Check-in API: Return 400 instead of 404 on checking in unpaid orders

doc/api/resources/checkinlists.rst

@@ -539,7 +539,8 @@ Order position endpoints
    :<json boolean force: Specifies that the check-in should succeed regardless of previous check-ins or required
                          questions that have not been filled. Defaults to ``false``.
    :<json boolean ignore_unpaid: Specifies that the check-in should succeed even if the order is in pending state.
-                                 Defaults to ``false``.
+                                 Defaults to ``false`` and only works when ``include_pending`` is set on the check-in
+                                 list.
    :<json string nonce: You can set this parameter to a unique random value to identify this check-in. If you're sending
                         this request twice with the same nonce, the second request will also succeed but will always
                         create only one check-in object even when the previous request was successful as well. This

src/pretix/api/views/checkin.py

@@ -189,7 +189,7 @@ class CheckinListPositionViewSet(viewsets.ReadOnlyModelViewSet):
         except ValueError:
             raise Http404()
 
-    def get_queryset(self):
+    def get_queryset(self, ignore_status=False):
         cqs = Checkin.objects.filter(
             position_id=OuterRef('pk'),
             list_id=self.checkinlist.pk
@@ -204,7 +204,7 @@ class CheckinListPositionViewSet(viewsets.ReadOnlyModelViewSet):
             last_checked_in=Subquery(cqs)
         )
 
-        if self.request.query_params.get('ignore_status', 'false') != 'true':
+        if self.request.query_params.get('ignore_status', 'false') != 'true' and not ignore_status:
             qs = qs.filter(
                 order__status__in=[Order.STATUS_PAID, Order.STATUS_PENDING] if self.checkinlist.include_pending else [Order.STATUS_PAID]
             )
@@ -251,7 +251,7 @@ class CheckinListPositionViewSet(viewsets.ReadOnlyModelViewSet):
         force = bool(self.request.data.get('force', False))
         ignore_unpaid = bool(self.request.data.get('ignore_unpaid', False))
         nonce = self.request.data.get('nonce')
-        op = self.get_object()
+        op = self.get_object(ignore_status=True)
 
         if 'datetime' in self.request.data:
             dt = DateTimeField().to_internal_value(self.request.data.get('datetime'))
@@ -304,8 +304,8 @@ class CheckinListPositionViewSet(viewsets.ReadOnlyModelViewSet):
                 'position': CheckinListOrderPositionSerializer(op, context=self.get_serializer_context()).data
             }, status=201)
 
-    def get_object(self):
-        queryset = self.filter_queryset(self.get_queryset())
+    def get_object(self, ignore_status=False):
+        queryset = self.filter_queryset(self.get_queryset(ignore_status=ignore_status))
         if self.kwargs['pk'].isnumeric():
             obj = get_object_or_404(queryset, Q(pk=self.kwargs['pk']) | Q(secret=self.kwargs['pk']))
         else:

src/tests/api/test_checkin.py

@@ -547,7 +547,16 @@ def test_require_paid(token_client, organizer, clist, event, order):
     resp = token_client.post('/api/v1/organizers/{}/events/{}/checkinlists/{}/positions/{}/redeem/'.format(
         organizer.slug, event.slug, clist.pk, order.positions.first().pk
     ), {}, format='json')
-    assert resp.status_code == 404
+    assert resp.status_code == 400
+    assert resp.data['status'] == 'error'
+    assert resp.data['reason'] == 'unpaid'
+
+    resp = token_client.post('/api/v1/organizers/{}/events/{}/checkinlists/{}/positions/{}/redeem/'.format(
+        organizer.slug, event.slug, clist.pk, order.positions.first().pk
+    ), {'ignore_unpaid': True}, format='json')
+    assert resp.status_code == 400
+    assert resp.data['status'] == 'error'
+    assert resp.data['reason'] == 'unpaid'
 
     clist.include_pending = True
     clist.save()