From dcb1d920eb6a31cef9fa3c90b0e412bed7963171 Mon Sep 17 00:00:00 2001
From: Raphael Michel <michel@rami.io>
Date: Wed, 3 Jan 2024 09:56:35 +0100
Subject: [PATCH] Check-in rules: Do not use empty lists in SQL converted query

---
 src/pretix/helpers/jsonlogic_query.py |  6 +++++-
 src/tests/base/test_checkin.py        | 18 ++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/src/pretix/helpers/jsonlogic_query.py b/src/pretix/helpers/jsonlogic_query.py
index b5ca491f74..867546c7ec 100644
--- a/src/pretix/helpers/jsonlogic_query.py
+++ b/src/pretix/helpers/jsonlogic_query.py
@@ -74,7 +74,11 @@ class InList(Func):
             raise TypeError(f'Dynamic right-hand-site currently not implemented, found {type(self.source_expressions[1])}')
         rhs, rhs_params = ['%s' for _ in self.source_expressions[1].value], [d for d in self.source_expressions[1].value]
 
-        return '%s IN (%s)' % (lhs, ', '.join(rhs)), lhs_params + rhs_params
+        if rhs:
+            return '%s IN (%s)' % (lhs, ', '.join(rhs)), lhs_params + rhs_params
+        else:
+            # "IN ()" is not considered valid SQL by PostgreSQL (unlike SQLite)
+            return 'FALSE', []
 
 
 def tolerance(b, tol=None, sign=1):
diff --git a/src/tests/base/test_checkin.py b/src/tests/base/test_checkin.py
index 765bb3e411..651d14c917 100644
--- a/src/tests/base/test_checkin.py
+++ b/src/tests/base/test_checkin.py
@@ -1171,3 +1171,21 @@ def test_auto_check_out_dst(event, position, clist):
         process_exit_all(sender=None)
     clist.refresh_from_db()
     assert clist.exit_all_at.astimezone(event.timezone) == datetime(2021, 3, 30, 2, 30, tzinfo=event.timezone)
+
+
+@pytest.mark.django_db
+def test_sql_empty_collection(position, clist, event):
+    event.has_subevents = True
+    event.save()
+    event.settings.timezone = 'Europe/Berlin'
+    se1 = event.subevents.create(name="Foo", date_from=datetime(2020, 2, 1, 12, 0, 0, tzinfo=event.timezone))
+    position.subevent = se1
+    position.save()
+    clist.rules = {"inList": [{"var": "product"}, {"objectList": []}]}
+    clist.save()
+    with freeze_time("2020-02-01 10:51:00"):
+        assert not OrderPosition.objects.filter(SQLLogic(clist).apply(clist.rules), pk=position.pk).exists()
+        with pytest.raises(CheckInError) as excinfo:
+            perform_checkin(position, clist, {})
+        assert excinfo.value.code == 'rules'
+        assert 'Entry not permitted: Ticket type not allowed.'