Enable support for read-only mode on APIs #1219
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
astrozzc
approved these changes
Oct 2, 2024
| """Process request ReadOnlyApiMiddleware.""" | ||
| if settings.READ_ONLY_API_MODE and request.method in ["POST", "PUT", "PATCH", "DELETE"]: | ||
| return HttpResponse( | ||
| json.dumps({"error": "This API is currently in read-only mode. Please try again later."}), |
There was a problem hiding this comment.
Wondering what message would pop up in customer's console, they might be confused with API.
Maybe something like the system is currently under maintenance and in read-only mode......
There was a problem hiding this comment.
👍 I was going to ping platex to see how a 405 might be handled right now to see if they'd render their own message or need to use the API message.
|
/retest |
lpichler
reviewed
Oct 3, 2024
lpichler
approved these changes
Oct 3, 2024
This adds an optional `READ_ONLY_API_MODE` environment variable consumed in settings, which defaults to `False`. It can be configured via params in the deploy template to enable/disable with config per environment. This is used in a new `ReadOnlyApiMiddleware` middleware for all RBAC requests, which checks the request method and the configuration setting to determine whether or not to process the request. In the event of a write method + read-only mode being enabled, we'll return a 405 with a message explaining we're in read-only mode, to be used during migration/maintenance windows for the service. Another option would be to use 503, though since we're still accepting GET requests a 405 with explicit message may be the best approach.
coderbydesign
force-pushed
the
read-only-mode
branch
from
475f2f3 to
623c101
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Link(s) to Jira
Description of Intent of Change(s)
This adds an optional
READ_ONLY_API_MODEenvironment variable consumed in settings, which defaults toFalse. It can be configured via params in the deploy template to enable/disable with config per environment.This is used in a new
ReadOnlyApiMiddlewaremiddleware for all RBAC requests, which checks the request method and the configuration setting to determine whether or not to process the request.In the event of a write method + read-only mode being enabled, we'll return a 405 with a message explaining we're in read-only mode, to be used during migration/maintenance windows for the service.
Another option would be to use 503, though since we're still accepting GET requests a 405 with explicit message may be the best approach.
Local Testing
By default, you should not be prevented from any write API requests.
Update your
.envto setREAD_ONLY_API_MODE=Trueand note that you receive a 405 on anything butGETrequests.TODO:
Checklist
Secure Coding Practices Checklist Link
Secure Coding Practices Checklist