fix(auto-update): dismiss route rejects non-object JSON with 400

A JSON array or scalar body made `.get('alert_id')` raise, returning 500.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Chuck
2026-09-14 18:54:53 -04:00
co-authored by Claude Opus 5
parent a6790891f9
commit b15b7b4ae0
2 changed files with 6 additions and 3 deletions
+3 -2
View File
@@ -639,9 +639,10 @@ class TestStatusRoutes:
data = client.get('/api/v3/system/auto-update').get_json()['data'] data = client.get('/api/v3/system/auto-update').get_json()['data']
assert data == {'alert': 'rolled back', 'alert_id': '7'} assert data == {'alert': 'rolled back', 'alert_id': '7'}
def test_dismiss_needs_an_id(self, api_client): @pytest.mark.parametrize('body', [{}, [1], 'x', 5])
def test_dismiss_needs_an_id_in_a_json_object(self, api_client, body):
client, _, _ = api_client client, _, _ = api_client
assert client.post('/api/v3/system/auto-update/dismiss', json={}).status_code == 400 assert client.post('/api/v3/system/auto-update/dismiss', json=body).status_code == 400
def test_dismiss(self, api_client, monkeypatch): def test_dismiss(self, api_client, monkeypatch):
client, _, _ = api_client client, _, _ = api_client
+3 -1
View File
@@ -141,7 +141,9 @@ def get_auto_update_status():
def dismiss_auto_update_alert(): def dismiss_auto_update_alert():
"""Hide the current automatic-update banner until a new alert replaces it.""" """Hide the current automatic-update banner until a new alert replaces it."""
from web_interface import auto_update from web_interface import auto_update
alert_id = str((request.get_json(silent=True) or {}).get('alert_id') or '').strip() payload = request.get_json(silent=True)
# A JSON array or scalar is a bad request, not a 500.
alert_id = str(payload.get('alert_id') or '').strip() if isinstance(payload, dict) else ''
if not alert_id: if not alert_id:
return jsonify({'status': 'error', 'message': 'alert_id required'}), 400 return jsonify({'status': 'error', 'message': 'alert_id required'}), 400
auto_update.dismiss_alert(alert_id) auto_update.dismiss_alert(alert_id)