ge-aerospace/shopdb-flask
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
762d1b7210bc9ce73b4332f3c3af53e2b5606cbb
shopdb-flask/shopdb/core/api/docs.py
cproudlock 762d1b7210 Make the API usable by an agent, and stop the contract going stale 
Someone writing a script against ShopDB had two options: read a 705 KB spec, or
guess. The spec is the reference, not an index, and handing an agent the whole
thing means either truncating it or spending a context window on 479 operations
nobody asked about.

Three additions, each feeding the next.

/api/docs/operations.txt is the index: every operation on one line with its
method, path, tag, auth and summary, at around 70 KB for all 486. A caller can
hold the entire API at once, find the four operations it needs, and only then
fetch their schemas.

/api/docs/openapi.json?tag=... narrows the spec to one of the 41 tag groups.
Components are kept intact deliberately: pruning the schema graph to match would
leave references resolving to nothing, and a generator that fails confusingly is
worse than a file that is larger than strictly necessary.

tools/mcp/ is an MCP server built on both. Five tools rather than 483, because a
tool per operation is unusable - clients degrade past a few dozen and models
start picking the wrong one. It reads everything from the live instance at call
time, so enabling a plugin adds operations it can already reach with no change
here. The token is the security boundary and the README says so plainly: every
operation the credential permits is reachable, so exploratory work wants a
read-scoped token.

The rest of this is about the contract not drifting, which is what makes any of
the above trustworthy.

Two CI jobs:

- api-contract runs the parity gates and then regenerates the spec and fails if
  anything changed. Those gates already existed and already worked - they caught
  both routes added here, unprompted - but nothing ran them except by hand, and
  the committed spec had silently drifted by three operations, including two
  setup endpoints added the day before.
- migrations-mysql is the job the header comment has been claiming for some
  time while not existing. It described "the REAL multi-site deploy path" and
  "what catches an Alembic regression on MySQL before it ships", and there was
  no such job. That is worse than no comment: it is the false confidence that
  let a migration ship which could not build a schema on a fresh MySQL database.
  The suite runs on SQLite, and SQLite accepts a foreign key onto a table that
  does not exist.

CONTRIBUTING.md now says to run gen_openapi.py --refresh after changing a route,
and that a route the sweep cannot classify belongs in PUBLIC_ENDPOINTS with a
reason rather than hand-edited into the inventory, which the next refresh would
overwrite. The new index route is declared there alongside the spec it indexes.
2026-09-20 12:59:49 -04:00

495 lines
24 KiB
Python
Raw Blame History

"""Interactive API docs: self-hosted Redoc over the generated OpenAPI spec.
Served at /api/docs (relative to the mount). The Redoc bundle is vendored in
staticdocs/ so this works fully offline on the air-gapped prod box - no CDN.
The spec is docs/openapi.json in the repo (regenerate with
scripts/gen_openapi.py after API changes).
Two renderers over ONE spec. Redoc is read-only by design and is the default,
because what is published is a contract. Swagger UI at /api/docs/try adds the
one thing Redoc will not do: fire a real request from the page, against this
server, with whatever session the browser is already carrying. That is its
whole value and the whole reason it is off unless a site turns it on - see
API_DOCS_TRYIT_ENABLED in shopdb/config.py.
"""
import json
import os
from markupsafe import escape
from flask import Blueprint, Response, current_app, request, send_file, url_for
docs_bp = Blueprint('docs', __name__)
_HERE = os.path.dirname(os.path.abspath(__file__))
# shopdb/core/api -> repo root
_REPO_ROOT = os.path.dirname(os.path.dirname(os.path.dirname(_HERE)))
_SPEC = os.path.join(_REPO_ROOT, 'docs', 'openapi.json')
_LLMS = os.path.join(_REPO_ROOT, 'docs', 'llms.txt')
_REDOC = os.path.join(_HERE, 'staticdocs', 'redoc.standalone.js')
# Vendored from swagger-ui-dist 5.33.0. TWO files out of the ~30 in that dist,
# because those are the two the page below actually loads:
# swagger-ui.css - the stylesheet. Its images are inline data: URIs,
# so it pulls nothing else. The trailing
# sourceMappingURL comment was stripped: the .map
# is not vendored, and left in place it turns every
# devtools open into a 404 on a box with no
# internet to fall back on.
# swagger-ui-bundle.min.js - the renderer plus the core presets, self-
# contained. NOT vendored beside it:
# swagger-ui-standalone-preset.js (the topbar with
# the "load any spec URL" box - this page serves
# one spec on purpose), the ES bundles (module
# builds of the same code), the .map files (~10 MB
# of source maps that only devtools reads),
# oauth2-redirect.html (no OAuth flow here), and
# the favicons.
# The upstream name is swagger-ui-bundle.js; the vendored copy carries .min.js,
# which is what it is - a minified single-line build. That suffix is also what
# scripts/check-naming-and-style.sh already filters vendored bundles by, so the
# style gate does not report thousands of hits in code nobody here wrote.
# swagger-ui.LICENSE.txt is the Apache-2.0 text that ships with the dist. It is
# never served; it is here because redistributing the bundle requires it.
_SWAGGER_CSS = os.path.join(_HERE, 'staticdocs', 'swagger-ui.css')
_SWAGGER_JS = os.path.join(_HERE, 'staticdocs', 'swagger-ui-bundle.min.js')
_TRYIT_ENDPOINT = 'docs.swagger_tryit'
def _tryit_is_mounted():
"""True when the try-it page exists on THIS app.
Reads the url map rather than the config flag on purpose: the routes are
bound once, at blueprint registration, so a config value changed after boot
would have the Redoc page advertise a link that answers 404.
"""
return _TRYIT_ENDPOINT in current_app.view_functions
@docs_bp.route('/', strict_slashes=False)
def docs_index():
"""Redoc page. url_for keeps the asset URLs correct under any mount."""
spec_url = url_for('docs.openapi_spec')
redoc_url = url_for('docs.redoc_js')
# Mentioned only when it is actually there. An unconditional note would be
# an advert for a 404 on every box that ships the shipped default.
tryit_note = ''
if _tryit_is_mounted():
tryit_note = (
'<p class="docs-note">'
'This page is read-only. To send a real request against this '
'server, use <a href="%s">the try-it view</a>.</p>'
% url_for(_TRYIT_ENDPOINT)
)
# DARK MODE. Redoc does not read prefers-color-scheme on its own, and
# the <redoc spec-url> element takes no theme - so the page goes through
# Redoc.init instead, which does. The app has a dark theme and this was
# the one page that stayed white when the rest of the site went dark.
#
# The page RE-INITIALISES when the OS scheme flips rather than restyling:
# Redoc bakes its colours into styled-components at init, so a CSS
# override reaches the chrome and misses the content.
page = (
'<!doctype html><html><head>'
'<title>ShopDB API</title>'
'<meta charset="utf-8">'
'<meta name="viewport" content="width=device-width, initial-scale=1">'
'<style>'
# color-scheme follows the SAME attribute Redoc is themed from, so the
# OS never paints dark scrollbars under a page the user set to light.
':root{color-scheme:light}'
':root[data-theme="dark"]{color-scheme:dark}'
'body{margin:0;padding:0;background:#fff}'
'.docs-note{font:14px/1.6 system-ui,-apple-system,Segoe UI,sans-serif;'
'margin:0;padding:10px 16px;background:#f5f5f5;color:#1a1a2e;'
'border-bottom:1px solid #dee2e6}'
'.docs-note a{color:#2d6ce0}'
# The ONLY Redoc elements with no theme key. Each is a colour hard-coded
# in the vendored bundle, so it cannot be reached from the theme object:
# h5 section headings ("query Parameters"),
# rgba(38,50,56,.5) - fails AA on light too
# td[colspan] > div nested schema tables at depth 2 are
# painted #ffffff whatever nestedBackground
# says, and the response envelopes nest 3
# deep, so it shows on every operation
# .react-tabs__tab--selected right-panel tab paints text.primary on
# rightPanel.textColor; both are light in
# dark mode, so the selected tab label
# vanished into its own background
# Selectors use Redoc's own DOM - tag, colspan attribute, react-tabs
# class - never generated class hashes, which change on every build.
'#redoc h5{color:#5c636a;border-bottom-color:#dee2e6}'
':root[data-theme="dark"] body{background:#0a0a1a}'
':root[data-theme="dark"] .docs-note{background:#0d0d2b;color:#e6e6e8;'
'border-bottom-color:rgba(65,129,255,0.2)}'
':root[data-theme="dark"] .docs-note a{color:#4181ff}'
':root[data-theme="dark"] #redoc h5{color:#9d9da3;'
'border-bottom-color:rgba(255,255,255,0.2)}'
':root[data-theme="dark"] #redoc td[colspan="2"]>div td[colspan="2"]>div'
'{background:#0a0a1a}'
':root[data-theme="dark"] #redoc td[colspan="2"]>div td[colspan="2"]>div '
'td[colspan="2"]>div{background:#0d0d2b}'
':root[data-theme="dark"] #redoc .react-tabs__tab--selected{color:#0a0a1a}'
# The content-type control is a native <select>. Redoc never styles it,
# so it keeps the OS default (black text, transparent background) and
# reads 1.07:1 on the dark right panel. Name both halves; the border
# keeps it looking like a control rather than stray text.
# The content-type label ("application/json") is a span INSIDE that
# same h5, carrying its own hard-coded black, so theming the h5 alone
# left it at 1.07:1 on the dark panel. Inherit rather than restate, so
# it tracks whatever the heading colour is.
'#redoc h5 span{color:inherit}'
# Redoc's footer badge links to redocly.com and its logo was replaced
# with a blank GIF so an air-gapped box stops reaching for a CDN, so
# what remains is a dead external link on a shop-floor kiosk. The MIT
# licence requires the notice be retained in the DISTRIBUTION, which
# staticdocs/redoc.standalone.js.LICENSE.txt covers; it does not
# require rendering a badge.
'#redoc a[href*="redocly.com"]{display:none}'
'</style></head><body>'
'%s'
'<div id="redoc"></div>'
'<script src="%s"></script>'
'<script>'
'var SPEC = %s;'
# Product type: the app's body stack and its mono stack. Inter is
# bundled into the SPA under a hashed filename this standalone page
# cannot reference, so system-ui is the honest choice (Segoe UI on the
# Windows kiosks).
'var FONT="system-ui,-apple-system,Segoe UI,sans-serif";'
'var MONO="SF Mono,Monaco,Consolas,monospace";'
# The product chrome is the same navy with white text in BOTH themes,
# so one object serves both. Redoc deep-merges the theme into a fresh
# copy of its defaults and snapshots it, so sharing is safe.
'var SIDEBAR={backgroundColor:"#00003d",'
'textColor:"rgba(255,255,255,0.85)",activeTextColor:"#ffffff",'
'groupItems:{activeBackgroundColor:"rgba(255,255,255,0.1)"},'
'level1Items:{activeBackgroundColor:"rgba(255,255,255,0.1)"},'
'arrow:{color:"rgba(255,255,255,0.85)"}};'
# Light. The middle column is the product CARD white. primary is
# --primary-dark rather than --primary, because --primary is 3.6:1 on
# white and fails AA; success and error are a shade darker than the
# product tokens for the same reason - those tokens are designed as
# fills, not as text on the nested panels where type names and required
# labels live. tabTextColor is pinned because the response tabs sit on
# the DARK code block in both themes, and Redoc would otherwise derive
# them from the light middle-panel colours.
'var LIGHT={colors:{primary:{main:"#2d6ce0",light:"#2d6ce0"},'
'success:{main:"#0b7a3b"},'
'warning:{main:"#ff9500",contrastText:"#1a1a2e"},'
'error:{main:"#c1273a"},'
'text:{primary:"#1a1a2e",secondary:"#5c636a"},'
'border:{dark:"#dee2e6"},'
'gray:{50:"#f5f5f5",100:"#f5f5f5"},'
# tabTextColor is deliberately NOT pinned here. It was, on the
# assumption that these tabs sit on the dark code block in both
# themes; measuring the rendered page showed the light-theme tab list
# on the white panel, where the bright green read 1.95:1. Unset, Redoc
# derives it from success.main, which is chosen to pass on white.
'responses:{}},'
'schema:{nestedBackground:"#f5f5f5"},'
'typography:{fontSize:"15px",lineHeight:"1.6em",fontFamily:FONT,'
'fontWeightBold:"600",headings:{fontFamily:FONT,fontWeight:"600"},'
'code:{fontFamily:MONO,color:"#1a1a2e",'
'backgroundColor:"rgba(26,26,46,0.06)"},'
'links:{hover:"#4181ff"}},'
'sidebar:SIDEBAR,'
'rightPanel:{backgroundColor:"#00003d",textColor:"#ffffff",'
'servers:{overlay:{backgroundColor:"#f5f5f5",textColor:"#1a1a2e"},'
'url:{backgroundColor:"#ffffff"}}},'
'codeBlock:{backgroundColor:"#0a0a1a"}};'
# Dark. Product tokens verbatim, with the two alpha text tokens
# flattened onto the page background so Redoc's own lighten and
# transparentize derivations stay predictable. The response accordion
# tints are named because Redoc derives a 7% tint that is invisible on
# a near-black page.
'var DARK={colors:{primary:{main:"#4181ff"},'
'success:{main:"#0ad64f"},'
'warning:{main:"#ff9500",contrastText:"#1a1a2e"},'
'error:{main:"#f5365c"},'
'text:{primary:"#e6e6e8",secondary:"#9d9da3"},'
'border:{dark:"rgba(65,129,255,0.2)"},'
'gray:{50:"#0d0d2b",100:"#0d0d2b"},'
'responses:{success:{backgroundColor:"rgba(10,214,79,0.12)"},'
'error:{backgroundColor:"rgba(245,54,92,0.12)"}}},'
'schema:{nestedBackground:"#0d0d2b"},'
'typography:{fontSize:"15px",lineHeight:"1.6em",fontFamily:FONT,'
'fontWeightBold:"600",headings:{fontFamily:FONT,fontWeight:"600"},'
'code:{fontFamily:MONO,color:"#e6e6e8",'
'backgroundColor:"rgba(255,255,255,0.08)"},'
'links:{hover:"#7aa8ff"}},'
'sidebar:SIDEBAR,'
'rightPanel:{backgroundColor:"#00003d",textColor:"#ffffff",'
'servers:{overlay:{backgroundColor:"#0d0d2b",textColor:"#e6e6e8"},'
'url:{backgroundColor:"#0a0a1a"}}},'
'codeBlock:{backgroundColor:"#0a0a1a"}};'
# THEME SOURCE. The app stores an explicit choice under this key and
# stamps <html data-theme>. This page is served from the same origin,
# so it reads the same key rather than guessing from the OS - picking
# light in the app on a dark-OS kiosk used to give a dark docs page.
# The OS scheme is only the fallback, exactly as in the app's store.
# localStorage can throw outright on a locked-down kiosk browser.
'var KEY="shopdb-theme";'
'var q=window.matchMedia("(prefers-color-scheme: dark)");'
'var el=document.getElementById("redoc");'
'function pick(){var t=null;'
'try{t=window.localStorage.getItem(KEY);}catch(e){}'
'if(t!=="dark"&&t!=="light"){t=q.matches?"dark":"light";}'
'return t;}'
# Re-initialise rather than restyle: Redoc bakes colours into
# styled-components at init. data-theme is stamped first so the CSS
# above and the Redoc theme can never disagree about which one is live.
'function draw(){var t=pick();'
'document.documentElement.setAttribute("data-theme",t);'
'el.innerHTML="";'
'Redoc.init(SPEC,{theme:t==="dark"?DARK:LIGHT},el);}'
'draw();'
# addEventListener is missing from MediaQueryList in older WebViews,
# and a shop-floor kiosk browser is exactly where this gets read.
'if(q.addEventListener){q.addEventListener("change",draw);}'
'else if(q.addListener){q.addListener(draw);}'
# Fires in THIS tab when the app in another tab toggles the theme.
'window.addEventListener("storage",function(e){'
'if(e.key===KEY){draw();}});'
'</script>'
'</body></html>' % (tryit_note, redoc_url, json.dumps(spec_url))
)
return Response(page, mimetype='text/html')
_SPEC_CACHE = {}
def _spec_with_server():
"""The generated spec, with `servers` set to where this instance is mounted.
THE MOUNT IS A DEPLOYMENT FACT, NOT A BUILD FACT. gen_openapi.py writes
servers: [{"url": "/"}] because it cannot know where the app will be hung,
and wsgi.py moves MOUNT_PATH from PATH_INFO into SCRIPT_NAME at runtime. So
an instance under /shopdb served a spec whose paths start at /api, and both
renderers dutifully built https://host/api/apitokens - a URL that 404s.
Anyone who copied it out of the docs page got a broken call, and Swagger's
try-it fired at the wrong place.
request.script_root is the runtime answer: '' for a root install, '/shopdb'
under the subpath method, and correct behind a proxy that sets the prefix.
The file is ~1 MB, so it is parsed once and cached by mtime; each request
gets a shallow copy with only `servers` replaced, which keeps two requests
on different mounts from racing on one dict.
"""
stamp = os.path.getmtime(_SPEC)
if _SPEC_CACHE.get('stamp') != stamp:
with open(_SPEC, 'r', encoding='utf-8') as handle:
_SPEC_CACHE['spec'] = json.load(handle)
_SPEC_CACHE['stamp'] = stamp
root = request.script_root or ''
spec = dict(_SPEC_CACHE['spec'])
spec['servers'] = [{
'url': root or '/',
'description': 'this instance',
}]
return spec
@docs_bp.route('/openapi.json')
def openapi_spec():
"""The generated OpenAPI 3.1 spec (machine + LLM readable).
?tag=core-assets narrows it to one tag group. The whole spec is ~700 KB
across 483 operations, which is more than a caller generating a client for
one area needs and more than most model context windows should spend. The
filtered copy keeps components intact, because a pruned schema graph is
worse than a large one: a $ref that resolves to nothing turns a working
generator into a confusing failure.
"""
if not os.path.isfile(_SPEC):
return Response('{"error":"openapi.json not generated"}',
status=404, mimetype='application/json')
spec = _spec_with_server()
wanted = (request.args.get('tag') or '').strip()
if wanted:
paths = {}
for path, methods in (spec.get('paths') or {}).items():
kept = {m: op for m, op in methods.items()
if not isinstance(op, dict) or wanted in (op.get('tags') or [])}
# A path whose only survivors are shared keys (parameters, summary)
# carries no operation and would read as an endpoint that exists
# and does nothing.
if any(isinstance(op, dict) and op.get('tags') for op in kept.values()):
paths[path] = kept
if not paths:
return Response(
json.dumps({'error': f'no operations tagged {wanted!r}',
'tags': sorted(_operation_tags(spec))}),
status=404, mimetype='application/json')
spec = dict(spec, paths=paths)
return Response(json.dumps(spec), mimetype='application/json')
def _operation_tags(spec):
"""Every tag that actually carries an operation."""
tags = set()
for methods in (spec.get('paths') or {}).values():
for op in methods.values():
if isinstance(op, dict):
tags.update(op.get('tags') or [])
return tags
@docs_bp.route('/operations.txt')
def operations_index():
"""Every operation, one line each: method, path, tag, auth, summary.
WHY THIS EXISTS. The spec is the reference and it is ~700 KB; this is the
index, and it is ~40 KB. A caller - a person or an agent writing a script -
can hold every one of the 483 operations at once here, find the four it
needs, and only then fetch their schemas from openapi.json?tag=... Handing
over the whole spec instead means either truncating it or spending a context
window on 479 operations nobody asked about.
Plain text on purpose: it is meant to be read and grepped, not parsed.
"""
if not os.path.isfile(_SPEC):
return Response('openapi.json not generated', status=404,
mimetype='text/plain')
spec = _spec_with_server()
servers = spec.get('servers') or [{'url': '/'}]
rows = []
for path, methods in sorted((spec.get('paths') or {}).items()):
for method, op in sorted(methods.items()):
if not isinstance(op, dict) or method.upper() not in _HTTP_METHODS:
continue
tag = (op.get('tags') or ['-'])[0]
auth = 'public' if op.get('security') == [] else (
','.join(sorted({k for s in (op.get('security') or [])
for k in s})) or 'bearer')
summary = ' '.join((op.get('summary') or '').split())
rows.append(f'{method.upper():<6} {path:<52} [{tag}] ({auth}) {summary}')
header = (
'# ShopDB API - operation index\n'
f'# {len(rows)} operations. Base URL: {servers[0].get("url", "/")}\n'
'#\n'
'# This is the INDEX. Schemas, parameters and examples are in the spec:\n'
'# /api/docs/openapi.json full (large)\n'
'# /api/docs/openapi.json?tag=<tag> one group\n'
'# Orientation for an agent, including the response envelope and auth:\n'
'# /api/docs/llms.txt\n'
'#\n'
'# METHOD path [tag] (auth) summary\n'
)
return Response(header + '\n'.join(rows) + '\n', mimetype='text/plain')
_HTTP_METHODS = {'GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'}
@docs_bp.route('/redoc.standalone.js')
def redoc_js():
"""Vendored Redoc bundle (offline)."""
return send_file(_REDOC, mimetype='application/javascript')
@docs_bp.route('/llms.txt')
def llms_txt():
"""Concise LLM-oriented API guide."""
if not os.path.isfile(_LLMS):
return Response('llms.txt not found', status=404, mimetype='text/plain')
return send_file(_LLMS, mimetype='text/plain')
def swagger_tryit():
"""Swagger UI over the SAME spec the Redoc page renders.
Every URL on the page comes from url_for, so the spec and both assets stay
same-origin and correct under a mount path (prod runs under /shopdb).
"""
spec_url = url_for('docs.openapi_spec')
css_url = url_for('docs.swagger_css')
js_url = url_for('docs.swagger_js')
redoc_page_url = url_for('docs.docs_index')
page = (
'<!doctype html><html><head>'
'<title>ShopDB API - try it</title>'
'<meta charset="utf-8">'
'<meta name="viewport" content="width=device-width, initial-scale=1">'
'<link rel="stylesheet" href="%(css)s">'
'<style>body{margin:0;padding:0}'
# The product's light-theme error colour, not an invented red. Swagger's
# stylesheet is light-only, so this page stays light and only the
# banner is themed; white on it is 5.8:1.
'.tryit-warn{font:14px/1.6 system-ui,-apple-system,Segoe UI,sans-serif;'
'background:#c1273a;'
'color:#fff;margin:0;padding:10px 16px}'
'.tryit-warn a{color:#fff}</style>'
'</head><body>'
'<p class="tryit-warn"><b>Execute sends a real request to this '
'server</b>, as whoever is signed in on this browser. A write '
'operation changes live data. The read-only contract is at '
'<a href="%(redoc)s">/api/docs</a>.</p>'
'<div id="swagger-ui"></div>'
'<script src="%(js)s"></script>'
'<script>\n'
'window.ui = SwaggerUIBundle({\n'
# json.dumps, NOT a bare "%s". SCRIPT_NAME is proxy-controlled and
# ProxyFix honours X-Forwarded-Prefix, so a mount path carrying a quote
# closed this string literal and executed what followed: SCRIPT_NAME of
# /a"+alert(1)+" rendered url: "/a"+alert(1)+"/api/docs/openapi.json".
# Escaping it as JSON is what makes the value data rather than code.
' url: %(spec)s,\n'
' dom_id: "#swagger-ui",\n'
' presets: [SwaggerUIBundle.presets.apis],\n'
' layout: "BaseLayout",\n'
' deepLinking: true,\n'
' filter: true,\n'
# 573 operations. Expanded by default, the page spends many seconds
# laying out before it answers a scroll.
' docExpansion: "none",\n'
' withCredentials: true,\n'
# THE air-gap setting. Left unset, Swagger UI renders a "valid" badge
# by handing this spec to the public swagger validator - an outbound
# request that cannot succeed here, and that would ship the internal
# API surface off the box if it ever could.
' validatorUrl: null\n'
'});\n'
'</script>'
'</body></html>'
% {'css': escape(css_url), 'js': escape(js_url),
'spec': json.dumps(spec_url),
'redoc': escape(redoc_page_url)}
)
return Response(page, mimetype='text/html')
def swagger_css():
"""Vendored Swagger UI stylesheet (offline)."""
return send_file(_SWAGGER_CSS, mimetype='text/css')
def swagger_js():
"""Vendored Swagger UI bundle (offline)."""
return send_file(_SWAGGER_JS, mimetype='application/javascript')
@docs_bp.record_once
def _mount_tryit(state):
"""Bind the try-it routes only when the flag is on for this app.
Binding at registration rather than checking the flag inside the view, so
that when it is off the routes DO NOT EXIST: the URL gets Flask's own 404
and confirms nothing, and the unauthenticated-GET sweep in
tests/test_core/test_public_read_surface.py never has to make an exception
for three routes that are only meant to be reachable on a dev box.
"""
if not state.app.config.get('API_DOCS_TRYIT_ENABLED'):
return
state.add_url_rule('/try', endpoint='swagger_tryit',
view_func=swagger_tryit, strict_slashes=False)
state.add_url_rule('/swagger-ui.css', endpoint='swagger_css',
view_func=swagger_css)
state.add_url_rule('/swagger-ui-bundle.min.js', endpoint='swagger_js',
view_func=swagger_js)
Reference in New Issue View Git Blame Copy Permalink