adorsys / adorsys/status-list-server

Reject or no-op empty PATCH requests and validate duplicate indices

未關閉
#483 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
bug rust
主要語言
Rust
星號
22
分支
5
平均合併
2 天 6 小時
30 天內合併 PR
47

描述

## Objective

Prevent empty PATCH requests (`{"statuses": []}`) from incrementing status list versions and inserting duplicate snapshots into history, and reject duplicate indices within a single update payload.

## Context

1. **Empty PATCH redundant writes:** Sending `PATCH /api/v1/status-lists/{list_id}` with `{"statuses": []}` executes a database transaction, advances `updated_at`, increments the version number, and inserts a duplicate snapshot into `status_list_history`. This causes unnecessary database load and bloats history retention tables.
2. **Duplicate index handling:** If an update payload contains duplicate indices (e.g. `[{"index": 0, "status": 0}, {"index": 0, "status": 1}]`), `apply_updates` currently loops through entries sequentially and silently allows the last entry to overwrite earlier ones without validation.

## Deliverables

- [ ] In `src/domain/service.rs` / `update_status.rs`, validate that `statuses` contains at least one update entry; reject empty update requests with `400 Bad Request` ("at least one status update required") or treat as an idempotent no-op without database write.
- [ ] In `src/domain/models/status_list.rs`, validate that all indices in `status_updates` are unique. Reject payloads with duplicate indices with `400 Bad Request`.
- [ ] Add unit and integration tests verifying both checks.

## Acceptance Criteria

- [ ] Empty PATCH requests do not advance the list version or write redundant history rows.
- [ ] Update payloads with duplicate indices are rejected with 400 Bad Request.

## References

- `src/domain/service.rs`
- `src/domain/models/status_list.rs` (lines 239–250)
- Arc review: `arc-review/finalReview/application-functional-bugs/README.md` (PoC 5)

貢獻指南

開啟貢獻指南

研究方向

Read `src/domain/service.rs` (`update_status.rs`) first to trace `PATCH /api/v1/status-lists/{list_id}` and where version/history writes happen. Then inspect `src/domain/models/status_list.rs` near lines 239-250 for `status_updates` validation. Implement/confirm checks so empty `statuses` and duplicate indices return `400`, then run unit tests for status-list validation and integration tests for the PATCH endpoint to verify no version/history write on empty input and rejection of duplicate indices.

由索引模型根據 Issue 內容生成。

評估

技術堆疊
rust
領域
api
Issue 類型
缺陷
難度
3/5
預估耗時
半天
活躍度
活躍
描述清晰度
基本清楚
新手友好度
72/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。