prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  [sentry] KeyError/v1/users/<int:user_id>/access-codes
  **I'm submitting a ...**  (check one with "x")
  - [x] bug report
  - [ ] feature request
  - [ ] support request => Please do not submit support requests here, instead ask your query in out Gitter channel at https://gitter.im/fossasia/open-event-orga-server
  
  ```
  KeyError: 'id'
    File "flask/app.py", line 1982, in wsgi_app
      response = self.full_dispatch_request()
    File "flask/app.py", line 1614, in full_dispatch_request
      rv = self.handle_user_exception(e)
    File "flask_cors/extension.py", line 161, in wrapped_function
      return cors_after_request(app.make_response(f(*args, **kwargs)))
    File "flask/app.py", line 1517, in handle_user_exception
      reraise(exc_type, exc_value, tb)
    File "flask/app.py", line 1612, in full_dispatch_request
      rv = self.dispatch_request()
    File "flask/app.py", line 1598, in dispatch_request
      return self.view_functions[rule.endpoint](**req.view_args)
    File "flask_rest_jsonapi/decorators.py", line 32, in wrapper
      return func(*args, **kwargs)
    File "flask/views.py", line 84, in view
      return self.dispatch_request(*args, **kwargs)
    File "flask_rest_jsonapi/resource.py", line 68, in dispatch_request
      response = method(*args, **kwargs)
    File "flask_rest_jsonapi/decorators.py", line 56, in wrapper
      return func(*args, **kwargs)
    File "flask_rest_jsonapi/resource.py", line 145, in get
      objects_count, objects = self._data_layer.get_collection(qs, kwargs)
    File "flask_rest_jsonapi/data_layers/alchemy.py", line 92, in get_collection
      query = self.query(view_kwargs)
    File "app/api/access_codes.py", line 56, in query
      if not has_access('is_user_itself', user_id=user.id):
    File "app/api/helpers/permission_manager.py", line 450, in has_access
      auth = permissions[access_level](lambda *a, **b: True, (), {}, (), **kwargs)
    File "app/api/helpers/permissions.py", line 43, in decorator
      return fn(*args, **kwargs)
    File "app/api/helpers/permission_manager.py", line 109, in is_user_itself
      if not user.is_admin and not user.is_super_admin and user.id != kwargs['id']:
  ```
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `app/api/access_codes.py`
  Content:
  ```
  1 from flask_rest_jsonapi import ResourceDetail, ResourceList, ResourceRelationship
  2 from flask_rest_jsonapi.exceptions import ObjectNotFound
  3 from app.api.helpers.exceptions import ForbiddenException
  4 
  5 from app.api.bootstrap import api
  6 from app.api.helpers.db import safe_query
  7 from app.api.helpers.permission_manager import has_access
  8 from app.api.helpers.permissions import jwt_required
  9 from app.api.helpers.query import event_query
  10 from app.api.helpers.utilities import require_relationship
  11 from app.api.schema.access_codes import AccessCodeSchema
  12 from app.models import db
  13 from app.models.access_code import AccessCode
  14 from app.models.ticket import Ticket
  15 from app.models.user import User
  16 
  17 
  18 class AccessCodeListPost(ResourceList):
  19     """
  20     Create AccessCodes
  21     """
  22     def before_post(self, args, kwargs, data):
  23         """
  24         before post method to check for required relationships and permissions
  25         :param args:
  26         :param kwargs:
  27         :param data:
  28         :return:
  29         """
  30         require_relationship(['event', 'user'], data)
  31         if not has_access('is_coorganizer', event_id=data['event']):
  32             raise ObjectNotFound({'parameter': 'event_id'},
  33                                  "Event: {} not found".format(data['event']))
  34 
  35     schema = AccessCodeSchema
  36     methods = ['POST', ]
  37     data_layer = {'session': db.session,
  38                   'model': AccessCode
  39                   }
  40 
  41 
  42 class AccessCodeList(ResourceList):
  43     """
  44     List AccessCodes
  45     """
  46     def query(self, view_kwargs):
  47         """
  48         Method to get access codes list based on different view_kwargs
  49         :param view_kwargs:
  50         :return:
  51         """
  52         query_ = self.session.query(AccessCode)
  53         query_ = event_query(self, query_, view_kwargs, permission='is_coorganizer')
  54         if view_kwargs.get('user_id'):
  55             user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')
  56             if not has_access('is_user_itself', user_id=user.id):
  57                 raise ForbiddenException({'source': ''}, 'Access Forbidden')
  58             query_ = query_.join(User).filter(User.id == user.id)
  59         if view_kwargs.get('ticket_id'):
  60             ticket = safe_query(self, Ticket, 'id', view_kwargs['ticket_id'], 'ticket_id')
  61             if not has_access('is_coorganizer', event_id=ticket.event_id):
  62                 raise ForbiddenException({'source': ''}, 'Access Forbidden')
  63             # access_code - ticket :: many-to-many relationship
  64             query_ = AccessCode.query.filter(AccessCode.tickets.any(id=ticket.id))
  65             query_
  66         return query_
  67 
  68     view_kwargs = True
  69     methods = ['GET', ]
  70     schema = AccessCodeSchema
  71     data_layer = {'session': db.session,
  72                   'model': AccessCode,
  73                   'methods': {
  74                       'query': query,
  75                   }}
  76 
  77 
  78 class AccessCodeDetail(ResourceDetail):
  79     """
  80     AccessCode detail by id
  81     """
  82 
  83     decorators = (api.has_permission('is_coorganizer', fetch='event_id',
  84                   fetch_as="event_id", model=AccessCode, methods="GET, PATCH"),
  85                   api.has_permission('is_coorganizer_but_not_admin', fetch='event_id',
  86                   fetch_as="event_id", model=AccessCode, methods="DELETE"),)
  87     schema = AccessCodeSchema
  88     data_layer = {'session': db.session,
  89                   'model': AccessCode
  90                   }
  91 
  92 
  93 class AccessCodeRelationshipRequired(ResourceRelationship):
  94     """
  95     AccessCode Relationship Required
  96     """
  97     decorators = (jwt_required,)
  98     methods = ['GET', 'PATCH']
  99     schema = AccessCodeSchema
  100     data_layer = {'session': db.session,
  101                   'model': AccessCode}
  102 
  103 
  104 class AccessCodeRelationshipOptional(ResourceRelationship):
  105     """
  106     AccessCode Relationship Optional
  107     """
  108     decorators = (jwt_required,)
  109     schema = AccessCodeSchema
  110     data_layer = {'session': db.session,
  111                   'model': AccessCode}
  112
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/app/api/access_codes.py b/app/api/access_codes.py
  --- a/app/api/access_codes.py
  +++ b/app/api/access_codes.py
  @@ -53,7 +53,7 @@
           query_ = event_query(self, query_, view_kwargs, permission='is_coorganizer')
           if view_kwargs.get('user_id'):
               user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')
  -            if not has_access('is_user_itself', user_id=user.id):
  +            if not has_access('is_user_itself', id=user.id):
                   raise ForbiddenException({'source': ''}, 'Access Forbidden')
               query_ = query_.join(User).filter(User.id == user.id)
           if view_kwargs.get('ticket_id'):
  
verification_info: {"golden_diff": "diff --git a/app/api/access_codes.py b/app/api/access_codes.py\n--- a/app/api/access_codes.py\n+++ b/app/api/access_codes.py\n@@ -53,7 +53,7 @@\n         query_ = event_query(self, query_, view_kwargs, permission='is_coorganizer')\n         if view_kwargs.get('user_id'):\n             user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')\n-            if not has_access('is_user_itself', user_id=user.id):\n+            if not has_access('is_user_itself', id=user.id):\n                 raise ForbiddenException({'source': ''}, 'Access Forbidden')\n             query_ = query_.join(User).filter(User.id == user.id)\n         if view_kwargs.get('ticket_id'):\n", "issue": "[sentry] KeyError/v1/users/<int:user_id>/access-codes\n**I'm submitting a ...**  (check one with \"x\")\r\n- [x] bug report\r\n- [ ] feature request\r\n- [ ] support request => Please do not submit support requests here, instead ask your query in out Gitter channel at https://gitter.im/fossasia/open-event-orga-server\r\n\r\n```\r\nKeyError: 'id'\r\n  File \"flask/app.py\", line 1982, in wsgi_app\r\n    response = self.full_dispatch_request()\r\n  File \"flask/app.py\", line 1614, in full_dispatch_request\r\n    rv = self.handle_user_exception(e)\r\n  File \"flask_cors/extension.py\", line 161, in wrapped_function\r\n    return cors_after_request(app.make_response(f(*args, **kwargs)))\r\n  File \"flask/app.py\", line 1517, in handle_user_exception\r\n    reraise(exc_type, exc_value, tb)\r\n  File \"flask/app.py\", line 1612, in full_dispatch_request\r\n    rv = self.dispatch_request()\r\n  File \"flask/app.py\", line 1598, in dispatch_request\r\n    return self.view_functions[rule.endpoint](**req.view_args)\r\n  File \"flask_rest_jsonapi/decorators.py\", line 32, in wrapper\r\n    return func(*args, **kwargs)\r\n  File \"flask/views.py\", line 84, in view\r\n    return self.dispatch_request(*args, **kwargs)\r\n  File \"flask_rest_jsonapi/resource.py\", line 68, in dispatch_request\r\n    response = method(*args, **kwargs)\r\n  File \"flask_rest_jsonapi/decorators.py\", line 56, in wrapper\r\n    return func(*args, **kwargs)\r\n  File \"flask_rest_jsonapi/resource.py\", line 145, in get\r\n    objects_count, objects = self._data_layer.get_collection(qs, kwargs)\r\n  File \"flask_rest_jsonapi/data_layers/alchemy.py\", line 92, in get_collection\r\n    query = self.query(view_kwargs)\r\n  File \"app/api/access_codes.py\", line 56, in query\r\n    if not has_access('is_user_itself', user_id=user.id):\r\n  File \"app/api/helpers/permission_manager.py\", line 450, in has_access\r\n    auth = permissions[access_level](lambda *a, **b: True, (), {}, (), **kwargs)\r\n  File \"app/api/helpers/permissions.py\", line 43, in decorator\r\n    return fn(*args, **kwargs)\r\n  File \"app/api/helpers/permission_manager.py\", line 109, in is_user_itself\r\n    if not user.is_admin and not user.is_super_admin and user.id != kwargs['id']:\r\n```\n", "before_files": [{"content": "from flask_rest_jsonapi import ResourceDetail, ResourceList, ResourceRelationship\nfrom flask_rest_jsonapi.exceptions import ObjectNotFound\nfrom app.api.helpers.exceptions import ForbiddenException\n\nfrom app.api.bootstrap import api\nfrom app.api.helpers.db import safe_query\nfrom app.api.helpers.permission_manager import has_access\nfrom app.api.helpers.permissions import jwt_required\nfrom app.api.helpers.query import event_query\nfrom app.api.helpers.utilities import require_relationship\nfrom app.api.schema.access_codes import AccessCodeSchema\nfrom app.models import db\nfrom app.models.access_code import AccessCode\nfrom app.models.ticket import Ticket\nfrom app.models.user import User\n\n\nclass AccessCodeListPost(ResourceList):\n    \"\"\"\n    Create AccessCodes\n    \"\"\"\n    def before_post(self, args, kwargs, data):\n        \"\"\"\n        before post method to check for required relationships and permissions\n        :param args:\n        :param kwargs:\n        :param data:\n        :return:\n        \"\"\"\n        require_relationship(['event', 'user'], data)\n        if not has_access('is_coorganizer', event_id=data['event']):\n            raise ObjectNotFound({'parameter': 'event_id'},\n                                 \"Event: {} not found\".format(data['event']))\n\n    schema = AccessCodeSchema\n    methods = ['POST', ]\n    data_layer = {'session': db.session,\n                  'model': AccessCode\n                  }\n\n\nclass AccessCodeList(ResourceList):\n    \"\"\"\n    List AccessCodes\n    \"\"\"\n    def query(self, view_kwargs):\n        \"\"\"\n        Method to get access codes list based on different view_kwargs\n        :param view_kwargs:\n        :return:\n        \"\"\"\n        query_ = self.session.query(AccessCode)\n        query_ = event_query(self, query_, view_kwargs, permission='is_coorganizer')\n        if view_kwargs.get('user_id'):\n            user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')\n            if not has_access('is_user_itself', user_id=user.id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            query_ = query_.join(User).filter(User.id == user.id)\n        if view_kwargs.get('ticket_id'):\n            ticket = safe_query(self, Ticket, 'id', view_kwargs['ticket_id'], 'ticket_id')\n            if not has_access('is_coorganizer', event_id=ticket.event_id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            # access_code - ticket :: many-to-many relationship\n            query_ = AccessCode.query.filter(AccessCode.tickets.any(id=ticket.id))\n            query_\n        return query_\n\n    view_kwargs = True\n    methods = ['GET', ]\n    schema = AccessCodeSchema\n    data_layer = {'session': db.session,\n                  'model': AccessCode,\n                  'methods': {\n                      'query': query,\n                  }}\n\n\nclass AccessCodeDetail(ResourceDetail):\n    \"\"\"\n    AccessCode detail by id\n    \"\"\"\n\n    decorators = (api.has_permission('is_coorganizer', fetch='event_id',\n                  fetch_as=\"event_id\", model=AccessCode, methods=\"GET, PATCH\"),\n                  api.has_permission('is_coorganizer_but_not_admin', fetch='event_id',\n                  fetch_as=\"event_id\", model=AccessCode, methods=\"DELETE\"),)\n    schema = AccessCodeSchema\n    data_layer = {'session': db.session,\n                  'model': AccessCode\n                  }\n\n\nclass AccessCodeRelationshipRequired(ResourceRelationship):\n    \"\"\"\n    AccessCode Relationship Required\n    \"\"\"\n    decorators = (jwt_required,)\n    methods = ['GET', 'PATCH']\n    schema = AccessCodeSchema\n    data_layer = {'session': db.session,\n                  'model': AccessCode}\n\n\nclass AccessCodeRelationshipOptional(ResourceRelationship):\n    \"\"\"\n    AccessCode Relationship Optional\n    \"\"\"\n    decorators = (jwt_required,)\n    schema = AccessCodeSchema\n    data_layer = {'session': db.session,\n                  'model': AccessCode}\n", "path": "app/api/access_codes.py"}], "after_files": [{"content": "from flask_rest_jsonapi import ResourceDetail, ResourceList, ResourceRelationship\nfrom flask_rest_jsonapi.exceptions import ObjectNotFound\nfrom app.api.helpers.exceptions import ForbiddenException\n\nfrom app.api.bootstrap import api\nfrom app.api.helpers.db import safe_query\nfrom app.api.helpers.permission_manager import has_access\nfrom app.api.helpers.permissions import jwt_required\nfrom app.api.helpers.query import event_query\nfrom app.api.helpers.utilities import require_relationship\nfrom app.api.schema.access_codes import AccessCodeSchema\nfrom app.models import db\nfrom app.models.access_code import AccessCode\nfrom app.models.ticket import Ticket\nfrom app.models.user import User\n\n\nclass AccessCodeListPost(ResourceList):\n    \"\"\"\n    Create AccessCodes\n    \"\"\"\n    def before_post(self, args, kwargs, data):\n        \"\"\"\n        before post method to check for required relationships and permissions\n        :param args:\n        :param kwargs:\n        :param data:\n        :return:\n        \"\"\"\n        require_relationship(['event', 'user'], data)\n        if not has_access('is_coorganizer', event_id=data['event']):\n            raise ObjectNotFound({'parameter': 'event_id'},\n                                 \"Event: {} not found\".format(data['event']))\n\n    schema = AccessCodeSchema\n    methods = ['POST', ]\n    data_layer = {'session': db.session,\n                  'model': AccessCode\n                  }\n\n\nclass AccessCodeList(ResourceList):\n    \"\"\"\n    List AccessCodes\n    \"\"\"\n    def query(self, view_kwargs):\n        \"\"\"\n        Method to get access codes list based on different view_kwargs\n        :param view_kwargs:\n        :return:\n        \"\"\"\n        query_ = self.session.query(AccessCode)\n        query_ = event_query(self, query_, view_kwargs, permission='is_coorganizer')\n        if view_kwargs.get('user_id'):\n            user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')\n            if not has_access('is_user_itself', id=user.id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            query_ = query_.join(User).filter(User.id == user.id)\n        if view_kwargs.get('ticket_id'):\n            ticket = safe_query(self, Ticket, 'id', view_kwargs['ticket_id'], 'ticket_id')\n            if not has_access('is_coorganizer', event_id=ticket.event_id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            # access_code - ticket :: many-to-many relationship\n            query_ = AccessCode.query.filter(AccessCode.tickets.any(id=ticket.id))\n            query_\n        return query_\n\n    view_kwargs = True\n    methods = ['GET', ]\n    schema = AccessCodeSchema\n    data_layer = {'session': db.session,\n                  'model': AccessCode,\n                  'methods': {\n                      'query': query,\n                  }}\n\n\nclass AccessCodeDetail(ResourceDetail):\n    \"\"\"\n    AccessCode detail by id\n    \"\"\"\n\n    decorators = (api.has_permission('is_coorganizer', fetch='event_id',\n                  fetch_as=\"event_id\", model=AccessCode, methods=\"GET, PATCH\"),\n                  api.has_permission('is_coorganizer_but_not_admin', fetch='event_id',\n                  fetch_as=\"event_id\", model=AccessCode, methods=\"DELETE\"),)\n    schema = AccessCodeSchema\n    data_layer = {'session': db.session,\n                  'model': AccessCode\n                  }\n\n\nclass AccessCodeRelationshipRequired(ResourceRelationship):\n    \"\"\"\n    AccessCode Relationship Required\n    \"\"\"\n    decorators = (jwt_required,)\n    methods = ['GET', 'PATCH']\n    schema = AccessCodeSchema\n    data_layer = {'session': db.session,\n                  'model': AccessCode}\n\n\nclass AccessCodeRelationshipOptional(ResourceRelationship):\n    \"\"\"\n    AccessCode Relationship Optional\n    \"\"\"\n    decorators = (jwt_required,)\n    schema = AccessCodeSchema\n    data_layer = {'session': db.session,\n                  'model': AccessCode}\n", "path": "app/api/access_codes.py"}]}