prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  Attendee : user/<id>/attendee gives Error 400
  **I'm submitting a ...**  (check one with "x")
  - [x] bug report
  - [ ] feature request
  - [ ] support request => Please do not submit support requests here, instead ask your query in out Gitter channel at https://gitter.im/fossasia/open-event-orga-server
  
  URL
  ```
  https://open-event-api.herokuapp.com/v1/users/5/attendees?include=ticket,event,order
  ```
  
  ERROR
  ```
  {
     "errors":[
        {
           "title":"Invalid include querystring parameter.",
           "source":{
              "parameter":"include"
           },
           "status":400,
           "detail":"AttendeeSchemaPublic has no attribute ticket"
        }
     ],
     "jsonapi":{
        "version":"1.0"
     }
  }
  ```
  Related Front-end route
  ```
  https://open-event-frontend.herokuapp.com/my-tickets
  ```
  Due to recent changes the URL gives ERROR 400.
  @poush @shubham-padia @enigmaeth @magdalenesuo Please have a look at it
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `app/api/attendees.py`
  Content:
  ```
  1 from flask_jwt import current_identity
  2 from flask_rest_jsonapi import ResourceDetail, ResourceList, ResourceRelationship
  3 
  4 from app.api.bootstrap import api
  5 from app.api.helpers.db import safe_query
  6 from app.api.helpers.exceptions import ForbiddenException
  7 from app.api.helpers.permission_manager import has_access
  8 from app.api.helpers.permissions import jwt_required
  9 from app.api.helpers.query import event_query
  10 from app.api.helpers.utilities import require_relationship
  11 from app.api.schema.attendees import AttendeeSchema, AttendeeSchemaPublic
  12 from app.models import db
  13 from app.models.order import Order
  14 from app.models.ticket import Ticket
  15 from app.models.ticket_holder import TicketHolder
  16 from app.models.user import User
  17 
  18 
  19 class AttendeeListPost(ResourceList):
  20     """
  21        List and create Attendees through direct URL
  22     """
  23 
  24     def before_post(self, args, kwargs, data):
  25         require_relationship(['ticket', 'event'], data)
  26         if not has_access('is_coorganizer', event_id=data['event']):
  27             raise ForbiddenException({'source': 'event_id'}, "Access Forbidden")
  28 
  29     methods = ['POST']
  30     schema = AttendeeSchema
  31     data_layer = {'session': db.session,
  32                   'model': TicketHolder}
  33 
  34 
  35 class AttendeeList(ResourceList):
  36     """
  37     List Attendees
  38     """
  39     def before_get(self, args, kwargs):
  40         if kwargs.get('user_id'):
  41             self.schema = AttendeeSchemaPublic
  42 
  43     def query(self, view_kwargs):
  44         query_ = self.session.query(TicketHolder)
  45 
  46         if view_kwargs.get('order_identifier'):
  47             order = safe_query(self, Order, 'identifier', view_kwargs['order_identifier'], 'order_identifier')
  48             if not has_access('is_registrar', event_id=order.event_id) or not has_access('is_user_itself',
  49                                                                                          id=order.user_id):
  50                 raise ForbiddenException({'source': ''}, 'Access Forbidden')
  51             query_ = query_.join(Order).filter(Order.id == order.id)
  52 
  53         if view_kwargs.get('ticket_id'):
  54             ticket = safe_query(self, Ticket, 'id', view_kwargs['ticket_id'], 'ticket_id')
  55             if not has_access('is_registrar', event_id=ticket.event_id):
  56                 raise ForbiddenException({'source': ''}, 'Access Forbidden')
  57             query_ = query_.join(Ticket).filter(Ticket.id == ticket.id)
  58 
  59         if view_kwargs.get('user_id'):
  60             user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')
  61             if not has_access('is_user_itself', user_id=user.id):
  62                 raise ForbiddenException({'source': ''}, 'Access Forbidden')
  63             query_ = query_.join(User, User.email == TicketHolder.email).filter(User.id == user.id)
  64 
  65         query_ = event_query(self, query_, view_kwargs, permission='is_registrar')
  66         return query_
  67 
  68     view_kwargs = True
  69     methods = ['GET', ]
  70     schema = AttendeeSchema
  71     data_layer = {'session': db.session,
  72                   'model': TicketHolder,
  73                   'methods': {
  74                       'query': query
  75                   }}
  76 
  77 
  78 class AttendeeDetail(ResourceDetail):
  79     """
  80     Attendee detail by id
  81     """
  82     def before_get_object(self, view_kwargs):
  83         attendee = safe_query(self, TicketHolder, 'id', view_kwargs['id'], 'attendee_id')
  84         if not has_access('is_registrar_or_user_itself', user_id=current_identity.id, event_id=attendee.event_id):
  85             raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')
  86 
  87     def before_delete_object(self, obj, kwargs):
  88         if not has_access('is_registrar', event_id=obj.event_id):
  89             raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')
  90 
  91     def before_update_object(self, obj, data, kwargs):
  92         if not has_access('is_registrar', event_id=obj.event_id):
  93             raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')
  94 
  95     decorators = (jwt_required,)
  96     schema = AttendeeSchema
  97     data_layer = {'session': db.session,
  98                   'model': TicketHolder,
  99                   'methods': {
  100                       'before_get_object': before_get_object,
  101                       'before_update_object': before_update_object,
  102                       'before_delete_object': before_delete_object
  103                   }}
  104 
  105 
  106 class AttendeeRelationshipRequired(ResourceRelationship):
  107     """
  108     Attendee Relationship (Required)
  109     """
  110     decorators = (jwt_required,)
  111     methods = ['GET', 'PATCH']
  112     schema = AttendeeSchema
  113     data_layer = {'session': db.session,
  114                   'model': TicketHolder}
  115 
  116 
  117 class AttendeeRelationshipOptional(ResourceRelationship):
  118     """
  119     Attendee Relationship(Optional)
  120     """
  121     decorators = (api.has_permission('is_user_itself', fetch="user_id", fetch_as="id", model=TicketHolder),)
  122     schema = AttendeeSchema
  123     data_layer = {'session': db.session,
  124                   'model': TicketHolder}
  125
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/app/api/attendees.py b/app/api/attendees.py
  --- a/app/api/attendees.py
  +++ b/app/api/attendees.py
  @@ -36,10 +36,6 @@
       """
       List Attendees
       """
  -    def before_get(self, args, kwargs):
  -        if kwargs.get('user_id'):
  -            self.schema = AttendeeSchemaPublic
  -
       def query(self, view_kwargs):
           query_ = self.session.query(TicketHolder)
  
verification_info: {"golden_diff": "diff --git a/app/api/attendees.py b/app/api/attendees.py\n--- a/app/api/attendees.py\n+++ b/app/api/attendees.py\n@@ -36,10 +36,6 @@\n     \"\"\"\n     List Attendees\n     \"\"\"\n-    def before_get(self, args, kwargs):\n-        if kwargs.get('user_id'):\n-            self.schema = AttendeeSchemaPublic\n-\n     def query(self, view_kwargs):\n         query_ = self.session.query(TicketHolder)\n", "issue": "Attendee : user/<id>/attendee gives Error 400\n**I'm submitting a ...**  (check one with \"x\")\r\n- [x] bug report\r\n- [ ] feature request\r\n- [ ] support request => Please do not submit support requests here, instead ask your query in out Gitter channel at https://gitter.im/fossasia/open-event-orga-server\r\n\r\nURL\r\n```\r\nhttps://open-event-api.herokuapp.com/v1/users/5/attendees?include=ticket,event,order\r\n```\r\n\r\nERROR\r\n```\r\n{\r\n   \"errors\":[\r\n      {\r\n         \"title\":\"Invalid include querystring parameter.\",\r\n         \"source\":{\r\n            \"parameter\":\"include\"\r\n         },\r\n         \"status\":400,\r\n         \"detail\":\"AttendeeSchemaPublic has no attribute ticket\"\r\n      }\r\n   ],\r\n   \"jsonapi\":{\r\n      \"version\":\"1.0\"\r\n   }\r\n}\r\n```\r\nRelated Front-end route\r\n```\r\nhttps://open-event-frontend.herokuapp.com/my-tickets\r\n```\r\nDue to recent changes the URL gives ERROR 400.\r\n@poush @shubham-padia @enigmaeth @magdalenesuo Please have a look at it\n", "before_files": [{"content": "from flask_jwt import current_identity\nfrom flask_rest_jsonapi import ResourceDetail, ResourceList, ResourceRelationship\n\nfrom app.api.bootstrap import api\nfrom app.api.helpers.db import safe_query\nfrom app.api.helpers.exceptions import ForbiddenException\nfrom app.api.helpers.permission_manager import has_access\nfrom app.api.helpers.permissions import jwt_required\nfrom app.api.helpers.query import event_query\nfrom app.api.helpers.utilities import require_relationship\nfrom app.api.schema.attendees import AttendeeSchema, AttendeeSchemaPublic\nfrom app.models import db\nfrom app.models.order import Order\nfrom app.models.ticket import Ticket\nfrom app.models.ticket_holder import TicketHolder\nfrom app.models.user import User\n\n\nclass AttendeeListPost(ResourceList):\n    \"\"\"\n       List and create Attendees through direct URL\n    \"\"\"\n\n    def before_post(self, args, kwargs, data):\n        require_relationship(['ticket', 'event'], data)\n        if not has_access('is_coorganizer', event_id=data['event']):\n            raise ForbiddenException({'source': 'event_id'}, \"Access Forbidden\")\n\n    methods = ['POST']\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder}\n\n\nclass AttendeeList(ResourceList):\n    \"\"\"\n    List Attendees\n    \"\"\"\n    def before_get(self, args, kwargs):\n        if kwargs.get('user_id'):\n            self.schema = AttendeeSchemaPublic\n\n    def query(self, view_kwargs):\n        query_ = self.session.query(TicketHolder)\n\n        if view_kwargs.get('order_identifier'):\n            order = safe_query(self, Order, 'identifier', view_kwargs['order_identifier'], 'order_identifier')\n            if not has_access('is_registrar', event_id=order.event_id) or not has_access('is_user_itself',\n                                                                                         id=order.user_id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            query_ = query_.join(Order).filter(Order.id == order.id)\n\n        if view_kwargs.get('ticket_id'):\n            ticket = safe_query(self, Ticket, 'id', view_kwargs['ticket_id'], 'ticket_id')\n            if not has_access('is_registrar', event_id=ticket.event_id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            query_ = query_.join(Ticket).filter(Ticket.id == ticket.id)\n\n        if view_kwargs.get('user_id'):\n            user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')\n            if not has_access('is_user_itself', user_id=user.id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            query_ = query_.join(User, User.email == TicketHolder.email).filter(User.id == user.id)\n\n        query_ = event_query(self, query_, view_kwargs, permission='is_registrar')\n        return query_\n\n    view_kwargs = True\n    methods = ['GET', ]\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder,\n                  'methods': {\n                      'query': query\n                  }}\n\n\nclass AttendeeDetail(ResourceDetail):\n    \"\"\"\n    Attendee detail by id\n    \"\"\"\n    def before_get_object(self, view_kwargs):\n        attendee = safe_query(self, TicketHolder, 'id', view_kwargs['id'], 'attendee_id')\n        if not has_access('is_registrar_or_user_itself', user_id=current_identity.id, event_id=attendee.event_id):\n            raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')\n\n    def before_delete_object(self, obj, kwargs):\n        if not has_access('is_registrar', event_id=obj.event_id):\n            raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')\n\n    def before_update_object(self, obj, data, kwargs):\n        if not has_access('is_registrar', event_id=obj.event_id):\n            raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')\n\n    decorators = (jwt_required,)\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder,\n                  'methods': {\n                      'before_get_object': before_get_object,\n                      'before_update_object': before_update_object,\n                      'before_delete_object': before_delete_object\n                  }}\n\n\nclass AttendeeRelationshipRequired(ResourceRelationship):\n    \"\"\"\n    Attendee Relationship (Required)\n    \"\"\"\n    decorators = (jwt_required,)\n    methods = ['GET', 'PATCH']\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder}\n\n\nclass AttendeeRelationshipOptional(ResourceRelationship):\n    \"\"\"\n    Attendee Relationship(Optional)\n    \"\"\"\n    decorators = (api.has_permission('is_user_itself', fetch=\"user_id\", fetch_as=\"id\", model=TicketHolder),)\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder}\n", "path": "app/api/attendees.py"}], "after_files": [{"content": "from flask_jwt import current_identity\nfrom flask_rest_jsonapi import ResourceDetail, ResourceList, ResourceRelationship\n\nfrom app.api.bootstrap import api\nfrom app.api.helpers.db import safe_query\nfrom app.api.helpers.exceptions import ForbiddenException\nfrom app.api.helpers.permission_manager import has_access\nfrom app.api.helpers.permissions import jwt_required\nfrom app.api.helpers.query import event_query\nfrom app.api.helpers.utilities import require_relationship\nfrom app.api.schema.attendees import AttendeeSchema, AttendeeSchemaPublic\nfrom app.models import db\nfrom app.models.order import Order\nfrom app.models.ticket import Ticket\nfrom app.models.ticket_holder import TicketHolder\nfrom app.models.user import User\n\n\nclass AttendeeListPost(ResourceList):\n    \"\"\"\n       List and create Attendees through direct URL\n    \"\"\"\n\n    def before_post(self, args, kwargs, data):\n        require_relationship(['ticket', 'event'], data)\n        if not has_access('is_coorganizer', event_id=data['event']):\n            raise ForbiddenException({'source': 'event_id'}, \"Access Forbidden\")\n\n    methods = ['POST']\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder}\n\n\nclass AttendeeList(ResourceList):\n    \"\"\"\n    List Attendees\n    \"\"\"\n    def query(self, view_kwargs):\n        query_ = self.session.query(TicketHolder)\n\n        if view_kwargs.get('order_identifier'):\n            order = safe_query(self, Order, 'identifier', view_kwargs['order_identifier'], 'order_identifier')\n            if not has_access('is_registrar', event_id=order.event_id) or not has_access('is_user_itself',\n                                                                                         id=order.user_id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            query_ = query_.join(Order).filter(Order.id == order.id)\n\n        if view_kwargs.get('ticket_id'):\n            ticket = safe_query(self, Ticket, 'id', view_kwargs['ticket_id'], 'ticket_id')\n            if not has_access('is_registrar', event_id=ticket.event_id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            query_ = query_.join(Ticket).filter(Ticket.id == ticket.id)\n\n        if view_kwargs.get('user_id'):\n            user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')\n            if not has_access('is_user_itself', user_id=user.id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            query_ = query_.join(User, User.email == TicketHolder.email).filter(User.id == user.id)\n\n        query_ = event_query(self, query_, view_kwargs, permission='is_registrar')\n        return query_\n\n    view_kwargs = True\n    methods = ['GET', ]\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder,\n                  'methods': {\n                      'query': query\n                  }}\n\n\nclass AttendeeDetail(ResourceDetail):\n    \"\"\"\n    Attendee detail by id\n    \"\"\"\n    def before_get_object(self, view_kwargs):\n        attendee = safe_query(self, TicketHolder, 'id', view_kwargs['id'], 'attendee_id')\n        if not has_access('is_registrar_or_user_itself', user_id=current_identity.id, event_id=attendee.event_id):\n            raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')\n\n    def before_delete_object(self, obj, kwargs):\n        if not has_access('is_registrar', event_id=obj.event_id):\n            raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')\n\n    def before_update_object(self, obj, data, kwargs):\n        if not has_access('is_registrar', event_id=obj.event_id):\n            raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')\n\n    decorators = (jwt_required,)\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder,\n                  'methods': {\n                      'before_get_object': before_get_object,\n                      'before_update_object': before_update_object,\n                      'before_delete_object': before_delete_object\n                  }}\n\n\nclass AttendeeRelationshipRequired(ResourceRelationship):\n    \"\"\"\n    Attendee Relationship (Required)\n    \"\"\"\n    decorators = (jwt_required,)\n    methods = ['GET', 'PATCH']\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder}\n\n\nclass AttendeeRelationshipOptional(ResourceRelationship):\n    \"\"\"\n    Attendee Relationship(Optional)\n    \"\"\"\n    decorators = (api.has_permission('is_user_itself', fetch=\"user_id\", fetch_as=\"id\", model=TicketHolder),)\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder}\n", "path": "app/api/attendees.py"}]}