Merge pull request #2696 from dandi/fix-upload-init-id-parsing

Fix dandiset ID parsing during upload initialization

Author: jjnesbitt

dandiapi/api/tests/test_upload.py

@@ -101,6 +101,26 @@ def test_upload_initialize(api_client, embargoed):
     assert upload.blob.name == f'blobs/{upload_id[:3]}/{upload_id[3:6]}/{upload_id}'
 
 
+@pytest.mark.django_db
+@pytest.mark.parametrize('dandiset_id', ['DANDI:abc', 'DANDI:123456', '001'])
+def test_upload_initialize_invalid_dandiset(api_client, dandiset_id):
+    user = UserFactory.create()
+    DandisetFactory.create(embargo_status=Dandiset.EmbargoStatus.UNEMBARGOING, owners=[user])
+    api_client.force_authenticate(user=user)
+
+    content_size = 123
+    resp = api_client.post(
+        '/api/uploads/initialize/',
+        {
+            'contentSize': content_size,
+            'digest': {'algorithm': 'dandi:dandi-etag', 'value': 'f' * 32 + '-1'},
+            'dandiset': dandiset_id,
+        },
+    )
+
+    assert resp.status_code == 400
+
+
 @pytest.mark.django_db
 def test_upload_initialize_unembargo_in_progress(api_client):
     user = UserFactory.create()

dandiapi/api/views/upload.py

@@ -39,7 +39,7 @@ class DigestSerializer(serializers.Serializer):
 class UploadInitializationRequestSerializer(serializers.Serializer):
     contentSize = serializers.IntegerField(min_value=1)  # noqa: N815
     digest = DigestSerializer()
-    dandiset = serializers.RegexField(Dandiset.IDENTIFIER_REGEX)
+    dandiset = serializers.RegexField(f'^{Dandiset.IDENTIFIER_REGEX}$')
 
 
 class PartInitializationResponseSerializer(serializers.Serializer):
@@ -131,7 +131,7 @@ def upload_initialize_view(request: AuthenticatedRequest) -> HttpResponseBase:
     if digest['algorithm'] != 'dandi:dandi-etag':
         return Response('Unsupported Digest Type', status=400)
     etag = digest['value']
-    dandiset_id = request_serializer.validated_data['dandiset']
+    dandiset_id = int(request_serializer.validated_data['dandiset'])
     dandiset = get_object_or_404(
         get_visible_dandisets(request.user),
         id=dandiset_id,