`create_room` does not validate the visibility pair, unlike every other create path

Open Beginner friendly
#453 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
88/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
api, backend, testing

Research direction

Start in core/switch_core/room_service.py at RoomCreateConfig and create_room, then compare the existing validation in update_room and core/tests/switch_core/test_authz.py. Add create-path coverage in the relevant test_room_service_*.py or test_rooms_yaml.py tests; done means invalid visibility strings and incompatible pairs are rejected while valid room creation continues to work.

Written by the indexing model from the issue text.

Description

RoomCreateConfig carries free-form read_visibility / write_visibility strings (core/switch_core/room_service.py, lines 79-80), and create_room (from line 411) never calls validate_visibility_pair.

Every comparable path does:

  • room_service.update_room — line 764
  • bridges/resource/service.py — lines 170, 222, 406, 455, 727, 774 (references, documents, packages)

So PATCH /rooms/{id} validates but POST /rooms does not. The gateway schema does not close the gap either: gateway/schemas.py:64-65 and 105-106 declare them as plain str rather than a Literal, as does rooms_yaml.py:104-105.

As a result POST /rooms accepts:

  • read_visibility="privat", which authz.can then treats as never-public, permanently; or
  • write_visibility="public" with read_visibility="private", the invariant-violating combination validate_visibility_pair exists specifically to reject.

The room can then only be repaired by a PATCH, which will itself refuse the stored value.

Suggested fix

One call at the top of create_room:

validate_visibility_pair(config.read_visibility, config.write_visibility)

It is already imported (line 10), and gateway/rooms.py:350 already maps ValueError to HTTP 400.

Tests

core/tests/switch_core/test_authz.py covers the validator itself. The create-path tests (test_room_service_*.py, test_rooms_yaml.py) do not assert that a bad visibility is rejected — a regression test belongs with this fix.

Dominant language
Python
Stars
646
Forks
52
Avg merge
1d 9h
Merged PRs (30d)
137

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from sandbox-quantum/switch

All issues in sandbox-quantum/switch

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.