Skip to content

Conversation

@Flix6x
Copy link
Contributor

@Flix6x Flix6x commented Jan 21, 2026

Description

  • Return validation errors instead of db errors
  • Move from load_default=None to required=False so that _serialize methods no longer need to pass through None values (apispec caught this)
  • Streamline function signatures of _serialize and _deserialize methods
  • The exact same JSON Marshmallow field was defined twice -> refactored
  • Added changelog item in documentation/changelog.rst
  • Added changelog item in documentation/api/changelog.rst
  • Added changelog item in documentation/cli/changelog.rst

Look & Feel

Now matches expected responses detailed in #1922.

How to test

The new test_all_custom_fields_call_super_deserialize makes sure that all fields mapping to a db object calls super()._deserialize, which checks that the value is actually an integer ID.

Further Improvements

The test uses a util method (deserialize_calls_super) with a switch (and_queries_db). If we set this to True we would also cover all fields that do not themselves query the db as part of deserializing. I tuned this off for now, because we have various fields that worked around this bug in one way or another, using their own validation logic rather than that of their superclass Marshmallow field. For instance:

class PipedAssetFieldListField(fields.Str):
    """
    Field that represents a list of Strings, in serialized form joined by "|".
    Each one should represent a field in the AssetAPIQuerySchema.
    """

    def _deserialize(self, values: str, attr, data, **kwargs) -> list[str]:
        if not isinstance(values, str):
            raise validate.ValidationError(
                "Invalid input type, should be a string, separable by '|'."
            )
        ...

could instead have been:

class PipedAssetFieldListField(fields.Str):
    """
    Field that represents a list of Strings, in serialized form joined by "|".
    Each one should represent a field in the AssetAPIQuerySchema.
    """

    def _deserialize(self, value: typing.Any, attr, data, **kwargs) -> list[str]:
        values: str = super()._deserialize(value, attr, data, **kwargs)
        ...

in which case the ValidationError would become slightly less informative.

In this particular case, the replacement would probably still be acceptable, but some others have more explicit error messages right now.

Related Items

Closes #1922.

…hat override

    _deserialize() call super()._deserialize()

Signed-off-by: F.N. Claessen <felix@seita.nl>
…t override

    _deserialize() call super()._deserialize()

Signed-off-by: F.N. Claessen <felix@seita.nl>
…deserialize method

Signed-off-by: F.N. Claessen <felix@seita.nl>
…lass methods

Signed-off-by: F.N. Claessen <felix@seita.nl>
…methods

Signed-off-by: F.N. Claessen <felix@seita.nl>
Signed-off-by: F.N. Claessen <felix@seita.nl>
Signed-off-by: F.N. Claessen <felix@seita.nl>
@Flix6x Flix6x added this to the 0.31.0 milestone Jan 21, 2026
@Flix6x Flix6x self-assigned this Jan 21, 2026
@Flix6x Flix6x added bug Something isn't working API CLI labels Jan 21, 2026
@read-the-docs-community
Copy link

read-the-docs-community bot commented Jan 21, 2026

Signed-off-by: F.N. Claessen <felix@seita.nl>
Signed-off-by: F.N. Claessen <felix@seita.nl>
…er fields, too

Signed-off-by: F.N. Claessen <felix@seita.nl>
Signed-off-by: F.N. Claessen <felix@seita.nl>
Signed-off-by: F.N. Claessen <felix@seita.nl>
Signed-off-by: F.N. Claessen <felix@seita.nl>
@Flix6x Flix6x changed the title Fix/marshmallow field subclass deserialization Fix/return validation errors instead of db errors Jan 21, 2026
Signed-off-by: F.N. Claessen <felix@seita.nl>
Signed-off-by: F.N. Claessen <felix@seita.nl>
Signed-off-by: F.N. Claessen <felix@seita.nl>
@Flix6x Flix6x marked this pull request as ready for review January 21, 2026 12:34
@Flix6x Flix6x requested a review from nhoening January 21, 2026 12:44
Copy link
Contributor

@nhoening nhoening left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice cleanup work, and good use of the inspect and importlib libraries to test this :)

Good for UX. And arguably this makes FlexMeasures a bit more secure as it leaks no internal information this way (well, the db structure was open source anyway).

I have just one request: Run make update-docs

Signed-off-by: F.N. Claessen <felix@seita.nl>
Signed-off-by: F.N. Claessen <felix@seita.nl>
@Flix6x Flix6x requested a review from nhoening January 21, 2026 14:06
@Flix6x Flix6x merged commit 7027248 into main Jan 21, 2026
8 checks passed
@Flix6x Flix6x deleted the fix/marshmallow-field-subclass-deserialization branch January 21, 2026 14:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

API bug Something isn't working CLI

Projects

None yet

Development

Successfully merging this pull request may close these issues.

DB errors during deserialization of user input

3 participants