Skip to content

Commit 653d6ee

Browse files
luontolaluontola
committed
change /applications/{save,judge,review_request} to use POST
- /save creates duplicate applications on duplicate request when creating a new application - /judge adds duplicate events on duplicate request - /review_request adds duplicate events on duplicate request
1 parent 122137f commit 653d6ee

File tree

4 files changed

+37
-37
lines changed

4 files changed

+37
-37
lines changed

‎docs/usingtheapi.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ Judging from the output of the previous command, in order to apply for access we
7171
Form item "Duration of the project" seems to be optional so we will leave that empty. Let's send in the application.
7272

7373
```sh
74-
curl -X PUT \
74+
curl -X POST \
7575
-H 'Content-Type: application/json' \
7676
-H 'Accept: application/json' \
7777
-H 'x-rems-api-key: 42' \
@@ -92,7 +92,7 @@ You should get the following output as a response:
9292
This tells us that the request succeeded, the system assigned id 12 to our application, the form was properly filled and that the application has progressed to an applied state. Now we can proceed to approving the request. Both users Developer and Bob have been assigned as approvers for the current workflow but only one of them needs to grant the permission. Let's provide an answer as Developer:
9393

9494
```sh
95-
curl -X PUT \
95+
curl -X POST \
9696
-H 'Content-Type: application/json' \
9797
-H 'Accept: application/json' \
9898
-H 'x-rems-api-key: 42' \

‎src/clj/rems/api/applications.clj

+3-3
Original file line numberDiff line numberDiff line change
@@ -173,21 +173,21 @@
173173
(content-type "application/pdf"))
174174
(not-found! "not found"))))
175175

176-
(PUT "/save" []
176+
(POST "/save" []
177177
:summary "Create a new application, change an existing one or submit an application"
178178
:body [request SaveApplicationCommand]
179179
:return SaveApplicationResponse
180180
(check-user)
181181
(ok (form/api-save (fix-keys request))))
182182

183-
(PUT "/judge" []
183+
(POST "/judge" []
184184
:summary "Judge an application"
185185
:body [request JudgeApplicationCommand]
186186
:return SuccessResponse
187187
(check-user)
188188
(ok (api-judge request)))
189189

190-
(PUT "/review_request" []
190+
(POST "/review_request" []
191191
:summary "Request a review"
192192
:body [request ReviewRequestCommand]
193193
:return SuccessResponse

‎src/cljs/rems/application.cljs

+4-4
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
[rems.phase :refer [phases get-application-phases]]
88
[rems.spinner :as spinner]
99
[rems.text :refer [text text-format localize-state localize-event localize-time localize-item]]
10-
[rems.util :refer [dispatch! fetch index-by put!]]
10+
[rems.util :refer [dispatch! fetch index-by post!]]
1111
[secretary.core :as secretary])
1212
(:require-macros [rems.guide-macros :refer [component-info example]]))
1313

@@ -131,7 +131,7 @@
131131
(if application-id
132132
{:application-id application-id}
133133
{:catalogue-items catalogue-items}))]
134-
(put! "/api/applications/save"
134+
(post! "/api/applications/save"
135135
{:handler (fn [resp]
136136
(if (:success resp)
137137
(do (rf/dispatch [::set-status :saved])
@@ -164,7 +164,7 @@
164164
{}))
165165

166166
(defn- judge-application [command application-id round comment]
167-
(put! "/api/applications/judge"
167+
(post! "/api/applications/judge"
168168
{:params {:command command
169169
:application-id application-id
170170
:round round
@@ -555,7 +555,7 @@
555555
(::review-comment db)))
556556

557557
(defn- send-third-party-review-request [reviewers user application-id round comment]
558-
(put! "/api/applications/review_request"
558+
(post! "/api/applications/review_request"
559559
{:params {:application-id application-id
560560
:round round
561561
:comment comment

‎test/clj/rems/test/api/applications.clj

+28-28
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
user-id "alice"
4040
another-user "alice_smith"
4141
catid 2]
42-
(let [response (-> (request :put (str "/api/applications/save"))
42+
(let [response (-> (request :post (str "/api/applications/save"))
4343
(authenticate api-key user-id)
4444
(json-body {:command "save"
4545
:catalogue-items [catid]
@@ -86,15 +86,15 @@
8686
application (read-body response)]
8787
(is (= 401 (:status response)))))
8888
(testing "saving as other user"
89-
(let [response (-> (request :put (str "/api/applications/save"))
89+
(let [response (-> (request :post (str "/api/applications/save"))
9090
(authenticate api-key another-user)
9191
(json-body {:command "save"
9292
:application-id application-id
9393
:items {1 "REST-Test"}})
9494
app)]
9595
(is (= 401 (:status response)))))
9696
(testing "submitting"
97-
(let [response (-> (request :put (str "/api/applications/save"))
97+
(let [response (-> (request :post (str "/api/applications/save"))
9898
(authenticate api-key user-id)
9999
(json-body {:command "submit"
100100
:application-id application-id
@@ -111,7 +111,7 @@
111111
(is (:valid cmd-response))
112112
(is (empty? (:validation cmd-response)))))
113113
(testing "approving"
114-
(let [response (-> (request :put (str "/api/applications/judge"))
114+
(let [response (-> (request :post (str "/api/applications/judge"))
115115
(authenticate api-key "developer")
116116
(json-body {:command "approve"
117117
:application-id application-id
@@ -131,7 +131,7 @@
131131
(let [api-key "42"
132132
user-id "alice"
133133
catid 2]
134-
(let [response (-> (request :put (str "/api/applications/save"))
134+
(let [response (-> (request :post (str "/api/applications/save"))
135135
(authenticate api-key user-id)
136136
(json-body {:command "save"
137137
:catalogue-items [catid]
@@ -150,7 +150,7 @@
150150
(is (some #(.contains (:text %) "non-localized link license") validations))
151151
(is (some #(.contains (:text %) "non-localized text license") validations)))
152152
(testing "add one field"
153-
(let [response (-> (request :put (str "/api/applications/save"))
153+
(let [response (-> (request :post (str "/api/applications/save"))
154154
(authenticate api-key user-id)
155155
(json-body {:command "save"
156156
:application-id application-id
@@ -162,7 +162,7 @@
162162
(is (not (:valid cmd-response)))
163163
(is (= 3 (count validations)))))
164164
(testing "add one license"
165-
(let [response (-> (request :put (str "/api/applications/save"))
165+
(let [response (-> (request :post (str "/api/applications/save"))
166166
(authenticate api-key user-id)
167167
(json-body {:command "save"
168168
:application-id application-id
@@ -175,7 +175,7 @@
175175
(is (not (:valid cmd-response)))
176176
(is (= 2 (count validations)))))
177177
(testing "submit partial form"
178-
(let [response (-> (request :put (str "/api/applications/save"))
178+
(let [response (-> (request :post (str "/api/applications/save"))
179179
(authenticate api-key user-id)
180180
(json-body {:command "submit"
181181
:application-id application-id
@@ -188,7 +188,7 @@
188188
(is (not (:valid cmd-response)))
189189
(is (= 2 (count validations)))))
190190
(testing "save full form"
191-
(let [response (-> (request :put (str "/api/applications/save"))
191+
(let [response (-> (request :post (str "/api/applications/save"))
192192
(authenticate api-key user-id)
193193
(json-body {:command "save"
194194
:application-id application-id
@@ -201,7 +201,7 @@
201201
(is (:valid cmd-response))
202202
(is (empty? validations))))
203203
(testing "submit full form"
204-
(let [response (-> (request :put (str "/api/applications/save"))
204+
(let [response (-> (request :post (str "/api/applications/save"))
205205
(authenticate api-key user-id)
206206
(json-body {:command "submit"
207207
:application-id application-id
@@ -219,7 +219,7 @@
219219
user-id "developer"
220220
catid 6]
221221
(testing "save draft for disabled item"
222-
(let [response (-> (request :put (str "/api/applications/save"))
222+
(let [response (-> (request :post (str "/api/applications/save"))
223223
(authenticate api-key user-id)
224224
(json-body {:command "save"
225225
:catalogue-items [catid]
@@ -229,7 +229,7 @@
229229
;; TODO should we actually return a nice error message here?
230230
(is (= 400 (:status response)) "should not be able to save draft with disbled item")))
231231
(testing "submit for application with disabled item"
232-
(let [response (-> (request :put (str "/api/applications/save"))
232+
(let [response (-> (request :post (str "/api/applications/save"))
233233
(authenticate api-key user-id)
234234
(json-body {:application-id 6 ;; application-id 6 is already created, but catalogue-item was disabled later
235235
:command "submit"
@@ -245,7 +245,7 @@
245245
applicant "alice"
246246
approver "developer"
247247
catid 2]
248-
(let [response (-> (request :put (str "/api/applications/save"))
248+
(let [response (-> (request :post (str "/api/applications/save"))
249249
(authenticate api-key applicant)
250250
(json-body {:command "submit"
251251
:catalogue-items [catid]
@@ -275,7 +275,7 @@
275275
(is (:can-approve? application))))
276276
;; TODO tests for :review-type
277277
(testing "approve application"
278-
(is (= 200 (-> (request :put (str "/api/applications/judge"))
278+
(is (= 200 (-> (request :post (str "/api/applications/judge"))
279279
(authenticate api-key approver)
280280
(json-body {:command "approve"
281281
:application-id app-id
@@ -305,7 +305,7 @@
305305
(let [api-key "42"
306306
user "developer"
307307
catid 2
308-
app-id (-> (request :put (str "/api/applications/save"))
308+
app-id (-> (request :post (str "/api/applications/save"))
309309
(authenticate api-key user)
310310
(json-body {:command "save"
311311
:catalogue-items [catid]
@@ -316,7 +316,7 @@
316316
:id)
317317
submit (fn []
318318
(is (= 200
319-
(-> (request :put (str "/api/applications/save"))
319+
(-> (request :post (str "/api/applications/save"))
320320
(authenticate api-key user)
321321
(json-body {:command "submit"
322322
:application-id app-id
@@ -326,7 +326,7 @@
326326
:status))))
327327
action (fn [body]
328328
(is (= 200
329-
(-> (request :put (str "/api/applications/judge"))
329+
(-> (request :post (str "/api/applications/judge"))
330330
(authenticate api-key user)
331331
(json-body (merge {:application-id app-id
332332
:round 0}
@@ -367,7 +367,7 @@
367367
approver "developer"
368368
reviewer "carl"
369369
catid 2
370-
app-id (-> (request :put (str "/api/applications/save"))
370+
app-id (-> (request :post (str "/api/applications/save"))
371371
(authenticate api-key applicant)
372372
(json-body {:command "submit"
373373
:catalogue-items [catid]
@@ -385,7 +385,7 @@
385385
(is (not (contains? (set (map :userid reviewers)) "invalid")))))
386386
(testing "send review request"
387387
(is (= 200
388-
(-> (request :put (str "/api/applications/review_request"))
388+
(-> (request :post (str "/api/applications/review_request"))
389389
(authenticate api-key approver)
390390
(json-body {:application-id app-id
391391
:round 0
@@ -405,7 +405,7 @@
405405
(map #(select-keys % [:userid :comment :event]) events)))))
406406
(testing "send review"
407407
(is (= 200
408-
(-> (request :put (str "/api/applications/judge"))
408+
(-> (request :post (str "/api/applications/judge"))
409409
(authenticate api-key reviewer)
410410
(json-body {:command "third-party-review"
411411
:application-id app-id
@@ -415,7 +415,7 @@
415415
:status))))
416416
(testing "approve"
417417
(is (= 200
418-
(-> (request :put (str "/api/applications/judge"))
418+
(-> (request :post (str "/api/applications/judge"))
419419
(authenticate api-key approver)
420420
(json-body {:command "approve"
421421
:application-id app-id
@@ -487,7 +487,7 @@
487487
(is cookie)
488488
(is csrf)
489489
(testing "submit with session"
490-
(let [response (-> (request :put (str "/api/applications/save"))
490+
(let [response (-> (request :post (str "/api/applications/save"))
491491
(header "Cookie" cookie)
492492
(header "x-csrf-token" csrf)
493493
(json-body {:command "submit"
@@ -499,7 +499,7 @@
499499
(is (= 200 (:status response)))
500500
(is (:success body))))
501501
(testing "submit with session but without csrf"
502-
(let [response (-> (request :put (str "/api/applications/save"))
502+
(let [response (-> (request :post (str "/api/applications/save"))
503503
(header "Cookie" cookie)
504504
(json-body {:command "submit"
505505
:catalogue-items [2]
@@ -508,7 +508,7 @@
508508
app)]
509509
(is (= 403 (:status response)))))
510510
(testing "submit with session and csrf and wrong api-key"
511-
(let [response (-> (request :put (str "/api/applications/save"))
511+
(let [response (-> (request :post (str "/api/applications/save"))
512512
(header "Cookie" cookie)
513513
(header "x-csrf-token" csrf)
514514
(header "x-rems-api-key" "WRONG")
@@ -539,15 +539,15 @@
539539
body (read-body response)]
540540
(is (= body "unauthorized"))))
541541
(testing "save without authentication"
542-
(let [response (-> (request :put (str "/api/applications/save"))
542+
(let [response (-> (request :post (str "/api/applications/save"))
543543
(json-body {:command "save"
544544
:catalogue-items [2]
545545
:items {1 "REST-Test"}})
546546
app)
547547
body (read-body response)]
548548
(is (str/includes? body "Invalid anti-forgery token"))))
549549
(testing "save with wrong API-Key"
550-
(let [response (-> (request :put (str "/api/applications/save"))
550+
(let [response (-> (request :post (str "/api/applications/save"))
551551
(assoc-in [:headers "x-rems-api-key"] "invalid-api-key")
552552
(json-body {:command "save"
553553
:catalogue-items [2]
@@ -556,7 +556,7 @@
556556
body (read-body response)]
557557
(is (= "invalid api key" body))))
558558
(testing "judge without authentication"
559-
(let [body (-> (request :put (str "/api/applications/judge"))
559+
(let [body (-> (request :post (str "/api/applications/judge"))
560560
(json-body {:command "approve"
561561
:application-id 2
562562
:round 0
@@ -565,7 +565,7 @@
565565
read-body)]
566566
(is (str/includes? body "Invalid anti-forgery token"))))
567567
(testing "judge with wrong API-Key"
568-
(let [body (-> (request :put (str "/api/applications/judge"))
568+
(let [body (-> (request :post (str "/api/applications/judge"))
569569
(authenticate "invalid-api-key" "developer")
570570
(json-body {:command "approve"
571571
:application-id 2

0 commit comments

Comments
 (0)