Strange response when uploading attachments for nonexistent dataset

Strange response when uploading attachments for nonexistent dataset

Summary

When uploading an attachment for a dataset that does not exist, the API returns 201 but the attachment does not seem to exist.

Steps to Reproduce

This code uploads an attachment for a dataset with ID bolloks-id that does not exist in the database and attempts to download the attachment which fails by returning []. I tried this both with and without a PID prefix.

import requests
from scitacean import model

token = "..."
params = {"access_token": token}
headers = {"Authorization": f"Bearer {token}"
           "Content-Type": "application/json"}

attachment = model.UploadAttachment(
    caption="an attachment",
    datasetId="bollocks-id",
    ownerGroup="group1",
)

response = requests.request(
    method="post",
    url="http://localhost:3000/api/v3/datasets/bollocks-id/attachments",
    data=attachment.model_dump_json(exclude_none=True),
    params=params,
    headers=headers,
    timeout=1,
    stream=False,
    verify=True,
)
print(response.status_code)
print(f"'{response.text}'")
print('------------')

response = requests.request(
    method="get",
    url="http://localhost:3000/api/v3/datasets/bollocks-id/attachments",
    data=None,
    params=params,
    headers=headers,
    timeout=1,
    stream=False,
    verify=True,
)
print(response.status_code)
print(f"'{response.text}'")
print('------------')

Output:

201
''
------------
200
'[]'
------------

Current Behaviour

See above

Expected Behaviour

SciCat should return an error explaining that the dataset does not exist. Or, if this is a security problem, say that no dataset with this id is visible.

Start by reproducing the POST to /api/v3/datasets/{id}/attachments with a nonexistent dataset ID, then inspect the attachment-upload endpoint handling for its dataset lookup. Confirm the response for an unknown dataset and verify that no attachment is created; the expected result is an explanatory error or an explicitly non-visible dataset response.