From 6166b1f626d6cc2e18b5e0428dccd6c41c1f1622 Mon Sep 17 00:00:00 2001 From: iris <2+iris@noreply.localhost> Date: Sat, 29 Aug 2026 06:14:32 -0400 Subject: [PATCH] State the deny-unknown-fields rule where it governs all the bodies It had landed appended to `SshRequest`'s doc comment, so a rule about every request body in the module read as something about how to describe a machine. Moved to the module doc beside the route table, where the set it governs is what a reader is already looking at, and worded so a new request body knows it is expected to carry the attribute too. Co-Authored-By: Claude Opus 5 --- server/src/routes.rs | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/server/src/routes.rs b/server/src/routes.rs index 50a3d9a..ee0d58d 100644 --- a/server/src/routes.rs +++ b/server/src/routes.rs @@ -29,6 +29,16 @@ //! //! Everything here works purely in the common event model; nothing may //! branch on the session kind (that's what drivers are for). +//! +//! **Every request body in this module refuses fields it does not know** +//! (`serde(deny_unknown_fields)`), and a new one is expected to do the +//! same. Silently ignoring a field is the worst available answer: a caller +//! that misspells `permissionMode` got a 200 and a session running in the +//! default permission mode, which is indistinguishable from success at the +//! place they are looking. It cost an hour here, chasing a "startup race" +//! that was a snake_case key serde had dropped on the floor. Query strings +//! are deliberately left permissive -- a stale link carrying an extra +//! parameter is not a mistake worth failing a request over. use std::convert::Infallible; use std::path::{Path, PathBuf}; @@ -186,16 +196,6 @@ fn info_for(setup: crate::config::SetupConfig) -> SetupInfo { /// Note what is absent: nothing here names a program. Providers are found /// by asking the machine (`crate::setups`), never sent, so the enrolled /// token cannot introduce something to run. -/// Every request body below refuses fields it does not know. -/// -/// Silently ignoring one is the worst available answer: a caller that -/// misspells `permissionMode` gets a session in the default permission mode -/// and a 200 saying it worked, which is indistinguishable from success at -/// the place they are looking. It cost an hour of chasing a "race" that was -/// a snake_case key serde had dropped on the floor. A 400 naming the field -/// is the whole fix, and it belongs on all of them rather than on the one -/// that bit -- query strings are deliberately excluded, since a stale link -/// carrying an extra parameter is not a mistake worth failing. #[derive(Deserialize)] #[serde(rename_all = "camelCase")] #[serde(deny_unknown_fields)]