search

RedHatInsights / insights-api-common-rails

Header, Encryption, RBAC, Serialization, Pagination and other common behavior for Insights microservices built with Rails
Apache License 2.0
3 stars 25 forks source link

Add check for readOnly parameters in `params_for_create` #135

Closed lindgrenj6 closed 4 years ago

lindgrenj6 commented 4 years ago

https://projects.engineering.redhat.com/browse/SSP-927

Found a bug when investigating this, basically in the params_for_create method before we were just allowing all the fields to come through whether they were readOnly or not. params_for_update did the right thing, but params_for_create was a bit more complicated since the requstBody can come in as a different ref with different fields.

This PR enhances the params_for_create function in the ParameterMixin so that it checks for any readOnly parameters as well as the requestBody schema if passing in :writeable => true when calling params_for_create.

lindgrenj6 commented 4 years ago

cc @syncrou @mkanoor

lindgrenj6 commented 4 years ago

Yeah this probably won't work for those services, it's going to need to be a separate method. writeOnce would really fix everything here - but the closest thing to the spec is writeOnly which is definitely not what we want!

After discussing with @syncrou and @mkanoor, I'm going to move the logic I have here into a separate function or add a parameter to params_for_create to return write-only params so we can use that in catalog.

miq-bot commented 4 years ago

Checked commit https://github.com/lindgrenj6/manageiq-api-common/commit/63f29502344706fe3f4147fe2f52d1fce454f514 with ruby 2.5.5, rubocop 0.69.0, haml-lint 0.20.0, and yamllint 1.10.0 7 files checked, 0 offenses detected Everything looks fine. :cake:

lindgrenj6 commented 4 years ago

@bdunne updated so it won't break sources/topology. This way anyone who wants to have POST requests validate against any read-only parameters this will do it.

miq-bot commented 4 years ago

This pull request is not mergeable. Please rebase and repush.