-
-
Notifications
You must be signed in to change notification settings - Fork 28
Closed
Description
Summary
The /temporale endpoint currently returns raw JSON arrays and doesn't support i18n data management in PUT/PATCH requests.
Problems
- Security concern: GET/POST responses return raw JSON arrays, which can be vulnerable to JSON hijacking in older browsers
- Inconsistent with /data endpoint: PUT/PATCH don't handle i18n data, unlike the
/dataendpoint pattern - No protection against accidental overwrites: PUT can overwrite existing data without warning
Proposed Solution
1. Object wrapper for responses
Wrap GET/POST responses in an object:
{
"events": [...],
"locale": "en"
}2. i18n support in PUT/PATCH
Accept i18n data in request payloads:
{
"events": [...],
"locales": ["en", "la", "de"],
"i18n": {
"en": { "Easter": "Easter Sunday", ... }
}
}3. PUT creation-only behavior
- PUT should only work when NO temporale data exists (initial creation)
- Return 409 Conflict if data already exists
- Use PATCH for updates
4. i18n consistency
- Every event_key must exist in ALL i18n files
- Use empty string as placeholder for untranslated entries
- Require Accept-Language locale translations for new event_keys
Breaking Changes
This is a breaking change for:
- Clients expecting array response from GET/POST
- Clients sending array payload to PUT/PATCH
- PUT behavior (now fails if data exists)
Since the endpoint is new and not yet in production, this is acceptable.
Metadata
Metadata
Assignees
Labels
No labels