ensure media upload endpoints are one-off #392
Conversation
JWP media upload endpoints are one-use-only URLs. Unfortunately we
allowed the same URL to be retrieved multiple times from the upload
endpoint which meant that a client may try to upload a media item
multiple times to the same URL.
Fix this by making the /media/{id}/upload endpoint a PUT-only endpoint.
If the upload endpoint URL exists in the database to begin with, we
return it and delete it from the database. If the endpoint does not
exist, we create one first.
This involves a bit of an unnecessary write and then delete from the
database in the case where the endpoint does not exist but for the
common case of "create media item" then "get upload endpoint", it Does
The Right Thing (TM).
Closes #367
rjw57
force-pushed
the
issue-367-one-off-upload-endpoints
branch
from
2b55a26 to
2d31e18
Compare
| # If there is already a created upload endpoint which expires more than a day from now, | ||
| # we can use the instance as is. | ||
| if hasattr(instance, 'upload_endpoint'): | ||
| headroom = datetime.timedelta(days=1) |
There was a problem hiding this comment.
will this code ever get executed if the we always delete the instance from the database after we create it?
There was a problem hiding this comment.
Yes as an upload endpoint is created by JWP when we first create the media resource. See the last line of mediaplatform_jwp.api.management._perform_item_update().
Codecov Report
@@ Coverage Diff @@
## master #392 +/- ##
=========================================
Coverage ? 91.32%
=========================================
Files ? 43
Lines ? 1949
Branches ? 0
=========================================
Hits ? 1780
Misses ? 169
Partials ? 0
Continue to review full report at Codecov.
|
|
If the PUT succeeds after JWP has finished processing, I'd be inclined to call that good enough to fix the issue for the moment. We're likely to migrate away from JWP so re-woking all the API plumbing to support it is probably left for another issue. |
JWP media upload endpoints are one-use-only URLs. Unfortunately we allowed the same URL to be retrieved multiple times from the upload endpoint which meant that a client may try to upload a media item multiple times to the same URL.
Fix this by making the /media/{id}/upload endpoint a PUT-only endpoint. If the upload endpoint URL exists in the database to begin with, we return it and delete it from the database. If the endpoint does not exist, we create one first.
This involves a bit of an unnecessary write and then delete from the database in the case where the endpoint does not exist but for the common case of "create media item" then "get upload endpoint", it Does The Right Thing (TM).
Closes #367