We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
"Vis påmeldte" shows list of both attending and waiting list
**Describe the bug**
A clear and concise description of what the bug is.

"Vis påmeldte" on arrangements shows both attending people and people on the waiting list. This can lead to misunderstandings because people on the waiting list might think they're attending the arrangement.

**To Reproduce**
Steps to reproduce the behavior:
1. Go to any arrangement
2. Click on 'Vis påmeldte'
3. Scroll down to bottom of list
4. See error

**Expected behavior**
A clear and concise description of what you expected to happen.

I expect the "vis påmeldte" modal to show only attending people.

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `apps/events/api/views.py`
Content:
```
1 from django.shortcuts import get_object_or_404
2 from guardian.shortcuts import get_objects_for_user
3 from rest_framework import mixins, permissions, status, viewsets
4 from rest_framework.decorators import action
5 from rest_framework.exceptions import NotFound
6 from rest_framework.response import Response
7 
8 from apps.payment.serializers import PaymentReadOnlySerializer
9 from apps.profiles.models import Privacy
10 
11 from ..constants import AttendStatus
12 from ..filters import (
13     EventFilter,
14     ExtrasFilter,
15     FieldOfStudyRuleFilter,
16     GradeRuleFilter,
17     RuleBundleFilter,
18     UserGroupRuleFilter,
19 )
20 from ..models import (
21     AttendanceEvent,
22     Attendee,
23     Event,
24     Extras,
25     FieldOfStudyRule,
26     GradeRule,
27     RuleBundle,
28     UserGroupRule,
29 )
30 from ..utils import handle_attend_event_payment
31 from .permissions import (
32     ChangeAttendeePermission,
33     RegisterPermission,
34     UnregisterPermission,
35 )
36 from .register_attendance_serializer import RegisterAttendanceSerializer
37 from .serializers import (
38     AttendanceEventSerializer,
39     AttendeeAdministrateSerializer,
40     AttendeeSerializer,
41     AttendeeUpdateSerializer,
42     EventSerializer,
43     ExtrasSerializer,
44     FieldOfStudyRuleSerializer,
45     GradeRuleSerializer,
46     PublicAttendeeSerializer,
47     RegisterSerializer,
48     RuleBundleSerializer,
49     UserGroupRuleSerializer,
50 )
51 
52 
53 class EventViewSet(viewsets.ModelViewSet):
54     serializer_class = EventSerializer
55     permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)
56     filterset_class = EventFilter
57     ordering_fields = (
58         "event_start",
59         "event_end",
60         "id",
61         "closest",
62         "has_passed",
63     )
64     ordering = ("has_passed", "closest", "id")
65 
66     def get_queryset(self):
67         user = self.request.user
68         return Event.by_nearest_active_event.get_queryset_for_user(user)
69 
70 
71 class AttendanceEventViewSet(viewsets.ModelViewSet):
72     serializer_class = AttendanceEventSerializer
73     permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)
74     queryset = AttendanceEvent.objects.all()
75 
76     def get_queryset(self):
77         user = self.request.user
78         events = Event.by_registration.get_queryset_for_user(user)
79         return super().get_queryset().filter(event__in=events)
80 
81     @action(
82         detail=True,
83         methods=["POST"],
84         permission_classes=(permissions.IsAuthenticated, RegisterPermission),
85         serializer_class=RegisterSerializer,
86     )
87     def register(self, request, pk=None):
88         user = request.user
89         privacy: Privacy = user.privacy
90         attendance_event: AttendanceEvent = self.get_object()
91         # Check if the recaptcha and other request data is valid
92         register_serializer = self.get_serializer(data=request.data)
93         register_serializer.is_valid(raise_exception=True)
94         data = register_serializer.validated_data
95         # Set the values to the users default settings if sent data is empty
96         # intentionally uses that bool(None) == False
97         attending_visibility = (
98             specific
99             if (specific := data.get("show_as_attending_event")) is not None
100             else bool(privacy.visible_as_attending_events)
101         )
102         allow_pictures = (
103             specific
104             if (specific := data.get("allow_pictures")) is not None
105             else bool(privacy.allow_pictures)
106         )
107 
108         attendee = Attendee.objects.create(
109             event=attendance_event,
110             user=user,
111             show_as_attending_event=attending_visibility,
112             allow_pictures=allow_pictures,
113             note=data.get("note"),
114         )
115 
116         if attendance_event.payment():
117             handle_attend_event_payment(attendance_event.event, user)
118 
119         attendee_serializer = AttendeeSerializer(attendee)
120         return Response(data=attendee_serializer.data, status=status.HTTP_201_CREATED)
121 
122     @action(
123         detail=True,
124         methods=["DELETE"],
125         permission_classes=(permissions.IsAuthenticated, UnregisterPermission),
126     )
127     def unregister(self, request, pk=None):
128         user = request.user
129         attendance_event: AttendanceEvent = self.get_object()
130         attendee = Attendee.objects.get(event=attendance_event, user=user)
131         # Attendees un-attend with themselves as the admin user.
132         attendee.unattend(user)
133 
134         return Response(status=status.HTTP_204_NO_CONTENT)
135 
136     @action(
137         detail=True,
138         methods=["GET"],
139         permission_classes=(permissions.IsAuthenticated,),
140         serializer_class=PublicAttendeeSerializer,
141         url_path="public-attendees",
142     )
143     def public_attendees(self, request, pk=None):
144         attendance_event: AttendanceEvent = self.get_object()
145         attendees = (
146             attendance_event.attending_attendees_qs | attendance_event.waitlist_qs
147         )
148         attendees = attendees.order_by("-show_as_attending_event", "timestamp")
149         serializer = self.get_serializer(attendees, many=True)
150 
151         return Response(data=serializer.data, status=status.HTTP_200_OK)
152 
153     @action(
154         detail=True,
155         methods=["GET"],
156         permission_classes=(permissions.IsAuthenticated,),
157         serializer_class=AttendeeSerializer,
158     )
159     def attendee(self, request, pk=None):
160         user = request.user
161         attendance_event: AttendanceEvent = self.get_object()
162         attendee = get_object_or_404(Attendee, event=attendance_event, user=user)
163         serializer = self.get_serializer(attendee)
164         return Response(data=serializer.data, status=status.HTTP_200_OK)
165 
166     @action(
167         detail=True,
168         methods=["GET"],
169         permission_classes=(permissions.IsAuthenticated,),
170         serializer_class=ExtrasSerializer,
171     )
172     def extras(self, request, pk=None):
173         attendance_event: AttendanceEvent = self.get_object()
174         serializer = self.get_serializer(attendance_event.extras, many=True)
175         return Response(data=serializer.data, status=status.HTTP_200_OK)
176 
177     @action(
178         detail=True,
179         methods=["GET"],
180         permission_classes=(permissions.IsAuthenticated,),
181         serializer_class=PaymentReadOnlySerializer,
182     )
183     def payment(self, request, pk=None):
184         attendance_event: AttendanceEvent = self.get_object()
185         payment = attendance_event.get_payment()
186         if not payment:
187             raise NotFound
188         serializer = self.get_serializer(payment)
189         return Response(data=serializer.data, status=status.HTTP_200_OK)
190 
191 
192 class AttendeeViewSet(
193     viewsets.GenericViewSet, mixins.ListModelMixin, mixins.RetrieveModelMixin
194 ):
195     serializer_class = AttendeeSerializer
196     filterset_fields = (
197         "event",
198         "attended",
199         "user",
200         "show_as_attending_event",
201         "allow_pictures",
202         "extras",
203     )
204 
205     @staticmethod
206     def _get_allowed_attendees(user):
207         """
208         A user is allowed to see attendees for their own user, and for events they are organizing.
209         """
210         if user.is_anonymous:
211             return Attendee.objects.none()
212 
213         attendees = get_objects_for_user(
214             user, "events.change_attendee", accept_global_perms=False
215         )
216         attendees |= Attendee.objects.filter(user=user)
217         return attendees.distinct()
218 
219     def get_queryset(self):
220         return self._get_allowed_attendees(self.request.user)
221 
222     @action(
223         detail=True,
224         methods=["PATCH", "PUT"],
225         permission_classes=(ChangeAttendeePermission,),
226         serializer_class=AttendeeUpdateSerializer,
227     )
228     def change(self, request, pk=None):
229         attendee: Attendee = self.get_object()
230         partial = request.method == "PATCH"
231         serializer = self.get_serializer(attendee, data=request.data, partial=partial)
232         serializer.is_valid(raise_exception=True)
233         serializer.save()
234         return Response(data=serializer.data, status=status.HTTP_200_OK)
235 
236     @action(
237         detail=True,
238         methods=["PATCH", "PUT"],
239         permission_classes=(permissions.DjangoObjectPermissions,),
240         serializer_class=AttendeeAdministrateSerializer,
241     )
242     def administrate(self, request, pk=None):
243         attendee: Attendee = self.get_object()
244         partial = request.method == "PATCH"
245         serializer = self.get_serializer(attendee, data=request.data, partial=partial)
246         serializer.is_valid(raise_exception=True)
247         serializer.save()
248         return Response(data=serializer.data, status=status.HTTP_200_OK)
249 
250     @action(
251         detail=False,
252         methods=["POST"],
253         serializer_class=RegisterAttendanceSerializer,
254         url_path="register-attendance",
255     )
256     def register_attendance(self, request, pk=None):
257         """
258         Register that a user has physically attended an event.
259         """
260         serializer = self.get_serializer(data=request.data)
261 
262         serializer.is_valid(raise_exception=True)
263 
264         attendee = serializer.get_attendee(request.data)
265         attendee.attended = True
266         attendee.save()
267 
268         return Response(
269             {
270                 "detail": {
271                     "message": f"{attendee.user} er registrert som deltaker. Velkommen!",
272                     "attend_status": AttendStatus.REGISTER_SUCCESS,
273                     "attendee": attendee.id,
274                 }
275             },
276             status=status.HTTP_200_OK,
277         )
278 
279 
280 class ExtrasViewSet(viewsets.ModelViewSet):
281     serializer_class = ExtrasSerializer
282     queryset = Extras.objects.all()
283     permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)
284     filterset_class = ExtrasFilter
285 
286 
287 class RuleBundleViewSet(viewsets.ModelViewSet):
288     serializer_class = RuleBundleSerializer
289     queryset = RuleBundle.objects.all()
290     permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)
291     filterset_class = RuleBundleFilter
292 
293 
294 class FieldOfStudyRuleViewSet(viewsets.ModelViewSet):
295     serializer_class = FieldOfStudyRuleSerializer
296     queryset = FieldOfStudyRule.objects.all()
297     permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)
298     filterset_class = FieldOfStudyRuleFilter
299 
300 
301 class GradeRuleViewSet(viewsets.ModelViewSet):
302     serializer_class = GradeRuleSerializer
303     queryset = GradeRule.objects.all()
304     permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)
305     filterset_class = GradeRuleFilter
306 
307 
308 class UserGroupRuleViewSet(viewsets.ModelViewSet):
309     serializer_class = UserGroupRuleSerializer
310     queryset = UserGroupRule.objects.all()
311     permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)
312     filterset_class = UserGroupRuleFilter
313
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/apps/events/api/views.py b/apps/events/api/views.py
--- a/apps/events/api/views.py
+++ b/apps/events/api/views.py
@@ -142,10 +142,21 @@
     )
     def public_attendees(self, request, pk=None):
         attendance_event: AttendanceEvent = self.get_object()
-        attendees = (
-            attendance_event.attending_attendees_qs | attendance_event.waitlist_qs
-        )
-        attendees = attendees.order_by("-show_as_attending_event", "timestamp")
+        attendees = attendance_event.attending_attendees_qs
+        serializer = self.get_serializer(attendees, many=True)
+
+        return Response(data=serializer.data, status=status.HTTP_200_OK)
+
+    @action(
+        detail=True,
+        methods=["GET"],
+        permission_classes=(permissions.IsAuthenticated,),
+        serializer_class=PublicAttendeeSerializer,
+        url_path="public-on-waitlist",
+    )
+    def public_on_waitlist(self, request, pk=None):
+        attendance_event: AttendanceEvent = self.get_object()
+        attendees = attendance_event.waitlist_qs
         serializer = self.get_serializer(attendees, many=True)
 
         return Response(data=serializer.data, status=status.HTTP_200_OK)

{"golden_diff": "diff --git a/apps/events/api/views.py b/apps/events/api/views.py\n--- a/apps/events/api/views.py\n+++ b/apps/events/api/views.py\n@@ -142,10 +142,21 @@\n     )\n     def public_attendees(self, request, pk=None):\n         attendance_event: AttendanceEvent = self.get_object()\n-        attendees = (\n-            attendance_event.attending_attendees_qs | attendance_event.waitlist_qs\n-        )\n-        attendees = attendees.order_by(\"-show_as_attending_event\", \"timestamp\")\n+        attendees = attendance_event.attending_attendees_qs\n+        serializer = self.get_serializer(attendees, many=True)\n+\n+        return Response(data=serializer.data, status=status.HTTP_200_OK)\n+\n+    @action(\n+        detail=True,\n+        methods=[\"GET\"],\n+        permission_classes=(permissions.IsAuthenticated,),\n+        serializer_class=PublicAttendeeSerializer,\n+        url_path=\"public-on-waitlist\",\n+    )\n+    def public_on_waitlist(self, request, pk=None):\n+        attendance_event: AttendanceEvent = self.get_object()\n+        attendees = attendance_event.waitlist_qs\n         serializer = self.get_serializer(attendees, many=True)\n \n         return Response(data=serializer.data, status=status.HTTP_200_OK)\n", "issue": "\"Vis p\u00e5meldte\" shows list of both attending and waiting list\n**Describe the bug**\r\nA clear and concise description of what the bug is.\r\n\r\n\"Vis p\u00e5meldte\" on arrangements shows both attending people and people on the waiting list. This can lead to misunderstandings because people on the waiting list might think they're attending the arrangement.\r\n\r\n**To Reproduce**\r\nSteps to reproduce the behavior:\r\n1. Go to any arrangement\r\n2. Click on 'Vis p\u00e5meldte'\r\n3. Scroll down to bottom of list\r\n4. See error\r\n\r\n**Expected behavior**\r\nA clear and concise description of what you expected to happen.\r\n\r\nI expect the \"vis p\u00e5meldte\" modal to show only attending people.\n", "before_files": [{"content": "from django.shortcuts import get_object_or_404\nfrom guardian.shortcuts import get_objects_for_user\nfrom rest_framework import mixins, permissions, status, viewsets\nfrom rest_framework.decorators import action\nfrom rest_framework.exceptions import NotFound\nfrom rest_framework.response import Response\n\nfrom apps.payment.serializers import PaymentReadOnlySerializer\nfrom apps.profiles.models import Privacy\n\nfrom ..constants import AttendStatus\nfrom ..filters import (\n    EventFilter,\n    ExtrasFilter,\n    FieldOfStudyRuleFilter,\n    GradeRuleFilter,\n    RuleBundleFilter,\n    UserGroupRuleFilter,\n)\nfrom ..models import (\n    AttendanceEvent,\n    Attendee,\n    Event,\n    Extras,\n    FieldOfStudyRule,\n    GradeRule,\n    RuleBundle,\n    UserGroupRule,\n)\nfrom ..utils import handle_attend_event_payment\nfrom .permissions import (\n    ChangeAttendeePermission,\n    RegisterPermission,\n    UnregisterPermission,\n)\nfrom .register_attendance_serializer import RegisterAttendanceSerializer\nfrom .serializers import (\n    AttendanceEventSerializer,\n    AttendeeAdministrateSerializer,\n    AttendeeSerializer,\n    AttendeeUpdateSerializer,\n    EventSerializer,\n    ExtrasSerializer,\n    FieldOfStudyRuleSerializer,\n    GradeRuleSerializer,\n    PublicAttendeeSerializer,\n    RegisterSerializer,\n    RuleBundleSerializer,\n    UserGroupRuleSerializer,\n)\n\n\nclass EventViewSet(viewsets.ModelViewSet):\n    serializer_class = EventSerializer\n    permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)\n    filterset_class = EventFilter\n    ordering_fields = (\n        \"event_start\",\n        \"event_end\",\n        \"id\",\n        \"closest\",\n        \"has_passed\",\n    )\n    ordering = (\"has_passed\", \"closest\", \"id\")\n\n    def get_queryset(self):\n        user = self.request.user\n        return Event.by_nearest_active_event.get_queryset_for_user(user)\n\n\nclass AttendanceEventViewSet(viewsets.ModelViewSet):\n    serializer_class = AttendanceEventSerializer\n    permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)\n    queryset = AttendanceEvent.objects.all()\n\n    def get_queryset(self):\n        user = self.request.user\n        events = Event.by_registration.get_queryset_for_user(user)\n        return super().get_queryset().filter(event__in=events)\n\n    @action(\n        detail=True,\n        methods=[\"POST\"],\n        permission_classes=(permissions.IsAuthenticated, RegisterPermission),\n        serializer_class=RegisterSerializer,\n    )\n    def register(self, request, pk=None):\n        user = request.user\n        privacy: Privacy = user.privacy\n        attendance_event: AttendanceEvent = self.get_object()\n        # Check if the recaptcha and other request data is valid\n        register_serializer = self.get_serializer(data=request.data)\n        register_serializer.is_valid(raise_exception=True)\n        data = register_serializer.validated_data\n        # Set the values to the users default settings if sent data is empty\n        # intentionally uses that bool(None) == False\n        attending_visibility = (\n            specific\n            if (specific := data.get(\"show_as_attending_event\")) is not None\n            else bool(privacy.visible_as_attending_events)\n        )\n        allow_pictures = (\n            specific\n            if (specific := data.get(\"allow_pictures\")) is not None\n            else bool(privacy.allow_pictures)\n        )\n\n        attendee = Attendee.objects.create(\n            event=attendance_event,\n            user=user,\n            show_as_attending_event=attending_visibility,\n            allow_pictures=allow_pictures,\n            note=data.get(\"note\"),\n        )\n\n        if attendance_event.payment():\n            handle_attend_event_payment(attendance_event.event, user)\n\n        attendee_serializer = AttendeeSerializer(attendee)\n        return Response(data=attendee_serializer.data, status=status.HTTP_201_CREATED)\n\n    @action(\n        detail=True,\n        methods=[\"DELETE\"],\n        permission_classes=(permissions.IsAuthenticated, UnregisterPermission),\n    )\n    def unregister(self, request, pk=None):\n        user = request.user\n        attendance_event: AttendanceEvent = self.get_object()\n        attendee = Attendee.objects.get(event=attendance_event, user=user)\n        # Attendees un-attend with themselves as the admin user.\n        attendee.unattend(user)\n\n        return Response(status=status.HTTP_204_NO_CONTENT)\n\n    @action(\n        detail=True,\n        methods=[\"GET\"],\n        permission_classes=(permissions.IsAuthenticated,),\n        serializer_class=PublicAttendeeSerializer,\n        url_path=\"public-attendees\",\n    )\n    def public_attendees(self, request, pk=None):\n        attendance_event: AttendanceEvent = self.get_object()\n        attendees = (\n            attendance_event.attending_attendees_qs | attendance_event.waitlist_qs\n        )\n        attendees = attendees.order_by(\"-show_as_attending_event\", \"timestamp\")\n        serializer = self.get_serializer(attendees, many=True)\n\n        return Response(data=serializer.data, status=status.HTTP_200_OK)\n\n    @action(\n        detail=True,\n        methods=[\"GET\"],\n        permission_classes=(permissions.IsAuthenticated,),\n        serializer_class=AttendeeSerializer,\n    )\n    def attendee(self, request, pk=None):\n        user = request.user\n        attendance_event: AttendanceEvent = self.get_object()\n        attendee = get_object_or_404(Attendee, event=attendance_event, user=user)\n        serializer = self.get_serializer(attendee)\n        return Response(data=serializer.data, status=status.HTTP_200_OK)\n\n    @action(\n        detail=True,\n        methods=[\"GET\"],\n        permission_classes=(permissions.IsAuthenticated,),\n        serializer_class=ExtrasSerializer,\n    )\n    def extras(self, request, pk=None):\n        attendance_event: AttendanceEvent = self.get_object()\n        serializer = self.get_serializer(attendance_event.extras, many=True)\n        return Response(data=serializer.data, status=status.HTTP_200_OK)\n\n    @action(\n        detail=True,\n        methods=[\"GET\"],\n        permission_classes=(permissions.IsAuthenticated,),\n        serializer_class=PaymentReadOnlySerializer,\n    )\n    def payment(self, request, pk=None):\n        attendance_event: AttendanceEvent = self.get_object()\n        payment = attendance_event.get_payment()\n        if not payment:\n            raise NotFound\n        serializer = self.get_serializer(payment)\n        return Response(data=serializer.data, status=status.HTTP_200_OK)\n\n\nclass AttendeeViewSet(\n    viewsets.GenericViewSet, mixins.ListModelMixin, mixins.RetrieveModelMixin\n):\n    serializer_class = AttendeeSerializer\n    filterset_fields = (\n        \"event\",\n        \"attended\",\n        \"user\",\n        \"show_as_attending_event\",\n        \"allow_pictures\",\n        \"extras\",\n    )\n\n    @staticmethod\n    def _get_allowed_attendees(user):\n        \"\"\"\n        A user is allowed to see attendees for their own user, and for events they are organizing.\n        \"\"\"\n        if user.is_anonymous:\n            return Attendee.objects.none()\n\n        attendees = get_objects_for_user(\n            user, \"events.change_attendee\", accept_global_perms=False\n        )\n        attendees |= Attendee.objects.filter(user=user)\n        return attendees.distinct()\n\n    def get_queryset(self):\n        return self._get_allowed_attendees(self.request.user)\n\n    @action(\n        detail=True,\n        methods=[\"PATCH\", \"PUT\"],\n        permission_classes=(ChangeAttendeePermission,),\n        serializer_class=AttendeeUpdateSerializer,\n    )\n    def change(self, request, pk=None):\n        attendee: Attendee = self.get_object()\n        partial = request.method == \"PATCH\"\n        serializer = self.get_serializer(attendee, data=request.data, partial=partial)\n        serializer.is_valid(raise_exception=True)\n        serializer.save()\n        return Response(data=serializer.data, status=status.HTTP_200_OK)\n\n    @action(\n        detail=True,\n        methods=[\"PATCH\", \"PUT\"],\n        permission_classes=(permissions.DjangoObjectPermissions,),\n        serializer_class=AttendeeAdministrateSerializer,\n    )\n    def administrate(self, request, pk=None):\n        attendee: Attendee = self.get_object()\n        partial = request.method == \"PATCH\"\n        serializer = self.get_serializer(attendee, data=request.data, partial=partial)\n        serializer.is_valid(raise_exception=True)\n        serializer.save()\n        return Response(data=serializer.data, status=status.HTTP_200_OK)\n\n    @action(\n        detail=False,\n        methods=[\"POST\"],\n        serializer_class=RegisterAttendanceSerializer,\n        url_path=\"register-attendance\",\n    )\n    def register_attendance(self, request, pk=None):\n        \"\"\"\n        Register that a user has physically attended an event.\n        \"\"\"\n        serializer = self.get_serializer(data=request.data)\n\n        serializer.is_valid(raise_exception=True)\n\n        attendee = serializer.get_attendee(request.data)\n        attendee.attended = True\n        attendee.save()\n\n        return Response(\n            {\n                \"detail\": {\n                    \"message\": f\"{attendee.user} er registrert som deltaker. Velkommen!\",\n                    \"attend_status\": AttendStatus.REGISTER_SUCCESS,\n                    \"attendee\": attendee.id,\n                }\n            },\n            status=status.HTTP_200_OK,\n        )\n\n\nclass ExtrasViewSet(viewsets.ModelViewSet):\n    serializer_class = ExtrasSerializer\n    queryset = Extras.objects.all()\n    permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)\n    filterset_class = ExtrasFilter\n\n\nclass RuleBundleViewSet(viewsets.ModelViewSet):\n    serializer_class = RuleBundleSerializer\n    queryset = RuleBundle.objects.all()\n    permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)\n    filterset_class = RuleBundleFilter\n\n\nclass FieldOfStudyRuleViewSet(viewsets.ModelViewSet):\n    serializer_class = FieldOfStudyRuleSerializer\n    queryset = FieldOfStudyRule.objects.all()\n    permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)\n    filterset_class = FieldOfStudyRuleFilter\n\n\nclass GradeRuleViewSet(viewsets.ModelViewSet):\n    serializer_class = GradeRuleSerializer\n    queryset = GradeRule.objects.all()\n    permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)\n    filterset_class = GradeRuleFilter\n\n\nclass UserGroupRuleViewSet(viewsets.ModelViewSet):\n    serializer_class = UserGroupRuleSerializer\n    queryset = UserGroupRule.objects.all()\n    permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)\n    filterset_class = UserGroupRuleFilter\n", "path": "apps/events/api/views.py"}], "after_files": [{"content": "from django.shortcuts import get_object_or_404\nfrom guardian.shortcuts import get_objects_for_user\nfrom rest_framework import mixins, permissions, status, viewsets\nfrom rest_framework.decorators import action\nfrom rest_framework.exceptions import NotFound\nfrom rest_framework.response import Response\n\nfrom apps.payment.serializers import PaymentReadOnlySerializer\nfrom apps.profiles.models import Privacy\n\nfrom ..constants import AttendStatus\nfrom ..filters import (\n    EventFilter,\n    ExtrasFilter,\n    FieldOfStudyRuleFilter,\n    GradeRuleFilter,\n    RuleBundleFilter,\n    UserGroupRuleFilter,\n)\nfrom ..models import (\n    AttendanceEvent,\n    Attendee,\n    Event,\n    Extras,\n    FieldOfStudyRule,\n    GradeRule,\n    RuleBundle,\n    UserGroupRule,\n)\nfrom ..utils import handle_attend_event_payment\nfrom .permissions import (\n    ChangeAttendeePermission,\n    RegisterPermission,\n    UnregisterPermission,\n)\nfrom .register_attendance_serializer import RegisterAttendanceSerializer\nfrom .serializers import (\n    AttendanceEventSerializer,\n    AttendeeAdministrateSerializer,\n    AttendeeSerializer,\n    AttendeeUpdateSerializer,\n    EventSerializer,\n    ExtrasSerializer,\n    FieldOfStudyRuleSerializer,\n    GradeRuleSerializer,\n    PublicAttendeeSerializer,\n    RegisterSerializer,\n    RuleBundleSerializer,\n    UserGroupRuleSerializer,\n)\n\n\nclass EventViewSet(viewsets.ModelViewSet):\n    serializer_class = EventSerializer\n    permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)\n    filterset_class = EventFilter\n    ordering_fields = (\n        \"event_start\",\n        \"event_end\",\n        \"id\",\n        \"closest\",\n        \"has_passed\",\n    )\n    ordering = (\"has_passed\", \"closest\", \"id\")\n\n    def get_queryset(self):\n        user = self.request.user\n        return Event.by_nearest_active_event.get_queryset_for_user(user)\n\n\nclass AttendanceEventViewSet(viewsets.ModelViewSet):\n    serializer_class = AttendanceEventSerializer\n    permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)\n    queryset = AttendanceEvent.objects.all()\n\n    def get_queryset(self):\n        user = self.request.user\n        events = Event.by_registration.get_queryset_for_user(user)\n        return super().get_queryset().filter(event__in=events)\n\n    @action(\n        detail=True,\n        methods=[\"POST\"],\n        permission_classes=(permissions.IsAuthenticated, RegisterPermission),\n        serializer_class=RegisterSerializer,\n    )\n    def register(self, request, pk=None):\n        user = request.user\n        privacy: Privacy = user.privacy\n        attendance_event: AttendanceEvent = self.get_object()\n        # Check if the recaptcha and other request data is valid\n        register_serializer = self.get_serializer(data=request.data)\n        register_serializer.is_valid(raise_exception=True)\n        data = register_serializer.validated_data\n        # Set the values to the users default settings if sent data is empty\n        # intentionally uses that bool(None) == False\n        attending_visibility = (\n            specific\n            if (specific := data.get(\"show_as_attending_event\")) is not None\n            else bool(privacy.visible_as_attending_events)\n        )\n        allow_pictures = (\n            specific\n            if (specific := data.get(\"allow_pictures\")) is not None\n            else bool(privacy.allow_pictures)\n        )\n\n        attendee = Attendee.objects.create(\n            event=attendance_event,\n            user=user,\n            show_as_attending_event=attending_visibility,\n            allow_pictures=allow_pictures,\n            note=data.get(\"note\"),\n        )\n\n        if attendance_event.payment():\n            handle_attend_event_payment(attendance_event.event, user)\n\n        attendee_serializer = AttendeeSerializer(attendee)\n        return Response(data=attendee_serializer.data, status=status.HTTP_201_CREATED)\n\n    @action(\n        detail=True,\n        methods=[\"DELETE\"],\n        permission_classes=(permissions.IsAuthenticated, UnregisterPermission),\n    )\n    def unregister(self, request, pk=None):\n        user = request.user\n        attendance_event: AttendanceEvent = self.get_object()\n        attendee = Attendee.objects.get(event=attendance_event, user=user)\n        # Attendees un-attend with themselves as the admin user.\n        attendee.unattend(user)\n\n        return Response(status=status.HTTP_204_NO_CONTENT)\n\n    @action(\n        detail=True,\n        methods=[\"GET\"],\n        permission_classes=(permissions.IsAuthenticated,),\n        serializer_class=PublicAttendeeSerializer,\n        url_path=\"public-attendees\",\n    )\n    def public_attendees(self, request, pk=None):\n        attendance_event: AttendanceEvent = self.get_object()\n        attendees = attendance_event.attending_attendees_qs\n        serializer = self.get_serializer(attendees, many=True)\n\n        return Response(data=serializer.data, status=status.HTTP_200_OK)\n\n    @action(\n        detail=True,\n        methods=[\"GET\"],\n        permission_classes=(permissions.IsAuthenticated,),\n        serializer_class=PublicAttendeeSerializer,\n        url_path=\"public-on-waitlist\",\n    )\n    def public_on_waitlist(self, request, pk=None):\n        attendance_event: AttendanceEvent = self.get_object()\n        attendees = attendance_event.waitlist_qs\n        serializer = self.get_serializer(attendees, many=True)\n\n        return Response(data=serializer.data, status=status.HTTP_200_OK)\n\n    @action(\n        detail=True,\n        methods=[\"GET\"],\n        permission_classes=(permissions.IsAuthenticated,),\n        serializer_class=AttendeeSerializer,\n    )\n    def attendee(self, request, pk=None):\n        user = request.user\n        attendance_event: AttendanceEvent = self.get_object()\n        attendee = get_object_or_404(Attendee, event=attendance_event, user=user)\n        serializer = self.get_serializer(attendee)\n        return Response(data=serializer.data, status=status.HTTP_200_OK)\n\n    @action(\n        detail=True,\n        methods=[\"GET\"],\n        permission_classes=(permissions.IsAuthenticated,),\n        serializer_class=ExtrasSerializer,\n    )\n    def extras(self, request, pk=None):\n        attendance_event: AttendanceEvent = self.get_object()\n        serializer = self.get_serializer(attendance_event.extras, many=True)\n        return Response(data=serializer.data, status=status.HTTP_200_OK)\n\n    @action(\n        detail=True,\n        methods=[\"GET\"],\n        permission_classes=(permissions.IsAuthenticated,),\n        serializer_class=PaymentReadOnlySerializer,\n    )\n    def payment(self, request, pk=None):\n        attendance_event: AttendanceEvent = self.get_object()\n        payment = attendance_event.get_payment()\n        if not payment:\n            raise NotFound\n        serializer = self.get_serializer(payment)\n        return Response(data=serializer.data, status=status.HTTP_200_OK)\n\n\nclass AttendeeViewSet(\n    viewsets.GenericViewSet, mixins.ListModelMixin, mixins.RetrieveModelMixin\n):\n    serializer_class = AttendeeSerializer\n    filterset_fields = (\n        \"event\",\n        \"attended\",\n        \"user\",\n        \"show_as_attending_event\",\n        \"allow_pictures\",\n        \"extras\",\n    )\n\n    @staticmethod\n    def _get_allowed_attendees(user):\n        \"\"\"\n        A user is allowed to see attendees for their own user, and for events they are organizing.\n        \"\"\"\n        if user.is_anonymous:\n            return Attendee.objects.none()\n\n        attendees = get_objects_for_user(\n            user, \"events.change_attendee\", accept_global_perms=False\n        )\n        attendees |= Attendee.objects.filter(user=user)\n        return attendees.distinct()\n\n    def get_queryset(self):\n        return self._get_allowed_attendees(self.request.user)\n\n    @action(\n        detail=True,\n        methods=[\"PATCH\", \"PUT\"],\n        permission_classes=(ChangeAttendeePermission,),\n        serializer_class=AttendeeUpdateSerializer,\n    )\n    def change(self, request, pk=None):\n        attendee: Attendee = self.get_object()\n        partial = request.method == \"PATCH\"\n        serializer = self.get_serializer(attendee, data=request.data, partial=partial)\n        serializer.is_valid(raise_exception=True)\n        serializer.save()\n        return Response(data=serializer.data, status=status.HTTP_200_OK)\n\n    @action(\n        detail=True,\n        methods=[\"PATCH\", \"PUT\"],\n        permission_classes=(permissions.DjangoObjectPermissions,),\n        serializer_class=AttendeeAdministrateSerializer,\n    )\n    def administrate(self, request, pk=None):\n        attendee: Attendee = self.get_object()\n        partial = request.method == \"PATCH\"\n        serializer = self.get_serializer(attendee, data=request.data, partial=partial)\n        serializer.is_valid(raise_exception=True)\n        serializer.save()\n        return Response(data=serializer.data, status=status.HTTP_200_OK)\n\n    @action(\n        detail=False,\n        methods=[\"POST\"],\n        serializer_class=RegisterAttendanceSerializer,\n        url_path=\"register-attendance\",\n    )\n    def register_attendance(self, request, pk=None):\n        \"\"\"\n        Register that a user has physically attended an event.\n        \"\"\"\n        serializer = self.get_serializer(data=request.data)\n\n        serializer.is_valid(raise_exception=True)\n\n        attendee = serializer.get_attendee(request.data)\n        attendee.attended = True\n        attendee.save()\n\n        return Response(\n            {\n                \"detail\": {\n                    \"message\": f\"{attendee.user} er registrert som deltaker. Velkommen!\",\n                    \"attend_status\": AttendStatus.REGISTER_SUCCESS,\n                    \"attendee\": attendee.id,\n                }\n            },\n            status=status.HTTP_200_OK,\n        )\n\n\nclass ExtrasViewSet(viewsets.ModelViewSet):\n    serializer_class = ExtrasSerializer\n    queryset = Extras.objects.all()\n    permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)\n    filterset_class = ExtrasFilter\n\n\nclass RuleBundleViewSet(viewsets.ModelViewSet):\n    serializer_class = RuleBundleSerializer\n    queryset = RuleBundle.objects.all()\n    permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)\n    filterset_class = RuleBundleFilter\n\n\nclass FieldOfStudyRuleViewSet(viewsets.ModelViewSet):\n    serializer_class = FieldOfStudyRuleSerializer\n    queryset = FieldOfStudyRule.objects.all()\n    permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)\n    filterset_class = FieldOfStudyRuleFilter\n\n\nclass GradeRuleViewSet(viewsets.ModelViewSet):\n    serializer_class = GradeRuleSerializer\n    queryset = GradeRule.objects.all()\n    permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)\n    filterset_class = GradeRuleFilter\n\n\nclass UserGroupRuleViewSet(viewsets.ModelViewSet):\n    serializer_class = UserGroupRuleSerializer\n    queryset = UserGroupRule.objects.all()\n    permission_classes = (permissions.DjangoModelPermissionsOrAnonReadOnly,)\n    filterset_class = UserGroupRuleFilter\n", "path": "apps/events/api/views.py"}]}