prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  User-Session: user/<id>/sessions returns all the sessions in system
  **I'm submitting a ...**  (check one with "x")
  - [x] bug report
  - [ ] feature request
  - [ ] support request => Please do not submit support requests here, instead ask your query in out Gitter channel at https://gitter.im/fossasia/open-event-orga-server
  
  The user API returns all the sessions in the system instead of sessions under the user
  eg
  URL
  ```
  https://open-event-api.herokuapp.com/v1/users/5/sessions
  ```
  
  Query Params:
  ```
  include:event
  sort:starts-at
  ```
  
  @poush @shubham-padia @enigmaeth @magdalenesuo Please have a look at it
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `app/api/sessions.py`
  Content:
  ```
  1 from flask_rest_jsonapi import ResourceDetail, ResourceList, ResourceRelationship
  2 
  3 from app.api.bootstrap import api
  4 from app.api.events import Event
  5 from app.api.helpers.db import safe_query
  6 from app.api.helpers.mail import send_email_new_session, send_email_session_accept_reject
  7 from app.api.helpers.notification import send_notif_new_session_organizer, send_notif_session_accept_reject
  8 from app.api.helpers.permissions import current_identity
  9 from app.api.helpers.query import event_query
  10 from app.api.helpers.utilities import require_relationship
  11 from app.api.schema.sessions import SessionSchema
  12 from app.models import db
  13 from app.models.microlocation import Microlocation
  14 from app.models.session import Session
  15 from app.models.session_type import SessionType
  16 from app.models.speaker import Speaker
  17 from app.models.track import Track
  18 from app.settings import get_settings
  19 
  20 
  21 class SessionListPost(ResourceList):
  22     """
  23     List Sessions
  24     """
  25     def before_post(self, args, kwargs, data):
  26         require_relationship(['event'], data)
  27         data['creator_id'] = current_identity.id
  28 
  29     def after_create_object(self, session, data, view_kwargs):
  30         if session.event.get_organizer():
  31             event_name = session.event.name
  32             organizer = session.event.get_organizer()
  33             organizer_email = organizer.email
  34             frontend_url = get_settings()['frontend_url']
  35             link = "{}/events/{}/sessions/{}"\
  36                 .format(frontend_url, session.event_id, session.id)
  37             send_email_new_session(organizer_email, event_name, link)
  38             send_notif_new_session_organizer(organizer, event_name, link)
  39 
  40     decorators = (api.has_permission('create_event'),)
  41     schema = SessionSchema
  42     data_layer = {'session': db.session,
  43                   'model': Session,
  44                   'methods': {'after_create_object': after_create_object
  45                               }}
  46 
  47 
  48 class SessionList(ResourceList):
  49     """
  50     List Sessions
  51     """
  52 
  53     def query(self, view_kwargs):
  54         query_ = self.session.query(Session)
  55         if view_kwargs.get('track_id') is not None:
  56             track = safe_query(self, Track, 'id', view_kwargs['track_id'], 'track_id')
  57             query_ = query_.join(Track).filter(Track.id == track.id)
  58         if view_kwargs.get('session_type_id') is not None:
  59             session_type = safe_query(self, SessionType, 'id', view_kwargs['session_type_id'], 'session_type_id')
  60             query_ = query_.join(SessionType).filter(SessionType.id == session_type.id)
  61         if view_kwargs.get('microlocation_id') is not None:
  62             microlocation = safe_query(self, Microlocation, 'id', view_kwargs['microlocation_id'], 'microlocation_id')
  63             query_ = query_.join(Microlocation).filter(Microlocation.id == microlocation.id)
  64         query_ = event_query(self, query_, view_kwargs)
  65         if view_kwargs.get('speaker_id'):
  66             speaker = safe_query(self, Speaker, 'id', view_kwargs['speaker_id'], 'speaker_id')
  67             # session-speaker :: many-to-many relationship
  68             query_ = Session.query.filter(Session.speakers.any(id=speaker.id))
  69         return query_
  70 
  71     view_kwargs = True
  72     methods = ['GET']
  73     schema = SessionSchema
  74     data_layer = {'session': db.session,
  75                   'model': Session,
  76                   'methods': {
  77                       'query': query
  78                   }}
  79 
  80 
  81 class SessionDetail(ResourceDetail):
  82     """
  83     Session detail by id
  84     """
  85     def before_get_object(self, view_kwargs):
  86         if view_kwargs.get('event_identifier'):
  87             event = safe_query(self, Event, 'identifier', view_kwargs['event_identifier'], 'identifier')
  88             view_kwargs['event_id'] = event.id
  89 
  90     def after_update_object(self, session, data, view_kwargs):
  91         """ Send email if session accepted or rejected """
  92         if 'state' in data and (session.state == 'accepted' or session.state == 'rejected'):
  93             # Email for speaker
  94             speakers = session.speakers
  95             for speaker in speakers:
  96                 frontend_url = get_settings()['frontend_url']
  97                 link = "{}/events/{}/sessions/{}" \
  98                     .format(frontend_url, session.event_id, session.id)
  99                 send_email_session_accept_reject(speaker.email, session, link)
  100                 send_notif_session_accept_reject(speaker, session.title, session.state, link)
  101 
  102             # Email for organizer
  103             if session.event.get_organizer():
  104                 organizer = session.event.get_organizer()
  105                 organizer_email = organizer.email
  106                 frontend_url = get_settings()['frontend_url']
  107                 link = "{}/events/{}/sessions/{}" \
  108                     .format(frontend_url, session.event_id, session.id)
  109                 send_email_session_accept_reject(organizer_email, session,
  110                                                  link)
  111                 send_notif_session_accept_reject(organizer, session.title,
  112                                                  session.state, link)
  113 
  114 
  115     decorators = (api.has_permission('is_speaker_for_session', methods="PATCH,DELETE"),)
  116     schema = SessionSchema
  117     data_layer = {'session': db.session,
  118                   'model': Session,
  119                   'methods': {'before_get_object': before_get_object,
  120                               'after_update_object': after_update_object}}
  121 
  122 
  123 class SessionRelationshipRequired(ResourceRelationship):
  124     """
  125     Session Relationship
  126     """
  127     schema = SessionSchema
  128     decorators = (api.has_permission('is_speaker_for_session', methods="PATCH,DELETE"),)
  129     methods = ['GET', 'PATCH']
  130     data_layer = {'session': db.session,
  131                   'model': Session}
  132 
  133 
  134 class SessionRelationshipOptional(ResourceRelationship):
  135     """
  136     Session Relationship
  137     """
  138     schema = SessionSchema
  139     decorators = (api.has_permission('is_speaker_for_session', methods="PATCH,DELETE"),)
  140     data_layer = {'session': db.session,
  141                   'model': Session}
  142
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/app/api/sessions.py b/app/api/sessions.py
  --- a/app/api/sessions.py
  +++ b/app/api/sessions.py
  @@ -15,6 +15,7 @@
   from app.models.session_type import SessionType
   from app.models.speaker import Speaker
   from app.models.track import Track
  +from app.models.user import User
   from app.settings import get_settings
   
   
  @@ -61,11 +62,15 @@
           if view_kwargs.get('microlocation_id') is not None:
               microlocation = safe_query(self, Microlocation, 'id', view_kwargs['microlocation_id'], 'microlocation_id')
               query_ = query_.join(Microlocation).filter(Microlocation.id == microlocation.id)
  +        if view_kwargs.get('user_id') is not None:
  +            user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')
  +            query_ = query_.join(User).filter(User.id == user.id)
           query_ = event_query(self, query_, view_kwargs)
           if view_kwargs.get('speaker_id'):
               speaker = safe_query(self, Speaker, 'id', view_kwargs['speaker_id'], 'speaker_id')
               # session-speaker :: many-to-many relationship
               query_ = Session.query.filter(Session.speakers.any(id=speaker.id))
  +
           return query_
   
       view_kwargs = True
  
verification_info: {"golden_diff": "diff --git a/app/api/sessions.py b/app/api/sessions.py\n--- a/app/api/sessions.py\n+++ b/app/api/sessions.py\n@@ -15,6 +15,7 @@\n from app.models.session_type import SessionType\n from app.models.speaker import Speaker\n from app.models.track import Track\n+from app.models.user import User\n from app.settings import get_settings\n \n \n@@ -61,11 +62,15 @@\n         if view_kwargs.get('microlocation_id') is not None:\n             microlocation = safe_query(self, Microlocation, 'id', view_kwargs['microlocation_id'], 'microlocation_id')\n             query_ = query_.join(Microlocation).filter(Microlocation.id == microlocation.id)\n+        if view_kwargs.get('user_id') is not None:\n+            user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')\n+            query_ = query_.join(User).filter(User.id == user.id)\n         query_ = event_query(self, query_, view_kwargs)\n         if view_kwargs.get('speaker_id'):\n             speaker = safe_query(self, Speaker, 'id', view_kwargs['speaker_id'], 'speaker_id')\n             # session-speaker :: many-to-many relationship\n             query_ = Session.query.filter(Session.speakers.any(id=speaker.id))\n+\n         return query_\n \n     view_kwargs = True\n", "issue": "User-Session: user/<id>/sessions returns all the sessions in system\n**I'm submitting a ...**  (check one with \"x\")\r\n- [x] bug report\r\n- [ ] feature request\r\n- [ ] support request => Please do not submit support requests here, instead ask your query in out Gitter channel at https://gitter.im/fossasia/open-event-orga-server\r\n\r\nThe user API returns all the sessions in the system instead of sessions under the user\r\neg\r\nURL\r\n```\r\nhttps://open-event-api.herokuapp.com/v1/users/5/sessions\r\n```\r\n\r\nQuery Params:\r\n```\r\ninclude:event\r\nsort:starts-at\r\n```\r\n\r\n@poush @shubham-padia @enigmaeth @magdalenesuo Please have a look at it\n", "before_files": [{"content": "from flask_rest_jsonapi import ResourceDetail, ResourceList, ResourceRelationship\n\nfrom app.api.bootstrap import api\nfrom app.api.events import Event\nfrom app.api.helpers.db import safe_query\nfrom app.api.helpers.mail import send_email_new_session, send_email_session_accept_reject\nfrom app.api.helpers.notification import send_notif_new_session_organizer, send_notif_session_accept_reject\nfrom app.api.helpers.permissions import current_identity\nfrom app.api.helpers.query import event_query\nfrom app.api.helpers.utilities import require_relationship\nfrom app.api.schema.sessions import SessionSchema\nfrom app.models import db\nfrom app.models.microlocation import Microlocation\nfrom app.models.session import Session\nfrom app.models.session_type import SessionType\nfrom app.models.speaker import Speaker\nfrom app.models.track import Track\nfrom app.settings import get_settings\n\n\nclass SessionListPost(ResourceList):\n    \"\"\"\n    List Sessions\n    \"\"\"\n    def before_post(self, args, kwargs, data):\n        require_relationship(['event'], data)\n        data['creator_id'] = current_identity.id\n\n    def after_create_object(self, session, data, view_kwargs):\n        if session.event.get_organizer():\n            event_name = session.event.name\n            organizer = session.event.get_organizer()\n            organizer_email = organizer.email\n            frontend_url = get_settings()['frontend_url']\n            link = \"{}/events/{}/sessions/{}\"\\\n                .format(frontend_url, session.event_id, session.id)\n            send_email_new_session(organizer_email, event_name, link)\n            send_notif_new_session_organizer(organizer, event_name, link)\n\n    decorators = (api.has_permission('create_event'),)\n    schema = SessionSchema\n    data_layer = {'session': db.session,\n                  'model': Session,\n                  'methods': {'after_create_object': after_create_object\n                              }}\n\n\nclass SessionList(ResourceList):\n    \"\"\"\n    List Sessions\n    \"\"\"\n\n    def query(self, view_kwargs):\n        query_ = self.session.query(Session)\n        if view_kwargs.get('track_id') is not None:\n            track = safe_query(self, Track, 'id', view_kwargs['track_id'], 'track_id')\n            query_ = query_.join(Track).filter(Track.id == track.id)\n        if view_kwargs.get('session_type_id') is not None:\n            session_type = safe_query(self, SessionType, 'id', view_kwargs['session_type_id'], 'session_type_id')\n            query_ = query_.join(SessionType).filter(SessionType.id == session_type.id)\n        if view_kwargs.get('microlocation_id') is not None:\n            microlocation = safe_query(self, Microlocation, 'id', view_kwargs['microlocation_id'], 'microlocation_id')\n            query_ = query_.join(Microlocation).filter(Microlocation.id == microlocation.id)\n        query_ = event_query(self, query_, view_kwargs)\n        if view_kwargs.get('speaker_id'):\n            speaker = safe_query(self, Speaker, 'id', view_kwargs['speaker_id'], 'speaker_id')\n            # session-speaker :: many-to-many relationship\n            query_ = Session.query.filter(Session.speakers.any(id=speaker.id))\n        return query_\n\n    view_kwargs = True\n    methods = ['GET']\n    schema = SessionSchema\n    data_layer = {'session': db.session,\n                  'model': Session,\n                  'methods': {\n                      'query': query\n                  }}\n\n\nclass SessionDetail(ResourceDetail):\n    \"\"\"\n    Session detail by id\n    \"\"\"\n    def before_get_object(self, view_kwargs):\n        if view_kwargs.get('event_identifier'):\n            event = safe_query(self, Event, 'identifier', view_kwargs['event_identifier'], 'identifier')\n            view_kwargs['event_id'] = event.id\n\n    def after_update_object(self, session, data, view_kwargs):\n        \"\"\" Send email if session accepted or rejected \"\"\"\n        if 'state' in data and (session.state == 'accepted' or session.state == 'rejected'):\n            # Email for speaker\n            speakers = session.speakers\n            for speaker in speakers:\n                frontend_url = get_settings()['frontend_url']\n                link = \"{}/events/{}/sessions/{}\" \\\n                    .format(frontend_url, session.event_id, session.id)\n                send_email_session_accept_reject(speaker.email, session, link)\n                send_notif_session_accept_reject(speaker, session.title, session.state, link)\n\n            # Email for organizer\n            if session.event.get_organizer():\n                organizer = session.event.get_organizer()\n                organizer_email = organizer.email\n                frontend_url = get_settings()['frontend_url']\n                link = \"{}/events/{}/sessions/{}\" \\\n                    .format(frontend_url, session.event_id, session.id)\n                send_email_session_accept_reject(organizer_email, session,\n                                                 link)\n                send_notif_session_accept_reject(organizer, session.title,\n                                                 session.state, link)\n\n\n    decorators = (api.has_permission('is_speaker_for_session', methods=\"PATCH,DELETE\"),)\n    schema = SessionSchema\n    data_layer = {'session': db.session,\n                  'model': Session,\n                  'methods': {'before_get_object': before_get_object,\n                              'after_update_object': after_update_object}}\n\n\nclass SessionRelationshipRequired(ResourceRelationship):\n    \"\"\"\n    Session Relationship\n    \"\"\"\n    schema = SessionSchema\n    decorators = (api.has_permission('is_speaker_for_session', methods=\"PATCH,DELETE\"),)\n    methods = ['GET', 'PATCH']\n    data_layer = {'session': db.session,\n                  'model': Session}\n\n\nclass SessionRelationshipOptional(ResourceRelationship):\n    \"\"\"\n    Session Relationship\n    \"\"\"\n    schema = SessionSchema\n    decorators = (api.has_permission('is_speaker_for_session', methods=\"PATCH,DELETE\"),)\n    data_layer = {'session': db.session,\n                  'model': Session}\n", "path": "app/api/sessions.py"}], "after_files": [{"content": "from flask_rest_jsonapi import ResourceDetail, ResourceList, ResourceRelationship\n\nfrom app.api.bootstrap import api\nfrom app.api.events import Event\nfrom app.api.helpers.db import safe_query\nfrom app.api.helpers.mail import send_email_new_session, send_email_session_accept_reject\nfrom app.api.helpers.notification import send_notif_new_session_organizer, send_notif_session_accept_reject\nfrom app.api.helpers.permissions import current_identity\nfrom app.api.helpers.query import event_query\nfrom app.api.helpers.utilities import require_relationship\nfrom app.api.schema.sessions import SessionSchema\nfrom app.models import db\nfrom app.models.microlocation import Microlocation\nfrom app.models.session import Session\nfrom app.models.session_type import SessionType\nfrom app.models.speaker import Speaker\nfrom app.models.track import Track\nfrom app.models.user import User\nfrom app.settings import get_settings\n\n\nclass SessionListPost(ResourceList):\n    \"\"\"\n    List Sessions\n    \"\"\"\n    def before_post(self, args, kwargs, data):\n        require_relationship(['event'], data)\n        data['creator_id'] = current_identity.id\n\n    def after_create_object(self, session, data, view_kwargs):\n        if session.event.get_organizer():\n            event_name = session.event.name\n            organizer = session.event.get_organizer()\n            organizer_email = organizer.email\n            frontend_url = get_settings()['frontend_url']\n            link = \"{}/events/{}/sessions/{}\"\\\n                .format(frontend_url, session.event_id, session.id)\n            send_email_new_session(organizer_email, event_name, link)\n            send_notif_new_session_organizer(organizer, event_name, link)\n\n    decorators = (api.has_permission('create_event'),)\n    schema = SessionSchema\n    data_layer = {'session': db.session,\n                  'model': Session,\n                  'methods': {'after_create_object': after_create_object\n                              }}\n\n\nclass SessionList(ResourceList):\n    \"\"\"\n    List Sessions\n    \"\"\"\n\n    def query(self, view_kwargs):\n        query_ = self.session.query(Session)\n        if view_kwargs.get('track_id') is not None:\n            track = safe_query(self, Track, 'id', view_kwargs['track_id'], 'track_id')\n            query_ = query_.join(Track).filter(Track.id == track.id)\n        if view_kwargs.get('session_type_id') is not None:\n            session_type = safe_query(self, SessionType, 'id', view_kwargs['session_type_id'], 'session_type_id')\n            query_ = query_.join(SessionType).filter(SessionType.id == session_type.id)\n        if view_kwargs.get('microlocation_id') is not None:\n            microlocation = safe_query(self, Microlocation, 'id', view_kwargs['microlocation_id'], 'microlocation_id')\n            query_ = query_.join(Microlocation).filter(Microlocation.id == microlocation.id)\n        if view_kwargs.get('user_id') is not None:\n            user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')\n            query_ = query_.join(User).filter(User.id == user.id)\n        query_ = event_query(self, query_, view_kwargs)\n        if view_kwargs.get('speaker_id'):\n            speaker = safe_query(self, Speaker, 'id', view_kwargs['speaker_id'], 'speaker_id')\n            # session-speaker :: many-to-many relationship\n            query_ = Session.query.filter(Session.speakers.any(id=speaker.id))\n\n        return query_\n\n    view_kwargs = True\n    methods = ['GET']\n    schema = SessionSchema\n    data_layer = {'session': db.session,\n                  'model': Session,\n                  'methods': {\n                      'query': query\n                  }}\n\n\nclass SessionDetail(ResourceDetail):\n    \"\"\"\n    Session detail by id\n    \"\"\"\n    def before_get_object(self, view_kwargs):\n        if view_kwargs.get('event_identifier'):\n            event = safe_query(self, Event, 'identifier', view_kwargs['event_identifier'], 'identifier')\n            view_kwargs['event_id'] = event.id\n\n    def after_update_object(self, session, data, view_kwargs):\n        \"\"\" Send email if session accepted or rejected \"\"\"\n        if 'state' in data and (session.state == 'accepted' or session.state == 'rejected'):\n            # Email for speaker\n            speakers = session.speakers\n            for speaker in speakers:\n                frontend_url = get_settings()['frontend_url']\n                link = \"{}/events/{}/sessions/{}\" \\\n                    .format(frontend_url, session.event_id, session.id)\n                send_email_session_accept_reject(speaker.email, session, link)\n                send_notif_session_accept_reject(speaker, session.title, session.state, link)\n\n            # Email for organizer\n            if session.event.get_organizer():\n                organizer = session.event.get_organizer()\n                organizer_email = organizer.email\n                frontend_url = get_settings()['frontend_url']\n                link = \"{}/events/{}/sessions/{}\" \\\n                    .format(frontend_url, session.event_id, session.id)\n                send_email_session_accept_reject(organizer_email, session,\n                                                 link)\n                send_notif_session_accept_reject(organizer, session.title,\n                                                 session.state, link)\n\n\n    decorators = (api.has_permission('is_speaker_for_session', methods=\"PATCH,DELETE\"),)\n    schema = SessionSchema\n    data_layer = {'session': db.session,\n                  'model': Session,\n                  'methods': {'before_get_object': before_get_object,\n                              'after_update_object': after_update_object}}\n\n\nclass SessionRelationshipRequired(ResourceRelationship):\n    \"\"\"\n    Session Relationship\n    \"\"\"\n    schema = SessionSchema\n    decorators = (api.has_permission('is_speaker_for_session', methods=\"PATCH,DELETE\"),)\n    methods = ['GET', 'PATCH']\n    data_layer = {'session': db.session,\n                  'model': Session}\n\n\nclass SessionRelationshipOptional(ResourceRelationship):\n    \"\"\"\n    Session Relationship\n    \"\"\"\n    schema = SessionSchema\n    decorators = (api.has_permission('is_speaker_for_session', methods=\"PATCH,DELETE\"),)\n    data_layer = {'session': db.session,\n                  'model': Session}\n", "path": "app/api/sessions.py"}]}