Infleqtion / client-superstaq

https://superstaq.readthedocs.io
Apache License 2.0
84 stars 19 forks source link

Missing user validation in General Superstaq Service when updating user balance or role #977

Closed cdbf1 closed 2 months ago

cdbf1 commented 2 months ago

What is happening?

In the two methods:

general-superstaq.service.Service,update_user_balance()
general-superstaq.service.Service,update_user_role()

a request is made to update some property of a given user. However, no check is made (either here or in the _SuperstaqClient object) that the email address provided is a known user. This leads to an internal server error (status 500) on the server side if a bad user email address is entered.

For example:

import qiskit_superstaq as qss
provider = qss.SuperstaqProvider()
provider.update_user_balance("bad_example_user", 200)    

results in:

SuperstaqServerException: Internal Server Error (Status code: 500)

How can we reproduce the issue?

See above

What should happen?

I suggest two possible "correct" behaviours:

  1. Instead of triggering a sever error, the general-superstaq.service.Service object should verify the email address before submitting the post request to the server.
  2. Alternatively (or possibly in addition), the severer should respond with more details about the reason for the failed post request.

Environment

Any additional context?

No response

stephanielee9 commented 2 months ago

Done when server is deployed