Repository: fossasia/open-event-server

Issue:
Discount codes under an Event shown to the public
**Describe the bug**
<!-- A clear and concise description of what the bug is. -->
The list of discount codes under an Event is shown to any registered user right now. 

**To Reproduce**
Steps to reproduce the behavior:
1. Fetch the list of discount codes for an event not organized by you.

**Expected behavior**
<!-- A clear and concise description of what you expected to happen. -->
It should only be shown to the event organizer or the admin.

**Parent Issue**
#4940 


Discussion:

Resolving patch:
diff --git a/app/api/discount_codes.py b/app/api/discount_codes.py
--- a/app/api/discount_codes.py
+++ b/app/api/discount_codes.py
@@ -17,7 +17,7 @@
 
 class DiscountCodeListPost(ResourceList):
     """
-    Create Discount Codes
+    Create Event and Ticket Discount code and Get Event Discount Codes
     """
 
     def before_post(self, args, kwargs, data):
@@ -68,7 +68,7 @@ def before_get(self, args, kwargs):
 
 class DiscountCodeList(ResourceList):
     """
-    List and Create Discount Code
+    Get the list of Ticket Discount Code
     """
 
     def query(self, view_kwargs):
@@ -78,17 +78,25 @@ def query(self, view_kwargs):
         :return:
         """
         query_ = self.session.query(DiscountCode)
+        # user can only access his/her discount codes.
         if view_kwargs.get('user_id'):
-            user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')
-            query_ = query_.join(User).filter(User.id == user.id)
+            if has_access('is_user_itself', user_id=view_kwargs['user_id']):
+                user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')
+                query_ = query_.join(User).filter(User.id == user.id)
+            else:
+                raise ForbiddenException({'source': ''}, 'You are not authorized')
 
         if view_kwargs.get('event_identifier'):
             event = safe_query(self, Event, 'identifier', view_kwargs['event_identifier'], 'event_identifier')
             view_kwargs['event_id'] = event.id
 
-        if view_kwargs.get('event_id') and has_access('is_coorganizer', event_id=view_kwargs['event_id']):
-            self.schema = DiscountCodeSchemaTicket
-            query_ = query_.filter_by(event_id=view_kwargs['event_id'])
+        # event co-organizer access required for discount codes under an event.
+        if view_kwargs.get('event_id'):
+            if has_access('is_coorganizer', event_id=view_kwargs['event_id']):
+                self.schema = DiscountCodeSchemaTicket
+                query_ = query_.filter_by(event_id=view_kwargs['event_id'])
+            else:
+                raise ForbiddenException({'source': ''}, 'Event organizer access required')
 
         return query_
 
diff --git a/app/factories/discount_code.py b/app/factories/discount_code.py
--- a/app/factories/discount_code.py
+++ b/app/factories/discount_code.py
@@ -10,7 +10,7 @@ class Meta:
         model = DiscountCode
         sqlalchemy_session = db.session
 
-    user = factory.RelatedFactory(UserFactory)
+    marketer = factory.RelatedFactory(UserFactory)
     code = common.string_
     discount_url = common.url_
     value = common.float_
@@ -23,5 +23,5 @@ class Meta:
     valid_till = common.dateEnd_
     used_for = "event"
     tickets = "event"
-    user_id = 1
+    marketer_id = 1
     event_id = None
diff --git a/app/models/discount_code.py b/app/models/discount_code.py
--- a/app/models/discount_code.py
+++ b/app/models/discount_code.py
@@ -45,7 +45,7 @@ def __init__(self,
                  used_for=None,
                  event_id=None,
                  tickets=None,
-                 user_id=None,
+                 marketer_id=None,
                  deleted_at=None):
         self.code = code
         self.discount_url = discount_url
@@ -61,7 +61,7 @@ def __init__(self,
         self.created_at = datetime.utcnow()
         self.used_for = used_for
         self.tickets = tickets
-        self.marketer_id = user_id
+        self.marketer_id = marketer_id
         self.deleted_at = deleted_at
 
     @staticmethod


Test patch: