[Arch] Inconsistent request validation — 7 Pydantic models vs 13 raw request.json() sites #52

New issue

Closed

opened 2026-07-01 07:26:34 +02:00 by bullitt · 1 comment

bullitt commented

2026-07-01 07:26:34 +02:00

Owner

Severity: Medium | Category: Backend

main.py defines only 7 BaseModel classes vs 13 call sites using await request.json() with manual dict extraction (main.py:264,275,291,368,407,446,472,555,1051,1152,1179,1245,1440). Zero endpoints declare response_model.

Recommendation: Add BaseModel request bodies for remaining request.json() sites, starting with PUT /api/shipments/{id} and PUT /api/settings (the latter's open-ended key-value shape is a legitimate exception, document rather than "fix").

Full detail: docs/architecture-review.md § C, Finding "Inconsistent request validation..."

**Severity:** Medium | **Category:** Backend main.py defines only 7 `BaseModel` classes vs 13 call sites using `await request.json()` with manual dict extraction (main.py:264,275,291,368,407,446,472,555,1051,1152,1179,1245,1440). Zero endpoints declare `response_model`. **Recommendation:** Add `BaseModel` request bodies for remaining `request.json()` sites, starting with `PUT /api/shipments/{id}` and `PUT /api/settings` (the latter's open-ended key-value shape is a legitimate exception, document rather than "fix"). Full detail: `docs/architecture-review.md` § C, Finding "Inconsistent request validation..."

bullitt added the

arch

label

2026-07-01 07:27:43 +02:00

bullitt commented

2026-07-01 08:43:40 +02:00

Author

Owner

Fixed on branch architecture-rework, commit d68c7d4: added typed Pydantic models for all 12 remaining raw request.json() endpoints (PUT /api/settings stays a flat dict, as the finding itself noted is legitimate). One intentional behavior change: PUT /auth/me now returns 422 for an over-length display_name instead of silently truncating it, matching every other length-bounded field in the file. Full suite: 259 passed.

Fixed on branch `architecture-rework`, commit d68c7d4: added typed Pydantic models for all 12 remaining raw `request.json()` endpoints (`PUT /api/settings` stays a flat dict, as the finding itself noted is legitimate). One intentional behavior change: `PUT /auth/me` now returns 422 for an over-length `display_name` instead of silently truncating it, matching every other length-bounded field in the file. Full suite: 259 passed.

bullitt closed this issue

2026-07-01 08:43:58 +02:00

bullitt referenced this issue from a commit

2026-07-01 09:15:22 +02:00

refactor: add Pydantic models for remaining raw request.json() endpoints (fixes #52)