[I] Dataset endpoints return 500 for a version from another dataset or a missing upload type [texera]

["tanishqgandhi1908 (via GitHub)" <gi...@apache.org>]

tanishqgandhi1908 opened a new issue, #9098:
URL: https://github.com/apache/texera/issues/9098

   ### What happened?
   
   Two dataset endpoints skip input checks that the matching model endpoints already make, so bad input produces a 500 instead of a 4xx:
   
   A version from another dataset. /dataset/{did}/version/{dvid}/rootFileNodes, its public twin /dataset/{did}/publicVersion/{dvid}/rootFileNodes, and /dataset/{did}/versionZip?dvid= check access on did but then load version dvid without checking it belongs to did. Asking a public dataset for a private dataset’s version id reads that other dataset’s version record and then fails at LakeFS, which returns a 500. The model side scopes the lookup to the model (getModelVersionByID(ctx, mid, mvid)).
   No type on multipart upload. POST /dataset/multipart-upload without type calls toLowerCase on null, which returns a 500. The model endpoint returns a 400 listing the valid types.
   
   Expected: a 404 for a version that isn’t part of the dataset, and a 400 for a missing or unknown type, as the model endpoints do.
   
   ```
   $ curl /api/dataset/215/publicVersion/16/rootFileNodes      # public dataset 215, version 16 of private dataset 216 (no login)
   -> HTTP 500
   $ curl /api/dataset/215/publicVersion/15/rootFileNodes      # its own version
   -> HTTP 200
   $ curl -X POST "/api/dataset/multipart-upload?ownerEmail=...&datasetName=public-weather&filePath=x.csv"   # no type
   -> HTTP 500   (NullPointerException: "operationType" is null)
   $ same request against /api/model/multipart-upload
   -> HTTP 400   {"message":"Invalid type parameter. Use 'list', 'init', 'finish', 'abort'."}
   
   ```
   
   ### How to reproduce?
   
   1. Create a public dataset A and a private dataset B, each with one version.
   2. GET /api/dataset/{A}/publicVersion/{B's version id}/rootFileNodes, with no login, returns 500.
   3. POST /api/dataset/multipart-upload?ownerEmail=...&datasetName={A}&filePath=x.csv, signed in and with no type, returns 500.
   
   ### Version/Branch
   
   1.4.0-incubating-SNAPSHOT (main)
   
   ### Commit Hash (Optional)
   
   _No response_
   
   ### What browsers are you seeing the problem on?
   
   _No response_
   
   ### Relevant log output
   
   ```shell
   
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Dataset endpoints return 500 for a version from another dataset or a missing upload type [texera]

["tanishqgandhi1908 (via GitHub)" <gi...@apache.org>]

tanishqgandhi1908 commented on issue #9098:
URL: https://github.com/apache/texera/issues/9098#issuecomment-6351906013

   /take


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org