Skip to content

Don’t inspect API error messages to do template validation - #6040

Open
quis wants to merge 4 commits into
mainfrom
dont-inspect-api-error-messages-to-do-validation
Open

Don’t inspect API error messages to do template validation#6040
quis wants to merge 4 commits into
mainfrom
dont-inspect-api-error-messages-to-do-validation

Conversation

@quis

@quis quis commented Aug 18, 2026

Copy link
Copy Markdown
Member

Catching an HTTPError then looking for a specific substring in something returned by the API is gross. Even more so when it’s plonked in the middle of a view method (and the cyclomatic complexity check agrees 😈).

The pattern we follow elsewhere, where possible, is:

  • validate in the admin app
  • pass to the API
  • validate on the API as a backup

This is good because:

  • we have 2 lines of defence against bad data
  • the admin app code is simpler and easier to test
  • the admin app code follows the same pattern as other validation (using WTForms objects and methods)
  • the content of the error messages are codified in the admin app

If the admin app lets something through which the API rejects then we get an exception, and we know we have a mismatch to investigate. This is very unlikely since they are both using the same utils code to do the validation.

quis added 3 commits August 18, 2026 15:05
Catching an `HTTPError`` then Looking for a specific substring in
something returned by the API is gross. Even morre so when it’s plonked
in the middle of a view method.

The pattern we follow elsewhere is generally:
- validate in the admin app
- pass to the API
- validate on the API as a backup

This is good because:
- we have 2 lines of defence against bad data
- the admin app code is simpler and easier to test
- the admin app code follows the same pattern as other forms (using
  WTForms objects and methods)
- the content error messages are codified in the admin app

If the admin app lets something through which the API rejects then we
get an exception, and we know we have something to investigate.
Catching an `HTTPError`` then Looking for a specific substring in
something returned by the API is gross. Even morre so when it’s plonked
in the middle of a view method.

The pattern we follow elsewhere is generally:
- validate in the admin app
- pass to the API
- validate on the API as a backup

This is good because:
- we have 2 lines of defence against bad data
- the admin app code is simpler and easier to test
- the admin app code follows the same pattern as other forms (using
  WTForms objects and methods)
- the content error messages are codified in the admin app

If the admin app lets something through which the API rejects then we
get an exception, and we know we have something to investigate.
These are now redudant because all they are doing is re-raising the
exceptions.
@quis quis changed the title Dont inspect API error messages to do template validation Don’t inspect API error messages to do template validation Aug 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant