Merge 5a54efe into 7a5e46f

app/controllers/api/v4/imports_controller.rb

@@ -2,11 +2,7 @@ class Api::V4::ImportsController < ApplicationController
   skip_before_action :verify_authenticity_token
   before_action :doorkeeper_authorize!
   before_action :validate_token_organization
-
-  rescue_from ActionController::ParameterMissing do |error|
-    log_failure(error)
-    render json: {error: "Unable to find key in payload: \"#{error.param}\""}, status: :bad_request
-  end
+  before_action :validate_resources_key, only: %i[import]
 
   def import
     return head :not_found unless Flipper.enabled?(:imports_api)
@@ -143,6 +139,21 @@ def validate_token_organization
     end
   end
 
+  def validate_resources_key
+    resources = params[:resources]
+    unless resources.present?
+      error_msg = 'Unable to find key in payload: "resources"'
+      log_failure(error_msg)
+      return render json: {error: error_msg}, status: :bad_request
+    end
+
+    unless resources.is_a?(Array)
+      error_msg = '"resources" must be an array'
+      log_failure(error_msg)
+      render json: {error: error_msg}, status: :bad_request
+    end
+  end
+
   def organization_id
     request.headers["HTTP_X_ORGANIZATION_ID"]
   end

spec/requests/api/imports/imports_request_spec.rb

@@ -112,4 +112,36 @@
     )
     expect(response.status).to eq(400)
   end
+
+  it "fails to import payload with no resource key" do
+    allow(Rails.logger).to receive(:info)
+
+    put route, params: [invalid_payload].to_json, headers: headers
+
+    expect(Rails.logger).to have_received(:info).with(
+      hash_including(
+        msg: "import_api_error",
+        controller: "Api::V4::ImportsController",
+        action: "import",
+        organization_id: organization.id
+      )
+    )
+    expect(response.status).to eq(400)
+  end
+
+  it "fails to import payload with non-array resources" do
+    allow(Rails.logger).to receive(:info)
+
+    put route, params: {resources: {invalid: :type}}.to_json, headers: headers
+
+    expect(Rails.logger).to have_received(:info).with(
+      hash_including(
+        msg: "import_api_error",
+        controller: "Api::V4::ImportsController",
+        action: "import",
+        organization_id: organization.id
+      )
+    )
+    expect(response.status).to eq(400)
+  end
 end