The Flask backend crashes on requests to unrouted paths and methods

[adamtheturtle]

What happens

The Flask backend raises an uncaught ValueError for any authenticated request to a path it does not route, or to a routed path with a method it does not serve.

validate_request in src/mock_vws/_flask_server/vws.py:194 is a before_request hook. Flask runs before_request handlers before it re-raises the routing exception in dispatch_request, so an unroutable request still reaches the validators. validate_keys then does:

(matching_route,) = (
    route
    for route in routes
    if re.match(...) and request_method in set(route.http_methods)
)

in src/mock_vws/_services_validators/key_validators.py:154. With no matching route the generator is empty and the unpacking raises. VWS_FLASK_APP.config["PROPAGATE_EXCEPTIONS"] is True, so this surfaces as a crash rather than a 500 page.

Reproduction

Running the target manager app on a local port and driving the VWS app with its test client, signing each request with valid server keys:

GET  /summary      -> 200
GET  /nonexistent  -> ValueError: not enough values to unpack (expected 1, got 0)
POST /summary      -> ValueError: not enough values to unpack (expected 1, got 0)

Why it matters

This affects the Flask and Docker backends only. The requests and httpx backends never route the request in the first place, so they raise a connection error, which is the documented behaviour for unmocked addresses.

Real Vuforia returns a 404 for an unknown path. Anyone pointing a client at the Docker mock and requesting a path the mock has not implemented — a typo, a newer VWS endpoint, or a health probe — gets a crash instead of a response.

Suggested resolution

Return a 404 when no route matches, rather than unpacking a generator that may be empty.

The narrow fix is to make validate_request skip validation for requests with no matching Flask endpoint (request.url_rule is None) and let Flask raise its own NotFound. That keeps the routing decision in Flask rather than duplicating it in the validators.

A wider fix falls out of sharing the route tables between the backends, since the mock currently keeps three separate ones: the @route table in _requests_mock_server/mock_web_services_api.py, the Flask decorators in _flask_server/vws.py, and the _Route list in key_validators.py.

[adamtheturtle]

Worth knowing why this has stayed latent, since it constrains the fix.

An unauthenticated request to an unrouted path returns 401, not a crash — validate_auth_header_exists runs before validate_keys and raises first:

unauthenticated /some-random-endpoint -> 401

The Docker health check probes /some-random-endpoint with no credentials and accepts 401, so it passes today. The crash needs a request signed with valid server keys, which nothing in the test suite sends to an unrouted path.

That means a fix which returns 404 for unrouted paths regardless of authentication would change what the health check sees. 404 is in its accepted set ({404, 401, 403}) so it would keep working, but it is worth checking rather than assuming. See also #3381.