Repository: fossasia/open-event-server

Issue:
every user is organizer for every event
**Describe the bug**
<!-- A clear and concise description of what the bug is. -->
Please refer to the screen shot given below

**Expected behavior**
<!-- A clear and concise description of what you expected to happen. -->
Only the events whom the user is actually an organiser should be displayed

**Screenshots**
<!-- If applicable, add screenshots to help explain your problem. -->
![image](https://user-images.githubusercontent.com/21087061/53115919-5bd67700-356d-11e9-9181-adbf6bf4eddf.png)

**Desktop (please complete the following information):**
 - OS: [e.g. iOS] Ubuntu
 - Browser [e.g. chrome, safari] Chrome
 
**Additional context**
<!-- Add any other context about the problem here. -->
Working on it


Discussion:
@iamareebjamal @CosmicCoder96  I think the problem lies in the fact that currently `organizer_events` relationship is having no validation checks as to whether the user is actually an organiser or not.

https://github.com/fossasia/open-event-server/blob/b7ffa627f94ccae389939e47840d605e610da257/app/api/schema/users.py#L151-L157

```python
    organizer_events = Relationship(
        self_view='v1.user_organizer_event',
        self_view_kwargs={'id': '<id>'},
        related_view='v1.event_list',
        schema='EventSchema',
        many=True,
        type_='event')
```
How should I proceed to make sure that the Relationship actually checks whether the current user is an organiser in the event or not, I could use help in this
@uds5501 are you still working on this?
@prabhupant No I am not, but would like to provide a heads up. It's a FE issue. The relations are correct in the server but not in the frontend. If you want to take over, be my guest
@uds5501 Transfer it to FE 
@uds5501 Wanted to know if the server is providing correct relation than Is it hardcoded for every user?
@kushthedude the server side relationships are working fine. as I have already mentioned above :)
@uds5501 Can i work on this issue ?
@Haider8 Progress?

Yes, working on it. Was stuck in some college work.

On Sun, Mar 31, 2019, 1:12 AM Kush Trivedi <notifications@github.com wrote:

> @Haider8 <https://github.com/Haider8> Progress?
>
> —
> You are receiving this because you were mentioned.
> Reply to this email directly, view it on GitHub
> <https://github.com/fossasia/open-event-frontend/issues/2390#issuecomment-478282903>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/ApSyUOS2nSBe5huSdeAc4j21LlTV5pmeks5vb746gaJpZM4cI3cv>
> .
>

@uds5501 @prabhupant I think this issue is not there anymore
@Haider8 It is still there :)
![image](https://user-images.githubusercontent.com/21087061/55533655-9d5f5380-56cf-11e9-8fc0-fae395dd99ed.png)

@uds5501 If you haven't spent much time on it, May I work on this issue?
@prateekj117 Go for it!
@uds5501 This problem doesn't seem to persist on my system.
Please try makin an event from a super user, and one from a new user and
let me know the results.

On Sun, 7 Apr 2019, 16:16 Prateek Jain, <notifications@github.com> wrote:

> @uds5501 <https://github.com/uds5501> This problem doesn't seem to
> persist on my system.
>
> —
> You are receiving this because you were mentioned.
> Reply to this email directly, view it on GitHub
> <https://github.com/fossasia/open-event-frontend/issues/2390#issuecomment-480579002>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/AUHDVYdVIS1obi-vWaEATuHaFGrWKAXeks5vecx8gaJpZM4cI3cv>
> .
>

@uds5501 Yes, you are right. The problem persists.
@CosmicCoder96 @iamareebjamal This is a temporary fix. I think that this issue is of the server as @uds5501 commented above. Can you please transfer this to the server so that I can do the permanent fix there.
@prateekj117 this is an issue at the front-end only. Happening due to incorrect model relationships at ember model levels. The server side relations are working fine, I have verified
@uds5501 Thanks for the info. In that case, I will look into it.

Resolving patch:
diff --git a/app/api/__init__.py b/app/api/__init__.py
--- a/app/api/__init__.py
+++ b/app/api/__init__.py
@@ -87,7 +87,7 @@
 from app.api.users import UserList, UserDetail, UserRelationship
 
 # users
-api.route(UserList, 'user_list', '/users')
+api.route(UserList, 'user_list', '/users', '/events/<int:event_id>/organizers')
 api.route(UserDetail, 'user_detail', '/users/<int:id>', '/notifications/<int:notification_id>/user',
           '/event-invoices/<int:event_invoice_id>/user', '/speakers/<int:speaker_id>/user',
           '/access-codes/<int:access_code_id>/marketer', '/email-notifications/<int:email_notification_id>/user',
@@ -102,12 +102,12 @@
 api.route(UserRelationship, 'user_access_codes', '/users/<int:id>/relationships/access-codes')
 api.route(UserRelationship, 'user_discount_codes', '/users/<int:id>/relationships/discount-codes')
 api.route(UserRelationship, 'user_email_notifications', '/users/<int:id>/relationships/email-notifications')
-api.route(UserRelationship, 'user_owner_event', '/users/<int:id>/relationships/owner-events')
-api.route(UserRelationship, 'user_organizer_event', '/users/<int:id>/relationships/organizer-events')
-api.route(UserRelationship, 'user_coorganizer_event', '/users/<int:id>/relationships/coorganizer-events')
-api.route(UserRelationship, 'user_track_organizer_event', '/users/<int:id>/relationships/track-organizer-events')
-api.route(UserRelationship, 'user_registrar_event', '/users/<int:id>/relationships/registrar-events')
-api.route(UserRelationship, 'user_moderator_event', '/users/<int:id>/relationships/moderator-events')
+api.route(UserRelationship, 'user_owner_events', '/users/<int:id>/relationships/owner-events')
+api.route(UserRelationship, 'user_organizer_events', '/users/<int:id>/relationships/organizer-events')
+api.route(UserRelationship, 'user_coorganizer_events', '/users/<int:id>/relationships/coorganizer-events')
+api.route(UserRelationship, 'user_track_organizer_events', '/users/<int:id>/relationships/track-organizer-events')
+api.route(UserRelationship, 'user_registrar_events', '/users/<int:id>/relationships/registrar-events')
+api.route(UserRelationship, 'user_moderator_events', '/users/<int:id>/relationships/moderator-events')
 api.route(UserRelationship, 'user_attendees', '/users/<int:id>/relationships/attendees')
 api.route(UserRelationship, 'user_events', '/users/<int:id>/relationships/events')
 api.route(UserRelationship, 'user_orders', '/users/<int:id>/relationships/orders')
@@ -200,7 +200,6 @@
 api.route(PanelPermissionRelationship, 'panel_permissions_custom_system_roles',
           '/panel-permissions/<int:id>/relationships/custom-system-roles')
 
-
 # roles
 api.route(RoleList, 'role_list', '/roles')
 api.route(RoleDetail, 'role_detail', '/roles/<int:id>', '/role-invites/<int:role_invite_id>/role')
@@ -246,7 +245,16 @@
 api.route(EventList, 'event_list', '/events', '/event-types/<int:event_type_id>/events',
           '/event-topics/<int:event_topic_id>/events',
           '/event-sub-topics/<int:event_sub_topic_id>/events', '/discount-codes/<int:discount_code_id>/events',
-          '/users/<int:user_id>/events')
+          '/users/<int:user_id>/events',
+          '/users/<int:user_owner_id>/owner-events',
+          '/users/<int:user_organizer_id>/organizer-events',
+          '/users/<int:user_coorganizer_id>/coorganizer-events',
+          '/users/<int:user_track_organizer_id>/track-organizer-events',
+          '/users/<int:user_registrar_id>/registrar-events',
+          '/users/<int:user_moderator_id>/moderator-events',
+          '/users/<int:user_marketer_id>/marketer-events',
+          '/users/<int:user_sales_admin_id>/sales-admin-events')
+
 api.route(EventDetail, 'event_detail', '/events/<int:id>', '/events/<identifier>',
           '/tickets/<int:ticket_id>/event', '/microlocations/<int:microlocation_id>/event',
           '/social-links/<int:social_link_id>/event',
diff --git a/app/api/events.py b/app/api/events.py
--- a/app/api/events.py
+++ b/app/api/events.py
@@ -46,10 +46,12 @@
 from app.models.ticket_holder import TicketHolder
 from app.models.track import Track
 from app.models.user_favourite_event import UserFavouriteEvent
-from app.models.user import User, ATTENDEE, OWNER, ORGANIZER, COORGANIZER
+from app.models.user import User, ATTENDEE, OWNER, ORGANIZER, COORGANIZER, TRACK_ORGANIZER, REGISTRAR, MODERATOR, \
+    SALES_ADMIN, MARKETER
 from app.models.users_events_role import UsersEventsRoles
 from app.models.stripe_authorization import StripeAuthorization
 
+
 def validate_event(user, modules, data):
     if not user.can_create_event():
         raise ForbiddenException({'source': ''},
@@ -142,6 +144,62 @@ def query(self, view_kwargs):
             query_ = query_.join(Event.roles).filter_by(user_id=user.id).join(UsersEventsRoles.role). \
                 filter(Role.name != ATTENDEE)
 
+        if view_kwargs.get('user_owner_id') and 'GET' in request.method:
+            if not has_access('is_user_itself', user_id=int(view_kwargs['user_owner_id'])):
+                raise ForbiddenException({'source': ''}, 'Access Forbidden')
+            user = safe_query(db, User, 'id', view_kwargs['user_owner_id'], 'user_owner_id')
+            query_ = query_.join(Event.roles).filter_by(user_id=user.id).join(UsersEventsRoles.role). \
+                filter(Role.name == OWNER)
+
+        if view_kwargs.get('user_organizer_id') and 'GET' in request.method:
+            if not has_access('is_user_itself', user_id=int(view_kwargs['user_organizer_id'])):
+                raise ForbiddenException({'source': ''}, 'Access Forbidden')
+            user = safe_query(db, User, 'id', view_kwargs['user_organizer_id'], 'user_organizer_id')
+            query_ = query_.join(Event.roles).filter_by(user_id=user.id).join(UsersEventsRoles.role). \
+                filter(Role.name == ORGANIZER)
+
+        if view_kwargs.get('user_coorganizer_id') and 'GET' in request.method:
+            if not has_access('is_user_itself', user_id=int(view_kwargs['user_coorganizer_id'])):
+                raise ForbiddenException({'source': ''}, 'Access Forbidden')
+            user = safe_query(db, User, 'id', view_kwargs['user_coorganizer_id'], 'user_coorganizer_id')
+            query_ = query_.join(Event.roles).filter_by(user_id=user.id).join(UsersEventsRoles.role). \
+                filter(Role.name == COORGANIZER)
+
+        if view_kwargs.get('user_track_organizer_id') and 'GET' in request.method:
+            if not has_access('is_user_itself', user_id=int(view_kwargs['user_track_organizer_id'])):
+                raise ForbiddenException({'source': ''}, 'Access Forbidden')
+            user = safe_query(db, User, 'id', view_kwargs['user_track_organizer_id'], 'user_organizer_id')
+            query_ = query_.join(Event.roles).filter_by(user_id=user.id).join(UsersEventsRoles.role). \
+                filter(Role.name == TRACK_ORGANIZER)
+
+        if view_kwargs.get('user_registrar_id') and 'GET' in request.method:
+            if not has_access('is_user_itself', user_id=int(view_kwargs['user_registrar_id'])):
+                raise ForbiddenException({'source': ''}, 'Access Forbidden')
+            user = safe_query(db, User, 'id', view_kwargs['user_registrar_id'], 'user_registrar_id')
+            query_ = query_.join(Event.roles).filter_by(user_id=user.id).join(UsersEventsRoles.role). \
+                filter(Role.name == REGISTRAR)
+
+        if view_kwargs.get('user_moderator_id') and 'GET' in request.method:
+            if not has_access('is_user_itself', user_id=int(view_kwargs['user_moderator_id'])):
+                raise ForbiddenException({'source': ''}, 'Access Forbidden')
+            user = safe_query(db, User, 'id', view_kwargs['user_moderator_id'], 'user_moderator_id')
+            query_ = query_.join(Event.roles).filter_by(user_id=user.id).join(UsersEventsRoles.role). \
+                filter(Role.name == MODERATOR)
+
+        if view_kwargs.get('user_marketer_id') and 'GET' in request.method:
+            if not has_access('is_user_itself', user_id=int(view_kwargs['user_marketer_id'])):
+                raise ForbiddenException({'source': ''}, 'Access Forbidden')
+            user = safe_query(db, User, 'id', view_kwargs['user_marketer_id'], 'user_marketer_id')
+            query_ = query_.join(Event.roles).filter_by(user_id=user.id).join(UsersEventsRoles.role). \
+                filter(Role.name == MARKETER)
+
+        if view_kwargs.get('user_sales_admin_id') and 'GET' in request.method:
+            if not has_access('is_user_itself', user_id=int(view_kwargs['user_sales_admin_id'])):
+                raise ForbiddenException({'source': ''}, 'Access Forbidden')
+            user = safe_query(db, User, 'id', view_kwargs['user_sales_admin_id'], 'user_sales_admin_id')
+            query_ = query_.join(Event.roles).filter_by(user_id=user.id).join(UsersEventsRoles.role). \
+                filter(Role.name == SALES_ADMIN)
+
         if view_kwargs.get('event_type_id') and 'GET' in request.method:
             query_ = self.session.query(Event).filter(
                 getattr(Event, 'event_type_id') == view_kwargs['event_type_id'])
diff --git a/app/api/schema/users.py b/app/api/schema/users.py
--- a/app/api/schema/users.py
+++ b/app/api/schema/users.py
@@ -160,44 +160,50 @@ class Meta:
         many=True,
         type_='session')
     owner_events = Relationship(
-        self_view='v1.user_owner_event',
+        self_view='v1.user_owner_events',
         self_view_kwargs={'id': '<id>'},
         related_view='v1.event_list',
+        related_view_kwargs={'user_owner_id': '<id>'},
         schema='EventSchema',
         many=True,
         type_='event')
     organizer_events = Relationship(
-        self_view='v1.user_organizer_event',
+        self_view='v1.user_organizer_events',
         self_view_kwargs={'id': '<id>'},
+        related_view_kwargs={'user_organizer_id': '<id>'},
         related_view='v1.event_list',
         schema='EventSchema',
         many=True,
         type_='event')
     coorganizer_events = Relationship(
-        self_view='v1.user_coorganizer_event',
+        self_view='v1.user_coorganizer_events',
         self_view_kwargs={'id': '<id>'},
         related_view='v1.event_list',
+        related_view_kwargs={'user_coorganizer_id': '<id>'},
         schema='EventSchema',
         many=True,
         type_='event')
     track_organizer_events = Relationship(
-        self_view='v1.user_track_organizer_event',
+        self_view='v1.user_track_organizer_events',
         self_view_kwargs={'id': '<id>'},
         related_view='v1.event_list',
+        related_view_kwargs={'user_track_organizer_id': '<id>'},
         schema='EventSchema',
         many=True,
         type_='event')
     registrar_events = Relationship(
-        self_view='v1.user_registrar_event',
+        self_view='v1.user_registrar_events',
         self_view_kwargs={'id': '<id>'},
         related_view='v1.event_list',
+        related_view_kwargs={'user_registrar_id': '<id>'},
         schema='EventSchema',
         many=True,
         type_='event')
     moderator_events = Relationship(
-        self_view='v1.user_moderator_event',
+        self_view='v1.user_moderator_events',
         self_view_kwargs={'id': '<id>'},
         related_view='v1.event_list',
+        related_view_kwargs={'user_moderator_id': '<id>'},
         schema='EventSchema',
         many=True,
         type_='event')


Test patch: