Repository: fossasia/open-event-server

Issue:
Key error 'user_id' in PATCH order.
**Describe the bug**
<!-- A clear and concise description of what the bug is. -->
The server returns HTTP 500 when sending a PATCH request to the /orders/<identifier> endpoint.


Discussion:

Resolving patch:
diff --git a/app/api/helpers/permission_manager.py b/app/api/helpers/permission_manager.py
--- a/app/api/helpers/permission_manager.py
+++ b/app/api/helpers/permission_manager.py
@@ -354,8 +354,8 @@ def permission_manager(view, view_args, view_kwargs, *args, **kwargs):
         try:
             order = Order.query.filter_by(identifier=view_kwargs['order_identifier']).one()
         except NoResultFound:
-            return NotFoundError({'parameter': 'order_identifier'}, 'Event not found').respond()
-        view_kwargs['id'] = order.identifier
+            return NotFoundError({'parameter': 'order_identifier'}, 'Order not found').respond()
+        view_kwargs['id'] = order.id
 
     # If event_identifier in route instead of event_id
     if 'event_identifier' in view_kwargs:
@@ -435,7 +435,6 @@ def permission_manager(view, view_args, view_kwargs, *args, **kwargs):
                 kwargs[kwargs['fetch']] = fetched
         else:
             return NotFoundError({'source': ''}, 'Object not found.').respond()
-
     if args[0] in permissions:
         return permissions[args[0]](view, view_args, view_kwargs, *args, **kwargs)
     else:
diff --git a/app/api/orders.py b/app/api/orders.py
--- a/app/api/orders.py
+++ b/app/api/orders.py
@@ -205,7 +205,7 @@ def before_get_object(self, view_kwargs):
         """
         if view_kwargs.get('attendee_id'):
             attendee = safe_query(self, TicketHolder, 'id', view_kwargs['attendee_id'], 'attendee_id')
-            view_kwargs['order_identifier'] = attendee.order.identifier
+            view_kwargs['id'] = attendee.order.id
         if view_kwargs.get('order_identifier'):
             order = safe_query(self, Order, 'identifier', view_kwargs['order_identifier'], 'order_identifier')
             view_kwargs['id'] = order.id
@@ -301,8 +301,9 @@ def before_delete_object(self, order, view_kwargs):
         elif order.amount and order.amount > 0 and (order.status == 'completed' or order.status == 'placed'):
             raise ConflictException({'source': ''}, 'You cannot delete a placed/completed paid order.')
 
+    # This is to ensure that the permissions manager runs and hence changes the kwarg from order identifier to id.
     decorators = (jwt_required, api.has_permission(
-        'is_user_itself', methods="PATCH,DELETE", fetch="id", fetch_as="order_id", model=Order),)
+        'auth_required', methods="PATCH,DELETE", fetch="user_id", model=Order),)
 
     schema = OrderSchema
     data_layer = {'session': db.session,
diff --git a/app/models/order.py b/app/models/order.py
--- a/app/models/order.py
+++ b/app/models/order.py
@@ -22,7 +22,7 @@ def get_updatable_fields():
     :return: The list of fields which can be modified by the order user using the pre payment form.
     """
     return ['country', 'address', 'city', 'state', 'zipcode', 'status', 'paid_via', 'order_notes', 'deleted_at', 'user',
-            'payment_mode']
+            'payment_mode', 'event', 'ticket_holders', 'user']
 
 
 class OrderTicket(SoftDeletionModel):


Test patch: