def METHOD_NAME(fav):
    if not has_access(
        'is_coorganizer_or_user_itself',
        event_id=fav.session.event_id,
        user_id=fav.user_id,
    ):
        raise ForbiddenError(
            {'pointer': 'user_id'}, "User or Co-Organizer level access required"
        )