Bodhi's REST API should separate the create and edit endpoints

[bowlofeggs]

While working on #1814 today I discovered that the REST API will set an update's severity to "unspecified" if the POST data does not include the severity field. This means that users who edit an update with the CLI and don't specify a --severity will end up altering the update to reset its severity to "unspecified".

[bowlofeggs]

It turns out that it's not just severity that gets reset, but all fields get reset if not specified in a follow-on post. If I use the CLI to change an update to have a stable karma of 5 and then use it to make a different change and don't specify that karma, it gets set back to 3 in the later update. I think this is rather surprising.

[bowlofeggs]

The associated PR seems to fix the CLI so that it doesn't suffer from this issue, but the real issue is that the API should not alter fields that it was not given in edit calls. I'd like to fix that issue in a future X release, so I'm going to reopen it.

Thanks for fixing the CLI for it though, I think that'll really help with most real-world use cases that hit this problem ☺

[bowlofeggs]

A fix for the CLI is planned to be included in the upcoming 3.9.0 release: #2477.

[bowlofeggs]

The CLI fix described above was released with 3.9.0.

[bowlofeggs]

The real problem here is that Bodhi's REST API isn't very RESTy. It uses the same URL for creating and editing updates. To signal that you are editing an update, the user includes a key in the JSON with "edited" and the build's title. The REST way to do it would be for the user to POST to the update's URL (i.e., not the /updates/ endpoint, but /updates/FEDORA-2018-abcde).

By making this change, we can easily give a different schema to the edit API than the create API, which is difficult to do under the current model.

[cverna]

You could also make use of the PUT and PATCH HTTP method and follow the CRUD principle.

CREATE an update --> POST
UPDATE an update --> PUT
PARTIAL UPDATE of an update --> PATCH

[sebwoj]

It looks like that "overrides" and "releases" apis are not RESTy as well.