# Buggy code
def query(self, view_kwargs):
    """
    query method for Attendees List
    :param view_kwargs:
    :return:
    """
    query_ = self.session.query(TicketHolder)

    if view_kwargs.get("order_identifier"):
        order = safe_query(
            self,
            Order,
            "identifier",
            view_kwargs["order_identifier"],
            "order_identifier",
        )
        if not has_access("is_registrar", event_id=order.event_id) or not has_access(
            "is_user_itself", user_id=order.user_id
        ):
            raise ForbiddenException({"source": ""}, "Access Forbidden")
        query_ = query_.join(Order).filter(Order.id == order.id)

    if view_kwargs.get("ticket_id"):
        ticket = safe_query(self, Ticket, "id", view_kwargs["ticket_id"], "ticket_id")
        if not has_access("is_registrar", event_id=ticket.event_id):
            raise ForbiddenException({"source": ""}, "Access Forbidden")
        query_ = query_.join(Ticket).filter(Ticket.id == ticket.id)

    if view_kwargs.get("user_id"):
        user = safe_query(self, User, "id", view_kwargs["user_id"], "user_id")
        if not has_access("is_user_itself", user_id=user.id):
            raise ForbiddenException({"source": ""}, "Access Forbidden")
        query_ = query_.join(User, User.email == TicketHolder.email).filter(
            User.id == user.id
        )

    query_ = event_query(self, query_, view_kwargs, permission="is_registrar")
    return query_


# Traceback (KeyError)
Exception on /v1/orders/fe5a8c1d-ac6d-4bd3-ac4b-0540d4bcc03b/attendees [GET]
Traceback (most recent call last):
File "/home/srv_twry/anaconda3/envs/open-event-server/lib/python3.6/site-packages/flask/app.py", line 2292, in wsgi_app
response = self.full_dispatch_request()
File "/home/srv_twry/anaconda3/envs/open-event-server/lib/python3.6/site-packages/flask/app.py", line 1815, in full_dispatch_request
rv = self.handle_user_exception(e)
File "/home/srv_twry/anaconda3/envs/open-event-server/lib/python3.6/site-packages/flask_cors/extension.py", line 161, in wrapped_function
return cors_after_request(app.make_response(f(*args, **kwargs)))
File "/home/srv_twry/anaconda3/envs/open-event-server/lib/python3.6/site-packages/flask/app.py", line 1718, in handle_user_exception
reraise(exc_type, exc_value, tb)
File "/home/srv_twry/anaconda3/envs/open-event-server/lib/python3.6/site-packages/flask/_compat.py", line 35, in reraise
raise value
File "/home/srv_twry/anaconda3/envs/open-event-server/lib/python3.6/site-packages/flask/app.py", line 1813, in full_dispatch_request
rv = self.dispatch_request()
File "/home/srv_twry/anaconda3/envs/open-event-server/lib/python3.6/site-packages/flask/app.py", line 1799, in dispatch_request
return self.view_functions[rule.endpoint](**req.view_args)
File "/media/srv_twry/work/Projects/Community-Projects/Fossasia/open-event-server/src/flask-rest-jsonapi/flask_rest_jsonapi/decorators.py", line 32, in wrapper
return func(*args, **kwargs)
File "/home/srv_twry/anaconda3/envs/open-event-server/lib/python3.6/site-packages/flask/views.py", line 88, in view
return self.dispatch_request(*args, **kwargs)
File "/media/srv_twry/work/Projects/Community-Projects/Fossasia/open-event-server/src/flask-rest-jsonapi/flask_rest_jsonapi/resource.py", line 68, in dispatch_request
response = method(*args, **kwargs)
File "/media/srv_twry/work/Projects/Community-Projects/Fossasia/open-event-server/src/flask-rest-jsonapi/flask_rest_jsonapi/decorators.py", line 56, in wrapper
return func(*args, **kwargs)
File "/media/srv_twry/work/Projects/Community-Projects/Fossasia/open-event-server/src/flask-rest-jsonapi/flask_rest_jsonapi/resource.py", line 145, in get
objects_count, objects = self._data_layer.get_collection(qs, kwargs)
File "/media/srv_twry/work/Projects/Community-Projects/Fossasia/open-event-server/src/flask-rest-jsonapi/flask_rest_jsonapi/data_layers/alchemy.py", line 92, in get_collection
query = self.query(view_kwargs)
File "/media/srv_twry/work/Projects/Community-Projects/Fossasia/open-event-server/app/api/attendees.py", line 81, in query
id=order.user_id):
File "/media/srv_twry/work/Projects/Community-Projects/Fossasia/open-event-server/app/api/helpers/permission_manager.py", line 445, in has_access
auth = permissions[access_level](lambda *a, **b: True, (), {}, (), **kwargs)
File "/media/srv_twry/work/Projects/Community-Projects/Fossasia/open-event-server/app/api/helpers/permissions.py", line 45, in decorator
return fn(*args, **kwargs)
File "/media/srv_twry/work/Projects/Community-Projects/Fossasia/open-event-server/app/api/helpers/permission_manager.py", line 109, in is_user_itself
if not user.is_admin and not user.is_super_admin and user.id != kwargs['user_id']:
KeyError: 'user_id'

# Fixed code
def query(self, view_kwargs):
    """
    query method for Attendees List
    :param view_kwargs:
    :return:
    """
    query_ = self.session.query(TicketHolder)

    if view_kwargs.get("order_identifier"):
        order = safe_query(
            self,
            Order,
            "identifier",
            view_kwargs["order_identifier"],
            "order_identifier",
        )
        if not has_access("is_registrar", event_id=order.event_id) and not has_access(
            "is_user_itself", user_id=order.user_id
        ):
            raise ForbiddenException({"source": ""}, "Access Forbidden")
        query_ = query_.join(Order).filter(Order.id == order.id)

    if view_kwargs.get("ticket_id"):
        ticket = safe_query(self, Ticket, "id", view_kwargs["ticket_id"], "ticket_id")
        if not has_access("is_registrar", event_id=ticket.event_id):
            raise ForbiddenException({"source": ""}, "Access Forbidden")
        query_ = query_.join(Ticket).filter(Ticket.id == ticket.id)

    if view_kwargs.get("user_id"):
        user = safe_query(self, User, "id", view_kwargs["user_id"], "user_id")
        if not has_access("is_user_itself", user_id=user.id):
            raise ForbiddenException({"source": ""}, "Access Forbidden")
        query_ = query_.join(User, User.email == TicketHolder.email).filter(
            User.id == user.id
        )

    query_ = event_query(self, query_, view_kwargs, permission="is_registrar")
    return query_