url/homelable
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: remove trailing slash from GET/POST routes to prevent 307→403 redirect

Browse Source 
FastAPI's redirect_slashes=True causes GET /api/v1/canvas to 307 redirect
to /api/v1/canvas/ — axios follows the redirect but drops the Authorization
header, resulting in 403. Fixed by declaring routes as empty string instead
of '/' so no redirect is issued. Same fix applied to nodes and edges routes.
Updated all tests to use paths without trailing slashes.
This commit is contained in:
Pouzor
2026-03-07 01:01:24 +01:00
parent a3e6a97404
commit 8a18ded2bc
6 changed files with 21 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/app/api/routes/canvas.py
+1 -1
View File
@@ -12,7 +12,7 @@ from app.schemas.canvas import CanvasSaveRequest, CanvasStateResponse
router = APIRouter() router = APIRouter()
@router.get("/", response_model=CanvasStateResponse) @router.get("", response_model=CanvasStateResponse)
async def load_canvas(db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)): async def load_canvas(db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)):
nodes = (await db.execute(select(Node))).scalars().all() nodes = (await db.execute(select(Node))).scalars().all()
edges = (await db.execute(select(Edge))).scalars().all() edges = (await db.execute(select(Edge))).scalars().all()
backend/app/api/routes/edges.py
+2 -2
View File
@@ -10,13 +10,13 @@ from app.schemas.edges import EdgeCreate, EdgeResponse, EdgeUpdate
router = APIRouter() router = APIRouter()
@router.get("/", response_model=list[EdgeResponse]) @router.get("", response_model=list[EdgeResponse])
async def list_edges(db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)): async def list_edges(db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)):
result = await db.execute(select(Edge)) result = await db.execute(select(Edge))
return result.scalars().all() return result.scalars().all()
@router.post("/", response_model=EdgeResponse, status_code=status.HTTP_201_CREATED) @router.post("", response_model=EdgeResponse, status_code=status.HTTP_201_CREATED)
async def create_edge(body: EdgeCreate, db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)): async def create_edge(body: EdgeCreate, db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)):
edge = Edge(**body.model_dump()) edge = Edge(**body.model_dump())
db.add(edge) db.add(edge)
backend/app/api/routes/nodes.py
+2 -2
View File
@@ -10,13 +10,13 @@ from app.schemas.nodes import NodeCreate, NodeResponse, NodeUpdate
router = APIRouter() router = APIRouter()
@router.get("/", response_model=list[NodeResponse]) @router.get("", response_model=list[NodeResponse])
async def list_nodes(db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)): async def list_nodes(db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)):
result = await db.execute(select(Node)) result = await db.execute(select(Node))
return result.scalars().all() return result.scalars().all()
@router.post("/", response_model=NodeResponse, status_code=status.HTTP_201_CREATED) @router.post("", response_model=NodeResponse, status_code=status.HTTP_201_CREATED)
async def create_node(body: NodeCreate, db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)): async def create_node(body: NodeCreate, db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)):
node = Node(**body.model_dump()) node = Node(**body.model_dump())
db.add(node) db.add(node)
backend/tests/test_auth.py
+1 -1
View File
@@ -29,7 +29,7 @@ async def test_login_wrong_username(client: AsyncClient, mock_credentials):
async def test_protected_route_requires_auth(client: AsyncClient): async def test_protected_route_requires_auth(client: AsyncClient):
res = await client.get("/api/v1/nodes/") res = await client.get("/api/v1/nodes")
assert res.status_code == 403 assert res.status_code == 403
backend/tests/test_edges.py
+8 -8
View File
@@ -16,14 +16,14 @@ async def headers(client: AsyncClient):
@pytest.fixture @pytest.fixture
async def two_nodes(client: AsyncClient, headers: dict): async def two_nodes(client: AsyncClient, headers: dict):
n1 = (await client.post("/api/v1/nodes/", json={"type": "router", "label": "R1", "status": "online"}, headers=headers)).json() n1 = (await client.post("/api/v1/nodes", json={"type": "router", "label": "R1", "status": "online"}, headers=headers)).json()
n2 = (await client.post("/api/v1/nodes/", json={"type": "switch", "label": "SW1", "status": "online"}, headers=headers)).json() n2 = (await client.post("/api/v1/nodes", json={"type": "switch", "label": "SW1", "status": "online"}, headers=headers)).json()
return n1["id"], n2["id"] return n1["id"], n2["id"]
async def test_create_edge(client: AsyncClient, headers: dict, two_nodes): async def test_create_edge(client: AsyncClient, headers: dict, two_nodes):
src, tgt = two_nodes src, tgt = two_nodes
res = await client.post("/api/v1/edges/", json={"source": src, "target": tgt, "type": "ethernet"}, headers=headers) res = await client.post("/api/v1/edges", json={"source": src, "target": tgt, "type": "ethernet"}, headers=headers)
assert res.status_code == 201 assert res.status_code == 201
data = res.json() data = res.json()
assert data["source"] == src assert data["source"] == src
@@ -33,22 +33,22 @@ async def test_create_edge(client: AsyncClient, headers: dict, two_nodes):
async def test_create_vlan_edge(client: AsyncClient, headers: dict, two_nodes): async def test_create_vlan_edge(client: AsyncClient, headers: dict, two_nodes):
src, tgt = two_nodes src, tgt = two_nodes
res = await client.post("/api/v1/edges/", json={"source": src, "target": tgt, "type": "vlan", "vlan_id": 20, "label": "VLAN 20"}, headers=headers) res = await client.post("/api/v1/edges", json={"source": src, "target": tgt, "type": "vlan", "vlan_id": 20, "label": "VLAN 20"}, headers=headers)
assert res.status_code == 201 assert res.status_code == 201
assert res.json()["vlan_id"] == 20 assert res.json()["vlan_id"] == 20
async def test_list_edges(client: AsyncClient, headers: dict, two_nodes): async def test_list_edges(client: AsyncClient, headers: dict, two_nodes):
src, tgt = two_nodes src, tgt = two_nodes
await client.post("/api/v1/edges/", json={"source": src, "target": tgt, "type": "ethernet"}, headers=headers) await client.post("/api/v1/edges", json={"source": src, "target": tgt, "type": "ethernet"}, headers=headers)
res = await client.get("/api/v1/edges/", headers=headers) res = await client.get("/api/v1/edges", headers=headers)
assert res.status_code == 200 assert res.status_code == 200
assert len(res.json()) == 1 assert len(res.json()) == 1
async def test_delete_edge(client: AsyncClient, headers: dict, two_nodes): async def test_delete_edge(client: AsyncClient, headers: dict, two_nodes):
src, tgt = two_nodes src, tgt = two_nodes
edge_id = (await client.post("/api/v1/edges/", json={"source": src, "target": tgt, "type": "wifi"}, headers=headers)).json()["id"] edge_id = (await client.post("/api/v1/edges", json={"source": src, "target": tgt, "type": "wifi"}, headers=headers)).json()["id"]
res = await client.delete(f"/api/v1/edges/{edge_id}", headers=headers) res = await client.delete(f"/api/v1/edges/{edge_id}", headers=headers)
assert res.status_code == 204 assert res.status_code == 204
assert len((await client.get("/api/v1/edges/", headers=headers)).json()) == 0 assert len((await client.get("/api/v1/edges", headers=headers)).json()) == 0
backend/tests/test_nodes.py
+7 -7
View File
@@ -15,14 +15,14 @@ async def headers(client: AsyncClient):
async def test_list_nodes_empty(client: AsyncClient, headers: dict): async def test_list_nodes_empty(client: AsyncClient, headers: dict):
res = await client.get("/api/v1/nodes/", headers=headers) res = await client.get("/api/v1/nodes", headers=headers)
assert res.status_code == 200 assert res.status_code == 200
assert res.json() == [] assert res.json() == []
async def test_create_node(client: AsyncClient, headers: dict): async def test_create_node(client: AsyncClient, headers: dict):
payload = {"type": "server", "label": "My Server", "ip": "192.168.1.10", "status": "unknown"} payload = {"type": "server", "label": "My Server", "ip": "192.168.1.10", "status": "unknown"}
res = await client.post("/api/v1/nodes/", json=payload, headers=headers) res = await client.post("/api/v1/nodes", json=payload, headers=headers)
assert res.status_code == 201 assert res.status_code == 201
data = res.json() data = res.json()
assert data["label"] == "My Server" assert data["label"] == "My Server"
@@ -31,7 +31,7 @@ async def test_create_node(client: AsyncClient, headers: dict):
async def test_get_node(client: AsyncClient, headers: dict): async def test_get_node(client: AsyncClient, headers: dict):
create = await client.post("/api/v1/nodes/", json={"type": "router", "label": "Router", "status": "online"}, headers=headers) create = await client.post("/api/v1/nodes", json={"type": "router", "label": "Router", "status": "online"}, headers=headers)
node_id = create.json()["id"] node_id = create.json()["id"]
res = await client.get(f"/api/v1/nodes/{node_id}", headers=headers) res = await client.get(f"/api/v1/nodes/{node_id}", headers=headers)
assert res.status_code == 200 assert res.status_code == 200
@@ -44,7 +44,7 @@ async def test_get_node_not_found(client: AsyncClient, headers: dict):
async def test_update_node(client: AsyncClient, headers: dict): async def test_update_node(client: AsyncClient, headers: dict):
create = await client.post("/api/v1/nodes/", json={"type": "server", "label": "Old", "status": "unknown"}, headers=headers) create = await client.post("/api/v1/nodes", json={"type": "server", "label": "Old", "status": "unknown"}, headers=headers)
node_id = create.json()["id"] node_id = create.json()["id"]
res = await client.patch(f"/api/v1/nodes/{node_id}", json={"label": "New", "ip": "10.0.0.1"}, headers=headers) res = await client.patch(f"/api/v1/nodes/{node_id}", json={"label": "New", "ip": "10.0.0.1"}, headers=headers)
assert res.status_code == 200 assert res.status_code == 200
@@ -53,7 +53,7 @@ async def test_update_node(client: AsyncClient, headers: dict):
async def test_delete_node(client: AsyncClient, headers: dict): async def test_delete_node(client: AsyncClient, headers: dict):
create = await client.post("/api/v1/nodes/", json={"type": "switch", "label": "Switch", "status": "unknown"}, headers=headers) create = await client.post("/api/v1/nodes", json={"type": "switch", "label": "Switch", "status": "unknown"}, headers=headers)
node_id = create.json()["id"] node_id = create.json()["id"]
res = await client.delete(f"/api/v1/nodes/{node_id}", headers=headers) res = await client.delete(f"/api/v1/nodes/{node_id}", headers=headers)
assert res.status_code == 204 assert res.status_code == 204
@@ -62,6 +62,6 @@ async def test_delete_node(client: AsyncClient, headers: dict):
async def test_list_nodes_returns_all(client: AsyncClient, headers: dict): async def test_list_nodes_returns_all(client: AsyncClient, headers: dict):
for i in range(3): for i in range(3):
await client.post("/api/v1/nodes/", json={"type": "generic", "label": f"Node {i}", "status": "unknown"}, headers=headers) await client.post("/api/v1/nodes", json={"type": "generic", "label": f"Node {i}", "status": "unknown"}, headers=headers)
res = await client.get("/api/v1/nodes/", headers=headers) res = await client.get("/api/v1/nodes", headers=headers)
assert len(res.json()) == 3 assert len(res.json()) == 3