Description
Several API route files pass the HTTP status code as a second positional argument to jsonify() instead of returning it as a separate tuple element. Flask serializes both arguments as a JSON array, so the response body is wrong and the HTTP status code is always 200.
Affected files
| File | Lines |
|---|
src/api/routes/roles.py | 28, 39, 41, 52, 54, 64, 66 |
src/api/routes/logging.py | 28, 51, 53, 64, 66, 76, 78 |
src/api/routes/settings.py | 28, 39, 41, 52, 54, 64, 66 |
src/api/routes/healthchecks.py | 19, 21, 32, 35, 37 |
Example
# Wrong — Flask serializes this as JSON array: [{...}, 200]returnjsonify(result, 200)
# Correct — status code is returned as HTTP response codereturnjsonify(result), 200Impact
- All responses from these routes return HTTP 200 regardless of the actual status (errors are swallowed)
- The response body is a JSON array
[{...}, 200] instead of a plain object {...} - Bot-side
api_helper.py receives malformed responses, causing silent data parsing failures
Description
Several API route files pass the HTTP status code as a second positional argument to
jsonify()instead of returning it as a separate tuple element. Flask serializes both arguments as a JSON array, so the response body is wrong and the HTTP status code is always 200.Affected files
src/api/routes/roles.pysrc/api/routes/logging.pysrc/api/routes/settings.pysrc/api/routes/healthchecks.pyExample
Impact
[{...}, 200]instead of a plain object{...}api_helper.pyreceives malformed responses, causing silent data parsing failures