Validation Missing from API Endpoints #1123
Labels
Comments
marrobi
added a commit
that referenced
this issue
Feb 7, 2025
Fixes #1123 Add validation to API endpoints to ensure correct resourceType in template registration payloads. * **Workspace Service Templates**: Add validation in `api_app/api/routes/workspace_service_templates.py` to check if `resourceType` is `WorkspaceService` before registering the template. Return a 422 Unprocessable Entity error if the `resourceType` does not match. * **Workspace Templates**: Add validation in `api_app/api/routes/workspace_templates.py` to check if `resourceType` is `Workspace` before registering the template. Return a 422 Unprocessable Entity error if the `resourceType` does not match. * **User Resource Templates**: Add validation in `api_app/api/routes/user_resource_templates.py` to check if `resourceType` is `UserResource` before registering the template. Return a 422 Unprocessable Entity error if the `resourceType` does not match. * **Shared Service Templates**: Add validation in `api_app/api/routes/shared_service_templates.py` to check if `resourceType` is `SharedService` before registering the template. Return a 422 Unprocessable Entity error if the `resourceType` does not match. * **Common Error Message**: Add a common error message string `INVALID_RESOURCE_TYPE` in `api_app/resources/strings.py` for validation errors, including the expected and received resourceType. * **Tests**: Add tests in `api_app/tests_ma/test_api/test_routes/test_workspace_service_templates.py`, `api_app/tests_ma/test_api/test_routes/test_workspace_templates.py`, `api_app/tests_ma/test_api/test_routes/test_user_resource_templates.py`, and `api_app/tests_ma/test_api/test_routes/test_shared_service_templates.py` to cover validation for each template registration --- For more details, open the [Copilot Workspace session](https://copilot-workspace.githubnext.com/microsoft/AzureTRE/issues/1123?shareId=XXXX-XXXX-XXXX-XXXX).
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
When calling the various POST endpoints it's possible to post a
workspace servicetemplate payload to the registerworkspacetemplate api, and vice versa. Neither call will return an error. Both will register a template that's not useful.In both cases, the payload sent to these APIs has a resourceType property that could have been used to validate the payload.
Validation could be added, and an error could be returned when inappropriate payloads are posted to these APIs.
The text was updated successfully, but these errors were encountered: