts were added to make renderer development easier and faster.
• New ticket templates for Remcon 2024 and VIII Twilightmeet were added.

Applications

• Applications can be now put on a reserve list with a dedicated status.
• Private/org notes were added to applications.
• Dynaforms now support new fields:
  • URLs contain web addresses.
  • Counters are integers with a specified min/max/default.
  • Templates can contain arbitrary HTML/Markdown to create pretty layouts.
• To submit applications, until now you could require ready tickets to be bound to an account about to submit an application. Registration requirements are now per-application type, not per-event.
• Custom application submission "thank you" messages can be now set.

Maintenance + Misc Stuff

• Django was upgraded to 4.2 LTS, most of the dependencies were upgraded to their latest-ish versions as well.
• Two-factor authentication was migrated from allauth-2fa to allauth.mfa. This requires manual intervention. Unfortunately, the migration was done as a last-minute change - we had to perform an emergency allauth upgrade due to Google SSO breaking on the older version we were stuck on. New 2FA views don't look all that great yet, although they are fully functional.
• File layout, URL schemes and permission checks on most views were reworked and cleaned up.
• The entire codebase is now formatted and checked with Ruff.
• Errors are now handled more gracefully.
• Django Admin filtering options are now themselves filtered down to the currently-selected event, if any.
• Sentry now logs and profiles ALL transactions.
• Docker is again the default ticket rendering container tool.
• Payment status change notification handling was revamped, leading to significantly fewer "missing payments" happening.
• Prometheus statistics are now "bucketized" per group of:
  • (ticket type, source, status, paid) -> total ticket count
  • (ticket type, source) -> total contributed value.
• Misc bugfixes and performance improvements.

Beowulf

Second system release, as used on Remcon 2023. Rough changelog:

Ticket Previews

• The ticket preview system was completely reworked. Instead of generating previews using a predefined overlay template, the generator can now invoke a Docker container with arbitrary preview generation logic inside.
• Generated previews can now include metadata from the ticket (nickname, code, role, etc). This enables generating print-ready images.
• On Remcon 2023, the generator used a Jinja2 template to generate HTML files which were then rendered from Chromium to a PNG file. This generator is shipped in the repo for reference.
• Ticket previews can now be generated in multiple variants - we used this to generate front and back sides of each final ticket to print.
• Previews and personalization is now optional on a per-type basis.
• The personalization section was removed from the registration page to keep it simple.

Dynamic Forms

• The dynamic form system was also reworked and now uses a JSON-based form schema system. This makes them a lot less painful to work with on the Python side, but much more so on the admin side.
• At the moment, there's no admin GUI available to customize the forms. You just gotta JSON by hand. Sorry.
• The new form schema fixes a number of annoying parsing issues present in the first iteration and enables new features in the future, although not that many are present just yet.
• It's now possible to make the labels/help text display Markdown or HTML directly.

Custom Event Pages

• It is now possible to set up a custom payment info page - if a specific event does not require fully-automated payments, a selected Event Page can be shown instead when "Pay Online" is clicked.
• That Event Page is shown only where relevant.

Crew Panel

• The entire Crew Panel got a visual rework, making it easier to process an attendee step by step.
• The ID query fields are now focused automatically. (Thanks to Rozz for the suggestion.)

Maintenance and Security

• Upgraded to Python 3.10, Django 4.1 and bumped most libraries to +/- latest as of the release date.
• The deployment scripts were upgraded to target Ubuntu 22.04.
• The app now runs as www-data, not root. Most of its permissions were stripped with systemd service isolation features.
• Fixed lots of PyCharm warnings and inspections.

Odds and Ends

• Fixed race conditions around available ticket counts. It was possible to overpurchase ticket types in high demand - now that's no longer the case.
• Added rate-limited ticket purchases (one ticket every X seconds per user/IP address).
• It's now possible to force attendees to register a ticket before submitting any applications.
• Passwords are now hashed with scrypt (and will be upgraded on any login).
• Applications now store a JSON block with all answers, next to the formatted text block.
• Reworked the attendee-side application details view - everything is now in a fancy table.
• Sent email titles are now translated as well.
• Admin site now displays lots of columns on most models, and is far more useful now.
• Application export dumps its data to XLSX instead of CSV.
• Superadmins can now peek some user-facing pages even if they don't own a given object directly. User-facing pages are now linked on the admin pages.
• On-site tickets are no longer shown in "Your Tickets". In practice users with on-site tickets never see them on their account at all, and it's just system admins that end up with 100s of tickets on their front pages.
• Added user hijacking - admins can now impersonate any specified user to aid troubleshooting and see what they see.
• Staff users can be now exempt from the 2FA requirement. This is useful for service accounts during the event itself.
• Enabled Sentry profiling, which makes it easier to spot routes taking way longer than it should. (Hello P24, we'll have a talk later.)
• Ticket prices can be now overridden per individual ticket.
• Some system messages (sales over, etc) can now be personalized on a per-Event basis.
• Notification channels can now output to Telegram. Configuring this is a pain, but we kinda used this successfully.
• A bunch of random misc things I forgot about. Sorry!

Atreyu

First system release, as used on Remcon 2022.