trueppm-api 0.4.0__py3-none-any.whl

trueppm_api/core/ratelimit.py

@@ -0,0 +1,148 @@
+"""Global rate-limiting kill switch (ADR-0604, extends ADR-0208).
+
+An operator-only escape hatch to disable **all** DRF throttling — e.g. to measure
+raw throughput in a k6 load test, or to run the full stack locally without
+fighting per-account limits. Disabling rate limiting removes a DoS/abuse
+protection, so it is deliberately hard to enable by accident:
+
+* ``TRUEPPM_RATE_LIMIT_ENABLED`` (bool, default ``True``) must be set false, **and**
+* ``TRUEPPM_RATE_LIMIT_DISABLE_ACK`` must equal :data:`RATE_LIMIT_DISABLE_ACK_SENTINEL`.
+
+Both are required in **every** environment (the acknowledgment is *not* gated on
+``DEBUG``): a uniform "disabling a security control always needs the explicit
+sentinel" invariant is simpler to reason about and leaves no ``DEBUG``-dependent
+edge case. A disable request without the exact sentinel is **ignored** — rate
+limiting stays on — and reported at ``CRITICAL``, so a stray env var can never
+silently open a DoS path. The refusal fails toward the *protected* state (limits
+on), never toward an outage: a fat-fingered flag must not remove protection *or*
+crash the app, so this deliberately does **not** ``raise`` the way the
+unencrypted-DB guard does.
+
+This is deploy-time operator config, never a UI/API toggle — an authenticated
+user must not be able to switch off a platform DoS protection (ADR-0497). The
+live state is surfaced read-only to workspace admins via ``/health/system/`` and
+a banner, and to monitoring via the ``trueppm.ratelimit.enabled`` OTEL gauge.
+
+The logic here is split into small pure functions so both the two-key
+acknowledgment resolution and the DRF-config transform are unit-testable without
+booting Django or mutating process env.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any, TypeVar
+
+if TYPE_CHECKING:
+    from collections.abc import MutableMapping
+
+    from rest_framework.request import Request
+    from rest_framework.throttling import BaseThrottle
+    from rest_framework.views import APIView
+
+# Bound as a string so ``rest_framework`` is never imported at runtime here — this
+# module is imported at settings-load time, and importing DRF that early risks the
+# ``rest_framework.views`` circular-import hazard documented in core/throttling.py.
+_ThrottleT = TypeVar("_ThrottleT", bound="BaseThrottle")
+
+# The exact acknowledgment an operator must set in ``TRUEPPM_RATE_LIMIT_DISABLE_ACK``
+# (alongside ``TRUEPPM_RATE_LIMIT_ENABLED=false``) to actually disable rate
+# limiting. Required in every environment. Documented verbatim in
+# docs/administration and referenced by ADR-0604; treat as a stable operator
+# contract — do not change the string without a deprecation note.
+RATE_LIMIT_DISABLE_ACK_SENTINEL = "i-understand-this-disables-abuse-protection"
+
+_DISABLED_MESSAGE = (
+    "API rate limiting is DISABLED (TRUEPPM_RATE_LIMIT_ENABLED=false with a valid "
+    "acknowledgment). Every DRF throttle — including the fail-closed sync write-path "
+    "throttle — is bypassed. This removes DoS/abuse protection and must never be set "
+    "on a production-facing deployment."
+)
+_REFUSED_MESSAGE = (
+    "Ignoring TRUEPPM_RATE_LIMIT_ENABLED=false: the required acknowledgment "
+    "TRUEPPM_RATE_LIMIT_DISABLE_ACK is missing or does not match the documented "
+    "sentinel. API rate limiting remains ENABLED. This is the safe default — a stray "
+    "disable flag never silently removes abuse protection."
+)
+
+
+def resolve_rate_limit_enabled(*, requested_enabled: bool, ack: str) -> tuple[bool, str | None]:
+    """Resolve the effective rate-limit switch from the two operator env inputs.
+
+    Args:
+        requested_enabled: value of ``TRUEPPM_RATE_LIMIT_ENABLED`` (default True).
+        ack: value of ``TRUEPPM_RATE_LIMIT_DISABLE_ACK`` (default "").
+
+    Returns:
+        ``(enabled, critical_message)``. ``critical_message`` is non-None whenever
+        the operator asked to disable rate limiting — either confirming the
+        (acknowledged) disable or reporting that an unacknowledged disable was
+        refused — so the caller logs it at ``CRITICAL``. The default (enabled)
+        path is silent.
+    """
+    if requested_enabled:
+        return True, None
+    if ack == RATE_LIMIT_DISABLE_ACK_SENTINEL:
+        return False, _DISABLED_MESSAGE
+    # Disable requested without the exact acknowledgment: refuse. Fail toward the
+    # protected state (limits ON), never toward an outage.
+    return True, _REFUSED_MESSAGE
+
+
+def apply_rate_limit_disable(rest_framework_config: MutableMapping[str, Any]) -> None:
+    """Neutralize every DRF throttle in a REST_FRAMEWORK config, in place.
+
+    Drops ``DEFAULT_THROTTLE_CLASSES`` and sets every ``DEFAULT_THROTTLE_RATES``
+    value to ``None`` — DRF's ``SimpleRateThrottle.allow_request`` returns True
+    immediately when its resolved rate is ``None``, so this disables *all*
+    SimpleRateThrottle-family throttles (defaults, scoped, MCP, invite,
+    monte-carlo, share, and any added later) from a single place, with no
+    per-class edits. Called from settings only when the operator has disabled
+    rate limiting with a valid acknowledgment.
+
+    The custom Redis ``BaseThrottle`` classes (task-sync, sync-upload, mentions,
+    …) do not read these rates, so they check the flag at request time via
+    :func:`rate_limiting_disabled` instead. Idempotent.
+    """
+    rest_framework_config["DEFAULT_THROTTLE_CLASSES"] = []
+    rates = rest_framework_config.get("DEFAULT_THROTTLE_RATES") or {}
+    rest_framework_config["DEFAULT_THROTTLE_RATES"] = dict.fromkeys(rates, None)
+
+
+def bypass_when_disabled(throttle_cls: type[_ThrottleT]) -> type[_ThrottleT]:
+    """Class decorator: allow all requests when the global kill switch is off.
+
+    Wraps a throttle's ``allow_request`` so it returns ``True`` — checked at
+    *request* time, before any Redis work — whenever an operator has disabled
+    rate limiting (ADR-0604). Applied to the custom Redis ``BaseThrottle``
+    throttles (task-sync, sync-upload, git-webhook, task-link-refresh, mentions,
+    token-issuance, attachment-upload), which resolve their own limits from Redis
+    and so are *not* covered by the ``DEFAULT_THROTTLE_RATES`` transform in
+    settings. One decorator line per class keeps the bypass explicit, greppable,
+    and testable via ``override_settings`` — with no edit inside each method body.
+
+    Deliberately bypasses even the fail-closed sync write-path throttle: an
+    operator who acknowledged the disable gets "off means off" with no hidden
+    exceptions, so the read-only status surfaced to admins is literally accurate.
+    """
+    original = throttle_cls.allow_request
+
+    def allow_request(self: BaseThrottle, request: Request, view: APIView) -> bool:
+        if rate_limiting_disabled():
+            return True
+        return bool(original(self, request, view))
+
+    throttle_cls.allow_request = allow_request  # type: ignore[method-assign]
+    return throttle_cls
+
+
+def rate_limiting_disabled() -> bool:
+    """True when the global kill switch has disabled all throttling.
+
+    Read at *request* time by every custom Redis throttle so ``override_settings``
+    and a live operator change take effect. Defaults to False (limits on) if the
+    setting is somehow absent, so a misconfiguration never silently drops
+    protection.
+    """
+    from django.conf import settings
+
+    return getattr(settings, "RATE_LIMIT_ENABLED", True) is False

trueppm_api/core/redis_throttle.py

@@ -0,0 +1,82 @@
+"""Atomic INCR-with-TTL primitives for the raw-redis throttle counters (#1757).
+
+Every raw-redis throttle under ``apps/*/throttles.py`` bounds a request rate by
+INCRementing a per-bucket counter key and setting a TTL so the window resets.
+The historical idiom did this as two separate round trips::
+
+    count = client.incr(key)
+    if count == 1:
+        client.expire(key, ttl)
+
+A crash — or a dropped connection, or an EXPIRE error — *between* the INCR and
+the EXPIRE leaves the counter key with **no TTL**: it never resets and that
+principal is wedged at HTTP 429 for that bucket indefinitely, a self-inflicted
+DoS (flagged Low/pre-existing in the #1719 security review). Collapsing both
+commands into one server-side Lua script makes the TTL inseparable from the
+counter's creation — Redis runs the script atomically, so a bucket either exists
+*with* a TTL or does not exist at all. There is no interleaving in which the
+counter outlives its window.
+
+``projects.throttles.claim_visit_window`` and
+``integrations.throttles.claim_webhook_delivery`` already have this guarantee via
+the atomic ``SET NX EX`` idiom; these helpers give the *counter* throttles the
+equivalent. The script text is passed to ``EVAL`` on every call: it is ~40 bytes,
+so the bandwidth cost is negligible and we avoid any ``NOSCRIPT`` cache-miss
+handling that ``EVALSHA`` would require.
+
+Both helpers raise ``redis.RedisError`` straight through on a broker failure —
+each caller keeps its own fail-open (rate throttles) or fail-closed (the
+write-path sync throttle) policy exactly as before.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    import redis
+
+# INCR the key and, only on the transition to 1 (the first hit of a fresh
+# window), stamp the TTL. Running both inside one EVAL means the EXPIRE can never
+# be lost between two round trips. Returns the post-increment count.
+_INCR_WITH_TTL_LUA = """
+local count = redis.call('INCR', KEYS[1])
+if count == 1 then
+    redis.call('EXPIRE', KEYS[1], ARGV[1])
+end
+return count
+"""
+
+# INCRBY the key by ARGV[1] and (re)stamp the TTL unconditionally. Used where the
+# counter is advanced by a variable amount and the window is meant to slide from
+# the most recent activity (mention fan-out accounting; the sync in-flight
+# semaphore, whose TTL is a crash-leak guard that should refresh on every entry).
+_INCRBY_WITH_TTL_LUA = """
+local count = redis.call('INCRBY', KEYS[1], ARGV[1])
+redis.call('EXPIRE', KEYS[1], ARGV[2])
+return count
+"""
+
+
+def incr_with_ttl(client: redis.Redis, key: str, ttl: int) -> int:
+    """Atomically INCR ``key`` and, on the first hit, set its ``ttl`` (seconds).
+
+    Drop-in replacement for the non-atomic ``INCR`` + ``if count == 1: EXPIRE``
+    idiom so a crash between the two can no longer strand a counter without a TTL.
+    Returns the post-increment count. Propagates ``redis.RedisError`` so the
+    caller keeps its existing fail-open / fail-closed policy.
+    """
+    # redis-py types eval() as Awaitable|str for the sync/async-generic client;
+    # the sync client returns the script's integer result. Matches the existing
+    # ``int(client.incr(...))  # type: ignore[arg-type]`` pattern in the throttles.
+    return int(client.eval(_INCR_WITH_TTL_LUA, 1, key, ttl))  # type: ignore[arg-type]
+
+
+def incrby_with_ttl(client: redis.Redis, key: str, amount: int, ttl: int) -> int:
+    """Atomically INCRBY ``key`` by ``amount`` and (re)set its ``ttl`` (seconds).
+
+    Like :func:`incr_with_ttl` but for the variable-amount counters, and it stamps
+    the TTL on *every* call (a sliding window) rather than only the first. Returns
+    the post-increment count. Propagates ``redis.RedisError``.
+    """
+    return int(client.eval(_INCRBY_WITH_TTL_LUA, 1, key, amount, ttl))  # type: ignore[arg-type]

trueppm_api/core/refresh_cookie_policy.py

@@ -0,0 +1,156 @@
+"""Refresh-cookie ``SameSite`` validation (#3556, follows ADR-0604's ack pattern).
+
+``TRUEPPM_AUTH_REFRESH_COOKIE_SAMESITE`` was, before this module, a free-form env
+override with no validation: whatever string an operator set landed verbatim on
+``Set-Cookie`` (see ``_set_refresh_cookie`` in ``core/auth_views.py``). The refresh
+and logout endpoints are authenticated by that cookie alone — no CSRF token, no
+double-submit — so ``SameSite=Strict`` (the shipped default) is the *only* control
+that stops a forged cross-site request from riding the cookie. An operator who
+sets the override to ``None`` (or, for a split-origin deploy, ``Lax``) removes or
+weakens that control, and nothing said so.
+
+This mirrors ``core/ratelimit.py``'s two-key acknowledgment shape rather than
+inventing a new one: disabling a security control always needs an explicit,
+documented sentinel, and the resolution is a pure function so it is unit-testable
+without booting Django or mutating process env. Unlike the rate-limit switch this
+one is a three-way choice, not a boolean, so the return shape carries a
+``warning`` and a ``critical`` slot instead of one message — at most one of the
+two is populated for any resolution:
+
+* ``Strict`` (default or explicit) — the safe value. Silent.
+* ``Lax`` — accepted as-is (a split-origin/iframe deploy may need it), but logged
+  at WARNING naming the consequence: the cookie stops riding cross-site *POSTs*
+  from another origin (the actual CSRF vector these endpoints care about), while
+  still riding a top-level cross-site *navigation*.
+* ``None`` with the exact acknowledgment sentinel
+  (:data:`REFRESH_COOKIE_SAMESITE_NONE_ACK_SENTINEL` in
+  ``TRUEPPM_AUTH_REFRESH_COOKIE_SAMESITE_NONE_ACK``) — accepted, but logged at
+  CRITICAL: this removes the SameSite CSRF backstop entirely and relies solely on
+  the ``Sec-Fetch-Site`` / ``Origin`` defense-in-depth check in
+  ``core/auth_views.py``.
+* ``None`` without the sentinel, or any value that is not one of the three
+  recognized words — refused. Falls back to ``Strict`` (fail toward the
+  *protected* state, exactly like an unacknowledged rate-limit disable) and logs
+  at CRITICAL so a typo or a fat-fingered override can never silently weaken the
+  cookie; it can only be silently ignored in favor of the safe default.
+"""
+
+from __future__ import annotations
+
+from typing import Literal, NamedTuple
+
+#: The precise literal type Django's ``HttpResponseBase.set_cookie``/``delete_cookie``
+#: stubs declare for ``samesite=``. Typing :attr:`RefreshCookieSameSiteResolution.value`
+#: as this — rather than a bare ``str`` — is what lets ``AUTH_REFRESH_COOKIE_SAMESITE``
+#: type-check at its call sites in ``core/auth_views.py`` (django-stubs' mypy plugin
+#: infers a settings attribute's type from its assignment in ``settings/base.py``).
+SameSiteValue = Literal["Strict", "Lax", "None"]
+
+#: The exact acknowledgment an operator must set in
+#: ``TRUEPPM_AUTH_REFRESH_COOKIE_SAMESITE_NONE_ACK`` (alongside
+#: ``TRUEPPM_AUTH_REFRESH_COOKIE_SAMESITE=None``) to actually drop SameSite
+#: protection on the refresh cookie. Documented verbatim in
+#: administration/configuration.md; treat as a stable operator contract — do not
+#: change the string without a deprecation note.
+REFRESH_COOKIE_SAMESITE_NONE_ACK_SENTINEL = "i-understand-this-removes-refresh-csrf-protection"
+
+#: The only values Django's cookie machinery treats as a real SameSite policy.
+#: Compared case-insensitively so ``lax``/``LAX``/``Lax`` all resolve the same way,
+#: but the *stored* setting is always one of these three canonical spellings —
+#: never the operator's raw casing — so nothing downstream (the ``Set-Cookie``
+#: header, ``_clear_refresh_cookie``'s matching ``delete_cookie`` call) can drift
+#: from what this function decided.
+_VALID_SAMESITE_VALUES = ("Strict", "Lax", "None")
+
+_LAX_WARNING = (
+    "TRUEPPM_AUTH_REFRESH_COOKIE_SAMESITE=Lax: the refresh cookie no longer blocks "
+    "cross-site requests unconditionally. Lax still withholds the cookie from a "
+    "cross-site POST (the vector that matters for CookieTokenRefreshView / "
+    "CookieTokenLogoutView), but attaches it to a cross-site top-level GET "
+    "navigation. Use this only for a deploy that genuinely needs the cookie to "
+    "survive top-level navigation from another site; the Sec-Fetch-Site / Origin "
+    "check in core/auth_views.py is defense in depth, not a substitute."
+)
+
+_NONE_ACKED_CRITICAL = (
+    "TRUEPPM_AUTH_REFRESH_COOKIE_SAMESITE=None is ACTIVE (acknowledged via "
+    "TRUEPPM_AUTH_REFRESH_COOKIE_SAMESITE_NONE_ACK). The refresh cookie now rides "
+    "on every cross-site request, browser-enforced SameSite protection is fully "
+    "removed from CookieTokenRefreshView and CookieTokenLogoutView, and the only "
+    "remaining control is the Sec-Fetch-Site / Origin check in core/auth_views.py "
+    "— which a non-browser client bypasses by sending neither header. Set this "
+    "only when TruePPM is genuinely framed or called cross-site and you have "
+    "verified CSRF_TRUSTED_ORIGINS is complete."
+)
+
+_NONE_UNACKED_CRITICAL = (
+    "Ignoring TRUEPPM_AUTH_REFRESH_COOKIE_SAMESITE=None: it removes the only "
+    "unconditional CSRF control on the refresh/logout endpoints, and the required "
+    "acknowledgment TRUEPPM_AUTH_REFRESH_COOKIE_SAMESITE_NONE_ACK is missing or "
+    "does not match the documented sentinel. Falling back to SameSite=Strict. "
+    "This is the safe default — a stray override never silently removes the "
+    "cookie's CSRF protection."
+)
+
+_UNRECOGNIZED_CRITICAL_TEMPLATE = (
+    "TRUEPPM_AUTH_REFRESH_COOKIE_SAMESITE={value!r} is not a recognized SameSite "
+    "value (Strict, Lax, None) — falling back to SameSite=Strict. An unrecognized "
+    "value is not a Django CSRF posture at all; browsers that honor the raw string "
+    "verbatim may fail closed and drop the cookie, while a permissive parser could "
+    "treat it as Lax or None. Set the value to one of Strict / Lax / None, or unset "
+    "the variable to accept the Strict default."
+)
+
+
+class RefreshCookieSameSiteResolution(NamedTuple):
+    """The effective ``SameSite`` value plus at most one log-worthy message."""
+
+    value: SameSiteValue
+    warning: str | None
+    critical: str | None
+
+
+def resolve_refresh_cookie_samesite(*, requested: str, ack: str) -> RefreshCookieSameSiteResolution:
+    """Resolve the effective refresh-cookie ``SameSite`` value from operator env.
+
+    Args:
+        requested: raw ``TRUEPPM_AUTH_REFRESH_COOKIE_SAMESITE`` (or legacy
+            ``AUTH_REFRESH_COOKIE_SAMESITE``) value, already applying that
+            fallback chain — this function only validates the resolved string.
+        ack: raw ``TRUEPPM_AUTH_REFRESH_COOKIE_SAMESITE_NONE_ACK`` value.
+
+    Returns:
+        A :class:`RefreshCookieSameSiteResolution`. ``value`` is always one of
+        ``"Strict"``, ``"Lax"``, ``"None"`` — never the raw operator string — so
+        callers can pass it straight to ``response.set_cookie(samesite=...)``
+        without re-validating.
+    """
+    stripped = (requested or "").strip()
+    lowered = stripped.lower()
+    normalized = next(
+        (candidate for candidate in _VALID_SAMESITE_VALUES if candidate.lower() == lowered),
+        None,
+    )
+
+    if normalized is None:
+        # Blank resolves through the env() default chain to "Strict" before this
+        # function ever runs, so an empty string here means the operator set the
+        # var to whitespace/empty explicitly — treat it the same as any other
+        # unrecognized value rather than special-casing it into silence.
+        message = _UNRECOGNIZED_CRITICAL_TEMPLATE.format(value=requested)
+        return RefreshCookieSameSiteResolution(value="Strict", warning=None, critical=message)
+
+    if normalized == "Strict":
+        return RefreshCookieSameSiteResolution(value="Strict", warning=None, critical=None)
+
+    if normalized == "Lax":
+        return RefreshCookieSameSiteResolution(value="Lax", warning=_LAX_WARNING, critical=None)
+
+    # normalized == "None"
+    if ack == REFRESH_COOKIE_SAMESITE_NONE_ACK_SENTINEL:
+        return RefreshCookieSameSiteResolution(
+            value="None", warning=None, critical=_NONE_ACKED_CRITICAL
+        )
+    return RefreshCookieSameSiteResolution(
+        value="Strict", warning=None, critical=_NONE_UNACKED_CRITICAL
+    )

trueppm_api/core/request_body.py

@@ -0,0 +1,86 @@
+"""Narrowing helpers for a JSON request body that has to be an object.
+
+DRF types ``Request.data`` as ``dict[str, Any] | list[Any]`` because a JSON body
+may legitimately be a top-level array. An endpoint that reads *named* fields off
+it therefore has to establish that the body is an object **before** the first
+``.get(...)`` or ``[...]`` — a ``list`` has neither, so reaching for one raises
+``AttributeError``/``TypeError`` and DRF returns a **500**, not the 400 the
+caller is owed.
+
+That is the #2795 class, and its defining trait is that the value-type guards
+these endpoints already carry (``if not isinstance(presenter, str)``) sit
+*downstream* of the container access that already blew up, so they never run.
+The container check has to come first, and it has to come before any write.
+
+Use :func:`object_body` at the top of any handler that reads named fields. Where
+a non-object body is genuinely unreachable — a view whose ``parser_classes`` are
+multipart-only, or one whose envelope serializer has already rejected a
+non-mapping — narrow with a ``cast`` and say *why* in a comment instead; a guard
+that can never fire is untestable and reads as protection that is not there.
+
+Note the neighbour with the opposite rule: ``_task_body_mapping()`` in
+``apps/projects/views.py`` coerces a non-mapping to ``{}`` rather than refusing
+it. That is safe only because a ``ModelSerializer`` has already rejected non-dicts
+at both its call sites — do not copy the pattern to a handler that reads
+``request.data`` first.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from rest_framework import status
+from rest_framework.exceptions import APIException
+from rest_framework.request import Request
+
+#: The one body every non-object refusal puts on the wire (#3281).
+#:
+#: A **dict** ``default_detail``, not a string, and that is the whole mechanism:
+#: DRF's handler passes a ``dict``/``list`` detail through verbatim and only wraps
+#: a *string* one as ``{"detail": ...}``. A string here therefore drops
+#: ``default_code`` on the floor — it stays on the ``ErrorDetail`` object and the
+#: client never sees it, which is exactly what #3278 shipped and what left one
+#: refusal speaking three different bodies.
+INVALID_BODY_DETAIL = "Request body must be a JSON object."
+INVALID_BODY_CODE = "invalid_body"
+
+
+class InvalidRequestBody(APIException):
+    """400 for a JSON body that parsed fine but is not an object.
+
+    A dedicated exception rather than ``ValidationError``: the latter would wrap
+    the message in a list under a field key and describe a *field* problem, and
+    this is a problem with the envelope — no field is at fault.
+
+    Shape 2 (``docs/api/errors.md``) — ``{"code", "detail"}`` — because the page
+    reserves the ``code`` for failures a client is expected to *handle*
+    differently rather than merely report, and a body the caller constructed
+    wrongly is a bug in its request construction, not a rejected field value.
+
+    Converging **upward** is what makes this non-breaking: ``detail`` is still
+    present everywhere it already was, so no client that reads it breaks, and the
+    group/ungroup guard that already emitted ``code`` is byte-identical. Stripping
+    ``code`` to match the other two would have been the client-visible direction.
+    """
+
+    status_code = status.HTTP_400_BAD_REQUEST
+    default_detail = {"code": INVALID_BODY_CODE, "detail": INVALID_BODY_DETAIL}  # noqa: RUF012
+    default_code = INVALID_BODY_CODE
+
+
+def object_body(request: Request) -> dict[str, Any]:
+    """Return the request body as a mapping, or raise :class:`InvalidRequestBody`.
+
+    Args:
+        request: The DRF request whose parsed body is being read.
+
+    Returns:
+        The parsed body, narrowed to ``dict[str, Any]``.
+
+    Raises:
+        InvalidRequestBody: The body parsed to a list or other non-mapping.
+    """
+    data = request.data
+    if not isinstance(data, dict):
+        raise InvalidRequestBody
+    return data