Repository: fossasia/open-event-server

Issue:
HTTP 500 in GET attendees under an order
**Describe the bug**
<!-- A clear and concise description of what the bug is. -->
The server returns HTTP 500 when trying to fetch the attendees under an order.

**To Reproduce**
Steps to reproduce the behavior:
1. Create one or more attendees
2. Create an order linking it to the above created attendees
3. Make a GET request to `/v1/orders/{order_identifier}/attendees`
4. See error

**Expected behavior**
<!-- A clear and concise description of what you expected to happen. -->
The server send the list of attendees

**Stacktrace**
<!-- If applicable, add stacktrace to help explain your problem. -->
``` Python
Exception on /v1/orders/fe5a8c1d-ac6d-4bd3-ac4b-0540d4bcc03b/attendees [GET]
Traceback (most recent call last):
  File "/home/srv_twry/anaconda3/envs/open-event-server/lib/python3.6/site-packages/flask/app.py", line 2292, in wsgi_app
    response = self.full_dispatch_request()
  File "/home/srv_twry/anaconda3/envs/open-event-server/lib/python3.6/site-packages/flask/app.py", line 1815, in full_dispatch_request
    rv = self.handle_user_exception(e)
  File "/home/srv_twry/anaconda3/envs/open-event-server/lib/python3.6/site-packages/flask_cors/extension.py", line 161, in wrapped_function
    return cors_after_request(app.make_response(f(*args, **kwargs)))
  File "/home/srv_twry/anaconda3/envs/open-event-server/lib/python3.6/site-packages/flask/app.py", line 1718, in handle_user_exception
    reraise(exc_type, exc_value, tb)
  File "/home/srv_twry/anaconda3/envs/open-event-server/lib/python3.6/site-packages/flask/_compat.py", line 35, in reraise
    raise value
  File "/home/srv_twry/anaconda3/envs/open-event-server/lib/python3.6/site-packages/flask/app.py", line 1813, in full_dispatch_request
    rv = self.dispatch_request()
  File "/home/srv_twry/anaconda3/envs/open-event-server/lib/python3.6/site-packages/flask/app.py", line 1799, in dispatch_request
    return self.view_functions[rule.endpoint](**req.view_args)
  File "/media/srv_twry/work/Projects/Community-Projects/Fossasia/open-event-server/src/flask-rest-jsonapi/flask_rest_jsonapi/decorators.py", line 32, in wrapper
    return func(*args, **kwargs)
  File "/home/srv_twry/anaconda3/envs/open-event-server/lib/python3.6/site-packages/flask/views.py", line 88, in view
    return self.dispatch_request(*args, **kwargs)
  File "/media/srv_twry/work/Projects/Community-Projects/Fossasia/open-event-server/src/flask-rest-jsonapi/flask_rest_jsonapi/resource.py", line 68, in dispatch_request
    response = method(*args, **kwargs)
  File "/media/srv_twry/work/Projects/Community-Projects/Fossasia/open-event-server/src/flask-rest-jsonapi/flask_rest_jsonapi/decorators.py", line 56, in wrapper
    return func(*args, **kwargs)
  File "/media/srv_twry/work/Projects/Community-Projects/Fossasia/open-event-server/src/flask-rest-jsonapi/flask_rest_jsonapi/resource.py", line 145, in get
    objects_count, objects = self._data_layer.get_collection(qs, kwargs)
  File "/media/srv_twry/work/Projects/Community-Projects/Fossasia/open-event-server/src/flask-rest-jsonapi/flask_rest_jsonapi/data_layers/alchemy.py", line 92, in get_collection
    query = self.query(view_kwargs)
  File "/media/srv_twry/work/Projects/Community-Projects/Fossasia/open-event-server/app/api/attendees.py", line 81, in query
    id=order.user_id):
  File "/media/srv_twry/work/Projects/Community-Projects/Fossasia/open-event-server/app/api/helpers/permission_manager.py", line 445, in has_access
    auth = permissions[access_level](lambda *a, **b: True, (), {}, (), **kwargs)
  File "/media/srv_twry/work/Projects/Community-Projects/Fossasia/open-event-server/app/api/helpers/permissions.py", line 45, in decorator
    return fn(*args, **kwargs)
  File "/media/srv_twry/work/Projects/Community-Projects/Fossasia/open-event-server/app/api/helpers/permission_manager.py", line 109, in is_user_itself
    if not user.is_admin and not user.is_super_admin and user.id != kwargs['user_id']:
KeyError: 'user_id'
```

**Additional context**
<!-- Add any other context about the problem here. -->
Parent issue: #4852 



Discussion:
Adding a preceding `and` condition checking the existence of `user_id` key should fix this?
No, just need to change the kwarg from `id` to `user_id`. Did it and now found another bug. I'll have to fix a lot of them before I can open a PR. Working on it :)
@srv-twry  I'm getting HTTP 403 when trying to reproduce the error. Also, can you please tell the expected time in which it will be completed? We need to implement this endpoint in Orga App and it's pending due to this.
Yeah, I kind of fixed the HTTP 500 in another PR so now it is raising HTTP 403. I'll look into it right now and hopefully should be able to fix it in a couple of days.

Resolving patch:
diff --git a/app/api/attendees.py b/app/api/attendees.py
--- a/app/api/attendees.py
+++ b/app/api/attendees.py
@@ -77,7 +77,7 @@ def query(self, view_kwargs):
 
         if view_kwargs.get('order_identifier'):
             order = safe_query(self, Order, 'identifier', view_kwargs['order_identifier'], 'order_identifier')
-            if not has_access('is_registrar', event_id=order.event_id) or not has_access('is_user_itself',
+            if not has_access('is_registrar', event_id=order.event_id) and not has_access('is_user_itself',
                                                                                          user_id=order.user_id):
                 raise ForbiddenException({'source': ''}, 'Access Forbidden')
             query_ = query_.join(Order).filter(Order.id == order.id)
diff --git a/app/api/orders.py b/app/api/orders.py
--- a/app/api/orders.py
+++ b/app/api/orders.py
@@ -107,6 +107,7 @@ def after_create_object(self, order, data, view_kwargs):
             od = OrderTicket(order_id=order.id, ticket_id=ticket, quantity=order_tickets[ticket])
             save_to_db(od)
         order.quantity = order.get_tickets_count()
+        order.user = current_user
         save_to_db(order)
         if not has_access('is_coorganizer', event_id=data['event']):
             TicketingManager.calculate_update_amount(order)


Test patch: