Skip to content

Reject PUT changes to ImportList.MinRefreshInterval instead of discarding them - #86

Open
jbob06 wants to merge 1 commit into
Chaptarr:developfrom
jbob06:fix/importlist-minrefreshinterval-immutable
Open

Reject PUT changes to ImportList.MinRefreshInterval instead of discarding them#86
jbob06 wants to merge 1 commit into
Chaptarr:developfrom
jbob06:fix/importlist-minrefreshinterval-immutable

Conversation

@jbob06

@jbob06 jbob06 commented Aug 26, 2026

Copy link
Copy Markdown

Summary

Fixes #23.

ImportListDefinition.MinRefreshInterval is a fixed, per-list-type constant declared on each IImportList implementation (e.g. GoodreadsBookshelf => TimeSpan.FromHours(12)), intentionally excluded from persistence (TableMapping.cs has .Ignore(i => i.MinRefreshInterval)), and unconditionally overwritten from the provider on every load via ImportListFactory.SetProviderCharacteristics. So a PUT /api/v1/importlist/{id} that changed it was silently accepted (HTTP 202), with the change discarded - the response goes on to echo the provider's value, not the one that was requested.

This adds a PutValidator rule comparing the requested value against the provider's authoritative value (via _importListFactory.Find(id) + SetProviderCharacteristics) and rejects the PUT with a clear validation error when they differ, instead of silently discarding it.

Two things to flag:

  • TimeSpan.Zero is always allowed through, since MinRefreshInterval is a non-nullable TimeSpan and a client that omits the field from its request body gets zero on deserialization. No provider ever uses zero, so this can't mask a real attempt to change the value, and it avoids a spurious 400 for clients that only send the fields they mean to change.
  • An unknown id is left to the normal Get()-based 404 handling rather than surfacing as a validation error from this rule.
  • POST isn't covered here (as written it couldn't be - Find(0) returns null for a not-yet-created list) - ImportList minRefreshInterval cannot be changed via the API (PUT is silently ignored) #23 is specifically about PUT, and POST already discards a client-supplied value the same way it always has.

Test plan

  • New unit tests in ImportListControllerMinRefreshIntervalFixture (4 cases: reject a real change, allow leaving it unchanged, allow omitting the field, defer to normal not-found handling for an unknown id) - built against the real ImportListController and the same ValidateResource method the ASP.NET pipeline calls on every PUT
  • Full existing test suite passes unchanged (2856/2856)

…ding them

MinRefreshInterval is a fixed, per-list-type constant declared on each
IImportList implementation (e.g. GoodreadsBookshelf => 12 hours) and is
intentionally excluded from persistence (TableMapping ignores it).
ImportListFactory.SetProviderCharacteristics unconditionally overwrites
it from the provider on every load, so a PUT that changed it was
silently accepted (202) with the change discarded - the response goes
on to echo the provider's value, not the one that was requested.

Add a PutValidator rule that compares the requested value against the
provider's authoritative value and returns a clear validation error
when they differ, instead of a silent no-op. TimeSpan.Zero (what a
non-nullable TimeSpan field deserializes to when omitted from the
request body) is always allowed through, since no provider ever uses
zero and clients that only send the fields they mean to change
shouldn't get a spurious 400. An unknown id is left to the normal
Get()-based 404 handling rather than surfacing as a validation error.

Fixes Chaptarr#23
@jbob06
jbob06 requested a review from robertlordhood as a code owner August 26, 2026 16:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ImportList minRefreshInterval cannot be changed via the API (PUT is silently ignored)

1 participant