Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: stricter validation of POST json body passed to the textile API. #760

Merged
merged 11 commits into from
Sep 19, 2024
Merged

fix: stricter validation of POST json body passed to the textile API. #760

merged 11 commits into from
Sep 19, 2024

Conversation

n1k0
Copy link
Member

@n1k0 n1k0 commented Sep 18, 2024 •
edited
Loading

Funnily enough, while we were thinking there wasn't any validation applied to some input POST parameters in the API, it was in fact our unit test env which was unable to execute these tests, because it didn't have access to the native JSON body to execute the correct assertions. Validation was working in e2e tests just fine… I should probably have spotted that earlier.

Edit: There actually wasn't any validation performed on some optional parameters passed as a JSON body to POST requests, because we were using the infamous Json.Decode.maybe decoder which fallbacks to returning Nothing instead of a failure in case the decoded value is invalid. This patch leverages Json.Decode.Extra.optionalField instead:

If a field is missing, succeed with Nothing. If it is present, decode it as normal and wrap successes in a Just.

When decoding with maybe, if a field is present but malformed, you get a success and Nothing. optionalField gives you a failed decoding in that case, so you know you received malformed data.

@n1k0 n1k0 force-pushed the fix/api-post-validation2 branch 2 times, most recently from d767b70 to 7c6ce42 Compare September 19, 2024 05:27
@n1k0 n1k0 requested a review from vjousse September 19, 2024 10:46
@n1k0
Copy link
Member Author

n1k0 commented Sep 19, 2024

@vjousse I'd like a first preliminary look over this patch and know what you think :)

vjousse
vjousse reviewed Sep 19, 2024
View reviewed changes
tests/server.spec.js Outdated Show resolved Hide resolved
@vjousse vjousse self-requested a review September 19, 2024 15:17
vjousse
vjousse approved these changes Sep 19, 2024
View reviewed changes
Copy link
Collaborator

@vjousse vjousse left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice work and good catch for the Maybe decoding! Tested locally and it works as expected.

@n1k0 n1k0 changed the title refactor: make POST API request unit-testable. fix: stricter validation of POST json body passed to the textile API. Sep 19, 2024
@n1k0 n1k0 merged commit a85bd8a into master Sep 19, 2024
7 checks passed
@n1k0 n1k0 deleted the fix/api-post-validation2 branch September 19, 2024 15:26
@github-actions github-actions bot mentioned this pull request Sep 19, 2024
Merged
@n1k0 n1k0 mentioned this pull request Sep 20, 2024
Merged
vjousse pushed a commit that referenced this pull request Sep 25, 2024
@github-actions
chore(master): release 2.3.0 (#747)
7992844 
[2.3.0](v2.2.0...v2.3.0)
(2024-09-25)


### Features

* add link to changelog in app footer.
([#748](#748))
([efe88f5](efe88f5))
* airTransportRatio should depend on durability
([#757](#757))
([a0761d1](a0761d1))
* displayName in the textile explorer, reordered columns
([#737](#737))
([65d0ed5](65d0ed5))


### Bug Fixes

* **api:** handle ingredient plane transport in food POST api.
([#769](#769))
([62587e2](62587e2))
* check db integrity after building it
([#753](#753))
([5b41ef6](5b41ef6))
* check uniqueness of JSON db primary keys at build time.
([#766](#766))
([0927954](0927954))
* decode and validate all optionals.
([#764](#764))
([87a7c6a](87a7c6a))
* encode physicalDurability parameter.
([#751](#751))
([f6750b8](f6750b8))
* fix github CI python build setup.
([#762](#762))
([ea2cd9f](ea2cd9f))
* fixed brightway explorer notebook error (wrong key)
([#745](#745))
([bc436c2](bc436c2))
* in brightway explorer: improve display of compartment categories, if
any ([#754](#754))
([757d5a6](757d5a6))
* stricter validation of POST json body passed to the textile API.
([#760](#760))
([a85bd8a](a85bd8a))
* **textile:** distribution step had no inland road transports added.
([#761](#761))
([d789d7d](d789d7d))
* Update export outside of EU probability.
([#765](#765))
([c3fd9f2](c3fd9f2))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
n1k0 added a commit that referenced this pull request Sep 26, 2024
@n1k0
fix: stricter validation of POST json body passed to the textile API. (…
01eda7b 
…#760)

There actually wasn't any strict validation performed on some optional
parameters passed as a JSON body to POST requests, because we were using
the infamous `Json.Decode.maybe` decoder which fallbacks to returning
`Nothing` instead of a failure in case the decoded value is invalid.
n1k0 pushed a commit that referenced this pull request Sep 26, 2024
@github-actions @n1k0
chore(master): release 2.3.0 (#747)
e3f4c53 
[2.3.0](v2.2.0...v2.3.0)
(2024-09-25)


### Features

* add link to changelog in app footer.
([#748](#748))
([efe88f5](efe88f5))
* airTransportRatio should depend on durability
([#757](#757))
([a0761d1](a0761d1))
* displayName in the textile explorer, reordered columns
([#737](#737))
([65d0ed5](65d0ed5))


### Bug Fixes

* **api:** handle ingredient plane transport in food POST api.
([#769](#769))
([62587e2](62587e2))
* check db integrity after building it
([#753](#753))
([5b41ef6](5b41ef6))
* check uniqueness of JSON db primary keys at build time.
([#766](#766))
([0927954](0927954))
* decode and validate all optionals.
([#764](#764))
([87a7c6a](87a7c6a))
* encode physicalDurability parameter.
([#751](#751))
([f6750b8](f6750b8))
* fix github CI python build setup.
([#762](#762))
([ea2cd9f](ea2cd9f))
* fixed brightway explorer notebook error (wrong key)
([#745](#745))
([bc436c2](bc436c2))
* in brightway explorer: improve display of compartment categories, if
any ([#754](#754))
([757d5a6](757d5a6))
* stricter validation of POST json body passed to the textile API.
([#760](#760))
([a85bd8a](a85bd8a))
* **textile:** distribution step had no inland road transports added.
([#761](#761))
([d789d7d](d789d7d))
* Update export outside of EU probability.
([#765](#765))
([c3fd9f2](c3fd9f2))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@vjousse vjousse vjousse approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@n1k0 @vjousse