influxdata / influxdata/openapi

In /stacks inconsistent 'kind' value between GET and PATCH methods

Open
#329 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
18
Forks
9
PR merge metrics
No merged PRs in 30d

Description

While working on Grace tests for stacks, I noticed that the `resources` defined for the GET method include a `kind` string property that is limited to an enumeration of acceptable strings. However in the PATCH method the `aditionalResources` property of `kind` is simply a string with no enumeration constraints. So it is possible to add a resource of type 'FOO' or a resource of type "NotificatoinEndpiont" (typos in enumerated type).

__Investigating with jq__

Stacks GET enforces an enumeration of TemplateKind

```bash
$ jq '.paths."/stacks".get.responses."200".content."application/json".schema.properties.stacks.items' cloud.json
{
"$ref": "#/components/schemas/Stack"
}

$ jq '.components.schemas.Stack.properties.events.items.properties.resources.items.properties.kind' cloud.json
{
"$ref": "#/components/schemas/TemplateKind"
}

$ jq '.components.schemas.TemplateKind' cloud.json
{
"type": "string",
"enum": [
"Bucket",
"Check",
"CheckDeadman",
"CheckThreshold",
"Dashboard",
"Label",
"NotificationEndpoint",
"NotificationEndpointHTTP",
"NotificationEndpointPagerDuty",
"NotificationEndpointSlack",
"NotificationRule",
"Task",
"Telegraf",
"Variable"
]
}
```
Stacks PATCH however does not have an enum and allows any string value

```bash
$ jq '.paths."/stacks/{stack_id}".patch.requestBody.content."application/json".schema.properties.additionalResources.items.properties.kind' cloud.json
{
"type": "string"
}
```

So the following is possible after PATCH, with no error thrown

```json
"resources": [
...
{
"apiVersion": "influxdata.com/v2alpha1",
"resourceID": "0969493978387000",
"kind": "Label",
"templateMetaName": "unbridled-bardeen-b87002",
"associations": [],
"links": {
"self": "/api/v2/labels/0969493978387000"
}
},
{
"apiVersion": "influxdata.com/v2alpha1",
"resourceID": "62e6b3f530226648",
"kind": "FOO",
"templateMetaName": "exciting-carver-b87000",
"associations": [],
"links": {
"self": "/api/v2/62e6b3f530226648"
}
}
],
```

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the OpenAPI schema shown in cloud.json and inspect the GET and PATCH paths for /stacks and /stacks/{stack_id}. Compare the resources.kind and additionalResources.kind definitions with TemplateKind. Done means PATCH rejects values outside the same allowed kind values as GET, with the relevant schema validation checked.

Written by the indexing model from the issue text.

Assessment

Tech stack
openapi
Domain
api
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.