API: Allow to redeem ticket by secret

doc/api/resources/checkinlists.rst

@@ -445,6 +445,8 @@ Order position endpoints
    The result format is the same as the :ref:`order-position-resource`, with one important difference: the
    ``checkins`` value will only include check-ins for the selected list.
 
+   **Instead of an ID, you can also use the ``secret`` field as the lookup parameter.**
+
    **Example request**:
 
    .. sourcecode:: http
@@ -516,6 +518,8 @@ Order position endpoints
    Tries to redeem an order position, identified by its internal ID, i.e. checks the attendee in. This endpoint
    accepts a number of optional requests in the body.
 
+   **Instead of an ID, you can also use the ``secret`` field as the lookup parameter.**
+
    :<json boolean questions_supported: When this parameter is set to ``true``, handling of questions is supported. If
                                        you do not implement question handling in your user interface, you **must**
                                        set this to ``false``. In that case, questions will just be ignored. Defaults

src/pretix/api/views/checkin.py

@@ -1,5 +1,5 @@
 from django.core.exceptions import ValidationError
-from django.db.models import Count, F, Max, OuterRef, Prefetch, Subquery
+from django.db.models import Count, F, Max, OuterRef, Prefetch, Q, Subquery
 from django.db.models.functions import Coalesce
 from django.http import Http404
 from django.shortcuts import get_object_or_404
@@ -264,3 +264,11 @@ class CheckinListPositionViewSet(viewsets.ReadOnlyModelViewSet):
             return Response({
                 'status': 'ok',
             }, status=201)
+
+    def get_object(self):
+        queryset = self.filter_queryset(self.get_queryset())
+        if self.kwargs['pk'].isnumeric():
+            obj = get_object_or_404(queryset, Q(pk=self.kwargs['pk']) | Q(secret=self.kwargs['pk']))
+        else:
+            obj = get_object_or_404(queryset, secret=self.kwargs['pk'])
+        return obj

src/tests/api/test_checkin.py

@@ -462,6 +462,15 @@ def test_custom_datetime(token_client, organizer, clist, event, order):
     assert Checkin.objects.last().datetime == dt
 
 
+@pytest.mark.django_db
+def test_by_secret(token_client, organizer, clist, event, order):
+    resp = token_client.post('/api/v1/organizers/{}/events/{}/checkinlists/{}/positions/{}/redeem/'.format(
+        organizer.slug, event.slug, clist.pk, order.positions.first().secret
+    ), {}, format='json')
+    assert resp.status_code == 201
+    assert resp.data['status'] == 'ok'
+
+
 @pytest.mark.django_db
 def test_only_once(token_client, organizer, clist, event, order):
     resp = token_client.post('/api/v1/organizers/{}/events/{}/checkinlists/{}/positions/{}/redeem/'.format(