We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Attendee : user/<id>/attendee gives Error 400
**I'm submitting a ...**  (check one with "x")
- [x] bug report
- [ ] feature request
- [ ] support request => Please do not submit support requests here, instead ask your query in out Gitter channel at https://gitter.im/fossasia/open-event-orga-server

URL
```
https://open-event-api.herokuapp.com/v1/users/5/attendees?include=ticket,event,order
```

ERROR
```
{
   "errors":[
      {
         "title":"Invalid include querystring parameter.",
         "source":{
            "parameter":"include"
         },
         "status":400,
         "detail":"AttendeeSchemaPublic has no attribute ticket"
      }
   ],
   "jsonapi":{
      "version":"1.0"
   }
}
```
Related Front-end route
```
https://open-event-frontend.herokuapp.com/my-tickets
```
Due to recent changes the URL gives ERROR 400.
@poush @shubham-padia @enigmaeth @magdalenesuo Please have a look at it

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `app/api/attendees.py`
Content:
```
1 from flask_jwt import current_identity
2 from flask_rest_jsonapi import ResourceDetail, ResourceList, ResourceRelationship
3 
4 from app.api.bootstrap import api
5 from app.api.helpers.db import safe_query
6 from app.api.helpers.exceptions import ForbiddenException
7 from app.api.helpers.permission_manager import has_access
8 from app.api.helpers.permissions import jwt_required
9 from app.api.helpers.query import event_query
10 from app.api.helpers.utilities import require_relationship
11 from app.api.schema.attendees import AttendeeSchema, AttendeeSchemaPublic
12 from app.models import db
13 from app.models.order import Order
14 from app.models.ticket import Ticket
15 from app.models.ticket_holder import TicketHolder
16 from app.models.user import User
17 
18 
19 class AttendeeListPost(ResourceList):
20     """
21        List and create Attendees through direct URL
22     """
23 
24     def before_post(self, args, kwargs, data):
25         require_relationship(['ticket', 'event'], data)
26         if not has_access('is_coorganizer', event_id=data['event']):
27             raise ForbiddenException({'source': 'event_id'}, "Access Forbidden")
28 
29     methods = ['POST']
30     schema = AttendeeSchema
31     data_layer = {'session': db.session,
32                   'model': TicketHolder}
33 
34 
35 class AttendeeList(ResourceList):
36     """
37     List Attendees
38     """
39     def before_get(self, args, kwargs):
40         if kwargs.get('user_id'):
41             self.schema = AttendeeSchemaPublic
42 
43     def query(self, view_kwargs):
44         query_ = self.session.query(TicketHolder)
45 
46         if view_kwargs.get('order_identifier'):
47             order = safe_query(self, Order, 'identifier', view_kwargs['order_identifier'], 'order_identifier')
48             if not has_access('is_registrar', event_id=order.event_id) or not has_access('is_user_itself',
49                                                                                          id=order.user_id):
50                 raise ForbiddenException({'source': ''}, 'Access Forbidden')
51             query_ = query_.join(Order).filter(Order.id == order.id)
52 
53         if view_kwargs.get('ticket_id'):
54             ticket = safe_query(self, Ticket, 'id', view_kwargs['ticket_id'], 'ticket_id')
55             if not has_access('is_registrar', event_id=ticket.event_id):
56                 raise ForbiddenException({'source': ''}, 'Access Forbidden')
57             query_ = query_.join(Ticket).filter(Ticket.id == ticket.id)
58 
59         if view_kwargs.get('user_id'):
60             user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')
61             if not has_access('is_user_itself', user_id=user.id):
62                 raise ForbiddenException({'source': ''}, 'Access Forbidden')
63             query_ = query_.join(User, User.email == TicketHolder.email).filter(User.id == user.id)
64 
65         query_ = event_query(self, query_, view_kwargs, permission='is_registrar')
66         return query_
67 
68     view_kwargs = True
69     methods = ['GET', ]
70     schema = AttendeeSchema
71     data_layer = {'session': db.session,
72                   'model': TicketHolder,
73                   'methods': {
74                       'query': query
75                   }}
76 
77 
78 class AttendeeDetail(ResourceDetail):
79     """
80     Attendee detail by id
81     """
82     def before_get_object(self, view_kwargs):
83         attendee = safe_query(self, TicketHolder, 'id', view_kwargs['id'], 'attendee_id')
84         if not has_access('is_registrar_or_user_itself', user_id=current_identity.id, event_id=attendee.event_id):
85             raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')
86 
87     def before_delete_object(self, obj, kwargs):
88         if not has_access('is_registrar', event_id=obj.event_id):
89             raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')
90 
91     def before_update_object(self, obj, data, kwargs):
92         if not has_access('is_registrar', event_id=obj.event_id):
93             raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')
94 
95     decorators = (jwt_required,)
96     schema = AttendeeSchema
97     data_layer = {'session': db.session,
98                   'model': TicketHolder,
99                   'methods': {
100                       'before_get_object': before_get_object,
101                       'before_update_object': before_update_object,
102                       'before_delete_object': before_delete_object
103                   }}
104 
105 
106 class AttendeeRelationshipRequired(ResourceRelationship):
107     """
108     Attendee Relationship (Required)
109     """
110     decorators = (jwt_required,)
111     methods = ['GET', 'PATCH']
112     schema = AttendeeSchema
113     data_layer = {'session': db.session,
114                   'model': TicketHolder}
115 
116 
117 class AttendeeRelationshipOptional(ResourceRelationship):
118     """
119     Attendee Relationship(Optional)
120     """
121     decorators = (api.has_permission('is_user_itself', fetch="user_id", fetch_as="id", model=TicketHolder),)
122     schema = AttendeeSchema
123     data_layer = {'session': db.session,
124                   'model': TicketHolder}
125
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/app/api/attendees.py b/app/api/attendees.py
--- a/app/api/attendees.py
+++ b/app/api/attendees.py
@@ -36,10 +36,6 @@
     """
     List Attendees
     """
-    def before_get(self, args, kwargs):
-        if kwargs.get('user_id'):
-            self.schema = AttendeeSchemaPublic
-
     def query(self, view_kwargs):
         query_ = self.session.query(TicketHolder)

{"golden_diff": "diff --git a/app/api/attendees.py b/app/api/attendees.py\n--- a/app/api/attendees.py\n+++ b/app/api/attendees.py\n@@ -36,10 +36,6 @@\n     \"\"\"\n     List Attendees\n     \"\"\"\n-    def before_get(self, args, kwargs):\n-        if kwargs.get('user_id'):\n-            self.schema = AttendeeSchemaPublic\n-\n     def query(self, view_kwargs):\n         query_ = self.session.query(TicketHolder)\n", "issue": "Attendee : user/<id>/attendee gives Error 400\n**I'm submitting a ...**  (check one with \"x\")\r\n- [x] bug report\r\n- [ ] feature request\r\n- [ ] support request => Please do not submit support requests here, instead ask your query in out Gitter channel at https://gitter.im/fossasia/open-event-orga-server\r\n\r\nURL\r\n```\r\nhttps://open-event-api.herokuapp.com/v1/users/5/attendees?include=ticket,event,order\r\n```\r\n\r\nERROR\r\n```\r\n{\r\n   \"errors\":[\r\n      {\r\n         \"title\":\"Invalid include querystring parameter.\",\r\n         \"source\":{\r\n            \"parameter\":\"include\"\r\n         },\r\n         \"status\":400,\r\n         \"detail\":\"AttendeeSchemaPublic has no attribute ticket\"\r\n      }\r\n   ],\r\n   \"jsonapi\":{\r\n      \"version\":\"1.0\"\r\n   }\r\n}\r\n```\r\nRelated Front-end route\r\n```\r\nhttps://open-event-frontend.herokuapp.com/my-tickets\r\n```\r\nDue to recent changes the URL gives ERROR 400.\r\n@poush @shubham-padia @enigmaeth @magdalenesuo Please have a look at it\n", "before_files": [{"content": "from flask_jwt import current_identity\nfrom flask_rest_jsonapi import ResourceDetail, ResourceList, ResourceRelationship\n\nfrom app.api.bootstrap import api\nfrom app.api.helpers.db import safe_query\nfrom app.api.helpers.exceptions import ForbiddenException\nfrom app.api.helpers.permission_manager import has_access\nfrom app.api.helpers.permissions import jwt_required\nfrom app.api.helpers.query import event_query\nfrom app.api.helpers.utilities import require_relationship\nfrom app.api.schema.attendees import AttendeeSchema, AttendeeSchemaPublic\nfrom app.models import db\nfrom app.models.order import Order\nfrom app.models.ticket import Ticket\nfrom app.models.ticket_holder import TicketHolder\nfrom app.models.user import User\n\n\nclass AttendeeListPost(ResourceList):\n    \"\"\"\n       List and create Attendees through direct URL\n    \"\"\"\n\n    def before_post(self, args, kwargs, data):\n        require_relationship(['ticket', 'event'], data)\n        if not has_access('is_coorganizer', event_id=data['event']):\n            raise ForbiddenException({'source': 'event_id'}, \"Access Forbidden\")\n\n    methods = ['POST']\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder}\n\n\nclass AttendeeList(ResourceList):\n    \"\"\"\n    List Attendees\n    \"\"\"\n    def before_get(self, args, kwargs):\n        if kwargs.get('user_id'):\n            self.schema = AttendeeSchemaPublic\n\n    def query(self, view_kwargs):\n        query_ = self.session.query(TicketHolder)\n\n        if view_kwargs.get('order_identifier'):\n            order = safe_query(self, Order, 'identifier', view_kwargs['order_identifier'], 'order_identifier')\n            if not has_access('is_registrar', event_id=order.event_id) or not has_access('is_user_itself',\n                                                                                         id=order.user_id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            query_ = query_.join(Order).filter(Order.id == order.id)\n\n        if view_kwargs.get('ticket_id'):\n            ticket = safe_query(self, Ticket, 'id', view_kwargs['ticket_id'], 'ticket_id')\n            if not has_access('is_registrar', event_id=ticket.event_id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            query_ = query_.join(Ticket).filter(Ticket.id == ticket.id)\n\n        if view_kwargs.get('user_id'):\n            user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')\n            if not has_access('is_user_itself', user_id=user.id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            query_ = query_.join(User, User.email == TicketHolder.email).filter(User.id == user.id)\n\n        query_ = event_query(self, query_, view_kwargs, permission='is_registrar')\n        return query_\n\n    view_kwargs = True\n    methods = ['GET', ]\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder,\n                  'methods': {\n                      'query': query\n                  }}\n\n\nclass AttendeeDetail(ResourceDetail):\n    \"\"\"\n    Attendee detail by id\n    \"\"\"\n    def before_get_object(self, view_kwargs):\n        attendee = safe_query(self, TicketHolder, 'id', view_kwargs['id'], 'attendee_id')\n        if not has_access('is_registrar_or_user_itself', user_id=current_identity.id, event_id=attendee.event_id):\n            raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')\n\n    def before_delete_object(self, obj, kwargs):\n        if not has_access('is_registrar', event_id=obj.event_id):\n            raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')\n\n    def before_update_object(self, obj, data, kwargs):\n        if not has_access('is_registrar', event_id=obj.event_id):\n            raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')\n\n    decorators = (jwt_required,)\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder,\n                  'methods': {\n                      'before_get_object': before_get_object,\n                      'before_update_object': before_update_object,\n                      'before_delete_object': before_delete_object\n                  }}\n\n\nclass AttendeeRelationshipRequired(ResourceRelationship):\n    \"\"\"\n    Attendee Relationship (Required)\n    \"\"\"\n    decorators = (jwt_required,)\n    methods = ['GET', 'PATCH']\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder}\n\n\nclass AttendeeRelationshipOptional(ResourceRelationship):\n    \"\"\"\n    Attendee Relationship(Optional)\n    \"\"\"\n    decorators = (api.has_permission('is_user_itself', fetch=\"user_id\", fetch_as=\"id\", model=TicketHolder),)\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder}\n", "path": "app/api/attendees.py"}], "after_files": [{"content": "from flask_jwt import current_identity\nfrom flask_rest_jsonapi import ResourceDetail, ResourceList, ResourceRelationship\n\nfrom app.api.bootstrap import api\nfrom app.api.helpers.db import safe_query\nfrom app.api.helpers.exceptions import ForbiddenException\nfrom app.api.helpers.permission_manager import has_access\nfrom app.api.helpers.permissions import jwt_required\nfrom app.api.helpers.query import event_query\nfrom app.api.helpers.utilities import require_relationship\nfrom app.api.schema.attendees import AttendeeSchema, AttendeeSchemaPublic\nfrom app.models import db\nfrom app.models.order import Order\nfrom app.models.ticket import Ticket\nfrom app.models.ticket_holder import TicketHolder\nfrom app.models.user import User\n\n\nclass AttendeeListPost(ResourceList):\n    \"\"\"\n       List and create Attendees through direct URL\n    \"\"\"\n\n    def before_post(self, args, kwargs, data):\n        require_relationship(['ticket', 'event'], data)\n        if not has_access('is_coorganizer', event_id=data['event']):\n            raise ForbiddenException({'source': 'event_id'}, \"Access Forbidden\")\n\n    methods = ['POST']\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder}\n\n\nclass AttendeeList(ResourceList):\n    \"\"\"\n    List Attendees\n    \"\"\"\n    def query(self, view_kwargs):\n        query_ = self.session.query(TicketHolder)\n\n        if view_kwargs.get('order_identifier'):\n            order = safe_query(self, Order, 'identifier', view_kwargs['order_identifier'], 'order_identifier')\n            if not has_access('is_registrar', event_id=order.event_id) or not has_access('is_user_itself',\n                                                                                         id=order.user_id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            query_ = query_.join(Order).filter(Order.id == order.id)\n\n        if view_kwargs.get('ticket_id'):\n            ticket = safe_query(self, Ticket, 'id', view_kwargs['ticket_id'], 'ticket_id')\n            if not has_access('is_registrar', event_id=ticket.event_id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            query_ = query_.join(Ticket).filter(Ticket.id == ticket.id)\n\n        if view_kwargs.get('user_id'):\n            user = safe_query(self, User, 'id', view_kwargs['user_id'], 'user_id')\n            if not has_access('is_user_itself', user_id=user.id):\n                raise ForbiddenException({'source': ''}, 'Access Forbidden')\n            query_ = query_.join(User, User.email == TicketHolder.email).filter(User.id == user.id)\n\n        query_ = event_query(self, query_, view_kwargs, permission='is_registrar')\n        return query_\n\n    view_kwargs = True\n    methods = ['GET', ]\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder,\n                  'methods': {\n                      'query': query\n                  }}\n\n\nclass AttendeeDetail(ResourceDetail):\n    \"\"\"\n    Attendee detail by id\n    \"\"\"\n    def before_get_object(self, view_kwargs):\n        attendee = safe_query(self, TicketHolder, 'id', view_kwargs['id'], 'attendee_id')\n        if not has_access('is_registrar_or_user_itself', user_id=current_identity.id, event_id=attendee.event_id):\n            raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')\n\n    def before_delete_object(self, obj, kwargs):\n        if not has_access('is_registrar', event_id=obj.event_id):\n            raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')\n\n    def before_update_object(self, obj, data, kwargs):\n        if not has_access('is_registrar', event_id=obj.event_id):\n            raise ForbiddenException({'source': 'User'}, 'You are not authorized to access this.')\n\n    decorators = (jwt_required,)\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder,\n                  'methods': {\n                      'before_get_object': before_get_object,\n                      'before_update_object': before_update_object,\n                      'before_delete_object': before_delete_object\n                  }}\n\n\nclass AttendeeRelationshipRequired(ResourceRelationship):\n    \"\"\"\n    Attendee Relationship (Required)\n    \"\"\"\n    decorators = (jwt_required,)\n    methods = ['GET', 'PATCH']\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder}\n\n\nclass AttendeeRelationshipOptional(ResourceRelationship):\n    \"\"\"\n    Attendee Relationship(Optional)\n    \"\"\"\n    decorators = (api.has_permission('is_user_itself', fetch=\"user_id\", fetch_as=\"id\", model=TicketHolder),)\n    schema = AttendeeSchema\n    data_layer = {'session': db.session,\n                  'model': TicketHolder}\n", "path": "app/api/attendees.py"}]}