Repository: fossasia/open-event-server

Issue:
Unable to order ticket
**Describe the bug**
<!-- A clear and concise description of what the bug is. -->
Unable to order ticket after syncing fork with development

**Stacktrace**
<!-- If applicable, add stacktrace to help explain your problem. -->
```py
Traceback (most recent call last):
  File "/Users/kush/open-event-server/venv/lib/python3.7/site-packages/sentry_sdk/integrations/flask.py", line 70, in sentry_patched_wsgi_app
    environ, start_response
  File "/Users/kush/open-event-server/venv/lib/python3.7/site-packages/sentry_sdk/integrations/wsgi.py", line 120, in __call__
    reraise(*_capture_exception(hub))
  File "/Users/kush/open-event-server/venv/lib/python3.7/site-packages/sentry_sdk/_compat.py", line 57, in reraise
    raise value
  File "/Users/kush/open-event-server/venv/lib/python3.7/site-packages/sentry_sdk/integrations/wsgi.py", line 116, in __call__
    _sentry_start_response, start_response, span
  File "/Users/kush/open-event-server/venv/lib/python3.7/site-packages/sentry_sdk/integrations/flask.py", line 69, in <lambda>
    return SentryWsgiMiddleware(lambda *a, **kw: old_app(self, *a, **kw))(
  File "/Users/kush/open-event-server/venv/lib/python3.7/site-packages/flask/app.py", line 2463, in __call__
    return self.wsgi_app(environ, start_response)
  File "/Users/kush/open-event-server/app/__init__.py", line 80, in __call__
    return self.app(environ, start_response)
  File "/Users/kush/open-event-server/venv/lib/python3.7/site-packages/flask/app.py", line 2449, in wsgi_app
    response = self.handle_exception(e)
  File "/Users/kush/open-event-server/venv/lib/python3.7/site-packages/flask_cors/extension.py", line 161, in wrapped_function
    return cors_after_request(app.make_response(f(*args, **kwargs)))
  File "/Users/kush/open-event-server/venv/lib/python3.7/site-packages/flask_cors/extension.py", line 161, in wrapped_function
    return cors_after_request(app.make_response(f(*args, **kwargs)))
  File "/Users/kush/open-event-server/venv/lib/python3.7/site-packages/flask/app.py", line 1866, in handle_exception
    reraise(exc_type, exc_value, tb)
  File "/Users/kush/open-event-server/venv/lib/python3.7/site-packages/flask/_compat.py", line 39, in reraise
    raise value
  File "/Users/kush/open-event-server/venv/lib/python3.7/site-packages/flask/app.py", line 2446, in wsgi_app
    response = self.full_dispatch_request()
  File "/Users/kush/open-event-server/venv/lib/python3.7/site-packages/flask/app.py", line 1951, in full_dispatch_request
    rv = self.handle_user_exception(e)
  File "/Users/kush/open-event-server/venv/lib/python3.7/site-packages/flask_cors/extension.py", line 161, in wrapped_function
    return cors_after_request(app.make_response(f(*args, **kwargs)))
  File "/Users/kush/open-event-server/venv/lib/python3.7/site-packages/flask_cors/extension.py", line 161, in wrapped_function
    return cors_after_request(app.make_response(f(*args, **kwargs)))
  File "/Users/kush/open-event-server/venv/lib/python3.7/site-packages/flask/app.py", line 1820, in handle_user_exception
    reraise(exc_type, exc_value, tb)
  File "/Users/kush/open-event-server/venv/lib/python3.7/site-packages/flask/_compat.py", line 39, in reraise
    raise value
  File "/Users/kush/open-event-server/venv/lib/python3.7/site-packages/flask/app.py", line 1949, in full_dispatch_request
    rv = self.dispatch_request()
  File "/Users/kush/open-event-server/venv/lib/python3.7/site-packages/flask/app.py", line 1935, in dispatch_request
    return self.view_functions[rule.endpoint](**req.view_args)
  File "/Users/kush/open-event-server/venv/src/flask-rest-jsonapi/flask_rest_jsonapi/api.py", line 133, in decorated
    return self.check_permissions(view, view_args, view_kwargs, *args, **kwargs)
  File "/Users/kush/open-event-server/app/api/helpers/permission_manager.py", line 380, in permission_manager
    return view(*view_args, **view_kwargs)
  File "/Users/kush/open-event-server/app/api/helpers/permissions.py", line 46, in decorator
    return fn(*args, **kwargs)
  File "/Users/kush/open-event-server/venv/src/flask-rest-jsonapi/flask_rest_jsonapi/decorators.py", line 32, in wrapper
    return func(*args, **kwargs)
  File "/Users/kush/open-event-server/venv/lib/python3.7/site-packages/flask/views.py", line 89, in view
    return self.dispatch_request(*args, **kwargs)
  File "/Users/kush/open-event-server/venv/src/flask-rest-jsonapi/flask_rest_jsonapi/resource.py", line 68, in dispatch_request
    response = method(*args, **kwargs)
  File "/Users/kush/open-event-server/venv/src/flask-rest-jsonapi/flask_rest_jsonapi/decorators.py", line 56, in wrapper
    return func(*args, **kwargs)
  File "/Users/kush/open-event-server/venv/src/flask-rest-jsonapi/flask_rest_jsonapi/resource.py", line 297, in patch
    if json_data['data']['id'] != str(kwargs[self.data_layer.get('url_field', 'id')]):
KeyError: 'id'
```



Discussion:
cc: @iamareebjamal 
Try to find out which commit caused problem using git bisect
@maze-runnar can you please also mention the issue you are facing while
ordering.

On Tue, 31 Dec, 2019, 13:39 Areeb Jamal, <notifications@github.com> wrote:

> Try to find out which commit caused problem using git bisect
>
> —
> You are receiving this because you authored the thread.
> Reply to this email directly, view it on GitHub
> <https://github.com/fossasia/open-event-server/issues/6703?email_source=notifications&email_token=AKQMTLTF5NMFUXE3CAINMY3Q3L42ZA5CNFSM4KBSG52KYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEH34HHQ#issuecomment-569885598>,
> or unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AKQMTLT567SKJ3AAPECKD3LQ3L42ZANCNFSM4KBSG52A>
> .
>

@iamareebjamal @kushthedude this caused the issue and broke the ordering system

https://github.com/fossasia/open-event-server/pull/6573
Reason?
> @maze-runnar can you please also mention the issue you are facing while ordering.
> […](#)
> On Tue, 31 Dec, 2019, 13:39 Areeb Jamal, ***@***.***> wrote: Try to find out which commit caused problem using git bisect — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#6703?email_source=notifications&email_token=AKQMTLTF5NMFUXE3CAINMY3Q3L42ZA5CNFSM4KBSG52KYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEH34HHQ#issuecomment-569885598>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AKQMTLT567SKJ3AAPECKD3LQ3L42ZANCNFSM4KBSG52A> .

@kushthedude When go to event for ordering ticket ,  the message popup to fill the detail then send to page your ticket is expired  .
@codedsun Can you please also check what is the issue faced by @maze-runnar
?

On Tue, 31 Dec, 2019, 15:19 Sundaram Dubey, <notifications@github.com>
wrote:

> @maze-runnar <https://github.com/maze-runnar> can you please also mention
> the issue you are facing while ordering.
> … <#m_6506157501205705504_>
> On Tue, 31 Dec, 2019, 13:39 Areeb Jamal, *@*.***> wrote: Try to find out
> which commit caused problem using git bisect — You are receiving this
> because you authored the thread. Reply to this email directly, view it on
> GitHub <#6703 <https://github.com/fossasia/open-event-server/issues/6703>?email_source=notifications&email_token=AKQMTLTF5NMFUXE3CAINMY3Q3L42ZA5CNFSM4KBSG52KYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEH34HHQ#issuecomment-569885598>,
> or unsubscribe
> https://github.com/notifications/unsubscribe-auth/AKQMTLT567SKJ3AAPECKD3LQ3L42ZANCNFSM4KBSG52A
> .
>
> @kushthedude <https://github.com/kushthedude> When go to event for
> ordering ticket , the message popup to fill the detail then send to page
> your ticket is expired .
>
> —
> You are receiving this because you were mentioned.
> Reply to this email directly, view it on GitHub
> <https://github.com/fossasia/open-event-server/issues/6703?email_source=notifications&email_token=AKQMTLTUUIHEOTCPVKU6QJLQ3MITVA5CNFSM4KBSG52KYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEH37S2Y#issuecomment-569899371>,
> or unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AKQMTLR76EPWPEOIRH2KOADQ3MITVANCNFSM4KBSG52A>
> .
>

The order is returning expired immediately after being created. 
https://github.com/fossasia/open-event-server/blob/d5cce64f78844bab8781f93af86ee839e4cf7b46/app/api/helpers/permission_manager.py#L394-L400

Aslo the earlier commit function says

```
 # This is to ensure that the permissions manager runs and hence changes the kwarg from order identifier to id.
    def before_delete_object(self, order, view_kwargs):
        """
        method to check for proper permissions for deleting
        :param order:
        :param view_kwargs:
        :return:
        """
        if not has_access('is_coorganizer', event_id=order.event.id):
            raise ForbiddenException({'source': ''}, 'Access Forbidden')
        elif order.amount and order.amount > 0 and (order.status == 'completed' or order.status == 'placed'):
            raise ConflictException({'source': ''}, 'You cannot delete a placed/completed paid order.')
```

```
decorators = (jwt_required, api.has_permission(
        'auth_required', methods="PATCH,DELETE", model=Order),)
```

Due to the patch request the permission manager changes the changes the kwarg from order identifier to id.

While in the current dev branch, the function is changed and we get the error of missing `id`
This is really bad logic. Why should permission manager change this? The entire function is sad to look at. Needless metaprogramming. Changing something required locally layers away to induce confusion

Reverting the PR. Open an issue to removw all logic from permission manager to appropriate routes and use it only for permission management as its name suggests
@iamareebjamal Wow, this was totally unexpected. Sorry I missed that. 
We can take an approach similar to:
https://github.com/fossasia/open-event-server/blob/d5cce64f78844bab8781f93af86ee839e4cf7b46/app/api/helpers/permissions.py#L149-L169

and expand this function to accommodate those cases specified in permission_manager and call it wherever we are using the has_access decorator.
@maze-runnar Please verify is your issue is resolved too.

On Tue, 31 Dec, 2019, 17:39 Areeb Jamal, <notifications@github.com> wrote:

> Closed #6703 <https://github.com/fossasia/open-event-server/issues/6703>.
>
> —
> You are receiving this because you were mentioned.
> Reply to this email directly, view it on GitHub
> <https://github.com/fossasia/open-event-server/issues/6703?email_source=notifications&email_token=AKQMTLRRWIJZWK7D7OQSKHLQ3MY6NA5CNFSM4KBSG52KYY3PNVWWK3TUL52HS4DFWZEXG43VMVCXMZLOORHG65DJMZUWGYLUNFXW5KTDN5WW2ZLOORPWSZGOVXD5PNA#event-2915555252>,
> or unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AKQMTLTVP54SUHIKK53NFSTQ3MY6NANCNFSM4KBSG52A>
> .
>

@kushthedude  , yes the issue is resolved now .
@iamareebjamal The issue stated by @maze-runnar is not resolved.
Procedure:-
- Create a Pendind Order.
- Don't pay for it and let it convert to Expired.
- Now every order you place will be directly expired !
@iamareebjamal @prateekj117 - Will #6719 fixes this issue or shall I take this up? and look more to it what went wrong.
No, that will not be used for a long time now. Take this up
@iamareebjamal This is the commit 7e9400673dcc751d77cbd93561f2454a468a9c6b where things got messed up. I used git bisect and everything before is working 
This commit is not even setting the tickets as expired. That was done in other PR so how can this break things?
> This commit is not even setting the tickets as expired. That was done in other PR so how can this break things?

I just resetted my head to the following, The issue is https://github.com/fossasia/open-event-frontend/blob/255c4a7e425ef7ec75bff8e4edb7dbe23425138c/app/components/forms/orders/order-form.js#L47 . 
The expire timer is not resetting for new orders. Once a order is created the expire timer goes on & on.

The actual issue is https://github.com/fossasia/open-event-server/pull/6693/files#r363030941
@codedsun Please fix this 

Resolving patch:
diff --git a/app/models/order.py b/app/models/order.py
--- a/app/models/order.py
+++ b/app/models/order.py
@@ -91,7 +91,7 @@ def __init__(self,
                  transaction_id=None,
                  paid_via=None,
                  is_billing_enabled=False,
-                 created_at=datetime.datetime.now(datetime.timezone.utc),
+                 created_at=None,
                  user_id=None,
                  discount_code_id=None,
                  event_id=None,
@@ -115,6 +115,8 @@ def __init__(self,
         self.transaction_id = transaction_id
         self.paid_via = paid_via
         self.is_billing_enabled = is_billing_enabled
+        if created_at is None:
+            created_at = datetime.datetime.now(datetime.timezone.utc)
         self.created_at = created_at
         self.discount_code_id = discount_code_id
         self.status = status


Test patch: