bcgov / bcgov/entity

Namex API shows Errors in the Logs - create endpoint

Open
#34,717 0 comments 0 reactions 0 assignees View on GitHub
Names Team techdebt
Dominant language
JavaScript
Stars
23
Forks
62
Avg merge
24m
Merged PRs (30d)
1

Description

From log August 27th

2026-08-27 05:38:16.337 PDT POST 500 204 B 21 ms
**https://namex-api-prod-698952081000.northamerica-northeast1.run.app/api/v1/payments/2892538/CREATE**

Error Traceback (most recent call last):
File "/usr/local/lib/python3.12/site-packages/flask_jwt_oidc/jwt_manager.py", line 327, in _validate_token
payload = jwt.decode(
^^^^^^^^^^^
File "/usr/local/lib/python3.12/site-packages/jwt/api_jwt.py", line 222, in decode
decoded = self.decode_complete(
^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/site-packages/jwt/api_jwt.py", line 167, in decode_complete
self._validate_claims(
File "/usr/local/lib/python3.12/site-packages/jwt/api_jwt.py", line 262, in _validate_claims
self._validate_exp(payload, now, leeway)
File "/usr/local/lib/python3.12/site-packages/jwt/api_jwt.py", line 363, in _validate_exp
raise ExpiredSignatureError("Signature has expired")
jwt.exceptions.ExpiredSignatureError: Signature has expired

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "/code/namex/resources/payment/payment.py", line 435, in post
is_staff = self._is_staff(auth_header)
^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/code/namex/resources/payment/payment.py", line 340, in _is_staff
return auth_header and validate_roles(jwt, auth_header, [User.STAFF])
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/code/namex/utils/auth.py", line 127, in validate_roles
_jwt._validate_token(token)
File "/usr/local/lib/python3.12/site-packages/flask_jwt_oidc/jwt_manager.py", line 337, in _validate_token
raise AuthError({'code': 'token_expired',

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading namex/resources/payment/payment.py around post and _is_staff, then follow validate_roles in namex/utils/auth.py and the logged flask_jwt_oidc validation path. Reproduce or trace the CREATE request with an expired token and clarify the intended error handling; done should be demonstrated by a focused test and clean expected logging for this case.

Written by the indexing model from the issue text.

Assessment

Tech stack
flask, python
Domain
api, authentication, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.