From 930e153db461121d9ca680fea442544c1089bbca Mon Sep 17 00:00:00 2001
From: Raphael Michel <michel@rami.io>
Date: Tue, 21 Jul 2026 12:30:25 +0200
Subject: [PATCH] Security profiles: Add missing annul checkpoint

---
 src/pretix/api/auth/devicesecurity.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/pretix/api/auth/devicesecurity.py b/src/pretix/api/auth/devicesecurity.py
index 7fc06e9522..77e354d6bd 100644
--- a/src/pretix/api/auth/devicesecurity.py
+++ b/src/pretix/api/auth/devicesecurity.py
@@ -108,6 +108,7 @@ class PretixScanSecurityProfile(AllowListSecurityProfile):
         ('GET', 'api-v1:event.settings'),
         ('POST', 'api-v1:upload'),
         ('POST', 'api-v1:checkinrpc.redeem'),
+        ('POST', 'api-v1:checkinrpc.annull'),
         ('GET', 'api-v1:checkinrpc.search'),
         ('GET', 'api-v1:reusablemedium-list'),
         ('POST', 'api-v1:reusablemedium-lookup'),
@@ -146,6 +147,7 @@ class PretixScanNoSyncNoSearchSecurityProfile(AllowListSecurityProfile):
         ('GET', 'api-v1:event.settings'),
         ('POST', 'api-v1:upload'),
         ('POST', 'api-v1:checkinrpc.redeem'),
+        ('POST', 'api-v1:checkinrpc.annull'),
         ('GET', 'api-v1:checkinrpc.search'),
     )
 
@@ -182,6 +184,7 @@ class PretixScanNoSyncSecurityProfile(AllowListSecurityProfile):
         ('GET', 'api-v1:event.settings'),
         ('POST', 'api-v1:upload'),
         ('POST', 'api-v1:checkinrpc.redeem'),
+        ('POST', 'api-v1:checkinrpc.annull'),
         ('GET', 'api-v1:checkinrpc.search'),
     )