feat(checkout-api): implement event-level checkout endpoint and improve search validation

src/pretix/api/serializers/checkin.py

@@ -1,6 +1,7 @@
 from django.utils.translation import gettext as _
 from rest_framework import serializers
 from rest_framework.exceptions import ValidationError
+from django.db.models import Q
 
 from pretix.api.serializers.event import SubEventSerializer
 from pretix.api.serializers.i18n import I18nAwareModelSerializer
@@ -72,7 +73,11 @@ def validate(self, data):
 
 
 class CheckinRedeemInputSerializer(serializers.Serializer):
-    lists = serializers.PrimaryKeyRelatedField(required=True, many=True, queryset=CheckinList.objects.none())
+    lists = serializers.ListField(
+        child=serializers.IntegerField(),
+        required=True,
+        allow_empty=False
+    )
     secret = serializers.CharField(required=True, allow_null=False)
     force = serializers.BooleanField(default=False, required=False)
     source_type = serializers.ChoiceField(choices=['barcode'], default='barcode')
@@ -82,12 +87,39 @@ class CheckinRedeemInputSerializer(serializers.Serializer):
     nonce = serializers.CharField(required=False, allow_null=True)
     datetime = serializers.DateTimeField(required=False, allow_null=True)
     answers = serializers.JSONField(required=False, allow_null=True)
-
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        self.fields['lists'].child_relation.queryset = CheckinList.objects.filter(
-            event__in=self.context['events']
-        ).select_related('event')
+
+    def validate_lists(self, value):
+        """Custom validation for checkin lists that handles scope properly"""
+        from django_scopes import scope
+
+        events = self.context.get('events', [])
+        if not events:
+            raise serializers.ValidationError("No events available in context")
+
+        # Get the organizer from the first event
+        organizer = events[0].organizer
+
+        # Validate within the proper scope
+        with scope(organizer=organizer):
+            # Get available checkin lists for the events
+            available_lists = CheckinList.objects.filter(
+                event__in=events
+            ).select_related('event')
+
+            available_ids = set(available_lists.values_list('id', flat=True))
+
+            # Validate each list ID
+            validated_lists = []
+            for list_id in value:
+                if list_id not in available_ids:
+                    raise serializers.ValidationError(
+                        f'Invalid pk "{list_id}" - object does not exist.'
+                    )
+                validated_lists.append(
+                    available_lists.get(id=list_id)
+                )
+
+            return validated_lists
 
 
 class MiniCheckinListSerializer(I18nAwareModelSerializer):

src/pretix/api/urls.py

@@ -17,6 +17,7 @@
     oauth,
     order,
     organizer,
+    room,
     upload,
     user,
     version,
@@ -103,6 +104,11 @@
         event.EventSettingsView.as_view(),
         name='event.settings',
     ),
+    url(
+        r'^organizers/(?P<organizer>[^/]+)/events/(?P<event>[^/]+)/checkout/$',
+        checkin.EventCheckoutView.as_view(),
+        name='event.checkout',
+    ),
     url(
         r'^organizers/(?P<organizer>[^/]+)/events/(?P<event>[^/]+)/',
         include(event_router.urls),
@@ -128,6 +134,21 @@
         checkin.CheckinRedeemView.as_view(),
         name='checkin.redeem',
     ),
+    url(
+        r'^organizers/(?P<organizer>[^/]+)/events/(?P<event>[^/]+)/rooms/(?P<room_id>[^/]+)/checkin/$',
+        room.RoomCheckinView.as_view(),
+        name='room.checkin',
+    ),
+    url(
+        r'^organizers/(?P<organizer>[^/]+)/events/(?P<event>[^/]+)/rooms/(?P<room_id>[^/]+)/checkout/$',
+        room.RoomCheckoutView.as_view(),
+        name='room.checkout',
+    ),
+    url(
+        r'^organizers/(?P<organizer>[^/]+)/events/(?P<event>[^/]+)/rooms/(?P<room_id>[^/]+)/status/$',
+        room.RoomStatusView.as_view(),
+        name='room.status',
+    ),
     url(
         r'^organizers/(?P<organizer>[^/]+)/events/(?P<event>[^/]+)/orders/(?P<order>[^/]+)/',
         include(order_router.urls),