Repository: fossasia/open-event-server

Issue:
order.user should not be available to the ticket holder
**Describe the bug**
order.user should not be available to the ticket holder and be only available when the holder is ticket purchaser

Steps:
 - [ ] Remove the user relation when holder is not purchaser
 - [ ] Make the changes in frontend also



Discussion:
I wanna take up this issue. Assign me
I want to work on this, Could you assign it to me 
I wanna work on to this project can you assign it to me.

Please assign it to me @codedsun 
please assign it to me

You guys can take up the issue if someone has claimed that he/she may work on the issue but no PR is submitted till 5-6 days. their is no need of assigning the issue to anyone.
Sir when I click on the fork button it say that "You don't have the permission to fork to these organization" and when I try to download the code via git these appears.
![Screenshot (34)](https://user-images.githubusercontent.com/72877136/103153729-a011ae80-47b8-11eb-85ed-0e903f39d1dd.png)
![Screenshot (35)](https://user-images.githubusercontent.com/72877136/103153731-a1db7200-47b8-11eb-8f99-4a3d565713cd.png)
![Screenshot (35)](https://user-images.githubusercontent.com/72877136/103153732-a1db7200-47b8-11eb-9a6a-ae09c232f681.png)
![Screenshot (34)](https://user-images.githubusercontent.com/72877136/103153734-a2740880-47b8-11eb-9018-6c6dd3617d73.png)
Please help me.
Sorry to disturb you. The problem has been solved 
No sir this problem is not solved. I was having problem in forking (that is solved). I am still having issues in cloning the code.
some screenshots.
![Screenshot (37)](https://user-images.githubusercontent.com/72877136/103156416-59c74a00-47ce-11eb-94cc-1be2d9110d18.png)
![Screenshot (38)](https://user-images.githubusercontent.com/72877136/103156418-5df36780-47ce-11eb-9e80-7ee57e738884.png)
please help me
@Atri22 - I would request you to clean the directory containing the code and clone the project again.
Use Linux or WSL
@codedshun -  I cleaned the directory containing the code but nothing happened, I even created a new directory in the D drive for cloning the code but still the same problem is arising. I tried to clone codes of some other projects to see if there is something wrong with my pc, but other projects were cloned properly. Please help me solve the issue sir. 
here are some screenshots

![Screenshot (42)](https://user-images.githubusercontent.com/72877136/103177279-12f55500-489f-11eb-9cb2-c2fc009a88d6.png)
![Screenshot (43)](https://user-images.githubusercontent.com/72877136/103177283-18529f80-489f-11eb-9e2f-2c253b720186.png)
![Screenshot (44)](https://user-images.githubusercontent.com/72877136/103177286-1b4d9000-489f-11eb-8538-d116f40d7c7c.png)
![Screenshot (45)](https://user-images.githubusercontent.com/72877136/103177287-1dafea00-489f-11eb-8eff-de2409dd59ab.png)
![Screenshot (46)](https://user-images.githubusercontent.com/72877136/103177291-20aada80-489f-11eb-9595-f2b96c8ce93a.png)
@iamareebjamal - As of now I don't know how to use Linux. But I will surly learn it sir.


Resolving patch:
diff --git a/app/api/routes.py b/app/api/routes.py
--- a/app/api/routes.py
+++ b/app/api/routes.py
@@ -1511,7 +1511,9 @@
     OrderRelationship, 'order_ticket', '/orders/<order_identifier>/relationships/ticket'
 )
 api.route(
-    OrderRelationship, 'order_user', '/orders/<order_identifier>/relationships/user'
+    OrderRelationship,
+    'order_user',
+    '/orders/<order_identifier>/relationships/user',
 )
 api.route(
     OrderRelationship, 'order_event', '/orders/<order_identifier>/relationships/event'
diff --git a/app/api/schema/orders.py b/app/api/schema/orders.py
--- a/app/api/schema/orders.py
+++ b/app/api/schema/orders.py
@@ -131,7 +131,8 @@ def initial_values(self, data):
         dump_only=True,
     )
 
-    user = Relationship(
+    user = GetterRelationship(
+        getter='safe_user',
         self_view='v1.order_user',
         self_view_kwargs={'order_identifier': '<identifier>'},
         related_view='v1.user_detail',
diff --git a/app/models/order.py b/app/models/order.py
--- a/app/models/order.py
+++ b/app/models/order.py
@@ -170,6 +170,20 @@ def filtered_ticket_holders(self):
             query_ = query_.filter(TicketHolder.user == current_user)
         return query_.all()
 
+    @property
+    def safe_user(self):
+        from app.api.helpers.permission_manager import has_access
+
+        if (
+            not has_access(
+                'is_coorganizer',
+                event_id=self.event_id,
+            )
+            and current_user.id != self.user_id
+        ):
+            return None
+        return self.user
+
     @property
     def site_view_link(self) -> str:
         frontend_url = get_settings()['frontend_url']


Test patch:
diff --git a/tests/all/integration/api/helpers/order/test_edit_order.py b/tests/all/integration/api/helpers/order/test_edit_order.py
--- a/tests/all/integration/api/helpers/order/test_edit_order.py
+++ b/tests/all/integration/api/helpers/order/test_edit_order.py
@@ -6,6 +6,7 @@
 from tests.factories.attendee import AttendeeSubFactory
 from tests.factories.event import EventFactoryBasic
 from tests.factories.order import OrderSubFactory
+from tests.factories.user import UserFactory
 
 
 def create_order(db, user):
@@ -64,6 +65,35 @@ def test_ignore_on_order_attendee_update(client, db, user, jwt):
     assert len(order.ticket_holders) == 3
 
 
+def test_order_get(client, db, user, jwt):
+    user1 = UserFactory(is_admin=False)
+    order_id = create_order(db, user1)
+    order = Order.query.get(order_id)
+    attendee = AttendeeSubFactory(order=order, email=user.email)
+
+    db.session.commit()
+
+    response = client.get(
+        f'/v1/orders/{order_id}?include=user',
+        content_type='application/vnd.api+json',
+        headers=jwt,
+    )
+
+    assert response.status_code == 200
+    assert json.loads(response.data)['data']['relationships']['user']['data'] == None
+
+    response = client.get(
+        f'/v1/attendees/{attendee.id}?include=order.user',
+        content_type='application/vnd.api+json',
+        headers=jwt,
+    )
+
+    assert response.status_code == 200
+    assert (
+        json.loads(response.data)['included'][0]['relationships']['user']['data'] == None
+    )
+
+
 def test_ignore_on_order_event_update(client, db, user, jwt):
     order_id = create_order(db, user)
     order = Order.query.get(order_id)