Services several issues: Error message and code consolidation

ilo - November 6, 2009 - 00:43
Project:Services
Version:7.x-1.x-dev
Component:Code
Category:task
Priority:critical
Assigned:Unassigned
Status:active
Description

There are several issues colliding currently in services..

1.- strings and error codes

In node_services, the same error code or message are used widely, probably result of copy paste. A major issue is about the usage of error code 401, used for Access denied error also in services module during auth validation.

Just from node_service:
node.get : services_error(t('Could not find the node.'), 401);
node.view: services_error(t('Could not find the node.'), 404);
node.save: services_error(t('Node not found.'), 401);
And also in node.save: services_error(implode("\n", $errors), 401);

2.- Access control mechanism

The best part of all this.. current implementation of access callbacks use the method arguments for validation, so if you simply try to view a node that doesn't exist, node_access() will return False, the user is not trusted to view that node, and the returned message by services.module is: tadaaa!! services_error(t('Access denied'), 401); the "could not find the node" message is never returned.

3.- error callbacks

Anyway, in the hypothetical case where you can bypass authorization callback, and successfully be returned by node.get the "Could not find the node" error, the xmlrpc_server wants to play also, and the error code returned is "1", just because is unable to find the error code (it is not passed in the error call, neither the regex works with the merged array) in the error callback.

Heyrocker and I commented on IRC (in our brand new quiet #drupal-services) that changing this for 6.x may have dramatic consequences for services clients that are using the error codes or messages, but being consistent in error codes and messages is so basic by 'definition', that probably we may start to talk about backwards compat or not.

 
 

Drupal is a registered trademark of Dries Buytaert.