We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Session allowed to be created without an associated Track
**Describe the bug**
<!-- A clear and concise description of what the bug is. -->
Sessions can be created without being associated with a Track 

**Expected behavior**
<!-- A clear and concise description of what you expected to happen. -->
It shouldn't be possible

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `app/api/sessions.py`
Content:
```
1 from flask_rest_jsonapi import ResourceDetail, ResourceList, ResourceRelationship
2 
3 from app.api.bootstrap import api
4 from app.api.events import Event
5 from app.api.helpers.db import safe_query, get_count
6 from app.api.helpers.exceptions import ForbiddenException
7 from app.api.helpers.mail import send_email_new_session, send_email_session_accept_reject
8 from app.api.helpers.notification import send_notif_new_session_organizer, send_notif_session_accept_reject
9 from app.api.helpers.permissions import current_identity
10 from app.api.helpers.query import event_query
11 from app.api.helpers.utilities import require_relationship
12 from app.api.schema.sessions import SessionSchema
13 from app.models import db
14 from app.models.microlocation import Microlocation
15 from app.models.session import Session
16 from app.models.session_type import SessionType
17 from app.models.speaker import Speaker
18 from app.models.track import Track
19 from app.models.user import User
20 from app.settings import get_settings
21 
22 
23 class SessionListPost(ResourceList):
24     """
25     List Sessions
26     """
27     def before_post(self, args, kwargs, data):
28         """
29         before post method to check for required relationship and proper permission
30         :param args:
31         :param kwargs:
32         :param data:
33         :return:
34         """
35         require_relationship(['event'], data)
36         data['creator_id'] = current_identity.id
37         if get_count(db.session.query(Event).filter_by(id=int(data['event']), is_sessions_speakers_enabled=False)) > 0:
38             raise ForbiddenException({'pointer': ''}, "Sessions are disabled for this Event")
39 
40     def after_create_object(self, session, data, view_kwargs):
41         """
42         method to send email for creation of new session
43         mails session link to the concerned user
44         :param session:
45         :param data:
46         :param view_kwargs:
47         :return:
48         """
49         if session.event.get_organizer():
50             event_name = session.event.name
51             organizer = session.event.get_organizer()
52             organizer_email = organizer.email
53             frontend_url = get_settings()['frontend_url']
54             link = "{}/events/{}/sessions/{}"\
55                 .format(frontend_url, session.event_id, session.id)
56             send_email_new_session(organizer_email, event_name, link)
57             send_notif_new_session_organizer(organizer, event_name, link)
58 
59     decorators = (api.has_permission('create_event'),)
60     schema = SessionSchema
61     data_layer = {'session': db.session,
62                   'model': Session,
63                   'methods': {'after_create_object': after_create_object
64                               }}
65 
66 
67 class SessionList(ResourceList):
68     """
69     List Sessions
70     """
71 
72     def query(self, view_kwargs):
73         """
74         query method for SessionList class
75         :param view_kwargs:
76         :return:
77         """
78         query_ = self.session.query(Session)
79         if view_kwargs.get('track_id') is not None:
80             track = safe_query(self, Track, 'id', view_kwargs['track_id'], 'track_id')
81             query_ = query_.join(Track).filter(Track.id == track.id)
82         if view_kwargs.get('session_type_id') is not None:
83             session_type = safe_query(self, SessionType, 'id', view_kwargs['session_type_id'], 'session_type_id')
84             query_ = query_.join(SessionType).filter(SessionType.id == session_type.id)
85         if view_kwargs.get('microlocation_id') is not None:
86             microlocation = safe_query(self, Microlocation, 'id', view_kwargs['microlocation_id'], 'microlocation_id')
87             query_ = query_.join(Microlocation).filter(Microlocation.id == microlocation.id)
88         if view_kwargs.get('user_id') is not None:
89             user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')
90             query_ = query_.join(User).filter(User.id == user.id)
91         query_ = event_query(self, query_, view_kwargs)
92         if view_kwargs.get('speaker_id'):
93             speaker = safe_query(self, Speaker, 'id', view_kwargs['speaker_id'], 'speaker_id')
94             # session-speaker :: many-to-many relationship
95             query_ = Session.query.filter(Session.speakers.any(id=speaker.id))
96 
97         return query_
98 
99     view_kwargs = True
100     methods = ['GET']
101     schema = SessionSchema
102     data_layer = {'session': db.session,
103                   'model': Session,
104                   'methods': {
105                       'query': query
106                   }}
107 
108 
109 class SessionDetail(ResourceDetail):
110     """
111     Session detail by id
112     """
113     def before_get_object(self, view_kwargs):
114         """
115         before get method to get the resource id for fetching details
116         :param view_kwargs:
117         :return:
118         """
119         if view_kwargs.get('event_identifier'):
120             event = safe_query(self, Event, 'identifier', view_kwargs['event_identifier'], 'identifier')
121             view_kwargs['event_id'] = event.id
122 
123     def after_update_object(self, session, data, view_kwargs):
124         """ Send email if session accepted or rejected """
125 
126         if 'state' in data and data.get('send_email', None) and (session.state == 'accepted' or
127                                                                  session.state == 'rejected'):
128             # Email for speaker
129             speakers = session.speakers
130             for speaker in speakers:
131                 frontend_url = get_settings()['frontend_url']
132                 link = "{}/events/{}/sessions/{}" \
133                     .format(frontend_url, session.event_id, session.id)
134                 send_email_session_accept_reject(speaker.email, session, link)
135                 send_notif_session_accept_reject(speaker, session.title, session.state, link)
136 
137             # Email for organizer
138             if session.event.get_organizer():
139                 organizer = session.event.get_organizer()
140                 organizer_email = organizer.email
141                 frontend_url = get_settings()['frontend_url']
142                 link = "{}/events/{}/sessions/{}" \
143                     .format(frontend_url, session.event_id, session.id)
144                 send_email_session_accept_reject(organizer_email, session,
145                                                  link)
146                 send_notif_session_accept_reject(organizer, session.title,
147                                                  session.state, link)
148 
149     decorators = (api.has_permission('is_speaker_for_session', methods="PATCH,DELETE"),)
150     schema = SessionSchema
151     data_layer = {'session': db.session,
152                   'model': Session,
153                   'methods': {'before_get_object': before_get_object,
154                               'after_update_object': after_update_object}}
155 
156 
157 class SessionRelationshipRequired(ResourceRelationship):
158     """
159     Session Relationship
160     """
161     schema = SessionSchema
162     decorators = (api.has_permission('is_speaker_for_session', methods="PATCH,DELETE"),)
163     methods = ['GET', 'PATCH']
164     data_layer = {'session': db.session,
165                   'model': Session}
166 
167 
168 class SessionRelationshipOptional(ResourceRelationship):
169     """
170     Session Relationship
171     """
172     schema = SessionSchema
173     decorators = (api.has_permission('is_speaker_for_session', methods="PATCH,DELETE"),)
174     data_layer = {'session': db.session,
175                   'model': Session}
176
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/app/api/sessions.py b/app/api/sessions.py
--- a/app/api/sessions.py
+++ b/app/api/sessions.py
@@ -32,7 +32,7 @@
         :param data:
         :return:
         """
-        require_relationship(['event'], data)
+        require_relationship(['event', 'track'], data)
         data['creator_id'] = current_identity.id
         if get_count(db.session.query(Event).filter_by(id=int(data['event']), is_sessions_speakers_enabled=False)) > 0:
             raise ForbiddenException({'pointer': ''}, "Sessions are disabled for this Event")

{"golden_diff": "diff --git a/app/api/sessions.py b/app/api/sessions.py\n--- a/app/api/sessions.py\n+++ b/app/api/sessions.py\n@@ -32,7 +32,7 @@\n         :param data:\n         :return:\n         \"\"\"\n-        require_relationship(['event'], data)\n+        require_relationship(['event', 'track'], data)\n         data['creator_id'] = current_identity.id\n         if get_count(db.session.query(Event).filter_by(id=int(data['event']), is_sessions_speakers_enabled=False)) > 0:\n             raise ForbiddenException({'pointer': ''}, \"Sessions are disabled for this Event\")\n", "issue": "Session allowed to be created without an associated Track\n**Describe the bug**\r\n<!-- A clear and concise description of what the bug is. -->\r\nSessions can be created without being associated with a Track \r\n\r\n**Expected behavior**\r\n<!-- A clear and concise description of what you expected to happen. -->\r\nIt shouldn't be possible\n", "before_files": [{"content": "from flask_rest_jsonapi import ResourceDetail, ResourceList, ResourceRelationship\n\nfrom app.api.bootstrap import api\nfrom app.api.events import Event\nfrom app.api.helpers.db import safe_query, get_count\nfrom app.api.helpers.exceptions import ForbiddenException\nfrom app.api.helpers.mail import send_email_new_session, send_email_session_accept_reject\nfrom app.api.helpers.notification import send_notif_new_session_organizer, send_notif_session_accept_reject\nfrom app.api.helpers.permissions import current_identity\nfrom app.api.helpers.query import event_query\nfrom app.api.helpers.utilities import require_relationship\nfrom app.api.schema.sessions import SessionSchema\nfrom app.models import db\nfrom app.models.microlocation import Microlocation\nfrom app.models.session import Session\nfrom app.models.session_type import SessionType\nfrom app.models.speaker import Speaker\nfrom app.models.track import Track\nfrom app.models.user import User\nfrom app.settings import get_settings\n\n\nclass SessionListPost(ResourceList):\n    \"\"\"\n    List Sessions\n    \"\"\"\n    def before_post(self, args, kwargs, data):\n        \"\"\"\n        before post method to check for required relationship and proper permission\n        :param args:\n        :param kwargs:\n        :param data:\n        :return:\n        \"\"\"\n        require_relationship(['event'], data)\n        data['creator_id'] = current_identity.id\n        if get_count(db.session.query(Event).filter_by(id=int(data['event']), is_sessions_speakers_enabled=False)) > 0:\n            raise ForbiddenException({'pointer': ''}, \"Sessions are disabled for this Event\")\n\n    def after_create_object(self, session, data, view_kwargs):\n        \"\"\"\n        method to send email for creation of new session\n        mails session link to the concerned user\n        :param session:\n        :param data:\n        :param view_kwargs:\n        :return:\n        \"\"\"\n        if session.event.get_organizer():\n            event_name = session.event.name\n            organizer = session.event.get_organizer()\n            organizer_email = organizer.email\n            frontend_url = get_settings()['frontend_url']\n            link = \"{}/events/{}/sessions/{}\"\\\n                .format(frontend_url, session.event_id, session.id)\n            send_email_new_session(organizer_email, event_name, link)\n            send_notif_new_session_organizer(organizer, event_name, link)\n\n    decorators = (api.has_permission('create_event'),)\n    schema = SessionSchema\n    data_layer = {'session': db.session,\n                  'model': Session,\n                  'methods': {'after_create_object': after_create_object\n                              }}\n\n\nclass SessionList(ResourceList):\n    \"\"\"\n    List Sessions\n    \"\"\"\n\n    def query(self, view_kwargs):\n        \"\"\"\n        query method for SessionList class\n        :param view_kwargs:\n        :return:\n        \"\"\"\n        query_ = self.session.query(Session)\n        if view_kwargs.get('track_id') is not None:\n            track = safe_query(self, Track, 'id', view_kwargs['track_id'], 'track_id')\n            query_ = query_.join(Track).filter(Track.id == track.id)\n        if view_kwargs.get('session_type_id') is not None:\n            session_type = safe_query(self, SessionType, 'id', view_kwargs['session_type_id'], 'session_type_id')\n            query_ = query_.join(SessionType).filter(SessionType.id == session_type.id)\n        if view_kwargs.get('microlocation_id') is not None:\n            microlocation = safe_query(self, Microlocation, 'id', view_kwargs['microlocation_id'], 'microlocation_id')\n            query_ = query_.join(Microlocation).filter(Microlocation.id == microlocation.id)\n        if view_kwargs.get('user_id') is not None:\n            user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')\n            query_ = query_.join(User).filter(User.id == user.id)\n        query_ = event_query(self, query_, view_kwargs)\n        if view_kwargs.get('speaker_id'):\n            speaker = safe_query(self, Speaker, 'id', view_kwargs['speaker_id'], 'speaker_id')\n            # session-speaker :: many-to-many relationship\n            query_ = Session.query.filter(Session.speakers.any(id=speaker.id))\n\n        return query_\n\n    view_kwargs = True\n    methods = ['GET']\n    schema = SessionSchema\n    data_layer = {'session': db.session,\n                  'model': Session,\n                  'methods': {\n                      'query': query\n                  }}\n\n\nclass SessionDetail(ResourceDetail):\n    \"\"\"\n    Session detail by id\n    \"\"\"\n    def before_get_object(self, view_kwargs):\n        \"\"\"\n        before get method to get the resource id for fetching details\n        :param view_kwargs:\n        :return:\n        \"\"\"\n        if view_kwargs.get('event_identifier'):\n            event = safe_query(self, Event, 'identifier', view_kwargs['event_identifier'], 'identifier')\n            view_kwargs['event_id'] = event.id\n\n    def after_update_object(self, session, data, view_kwargs):\n        \"\"\" Send email if session accepted or rejected \"\"\"\n\n        if 'state' in data and data.get('send_email', None) and (session.state == 'accepted' or\n                                                                 session.state == 'rejected'):\n            # Email for speaker\n            speakers = session.speakers\n            for speaker in speakers:\n                frontend_url = get_settings()['frontend_url']\n                link = \"{}/events/{}/sessions/{}\" \\\n                    .format(frontend_url, session.event_id, session.id)\n                send_email_session_accept_reject(speaker.email, session, link)\n                send_notif_session_accept_reject(speaker, session.title, session.state, link)\n\n            # Email for organizer\n            if session.event.get_organizer():\n                organizer = session.event.get_organizer()\n                organizer_email = organizer.email\n                frontend_url = get_settings()['frontend_url']\n                link = \"{}/events/{}/sessions/{}\" \\\n                    .format(frontend_url, session.event_id, session.id)\n                send_email_session_accept_reject(organizer_email, session,\n                                                 link)\n                send_notif_session_accept_reject(organizer, session.title,\n                                                 session.state, link)\n\n    decorators = (api.has_permission('is_speaker_for_session', methods=\"PATCH,DELETE\"),)\n    schema = SessionSchema\n    data_layer = {'session': db.session,\n                  'model': Session,\n                  'methods': {'before_get_object': before_get_object,\n                              'after_update_object': after_update_object}}\n\n\nclass SessionRelationshipRequired(ResourceRelationship):\n    \"\"\"\n    Session Relationship\n    \"\"\"\n    schema = SessionSchema\n    decorators = (api.has_permission('is_speaker_for_session', methods=\"PATCH,DELETE\"),)\n    methods = ['GET', 'PATCH']\n    data_layer = {'session': db.session,\n                  'model': Session}\n\n\nclass SessionRelationshipOptional(ResourceRelationship):\n    \"\"\"\n    Session Relationship\n    \"\"\"\n    schema = SessionSchema\n    decorators = (api.has_permission('is_speaker_for_session', methods=\"PATCH,DELETE\"),)\n    data_layer = {'session': db.session,\n                  'model': Session}\n", "path": "app/api/sessions.py"}], "after_files": [{"content": "from flask_rest_jsonapi import ResourceDetail, ResourceList, ResourceRelationship\n\nfrom app.api.bootstrap import api\nfrom app.api.events import Event\nfrom app.api.helpers.db import safe_query, get_count\nfrom app.api.helpers.exceptions import ForbiddenException\nfrom app.api.helpers.mail import send_email_new_session, send_email_session_accept_reject\nfrom app.api.helpers.notification import send_notif_new_session_organizer, send_notif_session_accept_reject\nfrom app.api.helpers.permissions import current_identity\nfrom app.api.helpers.query import event_query\nfrom app.api.helpers.utilities import require_relationship\nfrom app.api.schema.sessions import SessionSchema\nfrom app.models import db\nfrom app.models.microlocation import Microlocation\nfrom app.models.session import Session\nfrom app.models.session_type import SessionType\nfrom app.models.speaker import Speaker\nfrom app.models.track import Track\nfrom app.models.user import User\nfrom app.settings import get_settings\n\n\nclass SessionListPost(ResourceList):\n    \"\"\"\n    List Sessions\n    \"\"\"\n    def before_post(self, args, kwargs, data):\n        \"\"\"\n        before post method to check for required relationship and proper permission\n        :param args:\n        :param kwargs:\n        :param data:\n        :return:\n        \"\"\"\n        require_relationship(['event', 'track'], data)\n        data['creator_id'] = current_identity.id\n        if get_count(db.session.query(Event).filter_by(id=int(data['event']), is_sessions_speakers_enabled=False)) > 0:\n            raise ForbiddenException({'pointer': ''}, \"Sessions are disabled for this Event\")\n\n    def after_create_object(self, session, data, view_kwargs):\n        \"\"\"\n        method to send email for creation of new session\n        mails session link to the concerned user\n        :param session:\n        :param data:\n        :param view_kwargs:\n        :return:\n        \"\"\"\n        if session.event.get_organizer():\n            event_name = session.event.name\n            organizer = session.event.get_organizer()\n            organizer_email = organizer.email\n            frontend_url = get_settings()['frontend_url']\n            link = \"{}/events/{}/sessions/{}\"\\\n                .format(frontend_url, session.event_id, session.id)\n            send_email_new_session(organizer_email, event_name, link)\n            send_notif_new_session_organizer(organizer, event_name, link)\n\n    decorators = (api.has_permission('create_event'),)\n    schema = SessionSchema\n    data_layer = {'session': db.session,\n                  'model': Session,\n                  'methods': {'after_create_object': after_create_object\n                              }}\n\n\nclass SessionList(ResourceList):\n    \"\"\"\n    List Sessions\n    \"\"\"\n\n    def query(self, view_kwargs):\n        \"\"\"\n        query method for SessionList class\n        :param view_kwargs:\n        :return:\n        \"\"\"\n        query_ = self.session.query(Session)\n        if view_kwargs.get('track_id') is not None:\n            track = safe_query(self, Track, 'id', view_kwargs['track_id'], 'track_id')\n            query_ = query_.join(Track).filter(Track.id == track.id)\n        if view_kwargs.get('session_type_id') is not None:\n            session_type = safe_query(self, SessionType, 'id', view_kwargs['session_type_id'], 'session_type_id')\n            query_ = query_.join(SessionType).filter(SessionType.id == session_type.id)\n        if view_kwargs.get('microlocation_id') is not None:\n            microlocation = safe_query(self, Microlocation, 'id', view_kwargs['microlocation_id'], 'microlocation_id')\n            query_ = query_.join(Microlocation).filter(Microlocation.id == microlocation.id)\n        if view_kwargs.get('user_id') is not None:\n            user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')\n            query_ = query_.join(User).filter(User.id == user.id)\n        query_ = event_query(self, query_, view_kwargs)\n        if view_kwargs.get('speaker_id'):\n            speaker = safe_query(self, Speaker, 'id', view_kwargs['speaker_id'], 'speaker_id')\n            # session-speaker :: many-to-many relationship\n            query_ = Session.query.filter(Session.speakers.any(id=speaker.id))\n\n        return query_\n\n    view_kwargs = True\n    methods = ['GET']\n    schema = SessionSchema\n    data_layer = {'session': db.session,\n                  'model': Session,\n                  'methods': {\n                      'query': query\n                  }}\n\n\nclass SessionDetail(ResourceDetail):\n    \"\"\"\n    Session detail by id\n    \"\"\"\n    def before_get_object(self, view_kwargs):\n        \"\"\"\n        before get method to get the resource id for fetching details\n        :param view_kwargs:\n        :return:\n        \"\"\"\n        if view_kwargs.get('event_identifier'):\n            event = safe_query(self, Event, 'identifier', view_kwargs['event_identifier'], 'identifier')\n            view_kwargs['event_id'] = event.id\n\n    def after_update_object(self, session, data, view_kwargs):\n        \"\"\" Send email if session accepted or rejected \"\"\"\n\n        if 'state' in data and data.get('send_email', None) and (session.state == 'accepted' or\n                                                                 session.state == 'rejected'):\n            # Email for speaker\n            speakers = session.speakers\n            for speaker in speakers:\n                frontend_url = get_settings()['frontend_url']\n                link = \"{}/events/{}/sessions/{}\" \\\n                    .format(frontend_url, session.event_id, session.id)\n                send_email_session_accept_reject(speaker.email, session, link)\n                send_notif_session_accept_reject(speaker, session.title, session.state, link)\n\n            # Email for organizer\n            if session.event.get_organizer():\n                organizer = session.event.get_organizer()\n                organizer_email = organizer.email\n                frontend_url = get_settings()['frontend_url']\n                link = \"{}/events/{}/sessions/{}\" \\\n                    .format(frontend_url, session.event_id, session.id)\n                send_email_session_accept_reject(organizer_email, session,\n                                                 link)\n                send_notif_session_accept_reject(organizer, session.title,\n                                                 session.state, link)\n\n    decorators = (api.has_permission('is_speaker_for_session', methods=\"PATCH,DELETE\"),)\n    schema = SessionSchema\n    data_layer = {'session': db.session,\n                  'model': Session,\n                  'methods': {'before_get_object': before_get_object,\n                              'after_update_object': after_update_object}}\n\n\nclass SessionRelationshipRequired(ResourceRelationship):\n    \"\"\"\n    Session Relationship\n    \"\"\"\n    schema = SessionSchema\n    decorators = (api.has_permission('is_speaker_for_session', methods=\"PATCH,DELETE\"),)\n    methods = ['GET', 'PATCH']\n    data_layer = {'session': db.session,\n                  'model': Session}\n\n\nclass SessionRelationshipOptional(ResourceRelationship):\n    \"\"\"\n    Session Relationship\n    \"\"\"\n    schema = SessionSchema\n    decorators = (api.has_permission('is_speaker_for_session', methods=\"PATCH,DELETE\"),)\n    data_layer = {'session': db.session,\n                  'model': Session}\n", "path": "app/api/sessions.py"}]}