V3 Hardening & Fixes: Structured Errors, JWT Fallbacks, and Module Stability
- Implemented Structured Error Handling across GET/POST/PATCH helpers to extract rich V3 error metadata. - Added direct localStorage fallback for JWT detection to resolve race conditions during initial page load. - Fixed async race condition in Archives leading to 'archive_content_li is undefined' crash. - Hardened generic object processor to handle non-array API responses gracefully. - Resolved zero-result bug in Event Search by using raw 'account_id_random' to bypass backend mapping conflicts. - Isolated bootstrap headers in +layout.ts and removed invalid response headers from request config. - Enhanced /testing dashboard with live header inspection and V3 hardening audits.
This commit is contained in:
Scott Idem
@@ -43,7 +43,6 @@ const ae_api_init: key_val = {
|
||||
};
|
||||
|
||||
const ae_api_headers: key_val = {
|
||||
'Access-Control-Allow-Origin': '*',
|
||||
'Content-Type': 'application/json',
|
||||
'x-aether-api-key': api_secret_key,
|
||||
'x-ae-ignore-extra-fields': 'true'
|
||||
@@ -117,7 +116,7 @@ export async function load({ fetch, params, parent, route, url }) {
|
||||
headers: {
|
||||
...ae_api_init.headers,
|
||||
'x-aether-api-key': 'IDF68Em5X4HTZlswRNgepQ',
|
||||
'x-no-account-id': ae_no_account_id || 'bypass'
|
||||
'x-no-account-id': 'bypass' // Force explicit bypass for bootstrap
|
||||
}
|
||||
};
|
||||
|
||||
|
||||
@@ -5,6 +5,7 @@
|
||||
import { ae_loc, ae_api, ae_sess } from '$lib/stores/ae_stores';
|
||||
import { get_object } from '$lib/ae_api/api_get_object';
|
||||
import { post_object } from '$lib/ae_api/api_post_object';
|
||||
import { patch_object } from '$lib/ae_api/api_patch_object';
|
||||
import {
|
||||
Database,
|
||||
Server,
|
||||
@@ -29,7 +30,8 @@
|
||||
Code,
|
||||
FlaskConical,
|
||||
Info,
|
||||
Satellite
|
||||
Satellite,
|
||||
Settings2
|
||||
} from 'lucide-svelte';
|
||||
|
||||
// Core Module Imports
|
||||
@@ -178,54 +180,83 @@
|
||||
|
||||
// V3 Schema & Error Validation
|
||||
const test_permissive_mode = () => run_test('Permissive Mode Test', async () => {
|
||||
const endpoint = `/v3/crud/account/${$ae_loc.account_id || 'ghost'}`;
|
||||
// Capture current state at test time
|
||||
const current_ae_api = $ae_api;
|
||||
const current_ae_loc = $ae_loc;
|
||||
|
||||
const endpoint = `/v3/crud/account/${current_ae_loc.account_id || 'ghost'}`;
|
||||
const data = {
|
||||
name: $ae_loc.account_name,
|
||||
name: current_ae_loc.account_name,
|
||||
_non_existent_field: 'This should be ignored by the API'
|
||||
};
|
||||
// Use post_object for a patch-like operation if needed, or update_ae_obj_v3 style
|
||||
// For testing purposes, we'll use a standard fetch to see raw response
|
||||
const url = new URL(endpoint, $ae_api.base_url);
|
||||
const headers = {
|
||||
...$ae_api.headers,
|
||||
'x-account-id': $ae_loc.account_id || 'ghost',
|
||||
'Authorization': `Bearer ${$ae_loc.jwt}`
|
||||
};
|
||||
|
||||
const response = await fetch(url.toString(), {
|
||||
method: 'PATCH',
|
||||
headers,
|
||||
body: JSON.stringify(data)
|
||||
console.log('Permissive Mode: Starting PATCH test...', { endpoint, headers: current_ae_api.headers });
|
||||
|
||||
const result = await patch_object({
|
||||
api_cfg: current_ae_api,
|
||||
endpoint,
|
||||
data,
|
||||
log_lvl: 1
|
||||
});
|
||||
|
||||
const result = await response.json();
|
||||
return { status: response.status, result };
|
||||
if (!result) throw new Error('API returned false. Check console for 401/403/500 errors.');
|
||||
|
||||
return {
|
||||
message: 'SUCCESS: API accepted request with unknown field (Permissive Mode Active)',
|
||||
account_id: result.account_id,
|
||||
id_vision: typeof result.account_id === 'string' ? 'V3 (String)' : 'LEGACY (Integer)',
|
||||
returned_data: result
|
||||
};
|
||||
});
|
||||
|
||||
const test_structured_error = () => run_test('Structured Error Validation (Deliberate 400)', async () => {
|
||||
const endpoint = `/v3/crud/account/${$ae_loc.account_id || 'ghost'}`;
|
||||
// To trigger a 400 error despite permissive mode, we'll try to set a read-only field or invalid type if possible
|
||||
// Actually, the easiest way to test structured error is to send a malformed filter to /search
|
||||
const url = new URL(`${endpoint.split('/account')[0]}/account/search`, $ae_api.base_url);
|
||||
const headers = {
|
||||
...$ae_api.headers,
|
||||
'x-account-id': $ae_loc.account_id || 'ghost',
|
||||
'Authorization': `Bearer ${$ae_loc.jwt}`
|
||||
const current_ae_api = $ae_api;
|
||||
|
||||
// Use the exact Recovery Meetings search pattern to verify why it's throwing 403
|
||||
const endpoint = `/v3/crud/event/search`;
|
||||
const search_query = {
|
||||
and: [
|
||||
{ field: "conference", op: "eq", value: 0 },
|
||||
{ field: "trigger_schema_violation_400", op: "eq", value: "fail" }
|
||||
]
|
||||
};
|
||||
|
||||
const response = await fetch(url.toString(), {
|
||||
method: 'POST',
|
||||
headers,
|
||||
body: JSON.stringify({ and: [{ field: "non_existent", op: "eq", value: "fail" }] })
|
||||
console.log('Structured Error: Starting deliberate 400 test with Recovery filters...', { endpoint });
|
||||
|
||||
const result = await post_object({
|
||||
api_cfg: current_ae_api,
|
||||
endpoint,
|
||||
data: search_query,
|
||||
log_lvl: 1
|
||||
});
|
||||
|
||||
const result = await response.json();
|
||||
return { status: response.status, structured_details: result.meta?.details || 'MISSING' };
|
||||
// In Structured Error Mode, the helper returns the JSON object if it contains meta.details
|
||||
if (result?.meta?.details) {
|
||||
return {
|
||||
success: true,
|
||||
message: 'PASS: Successfully extracted rich error metadata',
|
||||
source: result.meta.details.category === 'validation' ? 'FastAPI Detail (Wrapped)' : 'V3 Meta Envelope',
|
||||
details: result.meta.details
|
||||
};
|
||||
}
|
||||
|
||||
return {
|
||||
success: false,
|
||||
message: 'FAIL: API returned an error but the helper could not extract metadata.',
|
||||
raw_result: result
|
||||
};
|
||||
});
|
||||
|
||||
// Environment Diagnostics
|
||||
let is_native = $derived(typeof window !== 'undefined' && !!(window as any).native_app);
|
||||
let app_mode = $derived($events_loc?.launcher?.app_mode || 'web');
|
||||
|
||||
// Derived state for Header Inspection - dynamically reconstruct standard request headers
|
||||
let active_headers = $derived({
|
||||
...($ae_api.headers || {}),
|
||||
'x-account-id': $ae_loc.account_id || '(missing)',
|
||||
'Authorization': $ae_loc.jwt ? `Bearer ${$ae_loc.jwt.slice(0, 10)}...` : '(missing)'
|
||||
});
|
||||
|
||||
</script>
|
||||
|
||||
@@ -291,6 +322,27 @@
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Header Inspection Card -->
|
||||
<div class="card p-6 variant-soft-primary space-y-4 border border-gray-500 shadow-lg">
|
||||
<header class="flex justify-between items-center border-b border-gray-500 pb-3">
|
||||
<div class="flex items-center gap-2 text-primary-700 dark:text-primary-300">
|
||||
<Settings2 size={20} />
|
||||
<h3 class="h3 font-bold">Live V3 Header Inspection</h3>
|
||||
</div>
|
||||
<span class="text-[10px] font-mono opacity-50 uppercase tracking-tighter">Real-time API Store View</span>
|
||||
</header>
|
||||
<div class="grid grid-cols-1 md:grid-cols-2 gap-4">
|
||||
{#each Object.entries(active_headers) as [key, value]}
|
||||
<div class="flex justify-between items-center p-3 bg-gray-500/10 rounded border border-gray-500/20">
|
||||
<span class="text-[10px] font-mono font-bold opacity-70">{key}</span>
|
||||
<span class="text-xs font-mono {key === 'x-ae-ignore-extra-fields' ? 'text-success-500 font-bold' : ''}">
|
||||
{key.includes('key') || key.includes('token') || key.includes('account') ? '********' : value}
|
||||
</span>
|
||||
</div>
|
||||
{/each}
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Session Context Card -->
|
||||
<div class="card p-6 variant-soft-surface space-y-4 border border-gray-500 shadow-lg">
|
||||
<header class="flex justify-between items-center border-b border-gray-500 pb-3">
|
||||
@@ -495,10 +547,10 @@
|
||||
<ShieldAlert size={20}/>
|
||||
<h4 class="h4 font-bold uppercase tracking-widest">V3 Hardening</h4>
|
||||
</header>
|
||||
<button class="btn variant-filled-warning p-4 w-full shadow-md transition-all hover:scale-[1.02] flex items-center justify-center gap-2" disabled={!$ae_loc.jwt} onclick={test_permissive_mode} title="Verifies the API ignores unknown fields (x-ae-ignore-extra-fields).">
|
||||
<button class="btn variant-filled-warning p-4 w-full shadow-md transition-all hover:scale-[1.02] flex items-center justify-center gap-2" onclick={test_permissive_mode} title="Verifies the API ignores unknown fields (x-ae-ignore-extra-fields).">
|
||||
<Zap size={16}/> Permissive Mode Test
|
||||
</button>
|
||||
<button class="btn variant-filled-error p-4 w-full shadow-md transition-all hover:scale-[1.02] flex items-center justify-center gap-2" disabled={!$ae_loc.jwt} onclick={test_structured_error} title="Deliberately triggers a 400 error to verify rich metadata extraction.">
|
||||
<button class="btn variant-filled-error p-4 w-full shadow-md transition-all hover:scale-[1.02] flex items-center justify-center gap-2" onclick={test_structured_error} title="Deliberately triggers a 400 error to verify rich metadata extraction.">
|
||||
<ShieldAlert size={16}/> Structured Error Test
|
||||
</button>
|
||||
</div>
|
||||
|
||||
Reference in New Issue
Block a user