Skip to content

Fix 500 path variables empty prod 14970 #1096

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jreynard-code merged 5 commits into from
Nov 27, 2025
Merged

Fix 500 path variables empty prod 14970 #1096

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
9ad6d0a
Add not-blank validation for resource identifiers across services
jreynard-code Nov 20, 2025
b3dfd99
Add integration tests for not-blank validation of run-related identif…
jreynard-code Nov 21, 2025
02cb6e8
Add integration tests for not-blank validation of runner-related iden…
jreynard-code Nov 24, 2025
ec44522
Add integration tests for not-blank validation of solution-related id…
jreynard-code Nov 24, 2025
3f91acf
Add regex validation for resource identifiers and update related inte…
jreynard-code Nov 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 56 additions & 0 deletions api/src/integrationTest/kotlin/com/cosmotech/api/home/dataset/DatasetControllerTests.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@ import kotlin.test.assertEquals
import org.apache.commons.io.IOUtils
import org.hamcrest.Matchers.empty
import org.hamcrest.Matchers.greaterThan
import org.hamcrest.core.StringContains.containsString
import org.json.JSONArray
import org.json.JSONObject
import org.junit.jupiter.api.BeforeEach
Expand Down Expand Up @@ -109,6 +110,61 @@ class DatasetControllerTests : ControllerTestBase() {
mvc, organizationId, constructWorkspaceCreateRequest(solutionId = solutionId))
}

@Test
@WithMockOauth2User
fun get_dataset_part_with_wrong_ids_format() {
mvc.perform(
get(
"/organizations/wrong-orgId/workspaces/wrong-workspaceId/datasets/wrong-datasetId/parts/wrong-datasetPartId")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(jsonPath("$.detail", containsString("wrong-orgId:must match \"^o-\\w{10,20}\"")))
.andExpect(
jsonPath("$.detail", containsString("wrong-workspaceId:must match \"^w-\\w{10,20}\"")))
.andExpect(
jsonPath("$.detail", containsString("wrong-datasetId:must match \"^d-\\w{10,20}\"")))
.andExpect(
jsonPath(
"$.detail", containsString("wrong-datasetPartId:must match \"^dp-\\w{10,20}\"")))

mvc.perform(
get(
"/organizations/wrong-orgId/workspaces/w-123456abcdef/datasets/d-123456azerty/parts/dp-123456azert")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(jsonPath("$.detail", containsString("wrong-orgId:must match \"^o-\\w{10,20}\"")))

mvc.perform(
get(
"/organizations/o-1233456azer/workspaces/wrong-workspaceId/datasets/d-123456azerty/parts/dp-123456azert")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(
jsonPath("$.detail", containsString("wrong-workspaceId:must match \"^w-\\w{10,20}\"")))

mvc.perform(
get(
"/organizations/o-1233456azer/workspaces/w-123456abcdef/datasets/wrong-datasetId/parts/dp-123456azert")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(
jsonPath("$.detail", containsString("wrong-datasetId:must match \"^d-\\w{10,20}\"")))

mvc.perform(
get(
"/organizations/o-1233456azer/workspaces/w-123456abcdef/datasets/d-123456azerty/parts/wrong-datasetPartId")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(
jsonPath(
"$.detail", containsString("wrong-datasetPartId:must match \"^dp-\\w{10,20}\"")))
}

@Test
@WithMockOauth2User
fun create_dataset() {
Expand Down
11 changes: 11 additions & 0 deletions ...integrationTest/kotlin/com/cosmotech/api/home/organization/OrganizationControllerTests.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,17 @@ class OrganizationControllerTests : ControllerTestBase() {
.andDo(MockMvcResultHandlers.print())
}

@Test
@WithMockOauth2User
fun get_organization_with_wrong_orgId_format() {
mvc.perform(
get("/organizations/wrongid-format")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(jsonPath("$.detail").value("wrongid-format:must match \"^o-\\w{10,20}\""))
}

@Test
@WithMockOauth2User
fun create_organization() {
Expand Down
80 changes: 80 additions & 0 deletions api/src/integrationTest/kotlin/com/cosmotech/api/home/run/RunControllerTests.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,7 @@ import io.mockk.impl.annotations.MockK
import io.mockk.mockk
import java.time.Instant
import java.util.*
import org.hamcrest.core.StringContains.containsString
import org.json.JSONObject
import org.junit.jupiter.api.BeforeEach
import org.junit.jupiter.api.Test
Expand Down Expand Up @@ -171,6 +172,85 @@ class RunControllerTests : ControllerTestBase() {
.getString("id")
}

@Test
@WithMockOauth2User
fun get_run_with_wrong_ids_format() {
mvc.perform(
get(
"/organizations/wrong-orgId/workspaces/wrong-workspaceId/runners/wrong-runnerId/runs/wrong-runId")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(jsonPath("$.detail", containsString("wrong-orgId:must match \"^o-\\w{10,20}\"")))
.andExpect(
jsonPath("$.detail", containsString("wrong-workspaceId:must match \"^w-\\w{10,20}\"")))
.andExpect(
jsonPath("$.detail", containsString("wrong-runnerId:must match \"^(r|s)-\\w{10,20}\"")))
.andExpect(
jsonPath("$.detail", containsString("wrong-runId:must match \"^(run|sr)-\\w{10,20}\"")))

mvc.perform(
get(
"/organizations/wrong-orgId/workspaces/w-123456abcdef/runners/r-123456azerty/runs/run-123456azerty")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(jsonPath("$.detail", containsString("wrong-orgId:must match \"^o-\\w{10,20}\"")))

mvc.perform(
get(
"/organizations/wrong-orgId/workspaces/w-123456abcdef/runners/s-123456azerty/runs/run-123456azerty")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(jsonPath("$.detail", containsString("wrong-orgId:must match \"^o-\\w{10,20}\"")))

mvc.perform(
get(
"/organizations/o-1233456azer/workspaces/wrong-workspaceId/runners/r-123456azerty/runs/run-123456azerty")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(
jsonPath("$.detail", containsString("wrong-workspaceId:must match \"^w-\\w{10,20}\"")))

mvc.perform(
get(
"/organizations/o-1233456azer/workspaces/wrong-workspaceId/runners/s-123456azerty/runs/run-123456azerty")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(
jsonPath("$.detail", containsString("wrong-workspaceId:must match \"^w-\\w{10,20}\"")))

mvc.perform(
get(
"/organizations/o-1233456azer/workspaces/w-123456abcdef/runners/wrong-runnerId/runs/run-123456azerty")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(
jsonPath("$.detail", containsString("wrong-runnerId:must match \"^(r|s)-\\w{10,20}\"")))

mvc.perform(
get(
"/organizations/o-1233456azer/workspaces/w-123456abcdef/runners/r-123456azerty/runs/wrong-runId")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(
jsonPath("$.detail", containsString("wrong-runId:must match \"^(run|sr)-\\w{10,20}\"")))

mvc.perform(
get(
"/organizations/o-1233456azer/workspaces/w-123456abcdef/runners/s-123456azerty/runs/wrong-runId")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(
jsonPath("$.detail", containsString("wrong-runId:must match \"^(run|sr)-\\w{10,20}\"")))
}

@Test
@WithMockOauth2User
fun list_runs() {
Expand Down
54 changes: 54 additions & 0 deletions api/src/integrationTest/kotlin/com/cosmotech/api/home/runner/RunnerControllerTests.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@ import com.cosmotech.workspace.domain.WorkspaceSolution
import com.cosmotech.workspace.domain.WorkspaceUpdateRequest
import com.ninjasquad.springmockk.SpykBean
import io.mockk.every
import org.hamcrest.core.StringContains.containsString
import org.json.JSONObject
import org.junit.jupiter.api.BeforeEach
import org.junit.jupiter.api.Test
Expand Down Expand Up @@ -159,6 +160,59 @@ class RunnerControllerTests : ControllerTestBase() {
.andExpect(status().is2xxSuccessful)
}

@Test
@WithMockOauth2User
fun get_runner_with_wrong_ids_format() {
mvc.perform(
get("/organizations/wrong-orgId/workspaces/wrong-workspaceId/runners/wrong-runnerId")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(jsonPath("$.detail", containsString("wrong-orgId:must match \"^o-\\w{10,20}\"")))
.andExpect(
jsonPath("$.detail", containsString("wrong-workspaceId:must match \"^w-\\w{10,20}\"")))
.andExpect(
jsonPath("$.detail", containsString("wrong-runnerId:must match \"^(r|s)-\\w{10,20}\"")))

mvc.perform(
get("/organizations/wrong-orgId/workspaces/w-123456abcdef/runners/r-123456azerty")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(jsonPath("$.detail", containsString("wrong-orgId:must match \"^o-\\w{10,20}\"")))

mvc.perform(
get("/organizations/wrong-orgId/workspaces/w-123456abcdef/runners/s-123456azerty")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(jsonPath("$.detail", containsString("wrong-orgId:must match \"^o-\\w{10,20}\"")))

mvc.perform(
get("/organizations/o-1233456azer/workspaces/wrong-workspaceId/runners/r-123456azerty")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(
jsonPath("$.detail", containsString("wrong-workspaceId:must match \"^w-\\w{10,20}\"")))

mvc.perform(
get("/organizations/o-1233456azer/workspaces/wrong-workspaceId/runners/s-123456azerty")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(
jsonPath("$.detail", containsString("wrong-workspaceId:must match \"^w-\\w{10,20}\"")))

mvc.perform(
get("/organizations/o-1233456azer/workspaces/w-123456abcdef/runners/wrong-runnerId")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(
jsonPath("$.detail", containsString("wrong-runnerId:must match \"^(r|s)-\\w{10,20}\"")))
}

@Test
@WithMockOauth2User
fun create_runner() {
Expand Down
29 changes: 29 additions & 0 deletions api/src/integrationTest/kotlin/com/cosmotech/api/home/solution/SolutionControllerTests.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ import com.cosmotech.solution.api.SolutionApiService
import com.cosmotech.solution.domain.*
import io.mockk.every
import io.mockk.mockk
import org.hamcrest.core.StringContains.containsString
import org.json.JSONObject
import org.junit.jupiter.api.BeforeEach
import org.junit.jupiter.api.Test
Expand Down Expand Up @@ -59,6 +60,34 @@ class SolutionControllerTests : ControllerTestBase() {
organizationId = createOrganizationAndReturnId(mvc, constructOrganizationCreateRequest())
}

@Test
@WithMockOauth2User
fun get_solution_with_wrong_ids_format() {
mvc.perform(
get("/organizations/wrong-orgId/solutions/wrong-solutionId")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(jsonPath("$.detail", containsString("wrong-orgId:must match \"^o-\\w{10,20}\"")))
.andExpect(
jsonPath("$.detail", containsString("wrong-solutionId:must match \"^sol-\\w{10,20}\"")))

mvc.perform(
get("/organizations/wrong-orgId/solutions/sol-123456abcdef")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(jsonPath("$.detail", containsString("wrong-orgId:must match \"^o-\\w{10,20}\"")))

mvc.perform(
get("/organizations/o-123456abcdef/solutions/wrong-solutionId")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(
jsonPath("$.detail", containsString("wrong-solutionId:must match \"^sol-\\w{10,20}\"")))
}

@Test
@WithMockOauth2User
fun list_solutions() {
Expand Down
29 changes: 29 additions & 0 deletions api/src/integrationTest/kotlin/com/cosmotech/api/home/workspace/WorkspaceControllerTests.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ import com.cosmotech.common.rbac.ROLE_VIEWER
import com.cosmotech.workspace.domain.WorkspaceAccessControl
import com.cosmotech.workspace.domain.WorkspaceSecurity
import org.apache.commons.io.IOUtils
import org.hamcrest.core.StringContains.containsString
import org.json.JSONObject
import org.junit.jupiter.api.BeforeEach
import org.junit.jupiter.api.Test
Expand Down Expand Up @@ -53,6 +54,34 @@ class WorkspaceControllerTests : ControllerTestBase() {
solutionId = createSolutionAndReturnId(mvc, organizationId, constructSolutionCreateRequest())
}

@Test
@WithMockOauth2User
fun get_workspace_with_wrong_ids_format() {
mvc.perform(
get("/organizations/wrong-orgId/workspaces/wrong-workspaceId")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(jsonPath("$.detail", containsString("wrong-orgId:must match \"^o-\\w{10,20}\"")))
.andExpect(
jsonPath("$.detail", containsString("wrong-workspaceId:must match \"^w-\\w{10,20}\"")))

mvc.perform(
get("/organizations/wrong-orgId/workspaces/w-123456abcdef")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(jsonPath("$.detail", containsString("wrong-orgId:must match \"^o-\\w{10,20}\"")))

mvc.perform(
get("/organizations/o-123456abcdef/workspaces/wrong-workspaceId")
.contentType(MediaType.APPLICATION_JSON)
.accept(MediaType.APPLICATION_JSON))
.andExpect(status().isBadRequest)
.andExpect(
jsonPath("$.detail", containsString("wrong-workspaceId:must match \"^w-\\w{10,20}\"")))
}

@Test
@WithMockOauth2User
fun create_workspace() {
Expand Down
16 changes: 16 additions & 0 deletions common/src/main/kotlin/com/cosmotech/common/exceptions/CsmExceptionHandling.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,10 @@
package com.cosmotech.common.exceptions

import io.awspring.cloud.s3.S3Exception
import jakarta.validation.ConstraintViolationException
import java.net.URI
import org.apache.commons.lang3.NotImplementedException
import org.hibernate.validator.internal.engine.ConstraintViolationImpl
import org.springframework.core.Ordered
import org.springframework.core.annotation.Order
import org.springframework.http.HttpHeaders
Expand Down Expand Up @@ -129,6 +131,20 @@ open class CsmExceptionHandling : ResponseEntityExceptionHandler() {
return problemDetail
}

@ExceptionHandler
fun handleConstraintViolationException(exception: ConstraintViolationException): ProblemDetail {
val badRequestStatus = HttpStatus.BAD_REQUEST
val problemDetail = ProblemDetail.forStatus(badRequestStatus)
problemDetail.type = URI.create(httpStatusCodeTypePrefix + badRequestStatus.value())
val constraintViolations = exception.constraintViolations
problemDetail.detail =
constraintViolations.joinToString {
val constraint = (it as ConstraintViolationImpl)
"${constraint.invalidValue}:${constraint.message}"
}
return problemDetail
}

@ExceptionHandler(AuthenticationServiceException::class)
fun handleAuthenticationServiceException(
exception: AuthenticationServiceException
Expand Down
4 changes: 4 additions & 0 deletions dataset/src/main/openapi/dataset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -726,27 +726,31 @@ components:
required: true
schema:
type: string
pattern: '^o-\w{10,20}'
workspaceId:
name: workspace_id
in: path
description: the Workspace identifier
required: true
schema:
type: string
pattern: '^w-\w{10,20}'
datasetId:
name: dataset_id
in: path
description: the Dataset identifier
required: true
schema:
type: string
pattern: '^d-\w{10,20}'
datasetPartId:
name: dataset_part_id
in: path
description: the Dataset part identifier
required: true
schema:
type: string
pattern: '^dp-\w{10,20}'
page:
name: page
in: query
Expand Down
Loading
Loading