Currently, if a user only specifies a payload_content_type without a payload, the attribute is only partially validated and doesn't determine if the attribute content is one of the appropriate values.
If a user specifies a payload_content_type it should be properly validated.
Steps to Replicate:
curl -X POST -H "X-Auth-Token:$AUTH_TOKEN" -H "Content-Type:application/json" -H "X-Project-Id:$PROJECT_ID" -d '{
"type": "key",
"meta": {
"mode": "cbc",
"bit_length": 256,
"name": "secretname",
"algorithm": "aes",
"payload_content_type": "blarg!"
}
}' http://localhost:9311/v1/orders
Actual Response:
200 OK
{
"order_ref": "http://localhost:9311/v1/orders/cbb189f5-0da4-480b-b04b-e2dae1dc0911"
}
Expected Response:
400 Bad Request
{
"code": 400,
"description": "Provided object does not match schema 'Secret' within 'Order': payload_content_type is not one of ['text/plain', 'text/plain;charset=utf-8', 'text/plain; charset=utf-8', 'application/octet-stream']",
"title": "Bad Request"
}
Hello John, per the API doc if the 'payload' is not specified, the 'payload_
So I think this 'functions as designed', but perhaps the API should me modified to reject attempts to set those attributes if 'payload' is not specified? Worth bringing up at summit?