Hardened API and catered for Partner role query filter bypass

2026-10-04 08:18:43 +02:00
parent 8d069c2da0
commit 8100518549
62 changed files with 232 additions and 193 deletions
@@ -19,7 +19,7 @@ public class CreateIndicatorEndpoint : IEndpoint
                await service.CreateIndicatorAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
@@ -28,8 +28,8 @@ public class CreateIndicatorEndpoint : IEndpoint
            .WithName(typeof(CreateIndicatorEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Evidence);
@@ -19,7 +19,7 @@ public class CreateMilestoneEndpoint : IEndpoint
                await service.CreateMilestoneAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
@@ -30,6 +30,7 @@ public class CreateMilestoneEndpoint : IEndpoint
            .Produces(StatusCodes.Status200OK)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Evidence);
    }
@@ -19,7 +19,7 @@ public sealed class GetEvidenceEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var evidence } => Results.Ok(evidence),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a specific evidence record and assiciated file URLs")
@@ -27,9 +27,9 @@ public sealed class GetEvidenceEndpoint : IEndpoint
            .WithName(typeof(GetEvidenceEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Domain.Models.Evidence>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces(StatusCodes.Status403Forbidden)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Evidence)
            .CacheOutput();
@@ -19,17 +19,17 @@ public sealed class GetEvidenceUrlEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var evidenceUrl } => Results.Ok(evidenceUrl),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Gets a secure download URL of the evidence file, URL expires (default: 15min)")
            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetEvidenceUrlEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
-            .Produces<string>(StatusCodes.Status200OK)
-            .Produces<string>(StatusCodes.Status404NotFound)
-            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<string>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Grants)
            .CacheOutput();
@@ -20,7 +20,7 @@ public sealed class GetIndicatorEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var indicator } => Results.Ok(indicator),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a specific indicator.")
@@ -28,9 +28,9 @@ public sealed class GetIndicatorEndpoint : IEndpoint
            .WithName(typeof(GetIndicatorEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Indicator>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces(StatusCodes.Status403Forbidden)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Evidence)
            .CacheOutput();
@@ -19,7 +19,7 @@ public sealed class UpdateEvidenceEndpoint : IEndpoint
                await service.UpdateEvidenceAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
@@ -29,9 +29,9 @@ public sealed class UpdateEvidenceEndpoint : IEndpoint
            .WithName(typeof(UpdateEvidenceEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Evidence);