Scott.Idem/OSIT-AE-App-Svelte
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V3 Hardening & Fixes: Structured Errors, JWT Fallbacks, and Module Stability

Browse Source 
- Implemented Structured Error Handling across GET/POST/PATCH helpers to extract rich V3 error metadata.
- Added direct localStorage fallback for JWT detection to resolve race conditions during initial page load.
- Fixed async race condition in Archives leading to 'archive_content_li is undefined' crash.
- Hardened generic object processor to handle non-array API responses gracefully.
- Resolved zero-result bug in Event Search by using raw 'account_id_random' to bypass backend mapping conflicts.
- Isolated bootstrap headers in +layout.ts and removed invalid response headers from request config.
- Enhanced /testing dashboard with live header inspection and V3 hardening audits.
This commit is contained in:
Scott Idem
2026-01-19 19:06:32 -05:00
parent c40a296a77
commit 0e411531eb
8 changed files with 354 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files

118
src/routes/testing/+page.svelte
View File

@@ -5,6 +5,7 @@
import { ae_loc, ae_api, ae_sess } from '$lib/stores/ae_stores';
import { get_object } from '$lib/ae_api/api_get_object';
import { post_object } from '$lib/ae_api/api_post_object';
import { patch_object } from '$lib/ae_api/api_patch_object';
import {
Database,
Server,
@@ -29,7 +30,8 @@
Code,
FlaskConical,
Info,
Satellite
Satellite,
Settings2
} from 'lucide-svelte';
// Core Module Imports
@@ -178,54 +180,83 @@
// V3 Schema & Error Validation
const test_permissive_mode = () => run_test('Permissive Mode Test', async () => {
const endpoint = `/v3/crud/account/${$ae_loc.account_id || 'ghost'}`;
// Capture current state at test time
const current_ae_api = $ae_api;
const current_ae_loc = $ae_loc;
const endpoint = `/v3/crud/account/${current_ae_loc.account_id || 'ghost'}`;
const data = {
name: $ae_loc.account_name,
name: current_ae_loc.account_name,
_non_existent_field: 'This should be ignored by the API'
};
// Use post_object for a patch-like operation if needed, or update_ae_obj_v3 style
// For testing purposes, we'll use a standard fetch to see raw response
const url = new URL(endpoint, $ae_api.base_url);
const headers = {
...$ae_api.headers,
'x-account-id': $ae_loc.account_id || 'ghost',
'Authorization': `Bearer ${$ae_loc.jwt}`
};
const response = await fetch(url.toString(), {
method: 'PATCH',
headers,
body: JSON.stringify(data)
console.log('Permissive Mode: Starting PATCH test...', { endpoint, headers: current_ae_api.headers });
const result = await patch_object({
api_cfg: current_ae_api,
endpoint,
data,
log_lvl: 1
});
const result = await response.json();
return { status: response.status, result };
if (!result) throw new Error('API returned false. Check console for 401/403/500 errors.');
return {
message: 'SUCCESS: API accepted request with unknown field (Permissive Mode Active)',
account_id: result.account_id,
id_vision: typeof result.account_id === 'string' ? 'V3 (String)' : 'LEGACY (Integer)',
returned_data: result
};
});
const test_structured_error = () => run_test('Structured Error Validation (Deliberate 400)', async () => {
const endpoint = `/v3/crud/account/${$ae_loc.account_id || 'ghost'}`;
// To trigger a 400 error despite permissive mode, we'll try to set a read-only field or invalid type if possible
// Actually, the easiest way to test structured error is to send a malformed filter to /search
const url = new URL(`${endpoint.split('/account')[0]}/account/search`, $ae_api.base_url);
const headers = {
...$ae_api.headers,
'x-account-id': $ae_loc.account_id || 'ghost',
'Authorization': `Bearer ${$ae_loc.jwt}`
const current_ae_api = $ae_api;
// Use the exact Recovery Meetings search pattern to verify why it's throwing 403
const endpoint = `/v3/crud/event/search`;
const search_query = {
and: [
{ field: "conference", op: "eq", value: 0 },
{ field: "trigger_schema_violation_400", op: "eq", value: "fail" }
]
};
const response = await fetch(url.toString(), {
method: 'POST',
headers,
body: JSON.stringify({ and: [{ field: "non_existent", op: "eq", value: "fail" }] })
console.log('Structured Error: Starting deliberate 400 test with Recovery filters...', { endpoint });
const result = await post_object({
api_cfg: current_ae_api,
endpoint,
data: search_query,
log_lvl: 1
});
const result = await response.json();
return { status: response.status, structured_details: result.meta?.details || 'MISSING' };
// In Structured Error Mode, the helper returns the JSON object if it contains meta.details
if (result?.meta?.details) {
return {
success: true,
message: 'PASS: Successfully extracted rich error metadata',
source: result.meta.details.category === 'validation' ? 'FastAPI Detail (Wrapped)' : 'V3 Meta Envelope',
details: result.meta.details
};
}
return {
success: false,
message: 'FAIL: API returned an error but the helper could not extract metadata.',
raw_result: result
};
});
// Environment Diagnostics
let is_native = $derived(typeof window !== 'undefined' && !!(window as any).native_app);
let app_mode = $derived($events_loc?.launcher?.app_mode || 'web');
// Derived state for Header Inspection - dynamically reconstruct standard request headers
let active_headers = $derived({
...($ae_api.headers || {}),
'x-account-id': $ae_loc.account_id || '(missing)',
'Authorization': $ae_loc.jwt ? `Bearer ${$ae_loc.jwt.slice(0, 10)}...` : '(missing)'
});
</script>
@@ -291,6 +322,27 @@
</div>
</div>
<!-- Header Inspection Card -->
<div class="card p-6 variant-soft-primary space-y-4 border border-gray-500 shadow-lg">
<header class="flex justify-between items-center border-b border-gray-500 pb-3">
<div class="flex items-center gap-2 text-primary-700 dark:text-primary-300">
<Settings2 size={20} />
<h3 class="h3 font-bold">Live V3 Header Inspection</h3>
</div>
<span class="text-[10px] font-mono opacity-50 uppercase tracking-tighter">Real-time API Store View</span>
</header>
<div class="grid grid-cols-1 md:grid-cols-2 gap-4">
{#each Object.entries(active_headers) as [key, value]}
<div class="flex justify-between items-center p-3 bg-gray-500/10 rounded border border-gray-500/20">
<span class="text-[10px] font-mono font-bold opacity-70">{key}</span>
<span class="text-xs font-mono {key === 'x-ae-ignore-extra-fields' ? 'text-success-500 font-bold' : ''}">
{key.includes('key') || key.includes('token') || key.includes('account') ? '********' : value}
</span>
</div>
{/each}
</div>
</div>
<!-- Session Context Card -->
<div class="card p-6 variant-soft-surface space-y-4 border border-gray-500 shadow-lg">
<header class="flex justify-between items-center border-b border-gray-500 pb-3">
@@ -495,10 +547,10 @@
<ShieldAlert size={20}/>
<h4 class="h4 font-bold uppercase tracking-widest">V3 Hardening</h4>
</header>
<button class="btn variant-filled-warning p-4 w-full shadow-md transition-all hover:scale-[1.02] flex items-center justify-center gap-2" disabled={!$ae_loc.jwt} onclick={test_permissive_mode} title="Verifies the API ignores unknown fields (x-ae-ignore-extra-fields).">
<button class="btn variant-filled-warning p-4 w-full shadow-md transition-all hover:scale-[1.02] flex items-center justify-center gap-2" onclick={test_permissive_mode} title="Verifies the API ignores unknown fields (x-ae-ignore-extra-fields).">
<Zap size={16}/> Permissive Mode Test
</button>
<button class="btn variant-filled-error p-4 w-full shadow-md transition-all hover:scale-[1.02] flex items-center justify-center gap-2" disabled={!$ae_loc.jwt} onclick={test_structured_error} title="Deliberately triggers a 400 error to verify rich metadata extraction.">
<button class="btn variant-filled-error p-4 w-full shadow-md transition-all hover:scale-[1.02] flex items-center justify-center gap-2" onclick={test_structured_error} title="Deliberately triggers a 400 error to verify rich metadata extraction.">
<ShieldAlert size={16}/> Structured Error Test
</button>
</div>