Repository: fossasia/open-event-server

Issue:
Fix 'auth required' for GET /speakers
**I'm submitting a ...**  (check one with "x")
- [x] bug report
- [ ] feature request
- [ ] support request => Please do not submit support requests here, instead ask your query in out Gitter channel at https://gitter.im/fossasia/open-event-orga-server

**Current behavior:**
<!-- Describe how the bug manifests. -->

**Expected behavior:**
<!-- Describe what the behavior would be without the bug. -->

**Steps to reproduce:**
<!-- If you are able to illustrate the bug or feature request with an example, please provide steps to reproduce -->

**Related code:**

```
insert any relevant code here else remove this section
```

**Other information:**
<!-- List any other information that is relevant to your issue. Stack traces, related issues, suggestions on how to fix, Stack Overflow links, forum links, etc. -->

**System information:** 

<!-- Add information about the system your facing this bug on. If you think this is irrelevant or if it's a UI bug or a feature request, please remove this section -->

```
Your operating system
```

```
output of `python --version`
```



Discussion:

Resolving patch:
diff --git a/app/api/speakers.py b/app/api/speakers.py
--- a/app/api/speakers.py
+++ b/app/api/speakers.py
@@ -2,6 +2,7 @@
 from marshmallow_jsonapi.flask import Schema, Relationship
 from flask_rest_jsonapi import ResourceDetail, ResourceList, ResourceRelationship
 from flask_rest_jsonapi.exceptions import ObjectNotFound
+from flask import request
 
 from app.api.helpers.utilities import dasherize
 from app.api.helpers.permissions import jwt_required
@@ -125,14 +126,26 @@ def query(self, view_kwargs):
         :return:
         """
         query_ = self.session.query(Speaker)
-        if view_kwargs.get('event_identifier'):
-            event = safe_query(self, Event, 'identifier', view_kwargs['event_identifier'], 'event_identifier')
-            view_kwargs['event_id'] = event.id
         if view_kwargs.get('event_id'):
             event = safe_query(self, Event, 'id', view_kwargs['event_id'], 'event_id')
-            query_ = query_.join(Event).filter(Event.id == event.id)
-            if not has_access('is_coorganizer', event_id=event.id):
-                query_ = query_.filter(Event.state == "published")
+            if event.state != 'published':
+                if 'Authorization' in request.headers and has_access('is_coorganizer', event_id=event.id):
+                    query_ = query_.join(Event).filter(Event.id == event.id)
+                else:
+                    raise ObjectNotFound({'parameter': 'event_id'},
+                                         "Event: {} not found".format(view_kwargs['event_identifier']))
+            else:
+                query_ = query_.join(Event).filter(Event.id == event.id)
+        elif view_kwargs.get('event_identifier'):
+            event = safe_query(self, Event, 'identifier', view_kwargs['event_identifier'], 'event_identifier')
+            if event.state != 'published':
+                if 'Authorization' in request.headers and has_access('is_coorganizer', event_id=event.id):
+                    query_ = query_.join(Event).filter(Event.id == event.id)
+                else:
+                    raise ObjectNotFound({'parameter': 'event_identifier'},
+                                         "Event: {} not found".format(view_kwargs['event_identifier']))
+            else:
+                query_ = query_.join(Event).filter(Event.id == event.id)
 
         if view_kwargs.get('user_id'):
             user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')
@@ -142,7 +155,7 @@ def query(self, view_kwargs):
             session = safe_query(self, Session, 'id', view_kwargs['session_id'], 'session_id')
             # session-speaker :: many-to-many relationship
             query_ = Speaker.query.filter(Speaker.sessions.any(id=session.id))
-            if not has_access('is_coorganizer', event_id=session.event_id):
+            if 'Authorization' in request.headers and not has_access('is_coorganizer', event_id=session.event_id):
                 if not has_access('is_session_self_submitted', session_id=session.id):
                     query_ = query_.filter(Session.state == "approved" or Session.state == "accepted")
 


Test patch: