Sergey Antropoff
f981ca1bf1
Keep Ingress from rewriting API 404/405 into branded HTML; document curl/auth and a prompt for sibling sims.
93 lines
4.2 KiB
Markdown
93 lines
4.2 KiB
Markdown
# Prompt: fix API error bodies + Web UI session on 401 (other simulators)
|
||
|
||
Copy everything below the line into a chat opened on **ovirt_api_simulator**,
|
||
**vmware_api_simulator**, or **openstack_api_simulator**. Adapt product names
|
||
(API path prefixes, cookie/CSRF names, Helm chart paths) to that repo.
|
||
|
||
---
|
||
|
||
## Task
|
||
|
||
Fix the same class of production issues already fixed in
|
||
`proxmox_api_simulator` (reference implementation). Do **not** claim the
|
||
simulator is “incomplete” or “not supported”; keep durable, realistic API
|
||
behavior.
|
||
|
||
### Symptoms seen behind Ingress
|
||
|
||
1. Client calls a path with a **wrong / missing resource id** (e.g. bad node /
|
||
host / datacenter name). Instead of the simulator’s JSON/XML error, the
|
||
browser or curl receives a **branded HTML 404** (“page not found”) from the
|
||
cluster Ingress / custom error pages.
|
||
2. Client sends a mutation (**POST/PUT/DELETE**) that the Ingress rejects or
|
||
rewrites → **nginx HTML 405** instead of the simulator’s auth/validation
|
||
error.
|
||
3. In the **Web UI**, after the API returns **401** (expired session), the
|
||
response panel says unauthorized but the **header still shows the signed-in
|
||
user** (does not switch to Guest / signed-out).
|
||
|
||
Root cause for (1)/(2) is usually **ingress-nginx**
|
||
`custom-http-errors` / `proxy-intercept-errors` replacing upstream bodies.
|
||
Root cause for (3) is UI code that renders 401 text but does not clear
|
||
ticket/token/cookie/localStorage and call the same path as logout.
|
||
|
||
### What to implement in THIS repo
|
||
|
||
#### 1. Clearer “resource not found” API errors
|
||
|
||
- Find the shared helper that validates that a node/host/cluster/datacenter
|
||
exists (equivalent of Proxmox `require_node`).
|
||
- On miss, return the **native API error shape** for this product with a
|
||
message that includes the bad id, e.g. Proxmox style:
|
||
`No such node ('pve01')` plus a field-level `errors` map when the product
|
||
uses one.
|
||
- Update unit tests that matched the old message string.
|
||
- Ensure the app always returns `Content-Type` appropriate for the API
|
||
(JSON/XML) and never an HTML error page from the app itself.
|
||
|
||
#### 2. Web UI: treat HTTP 401 as session expiry
|
||
|
||
- When any in-app API helper gets **401** and a session is currently stored:
|
||
- clear ticket/token/csrf/username (whatever this UI uses);
|
||
- clear auth cookies;
|
||
- clear persisted auth in localStorage/sessionStorage;
|
||
- update the header auth pill / badge to the signed-out / Guest state;
|
||
- show a short toast like “Session expired — sign in again”;
|
||
- still show the 401 explanation in the response panel.
|
||
- Refactor logout to share one `clearSession(...)` helper so logout and
|
||
expiry stay in sync. Do not leave stale “signed in as …” UI after 401.
|
||
|
||
#### 3. Helm / Ingress example + docs
|
||
|
||
- In the chart’s ingress example values (and kubernetes troubleshooting docs):
|
||
- `nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"`
|
||
- `nginx.ingress.kubernetes.io/custom-http-errors: "502,503"`
|
||
(do **not** list 404/405 so API bodies are preserved)
|
||
- Document: if clients still see branded HTML 404/405, the cluster controller
|
||
is rewriting responses — fix Ingress annotations, not the simulator handlers.
|
||
- Document a correct authenticated mutation curl for this product (cookie /
|
||
token + CSRF if required + the body encoding this API expects — often
|
||
form-urlencoded, not bare JSON).
|
||
|
||
### Out of scope
|
||
|
||
- Do not add “not implemented in the simulator” user-facing messages.
|
||
- Do not change unrelated product semantics.
|
||
- Do not force-push or commit unless the user asks.
|
||
|
||
### Done when
|
||
|
||
- Missing resource → product-shaped API error with the id in the message
|
||
(verified by unit test and/or curl against the app, not only via Ingress).
|
||
- UI 401 → Guest / signed-out header + cleared storage/cookies.
|
||
- Ingress example + troubleshooting docs warn about HTML error-page rewrite
|
||
and show the correct curl pattern.
|
||
- Lint/tests for touched areas pass.
|
||
|
||
### Reference (proxmox_api_simulator)
|
||
|
||
- `app/handlers/common.py` — `require_node` / `node_metadata` message
|
||
- `app/web/index.html` — `clearSession` / `expireSession` / `showResponse` 401
|
||
- `helm/proxmox-api-simulator/values-ingress-example.yaml` — annotations
|
||
- `docs/troubleshooting.md` — Ingress HTML 404/405 + curl notes
|