npm - @biffo/cli - Versions diffs - 0.215.3 → 0.215.4 - Mend

@biffo/cli 0.215.3 → 0.215.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/_skeletons/sibling-template/apps/frontend/src/app/page.test.tsx CHANGED Viewed

@@ -37,6 +37,7 @@ describe('HomePage', () => {
       get: vi.fn().mockResolvedValueOnce({ username: 'keiran' }),
       post: vi.fn(),
       put: vi.fn(),
+      patch: vi.fn(),
       delete: vi.fn(),
     })

package/_skeletons/sibling-template/apps/frontend/src/lib/api-client.test.ts ADDED Viewed

@@ -0,0 +1,63 @@
+import { describe, expect, it, vi, afterEach } from 'vitest'
+import { ApiError, createApiClient, extractErrorMessage } from './api-client'
+/**
+ * A backend's error body is JSON like `{"detail": "..."}`. Throwing the whole
+ * body as the message rendered `{"detail":"Internal Server Error"}` at the user
+ * in a course player (tabsii-lms#13) and `{"detail":"Administrator access
+ * required"}` where a user list belonged (biffo-template#1107). The API is
+ * behaving; the presentation is not.
+ *
+ * These mirror `services/api/tests/test_core_client.py::TestExtractDetail`
+ * case for case, because the two layers solve the same problem and drifting
+ * apart would make neither reasonable about.
+ */
+describe('extractErrorMessage', () => {
+  it('unwraps a JSON detail body', () => {
+    expect(extractErrorMessage('{"detail":"Internal Server Error"}', 'Server Error')).toBe(
+      'Internal Server Error',
+    )
+  })
+  it('falls back to the raw text when the body is not JSON', () => {
+    expect(extractErrorMessage('<html>Bad Gateway</html>', 'Bad Gateway')).toBe(
+      '<html>Bad Gateway</html>',
+    )
+  })
+  it('falls back to the raw text when the JSON has no detail key', () => {
+    expect(extractErrorMessage('{"message":"nope"}', 'Bad Request')).toBe('{"message":"nope"}')
+  })
+  it('falls back to the raw text when detail is not a string', () => {
+    const body = '{"detail":[{"loc":["body","x"],"msg":"bad"}]}'
+    expect(extractErrorMessage(body, 'Unprocessable Entity')).toBe(body)
+  })
+  it('uses the status text when the body is empty', () => {
+    expect(extractErrorMessage('', 'Internal Server Error')).toBe('Internal Server Error')
+  })
+})
+describe('createApiClient error handling', () => {
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+  it('throws an ApiError carrying the message, not the wire format', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn().mockResolvedValue({
+        ok: false,
+        status: 500,
+        statusText: 'Internal Server Error',
+        text: () => Promise.resolve('{"detail":"Internal Server Error"}'),
+      }),
+    )
+    const api = createApiClient(() => 'token')
+    await expect(api.get('/api/v1/courses')).rejects.toThrow(
+      new ApiError(500, 'Internal Server Error'),
+    )
+  })
+})

package/_skeletons/sibling-template/apps/frontend/src/lib/api-client.ts CHANGED Viewed

@@ -15,10 +15,46 @@ export class ApiError extends Error {
   }
 }
+/**
+ * The message a person should see for a failed request — not the wire format.
+ *
+ * A Biffo backend's errors are JSON like `{"detail": "..."}`. Throwing the
+ * whole body as the message renders `{"detail":"Internal Server Error"}` at
+ * the user (tabsii-lms#13, biffo-template#1107) — the API is behaving, the
+ * presentation is not.
+ *
+ * This is the browser-side twin of `_extract_detail` in this repo's
+ * `services/api/src/api/core_client.py`, which solves the identical problem
+ * server-side, and it keeps that function's reasoning deliberately:
+ *
+ * - **Parsed, never assumed.** A non-JSON body (a proxy timeout page, a
+ *   CloudFront error), or JSON with no `detail`, falls back to the raw text
+ *   unchanged — so this can never hide information the caller had before.
+ * - **A non-string `detail` also falls back.** FastAPI's own 422 makes
+ *   `detail` a list of field errors; picking something out of it would just
+ *   move the problem rather than fix it.
+ *
+ * The one addition over the Python version: an empty body yields the HTTP
+ * status text, because a browser rendering `''` shows the user nothing at all.
+ */
+export function extractErrorMessage(body: string, statusText: string): string {
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(body)
+  } catch {
+    return body || statusText
+  }
+  if (typeof parsed === 'object' && parsed !== null && 'detail' in parsed) {
+    const { detail } = parsed
+    if (typeof detail === 'string') return detail || statusText
+  }
+  return body || statusText
+}
 async function handleResponse<T>(res: Response): Promise<T> {
   if (!res.ok) {
-    const body = await res.text().catch(() => res.statusText)
-    throw new ApiError(res.status, body)
+    const body = await res.text().catch(() => '')
+    throw new ApiError(res.status, extractErrorMessage(body, res.statusText))
   }
   return res.json() as Promise<T>
 }
@@ -50,6 +86,16 @@ export function createApiClient(getIdToken: () => string | null) {
         body: JSON.stringify(body),
       }).then((r) => handleResponse<T>(r)),
+    // Folded in from tabsii-crm, which had added it locally. It costs a sibling
+    // that never calls it nothing, and leaving it out would mean this file
+    // could never be distributed without destroying crm's copy.
+    patch: <T>(path: string, body: unknown): Promise<T> =>
+      fetch(`${API_URL}${path}`, {
+        method: 'PATCH',
+        headers: authHeaders(),
+        body: JSON.stringify(body),
+      }).then((r) => handleResponse<T>(r)),
     delete: <T>(path: string): Promise<T> =>
       fetch(`${API_URL}${path}`, { method: 'DELETE', headers: authHeaders() }).then((r) =>
         handleResponse<T>(r),

package/_skeletons/sibling-template/services/api/src/api/core_client.py CHANGED Viewed

@@ -14,6 +14,35 @@ class CoreApiError(Exception):
         super().__init__(detail)
+def _extract_detail(response: httpx.Response) -> str:
+    """The message a caller should see for an upstream error, not the whole body.
+    The core's own error responses are JSON like ``{"detail": "..."}`` --
+    ``response.text`` is that ENTIRE body, so raising it as-is and then handing
+    it to FastAPI's ``HTTPException(detail=...)`` serialises it a second time.
+    The client then receives ``{"detail": "{\\"detail\\": \\"<message>\\"}"}``:
+    valid JSON, but a JSON *string* rather than the message inside it, and any
+    component that renders ``detail`` shows that raw escaped blob to a user
+    (tabsii-crm#137).
+    Parsed rather than assumed: a non-JSON or JSON-without-``detail`` upstream
+    body (a proxy timeout page, a differently-shaped error) falls back to the
+    raw text unchanged, so this never hides information the caller had before.
+    Fixed in two siblings independently before it was ever fixed HERE, which is
+    why three more were still shipping ``response.text`` months later. The
+    browser-side twin is ``extractErrorMessage`` in
+    ``apps/frontend/src/lib/api-client.ts``; keep the two in step.
+    """
+    try:
+        body = response.json()
+    except ValueError:
+        return response.text
+    if isinstance(body, dict) and isinstance(body.get("detail"), str):
+        return body["detail"]
+    return response.text
 class CoreApiClient:
     """
     Thin per-request client for calling the core project's API (ADR-0002/
@@ -38,7 +67,7 @@ class CoreApiClient:
                 headers={"Authorization": f"Bearer {self._bearer_token}"},
             )
         if response.is_error:
-            raise CoreApiError(response.status_code, response.text)
+            raise CoreApiError(response.status_code, _extract_detail(response))
         return response.json()  # type: ignore[no-any-return]
     async def post(self, path: str, body: dict) -> dict:
@@ -49,7 +78,7 @@ class CoreApiClient:
                 headers={"Authorization": f"Bearer {self._bearer_token}"},
             )
         if response.is_error:
-            raise CoreApiError(response.status_code, response.text)
+            raise CoreApiError(response.status_code, _extract_detail(response))
         return response.json()  # type: ignore[no-any-return]

package/_skeletons/sibling-template/services/api/tests/test_core_client.py ADDED Viewed

@@ -0,0 +1,73 @@
+"""A proxied error must reach a caller as a plain message, not a JSON string
+re-serialised from an already-JSON upstream body.
+`CoreApiClient` raises `CoreApiError(status_code, detail)` on every verb, and a
+router turns that into `HTTPException(status_code=exc.status_code,
+detail=exc.detail)`. When `detail` was `response.text` — the WHOLE upstream
+body — a core error like `{"detail": "Method Not Allowed"}` became, once
+FastAPI serialised it a second time, `{"detail": "{\\"detail\\": \\"Method Not
+Allowed\\"}"}`: valid JSON, but a JSON *string* rather than the message inside
+it. Any component that renders `detail` showed that raw escaped blob to a user.
+Found and fixed independently in two siblings (tabsii-crm#137, tabsii-lms#13)
+before it was ever fixed in this skeleton, so three more siblings were still
+shipping the bug months later. The test lives here now so a sibling is born
+with it.
+"""
+import httpx
+import pytest
+from api.config import settings
+from api.core_client import CoreApiClient, CoreApiError, _extract_detail
+class TestExtractDetail:
+    """The parsing rule alone, with no network involved."""
+    def test_unwraps_a_json_detail_body(self) -> None:
+        response = httpx.Response(422, json={"detail": "Method Not Allowed"})
+        assert _extract_detail(response) == "Method Not Allowed"
+    def test_falls_back_to_raw_text_when_not_json(self) -> None:
+        response = httpx.Response(502, content=b"<html>Bad Gateway</html>")
+        assert _extract_detail(response) == "<html>Bad Gateway</html>"
+    def test_falls_back_to_raw_text_when_json_has_no_detail_key(self) -> None:
+        response = httpx.Response(400, json={"message": "nope"})
+        assert _extract_detail(response) == response.text
+    def test_falls_back_to_raw_text_when_detail_is_not_a_string(self) -> None:
+        # A validation-error body shaped like FastAPI's own 422 (`detail` is a
+        # list of field errors) — extracting a non-string would just move the
+        # double-encoding problem rather than fix it, so this is left as the
+        # raw body precisely like the "not JSON" case.
+        response = httpx.Response(422, json={"detail": [{"loc": ["body", "x"], "msg": "bad"}]})
+        assert _extract_detail(response) == response.text
+class TestCoreApiClientErrorPassthrough:
+    """A mocked upstream error reaches `CoreApiError.detail` flat."""
+    async def test_get_surfaces_the_inner_message_not_the_whole_body(
+        self, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        monkeypatch.setattr(settings, "core_api_url", "https://core.example.com")
+        def handler(request: httpx.Request) -> httpx.Response:
+            return httpx.Response(403, json={"detail": "Administrator access required"})
+        transport = httpx.MockTransport(handler)
+        original = httpx.AsyncClient
+        def patched(*args, **kwargs):  # type: ignore[no-untyped-def]
+            kwargs["transport"] = transport
+            return original(*args, **kwargs)
+        monkeypatch.setattr(httpx, "AsyncClient", patched)
+        with pytest.raises(CoreApiError) as excinfo:
+            await CoreApiClient("token").get("/api/v1/admin/users")
+        assert excinfo.value.detail == "Administrator access required"
+        assert excinfo.value.status_code == 403

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.215.3",
+  "version": "0.215.4",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",