sriram veeraghanta
9f77ea5ebb
* chore(api): add docker compose test runner
Adds docker-compose-test.yml at the repo root that boots an isolated
postgres / valkey / rabbitmq / minio stack with health checks and tmpfs
data dirs, then runs pytest against it and exits. Includes a usage doc
under apps/api/tests/RUNNING_TESTS.md and a pointer in AGENTS.md.
Prereq: ./setup.sh (generates apps/api/.env).
Usage:
docker compose -f docker-compose-test.yml up --build \
--abort-on-container-exit --exit-code-from api-tests
docker compose -f docker-compose-test.yml down -v
* fix(api): correct bugs surfaced by the pytest suite
Five small bugs caught by enabling the pytest contract suite end-to-end.
Each is independently justifiable:
- api/serializers/cycle.py + api/views/cycle.py: CycleCreateSerializer.validate
required project_id in the request body, but the view only ever passes
it through the URL kwarg. Cycle create/update via the public API was
returning 400 "Project ID is required". Read project_id from
serializer context (passed by the view) in addition to body/instance.
- app/views/api.py: ApiTokenEndpoint.get(pk) and patch(pk) did not filter
out is_service=True tokens, so a user could read and modify service
tokens through the user token endpoint. The list mode and delete
already filter is_service=False; aligned the other two.
- bgtasks/work_item_link_task.py: validate_url_ip checked hostname before
scheme, so file:///etc/passwd raised "No hostname found" instead of
the documented "Only HTTP and HTTPS" error. Swapped the order so the
scheme guard matches the docstring intent.
- utils/path_validator.py: get_allowed_hosts used `WEB_URL or APP_BASE_URL`
so when both are configured to different hosts (the standard local
setup: WEB_URL=:8000, APP_BASE_URL=:3000), only one was added to the
allow-list. Redirects to APP_BASE_URL then had their next_path stripped
because the host wasn't allowed. Include every configured base URL.
* chore(api): align pytest tests with current behavior, clear warnings
Test-side fixes paired with the product fixes in the previous commit, plus
deprecation cleanup that drops the test run from 104 warnings to 0.
Tests:
- tests/contract/api/test_cycles.py: project fixture sets cycle_view=True;
the Project model defaults the flag to False, so cycle create/update
always tripped "Cycles are not enabled for this project".
- tests/contract/app/test_authentication.py: next_path uses "/workspaces"
(validate_next_path rejects values without a leading slash and returns
empty, which dropped the path from the redirect URL).
- tests/unit/bg_tasks/test_copy_s3_objects.py: mocked sync_with_external_service
now returns description_json; the task unconditionally writes the value
back to the Issue, and Issue.description_json is NOT NULL on UPDATE.
- tests/unit/utils/test_url.py: three length-limit tests placed the URL at
char 970+ on a single line, which contains_url truncates away as ReDoS
defense (500-char per-line cap). Restructured to keep test intent intact
while staying inside the per-line window.
Warning cleanup (104 → 0):
- settings/common.py: removed USE_L10N=True (deprecated in Django 4.0,
removed in 5.0; default is True).
- celery.py, settings/local.py, settings/production.py: pythonjsonlogger
moved jsonlogger → json; update the import / formatter path.
63 lines
2.4 KiB
Python
63 lines
2.4 KiB
Python
# Copyright (c) 2023-present Plane Software, Inc. and contributors
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
# See the LICENSE file for details.
|
|
|
|
# Python import
|
|
from uuid import uuid4
|
|
from typing import Optional
|
|
|
|
# Third party
|
|
from rest_framework.response import Response
|
|
from rest_framework.request import Request
|
|
from rest_framework import status
|
|
|
|
# Module import
|
|
from .base import BaseAPIView
|
|
from plane.db.models import APIToken
|
|
from plane.app.serializers import APITokenSerializer, APITokenReadSerializer
|
|
|
|
|
|
class ApiTokenEndpoint(BaseAPIView):
|
|
def post(self, request: Request) -> Response:
|
|
label = request.data.get("label", str(uuid4().hex))
|
|
description = request.data.get("description", "")
|
|
expired_at = request.data.get("expired_at", None)
|
|
|
|
# Check the user type
|
|
user_type = 1 if request.user.is_bot else 0
|
|
|
|
api_token = APIToken.objects.create(
|
|
label=label,
|
|
description=description,
|
|
user=request.user,
|
|
user_type=user_type,
|
|
expired_at=expired_at,
|
|
)
|
|
|
|
serializer = APITokenSerializer(api_token)
|
|
# Token will be only visible while creating
|
|
return Response(serializer.data, status=status.HTTP_201_CREATED)
|
|
|
|
def get(self, request: Request, pk: Optional[str] = None) -> Response:
|
|
if pk is None:
|
|
api_tokens = APIToken.objects.filter(user=request.user, is_service=False)
|
|
serializer = APITokenReadSerializer(api_tokens, many=True)
|
|
return Response(serializer.data, status=status.HTTP_200_OK)
|
|
else:
|
|
api_tokens = APIToken.objects.get(user=request.user, pk=pk, is_service=False)
|
|
serializer = APITokenReadSerializer(api_tokens)
|
|
return Response(serializer.data, status=status.HTTP_200_OK)
|
|
|
|
def delete(self, request: Request, pk: str) -> Response:
|
|
api_token = APIToken.objects.get(user=request.user, pk=pk, is_service=False)
|
|
api_token.delete()
|
|
return Response(status=status.HTTP_204_NO_CONTENT)
|
|
|
|
def patch(self, request: Request, pk: str) -> Response:
|
|
api_token = APIToken.objects.get(user=request.user, pk=pk, is_service=False)
|
|
serializer = APITokenSerializer(api_token, data=request.data, partial=True)
|
|
if serializer.is_valid():
|
|
serializer.save()
|
|
return Response(serializer.data, status=status.HTTP_200_OK)
|
|
return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
|