Repository: fossasia/open-event-server

Issue:
Updating order throws internal server error
**Describe the bug**
Updating order throws internal server error.  Sample request: `http://localhost:5000/v1/orders/b762cbfb-8cea-49e2-b1d2-c6e0f5f0b1fb`

**Expected behavior**
Request should succeed.

**Stacktrace**
```
INFO:werkzeug:127.0.0.1 - - [16/Jul/2018 22:37:13] "PATCH /v1/orders/b762cbfb-8cea-49e2-b1d2-c6e0f5f0b1fb HTTP/1.1" 500 -
Traceback (most recent call last):
  File "/home/rs/Pradeep/github/open-event-server/env/lib/python3.5/site-packages/flask/app.py", line 2309, in __call__
    return self.wsgi_app(environ, start_response)
  File "/home/rs/Pradeep/github/open-event-server/app/__init__.py", line 66, in __call__
    return self.app(environ, start_response)
  File "/home/rs/Pradeep/github/open-event-server/env/lib/python3.5/site-packages/flask/app.py", line 2295, in wsgi_app
    response = self.handle_exception(e)
  File "/home/rs/Pradeep/github/open-event-server/env/lib/python3.5/site-packages/flask_cors/extension.py", line 161, in wrapped_function
    return cors_after_request(app.make_response(f(*args, **kwargs)))
  File "/home/rs/Pradeep/github/open-event-server/env/lib/python3.5/site-packages/flask_cors/extension.py", line 161, in wrapped_function
    return cors_after_request(app.make_response(f(*args, **kwargs)))
  File "/home/rs/Pradeep/github/open-event-server/env/lib/python3.5/site-packages/flask/app.py", line 1741, in handle_exception
    reraise(exc_type, exc_value, tb)
  File "/home/rs/Pradeep/github/open-event-server/env/lib/python3.5/site-packages/flask/_compat.py", line 35, in reraise
    raise value
  File "/home/rs/Pradeep/github/open-event-server/env/lib/python3.5/site-packages/flask/app.py", line 2292, in wsgi_app
    response = self.full_dispatch_request()
  File "/home/rs/Pradeep/github/open-event-server/env/lib/python3.5/site-packages/flask/app.py", line 1815, in full_dispatch_request
    rv = self.handle_user_exception(e)
  File "/home/rs/Pradeep/github/open-event-server/env/lib/python3.5/site-packages/flask_cors/extension.py", line 161, in wrapped_function
    return cors_after_request(app.make_response(f(*args, **kwargs)))
  File "/home/rs/Pradeep/github/open-event-server/env/lib/python3.5/site-packages/flask_cors/extension.py", line 161, in wrapped_function
    return cors_after_request(app.make_response(f(*args, **kwargs)))
  File "/home/rs/Pradeep/github/open-event-server/env/lib/python3.5/site-packages/flask/app.py", line 1718, in handle_user_exception
    reraise(exc_type, exc_value, tb)
  File "/home/rs/Pradeep/github/open-event-server/env/lib/python3.5/site-packages/flask/_compat.py", line 35, in reraise
    raise value
  File "/home/rs/Pradeep/github/open-event-server/env/lib/python3.5/site-packages/flask/app.py", line 1813, in full_dispatch_request
    rv = self.dispatch_request()
  File "/home/rs/Pradeep/github/open-event-server/env/lib/python3.5/site-packages/flask/app.py", line 1799, in dispatch_request
    return self.view_functions[rule.endpoint](**req.view_args)
  File "/home/rs/Pradeep/github/open-event-server/app/api/helpers/permissions.py", line 45, in decorator
    return fn(*args, **kwargs)
  File "/home/rs/Pradeep/github/open-event-server/env/src/flask-rest-jsonapi/flask_rest_jsonapi/decorators.py", line 32, in wrapper
    return func(*args, **kwargs)
  File "/home/rs/Pradeep/github/open-event-server/env/lib/python3.5/site-packages/flask/views.py", line 88, in view
    return self.dispatch_request(*args, **kwargs)
  File "/home/rs/Pradeep/github/open-event-server/env/src/flask-rest-jsonapi/flask_rest_jsonapi/resource.py", line 68, in dispatch_request
    response = method(*args, **kwargs)
  File "/home/rs/Pradeep/github/open-event-server/env/src/flask-rest-jsonapi/flask_rest_jsonapi/decorators.py", line 56, in wrapper
    return func(*args, **kwargs)
  File "/home/rs/Pradeep/github/open-event-server/env/src/flask-rest-jsonapi/flask_rest_jsonapi/resource.py", line 294, in patch
    if json_data['data']['id'] != str(kwargs[self.data_layer.get('url_field', 'id')]):
KeyError: 'id'
```


Discussion:
Working on it.


Resolving patch:
diff --git a/app/api/helpers/permission_manager.py b/app/api/helpers/permission_manager.py
--- a/app/api/helpers/permission_manager.py
+++ b/app/api/helpers/permission_manager.py
@@ -7,6 +7,7 @@
 from app.api.helpers.permissions import jwt_required
 from app.models.session import Session
 from app.models.event import Event
+from app.models.order import Order
 from app.api.helpers.jwt import get_identity
 
 
@@ -348,6 +349,14 @@ def permission_manager(view, view_args, view_kwargs, *args, **kwargs):
         if not check(view_kwargs):
             return ForbiddenError({'source': ''}, 'Access forbidden').respond()
 
+    # For Orders API
+    if 'order_identifier' in view_kwargs:
+        try:
+            order = Order.query.filter_by(identifier=view_kwargs['order_identifier']).one()
+        except NoResultFound:
+            return NotFoundError({'parameter': 'order_identifier'}, 'Event not found').respond()
+        view_kwargs['id'] = order.identifier
+
     # If event_identifier in route instead of event_id
     if 'event_identifier' in view_kwargs:
         try:
diff --git a/app/api/orders.py b/app/api/orders.py
--- a/app/api/orders.py
+++ b/app/api/orders.py
@@ -7,6 +7,7 @@
 from marshmallow_jsonapi.flask import Schema
 from sqlalchemy.orm.exc import NoResultFound
 
+from app.api.bootstrap import api
 from app.api.data_layers.ChargesLayer import ChargesLayer
 from app.api.helpers.db import save_to_db, safe_query, safe_query_without_soft_deleted_entries
 from app.api.helpers.exceptions import ForbiddenException, UnprocessableEntity, ConflictException
@@ -300,7 +301,8 @@ def before_delete_object(self, order, view_kwargs):
         elif order.amount and order.amount > 0 and (order.status == 'completed' or order.status == 'placed'):
             raise ConflictException({'source': ''}, 'You cannot delete a placed/completed paid order.')
 
-    decorators = (jwt_required,)
+    decorators = (jwt_required, api.has_permission(
+        'is_user_itself', methods="PATCH,DELETE", fetch="id", fetch_as="order_id", model=Order),)
 
     schema = OrderSchema
     data_layer = {'session': db.session,


Test patch: