POST request to /api/4.0/phys_locations accepts mismatch values for regionName #5562

[dmohan001c]

I'm submitting a

• Bug Report

This Bug Report affects these Traffic Control components:

• Traffic Ops

Current behavior:

When you make a POST request to the /phys_locations endpoint, if you pass in the body with id from one Region and the name from another Region you get a successful response.

Expected behavior:

Request with a mismatch between Redion ID and name should fail or region could be dynamically named based on ID.

Minimal reproduction of the problem with instructions:

With these Regions in Traffic Ops

[
    {
        "divisionName": "Quebec",
        "division": 1,
        "id": 1,
        "lastUpdated": "2021-09-08 15:28:41+00",
        "name": "Montreal"
    },
    {
        "divisionName": "USA",
        "division": 2,
        "id": 2,
        "lastUpdated": "2021-09-08 15:28:41+00",
        "name": "Washington, D.C"
    }
]

Make a POST request to /phys_locations with this body:

{
    "address": "1234 mile high circle",
    "city": "Denver",
    "poc": "Person",
    "name": "Great_Britain1",
    "regionId": 1,
    "region": "Washington, D.C",
    "shortName": "testphyloc2",
    "state": "CO",
    "zip": "80202"
}

observe a 200 OK response that verifies the current state of the object is exactly what was submitted:

{
        "alerts": [
                {
                        "text": "physLocation was created.",
                        "level": "success"
                }
        ],
        "response": {
                "address": "1234 mile high circle",
                "city": "Denver",
                "comments": null,
                "email": null,
                "id": 3,
                "lastUpdated": "2021-09-08 15:49:36+00",
                "name": "Great_Britain1",
                "phone": null,
                "poc": "Person",
                "regionId": 1,
                "region": "Washington, D.C",
                "shortName": "testphyloc2",
                "state": "CO",
                "zip": "80202"
        }
}

... even though a subsequent GET request made to /phys_locations?id=3 shows that the Region name is different than what was submitted:

{
        "response": [
                {
                        "address": "1234 mile high circle",
                        "city": "Denver",
                        "comments": null,
                        "email": null,
                        "id": 3,
                        "lastUpdated": "2021-09-08 15:49:36+00",
                        "name": "Great_Britain1",
                        "phone": null,
                        "poc": "Person",
                        "regionId": 1,
                        "region": "Montreal",
                        "shortName": "testphyloc2",
                        "state": "CO",
                        "zip": "80202"
                }
        ]
}

[ocket8888]

... or region could be dynamically named based on ID.

So instead of just ignoring the name it would correct it in the response to be the Region identified by regionId? IMO, it would be best to just do away with the ID in the requests and responses and just only use the name. Of course, that'll be a breaking API change whereas just correcting it wouldn't be.

[srijeet0406]

I can take this.