[Bug]: Rest APIs for Status allow for "Patch" and "Put" methods

[sushilks]

Contact Details

No response

Tell us the project / group you are associated with

Community (Default)

What happened?

on the playground example of the data model
/leader/{root.Leader}/status
currently accepts "PUT" and "PATCH" methods.
Status is intended to be a read only status of the node and should only have get method.

Describe the expected behavior

Status for the node should be a read only api on the REST and should only have GET method(in the Customer facing view)

What version are you running?

NexusCli: v0.0.146
NexusCompiler: v0.0.59
NexusAppTemplates: v0.0.10
NexusDatamodelTemplates: v0.0.22
NexusRuntimeManifets: v0.2.57

How critical is this bug to you?

Critical - solution is severely limited in value

How can we recreate the bug?

No response

Any debug data that you are able to share?

No response

What is your operating system?

MacOS

Any additional / relevant info

No response

[ramramu3433]

New JIRA Created with ID: https://jira.eng.vmware.com/browse/NPT-712

[xmen4xp]

@sushilks

While I see your point, this status is "user specified" status section on the the node and hence exposed only if a "PUT" API has been enabled on the spec.

Currently we treat a Nexus node as having two attributes:

1. Node Spec
2. Node Status (optional; will be expose only if configured)

If PUT is enabled on the "node", we expose API's to PUT/PATCH both spec and status.

We could use RBAC to provide restrict access to the status, if status should not be available to everybody.

What do you think ?