Repository: fossasia/open-event-server

Issue:
[Sentry] KeyError/v1/users/<int:user_id>/attendees
**I'm submitting a ...**  (check one with "x")
- [x] bug report
- [ ] feature request
- [ ] support request => Please do not submit support requests here, instead ask your query in out Gitter channel at https://gitter.im/fossasia/open-event-orga-server

```
KeyError: 'id'
  File "flask/app.py", line 1982, in wsgi_app
    response = self.full_dispatch_request()
  File "flask/app.py", line 1614, in full_dispatch_request
    rv = self.handle_user_exception(e)
  File "flask_cors/extension.py", line 161, in wrapped_function
    return cors_after_request(app.make_response(f(*args, **kwargs)))
  File "flask/app.py", line 1517, in handle_user_exception
    reraise(exc_type, exc_value, tb)
  File "flask/app.py", line 1612, in full_dispatch_request
    rv = self.dispatch_request()
  File "flask/app.py", line 1598, in dispatch_request
    return self.view_functions[rule.endpoint](**req.view_args)
  File "flask_rest_jsonapi/decorators.py", line 32, in wrapper
    return func(*args, **kwargs)
  File "flask/views.py", line 84, in view
    return self.dispatch_request(*args, **kwargs)
  File "flask_rest_jsonapi/resource.py", line 68, in dispatch_request
    response = method(*args, **kwargs)
  File "flask_rest_jsonapi/decorators.py", line 56, in wrapper
    return func(*args, **kwargs)
  File "flask_rest_jsonapi/resource.py", line 145, in get
    objects_count, objects = self._data_layer.get_collection(qs, kwargs)
  File "flask_rest_jsonapi/data_layers/alchemy.py", line 92, in get_collection
    query = self.query(view_kwargs)
  File "app/api/attendees.py", line 57, in query
    if not has_access('is_user_itself', user_id=user.id):
  File "app/api/helpers/permission_manager.py", line 450, in has_access
    auth = permissions[access_level](lambda *a, **b: True, (), {}, (), **kwargs)
  File "app/api/helpers/permissions.py", line 43, in decorator
    return fn(*args, **kwargs)
  File "app/api/helpers/permission_manager.py", line 109, in is_user_itself
    if not user.is_admin and not user.is_super_admin and user.id != kwargs['id']:

```



Discussion:

Resolving patch:
diff --git a/app/api/attendees.py b/app/api/attendees.py
--- a/app/api/attendees.py
+++ b/app/api/attendees.py
@@ -54,7 +54,7 @@ def query(self, view_kwargs):
 
         if view_kwargs.get('user_id'):
             user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')
-            if not has_access('is_user_itself', user_id=user.id):
+            if not has_access('is_user_itself', id=user.id):
                 raise ForbiddenException({'source': ''}, 'Access Forbidden')
             query_ = query_.join(User, User.email == TicketHolder.email).filter(User.id == user.id)
 
diff --git a/app/api/users.py b/app/api/users.py
--- a/app/api/users.py
+++ b/app/api/users.py
@@ -79,7 +79,7 @@ def before_get_object(self, view_kwargs):
         if view_kwargs.get('attendee_id') is not None:
             attendee = safe_query(self, TicketHolder, 'id', view_kwargs['attendee_id'], 'attendee_id')
             if attendee.user is not None:
-                if not has_access('is_user_itself', user_id=attendee.user.id) or not has_access('is_coorganizer', event_id=attendee.event_id):
+                if not has_access('is_user_itself', id=attendee.user.id) or not has_access('is_coorganizer', event_id=attendee.event_id):
                     raise ForbiddenException({'source': ''}, 'Access Forbidden')
                 view_kwargs['id'] = attendee.user.id
             else:


Test patch: