Do not allow customers to cancel checked-in orders

src/pretix/base/models/orders.py

@@ -395,8 +395,14 @@ class Order(LockModel, LoggedModel):
         """
         Returns whether or not this order can be canceled by the user.
         """
-        positions = list(self.positions.all().select_related('item'))
-        cancelable = all([op.item.allow_cancel for op in positions])
+        from .checkin import Checkin
+
+        positions = list(
+            self.positions.all().annotate(
+                has_checkin=Exists(Checkin.objects.filter(position_id=OuterRef('pk')))
+            ).select_related('item')
+        )
+        cancelable = all([op.item.allow_cancel and not op.has_checkin for op in positions])
         if not cancelable or not positions:
             return False
         if self.user_cancel_deadline and now() > self.user_cancel_deadline:

src/tests/base/test_models.py

@@ -15,7 +15,7 @@ from django.utils.timezone import now
 
 from pretix.base.i18n import language
 from pretix.base.models import (
-    CachedFile, CartPosition, CheckinList, Event, Item, ItemCategory,
+    CachedFile, CartPosition, Checkin, CheckinList, Event, Item, ItemCategory,
     ItemVariation, Order, OrderFee, OrderPayment, OrderPosition, OrderRefund,
     Organizer, Question, Quota, User, Voucher, WaitingListEntry,
 )
@@ -865,6 +865,18 @@ class OrderTestCase(BaseQuotaTestCase):
         self.event.settings.cancel_allow_user_paid = True
         assert self.order.user_cancel_allowed
 
+    def test_can_cancel_checked_in(self):
+        self.order.status = Order.STATUS_PAID
+        self.order.save()
+        self.event.settings.cancel_allow_user = False
+        self.event.settings.cancel_allow_user_paid = True
+        assert self.order.user_cancel_allowed
+        Checkin.objects.create(
+            position=self.order.positions.first(),
+            list=CheckinList.objects.create(event=self.event, name='Default')
+        )
+        assert not self.order.user_cancel_allowed
+
     def test_can_cancel_order_multiple(self):
         item1 = Item.objects.create(event=self.event, name="Ticket", default_price=23,
                                     admission=True, allow_cancel=True)