We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Not allowing attendee POST request
**I'm submitting a ...**
- [x] bug report

**Current behavior:**
Created a new event with new user account. Created a free ticket for the event. for create attendee request the response is:
```
"errors": [
        {
            "status": 403,
            "source": {
                "source": "event_id"
            },
            "detail": "Access Forbidden",
            "title": "Access Forbidden"
        }
    ],
    "jsonapi": {
        "version": "1.0"
    }
}
```

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `app/api/attendees.py`
Content:
```
1 from flask_jwt import current_identity
2 from flask_rest_jsonapi import ResourceDetail, ResourceList, ResourceRelationship
3 
4 from app.api.bootstrap import api
5 from app.api.helpers.db import safe_query
6 from app.api.helpers.exceptions import ForbiddenException, UnprocessableEntity
7 from app.api.helpers.permission_manager import has_access
8 from app.api.helpers.permissions import jwt_required
9 from app.api.helpers.query import event_query
10 from app.api.helpers.utilities import require_relationship
11 from app.api.schema.attendees import AttendeeSchema, AttendeeSchemaPublic
12 from app.models import db
13 from app.models.order import Order
14 from app.models.ticket import Ticket
15 from app.models.ticket_holder import TicketHolder
16 from app.models.user import User
17 
18 
19 class AttendeeListPost(ResourceList):
20     """
21        List and create Attendees through direct URL
22     """
23 
24     def before_post(self, args, kwargs, data):
25         """
26         Before post method to check for required relationship and proper permissions
27         :param args:
28         :param kwargs:
29         :param data:
30         :return:
31         """
32         require_relationship(['ticket', 'event'], data)
33         if not has_access('is_coorganizer', event_id=data['event']):
34             raise ForbiddenException({'source': 'event_id'}, "Access Forbidden")
35 
36     methods = ['POST']
37     schema = AttendeeSchema
38     data_layer = {'session': db.session,
39                   'model': TicketHolder}
40 
41 
42 class AttendeeList(ResourceList):
43     """
44     List Attendees
45     """
46     def query(self, view_kwargs):
47         """
48         query method for Attendees List
49         :param view_kwargs:
50         :return:
51         """
52         query_ = self.session.query(TicketHolder)
53 
54         if view_kwargs.get('order_identifier'):
55             order = safe_query(self, Order, 'identifier', view_kwargs['order_identifier'], 'order_identifier')
56             if not has_access('is_registrar', event_id=order.event_id) or not has_access('is_user_itself',
57                                                                                          id=order.user_id):
58                 raise ForbiddenException({'source': ''}, 'Access Forbidden')
59             query_ = query_.join(Order).filter(Order.id == order.id)
60 
61         if view_kwargs.get('ticket_id'):
62             ticket = safe_query(self, Ticket, 'id', view_kwargs['ticket_id'], 'ticket_id')
63             if not has_access('is_registrar', event_id=ticket.event_id):
64                 raise ForbiddenException({'source': ''}, 'Access Forbidden')
65             query_ = query_.join(Ticket).filter(Ticket.id == ticket.id)
66 
67         if view_kwargs.get('user_id'):
68             user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')
69             if not has_access('is_user_itself', id=user.id):
70                 raise ForbiddenException({'source': ''}, 'Access Forbidden')
71             query_ = query_.join(User, User.email == TicketHolder.email).filter(User.id == user.id)
72 
73         query_ = event_query(self, query_, view_kwargs, permission='is_registrar')
74         return query_
75 
76     view_kwargs = True
77     methods = ['GET', ]
78     schema = AttendeeSchema
79     data_layer = {'session': db.session,
80                   'model': TicketHolder,
81                   'methods': {
82                       'query': query
83                   }}
84 
85 
86 class AttendeeDetail(ResourceDetail):
87     """
88     Attendee detail by id
89     """
90     def before_get_object(self, view_kwargs):
91         """
92         before get object method for attendee detail
93         :param view_kwargs:
94         :return:
95         """
96         attendee = safe_query(self, TicketHolder, 'id', view_kwargs['id'], 'attendee_id')
97         if not has_access('is_registrar_or_user_itself', user_id=current_identity.id, event_id=attendee.event_id):
98             raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')
99 
100     def before_delete_object(self, obj, kwargs):
101         """
102         before delete object method for attendee detail
103         :param obj:
104         :param kwargs:
105         :return:
106         """
107         if not has_access('is_registrar', event_id=obj.event_id):
108             raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')
109 
110     def before_update_object(self, obj, data, kwargs):
111         """
112         before update object method for attendee detail
113         :param obj:
114         :param data:
115         :param kwargs:
116         :return:
117         """
118         if not has_access('is_registrar', event_id=obj.event_id):
119             raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')
120 
121         if 'is_checked_in' in data:
122             if data['is_checked_in'] and 'checkin_times' not in data:
123                 raise UnprocessableEntity({'pointer': '/data/attributes/checkin_times'},
124                                           "Check in time missing while trying to check in attendee")
125 
126             if obj.checkin_times and data['checkin_times'] not in obj.checkin_times.split(","):
127                 data['checkin_times'] = '{},{}'.format(obj.checkin_times, data['checkin_times'])
128 
129     decorators = (jwt_required,)
130     schema = AttendeeSchema
131     data_layer = {'session': db.session,
132                   'model': TicketHolder,
133                   'methods': {
134                       'before_get_object': before_get_object,
135                       'before_update_object': before_update_object,
136                       'before_delete_object': before_delete_object
137                   }}
138 
139 
140 class AttendeeRelationshipRequired(ResourceRelationship):
141     """
142     Attendee Relationship (Required)
143     """
144     decorators = (jwt_required,)
145     methods = ['GET', 'PATCH']
146     schema = AttendeeSchema
147     data_layer = {'session': db.session,
148                   'model': TicketHolder}
149 
150 
151 class AttendeeRelationshipOptional(ResourceRelationship):
152     """
153     Attendee Relationship(Optional)
154     """
155     decorators = (api.has_permission('is_user_itself', fetch="user_id", fetch_as="id", model=TicketHolder),)
156     schema = AttendeeSchema
157     data_layer = {'session': db.session,
158                   'model': TicketHolder}
159
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/app/api/attendees.py b/app/api/attendees.py
--- a/app/api/attendees.py
+++ b/app/api/attendees.py
@@ -30,9 +30,8 @@
         :return:
         """
         require_relationship(['ticket', 'event'], data)
-        if not has_access('is_coorganizer', event_id=data['event']):
-            raise ForbiddenException({'source': 'event_id'}, "Access Forbidden")
 
+    decorators = (jwt_required,)
     methods = ['POST']
     schema = AttendeeSchema
     data_layer = {'session': db.session,

{"golden_diff": "diff --git a/app/api/attendees.py b/app/api/attendees.py\n--- a/app/api/attendees.py\n+++ b/app/api/attendees.py\n@@ -30,9 +30,8 @@\n         :return:\n         \"\"\"\n         require_relationship(['ticket', 'event'], data)\n-        if not has_access('is_coorganizer', event_id=data['event']):\n-            raise ForbiddenException({'source': 'event_id'}, \"Access Forbidden\")\n \n+    decorators = (jwt_required,)\n     methods = ['POST']\n     schema = AttendeeSchema\n     data_layer = {'session': db.session,\n", "issue": "Not allowing attendee POST request\n**I'm submitting a ...**\r\n- [x] bug report\r\n\r\n**Current behavior:**\r\nCreated a new event with new user account. Created a free ticket for the event. for create attendee request the response is:\r\n```\r\n\"errors\": [\r\n        {\r\n            \"status\": 403,\r\n            \"source\": {\r\n                \"source\": \"event_id\"\r\n            },\r\n            \"detail\": \"Access Forbidden\",\r\n            \"title\": \"Access Forbidden\"\r\n        }\r\n    ],\r\n    \"jsonapi\": {\r\n        \"version\": \"1.0\"\r\n    }\r\n}\r\n```\n", "before_files": [{"content": "from flask_jwt import current_identity\nfrom flask_rest_jsonapi import ResourceDetail, ResourceList, ResourceRelationship\n\nfrom app.api.bootstrap import api\nfrom app.api.helpers.db import safe_query\nfrom app.api.helpers.exceptions import ForbiddenException, UnprocessableEntity\nfrom app.api.helpers.permission_manager import has_access\nfrom app.api.helpers.permissions import jwt_required\nfrom app.api.helpers.query import event_query\nfrom app.api.helpers.utilities import require_relationship\nfrom app.api.schema.attendees import AttendeeSchema, AttendeeSchemaPublic\nfrom app.models import db\nfrom app.models.order import Order\nfrom app.models.ticket import Ticket\nfrom app.models.ticket_holder import TicketHolder\nfrom app.models.user import User\n\n\nclass AttendeeListPost(ResourceList):\n    \"\"\"\n       List and create Attendees through direct URL\n    \"\"\"\n\n    def before_post(self, args, kwargs, data):\n        \"\"\"\n        Before post method to check for required relationship and proper permissions\n        :param args:\n        :param kwargs:\n        :param data:\n        :return:\n        \"\"\"\n        require_relationship(['ticket', 'event'], data)\n        if not has_access('is_coorganizer', event_id=data['event']):\n            raise ForbiddenException({'source': 'event_id'}, \"Access Forbidden\")\n\n    methods = ['POST']\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder}\n\n\nclass AttendeeList(ResourceList):\n    \"\"\"\n    List Attendees\n    \"\"\"\n    def query(self, view_kwargs):\n        \"\"\"\n        query method for Attendees List\n        :param view_kwargs:\n        :return:\n        \"\"\"\n        query_ = self.session.query(TicketHolder)\n\n        if view_kwargs.get('order_identifier'):\n            order = safe_query(self, Order, 'identifier', view_kwargs['order_identifier'], 'order_identifier')\n            if not has_access('is_registrar', event_id=order.event_id) or not has_access('is_user_itself',\n                                                                                         id=order.user_id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            query_ = query_.join(Order).filter(Order.id == order.id)\n\n        if view_kwargs.get('ticket_id'):\n            ticket = safe_query(self, Ticket, 'id', view_kwargs['ticket_id'], 'ticket_id')\n            if not has_access('is_registrar', event_id=ticket.event_id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            query_ = query_.join(Ticket).filter(Ticket.id == ticket.id)\n\n        if view_kwargs.get('user_id'):\n            user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')\n            if not has_access('is_user_itself', id=user.id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            query_ = query_.join(User, User.email == TicketHolder.email).filter(User.id == user.id)\n\n        query_ = event_query(self, query_, view_kwargs, permission='is_registrar')\n        return query_\n\n    view_kwargs = True\n    methods = ['GET', ]\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder,\n                  'methods': {\n                      'query': query\n                  }}\n\n\nclass AttendeeDetail(ResourceDetail):\n    \"\"\"\n    Attendee detail by id\n    \"\"\"\n    def before_get_object(self, view_kwargs):\n        \"\"\"\n        before get object method for attendee detail\n        :param view_kwargs:\n        :return:\n        \"\"\"\n        attendee = safe_query(self, TicketHolder, 'id', view_kwargs['id'], 'attendee_id')\n        if not has_access('is_registrar_or_user_itself', user_id=current_identity.id, event_id=attendee.event_id):\n            raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')\n\n    def before_delete_object(self, obj, kwargs):\n        \"\"\"\n        before delete object method for attendee detail\n        :param obj:\n        :param kwargs:\n        :return:\n        \"\"\"\n        if not has_access('is_registrar', event_id=obj.event_id):\n            raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')\n\n    def before_update_object(self, obj, data, kwargs):\n        \"\"\"\n        before update object method for attendee detail\n        :param obj:\n        :param data:\n        :param kwargs:\n        :return:\n        \"\"\"\n        if not has_access('is_registrar', event_id=obj.event_id):\n            raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')\n\n        if 'is_checked_in' in data:\n            if data['is_checked_in'] and 'checkin_times' not in data:\n                raise UnprocessableEntity({'pointer': '/data/attributes/checkin_times'},\n                                          \"Check in time missing while trying to check in attendee\")\n\n            if obj.checkin_times and data['checkin_times'] not in obj.checkin_times.split(\",\"):\n                data['checkin_times'] = '{},{}'.format(obj.checkin_times, data['checkin_times'])\n\n    decorators = (jwt_required,)\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder,\n                  'methods': {\n                      'before_get_object': before_get_object,\n                      'before_update_object': before_update_object,\n                      'before_delete_object': before_delete_object\n                  }}\n\n\nclass AttendeeRelationshipRequired(ResourceRelationship):\n    \"\"\"\n    Attendee Relationship (Required)\n    \"\"\"\n    decorators = (jwt_required,)\n    methods = ['GET', 'PATCH']\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder}\n\n\nclass AttendeeRelationshipOptional(ResourceRelationship):\n    \"\"\"\n    Attendee Relationship(Optional)\n    \"\"\"\n    decorators = (api.has_permission('is_user_itself', fetch=\"user_id\", fetch_as=\"id\", model=TicketHolder),)\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder}\n", "path": "app/api/attendees.py"}], "after_files": [{"content": "from flask_jwt import current_identity\nfrom flask_rest_jsonapi import ResourceDetail, ResourceList, ResourceRelationship\n\nfrom app.api.bootstrap import api\nfrom app.api.helpers.db import safe_query\nfrom app.api.helpers.exceptions import ForbiddenException, UnprocessableEntity\nfrom app.api.helpers.permission_manager import has_access\nfrom app.api.helpers.permissions import jwt_required\nfrom app.api.helpers.query import event_query\nfrom app.api.helpers.utilities import require_relationship\nfrom app.api.schema.attendees import AttendeeSchema, AttendeeSchemaPublic\nfrom app.models import db\nfrom app.models.order import Order\nfrom app.models.ticket import Ticket\nfrom app.models.ticket_holder import TicketHolder\nfrom app.models.user import User\n\n\nclass AttendeeListPost(ResourceList):\n    \"\"\"\n       List and create Attendees through direct URL\n    \"\"\"\n\n    def before_post(self, args, kwargs, data):\n        \"\"\"\n        Before post method to check for required relationship and proper permissions\n        :param args:\n        :param kwargs:\n        :param data:\n        :return:\n        \"\"\"\n        require_relationship(['ticket', 'event'], data)\n\n    decorators = (jwt_required,)\n    methods = ['POST']\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder}\n\n\nclass AttendeeList(ResourceList):\n    \"\"\"\n    List Attendees\n    \"\"\"\n    def query(self, view_kwargs):\n        \"\"\"\n        query method for Attendees List\n        :param view_kwargs:\n        :return:\n        \"\"\"\n        query_ = self.session.query(TicketHolder)\n\n        if view_kwargs.get('order_identifier'):\n            order = safe_query(self, Order, 'identifier', view_kwargs['order_identifier'], 'order_identifier')\n            if not has_access('is_registrar', event_id=order.event_id) or not has_access('is_user_itself',\n                                                                                         id=order.user_id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            query_ = query_.join(Order).filter(Order.id == order.id)\n\n        if view_kwargs.get('ticket_id'):\n            ticket = safe_query(self, Ticket, 'id', view_kwargs['ticket_id'], 'ticket_id')\n            if not has_access('is_registrar', event_id=ticket.event_id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            query_ = query_.join(Ticket).filter(Ticket.id == ticket.id)\n\n        if view_kwargs.get('user_id'):\n            user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')\n            if not has_access('is_user_itself', id=user.id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            query_ = query_.join(User, User.email == TicketHolder.email).filter(User.id == user.id)\n\n        query_ = event_query(self, query_, view_kwargs, permission='is_registrar')\n        return query_\n\n    view_kwargs = True\n    methods = ['GET', ]\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder,\n                  'methods': {\n                      'query': query\n                  }}\n\n\nclass AttendeeDetail(ResourceDetail):\n    \"\"\"\n    Attendee detail by id\n    \"\"\"\n    def before_get_object(self, view_kwargs):\n        \"\"\"\n        before get object method for attendee detail\n        :param view_kwargs:\n        :return:\n        \"\"\"\n        attendee = safe_query(self, TicketHolder, 'id', view_kwargs['id'], 'attendee_id')\n        if not has_access('is_registrar_or_user_itself', user_id=current_identity.id, event_id=attendee.event_id):\n            raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')\n\n    def before_delete_object(self, obj, kwargs):\n        \"\"\"\n        before delete object method for attendee detail\n        :param obj:\n        :param kwargs:\n        :return:\n        \"\"\"\n        if not has_access('is_registrar', event_id=obj.event_id):\n            raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')\n\n    def before_update_object(self, obj, data, kwargs):\n        \"\"\"\n        before update object method for attendee detail\n        :param obj:\n        :param data:\n        :param kwargs:\n        :return:\n        \"\"\"\n        if not has_access('is_registrar', event_id=obj.event_id):\n            raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')\n\n        if 'is_checked_in' in data:\n            if data['is_checked_in'] and 'checkin_times' not in data:\n                raise UnprocessableEntity({'pointer': '/data/attributes/checkin_times'},\n                                          \"Check in time missing while trying to check in attendee\")\n\n            if obj.checkin_times and data['checkin_times'] not in obj.checkin_times.split(\",\"):\n                data['checkin_times'] = '{},{}'.format(obj.checkin_times, data['checkin_times'])\n\n    decorators = (jwt_required,)\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder,\n                  'methods': {\n                      'before_get_object': before_get_object,\n                      'before_update_object': before_update_object,\n                      'before_delete_object': before_delete_object\n                  }}\n\n\nclass AttendeeRelationshipRequired(ResourceRelationship):\n    \"\"\"\n    Attendee Relationship (Required)\n    \"\"\"\n    decorators = (jwt_required,)\n    methods = ['GET', 'PATCH']\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder}\n\n\nclass AttendeeRelationshipOptional(ResourceRelationship):\n    \"\"\"\n    Attendee Relationship(Optional)\n    \"\"\"\n    decorators = (api.has_permission('is_user_itself', fetch=\"user_id\", fetch_as=\"id\", model=TicketHolder),)\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder}\n", "path": "app/api/attendees.py"}]}