certat / do-portal

This project is in maintenance mode and will only receive bug fixes, but no new features. A new version of this software is being developed.
5 stars 5 forks source link

Harmonize and polish ripe/fody api #72

Open ghost opened 5 years ago

ghost commented 5 years ago

For a successful request (https://cp-aec-stg.cert.at/api/1.0/ripe/contact?cidr=83.136.39.0/24), this is the response:

{
  "abusecs": [
    "reports@cert.at"
  ],
  "notification_setting": {
    "cidr": "83.136.39.0/24",
    "delivery_format": "CSV",
    "delivery_protocol": "Mail",
    "notification_interval": 604800,
    "organization_id": null,
    "ripe_org_hdl": null
  }
}

Errors (https://cp-aec-stg.cert.at/api/1.0/ripe/contact?cidr=127.0.0.0/8):

{
  "message": "('no such cidr', '127.0.0.0/8')"
}

https://cp-aec-stg.cert.at/api/1.0/ripe/contact?cidr=127.0.0.asd23/8

{
  "message": "(psycopg2.DataError) invalid input syntax for type inet: \"127.0.0.asd23/8\"\nLINE 9:                       where address = '127.0.0.asd23/8'\n                                              ^\n [SQL: '\\n            select ripe_org_hdl\\n                   from fody.organisation_automatic oa\\n                   join fody.organisation_to_network_automatic o2na\\n                     on oa.organisation_automatic_id =\\n                        o2na.organisation_automatic_id\\n                   join fody.network_automatic na\\n                     on o2na.network_automatic_id = na.network_automatic_id\\n                      where address = %(b_address)s\\n            '] [parameters: {'b_address': '127.0.0.asd23/8'}]"
}

And failed authentication:

{
  "message": "Unauthorized", 
  "status": "unauthorized"
}

So status only exists in one case, and it is hard to detect the problem (temporary vs permanent, user error (wrong url) vs resource not found) from the message. IMO it should be present in all cases. Further, I think it is bad to send the full error message to the client, exposing internals.

MarkHofstetter commented 5 years ago

the same issue(s) apply to all api calls, as no JSON "schema" whatsoever is used, a decision has to be made for url + json structure