search

k-nut / csa-share-management

Small internal tool for managing monthly deposits in a community supported agriculture group
2 stars 3 forks source link

Add validation to API endpoints #30

Closed k-nut closed 2 years ago

k-nut commented 2 years ago

Currently it is possible for API consumers to send requests with missing fields or fields of invalid types which will trigger errors further down in the code. We should add request validation at the API level to ensure that 400 response codes are returned early for invalid payloads.

ticosax commented 2 years ago

I'm putting some suggestion for third party libraries we could adopt.

https://luolingchun.github.io/flask-openapi3/ https://github.com/bauerji/flask-pydantic https://github.com/turner-townsend/flask-pydantic-spec

I don't have a preference yet.

k-nut commented 2 years ago

Cool, thank you for doing the initial research. Since they all use Pydantic for the actual model validation (which I think is probably going to be the biggest part of this) I would guess that the cost of switching libraries later might not be that high.

On first look, I think I prefer the syntax of flask-pydantic but also like that flask-pydantic-spec uses type annotated parameters to the view functions. I don't really have a definite preference either though.

ticosax commented 2 years ago

I intentionally made pydantic a requirement, as this lib is here to stay. Additionally I would look at the resilience of these libraries. few maintainers ? not willing to share the maintainer role ? it's a red flag to me.