Validation against invalid UUID for remove-self endpoint#5968
Conversation
Signed-off-by: ashnaaseth2325-oss <ashnaaseth2325@gmail.com>
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
Clean, minimal fix that addresses exactly what the issue asked for.
CI checks (Python unit tests, linting, frontend build) were still pending at review time — no failures to report. No UI changes; Phase 3 skipped.
- praise: See inline comments on implementation and tests.
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Reviewed the pull request diff checking for:
- Correctness: bugs, edge cases, undocumented behavior, resource leaks, hardcoded values
- Design: unnecessary complexity, naming, readability, comment accuracy, redundant state
- Architecture: duplicated concerns, minimal interfaces, composition over inheritance
- Testing: behavior-based assertions, mocks only at hard boundaries, accurate coverage
- Completeness: missing dependencies, unupdated usages, i18n, accessibility, security
- Principles: DRY (same reason to change), SRP, Rule of Three (no premature abstraction)
- Checked CI status and linked issue acceptance criteria
- For UI changes: inspected screenshots for layout, visual completeness, and consistency
| if not channel_id: | ||
| return HttpResponseBadRequest("Channel ID is required.") | ||
| try: | ||
| channel_id = uuid.UUID(channel_id).hex |
There was a problem hiding this comment.
praise: Normalizing to .hex before the downstream Channel.objects.get() is a nice defensive touch — it canonicalizes any valid UUID variant (with/without dashes, mixed case) into a consistent 32-char hex string, preventing a class of subtle mismatch bugs.
| ) | ||
| self.assertEqual(response.status_code, 400, response.content) | ||
|
|
||
| def test_remove_self_with_missing_channel_returns_not_found(self): |
There was a problem hiding this comment.
praise: Good defensive coverage — the 404 test for a valid-but-nonexistent UUID confirms that the new validation block doesn't accidentally swallow legitimate Channel.DoesNotExist paths.
bjester
force-pushed
the
fix/remove-self-invalid-uuid
branch
from
06e56f5 to
3a047e5
Compare
bjester
force-pushed
the
fix/remove-self-invalid-uuid
branch
from
6624037 to
1bfd670
Compare
bjester
changed the title
3 participants
Summary
This PR fixes an unhandled exception in
ChannelUserViewSet.remove_selfwhere malformedchannel_idvalues could trigger a 500 error. It adds proper validation handling to return a 400 Bad Request instead.The change is localized to
contentcuration/contentcuration/viewsets/user.py, aligning error handling with existing patterns in the codebase.References
Original: #5776
closes #5779
Reviewer guidance
Sending a request with a malformed
channel_id(e.g.,not-a-valid-uuid) now returns a 400 Bad Request instead of a 500 error. Valid but non existent UUIDs correctly return 404 Not Found, while valid existing IDs continue to work as expected.AI usage
In followup, AI was used to address remaining review feedback.