api: Add stricter validation of input/output data

This change adds stricter validation of data that enters and leaves the
database. As a result, we clearly separate the database model from the
data model that the REST API exports.

1 files changed, 5 insertions, 5 deletions

diff --git a/opendc-web/opendc-web-api/opendc/api/topologies.py b/opendc-web/opendc-web-api/opendc/api/topologies.py
index eedf049d..a2d3f41a 100644
--- a/opendc-web/opendc-web-api/opendc/api/topologies.py
+++ b/opendc-web/opendc-web-api/opendc/api/topologies.py
@@ -24,7 +24,6 @@ from flask import request
 from flask_restful import Resource
 from marshmallow import Schema, fields
 
-from opendc.database import Database
 from opendc.models.project import Project
 from opendc.models.topology import Topology as TopologyModel, TopologySchema
 from opendc.exts import current_user, requires_auth
@@ -43,7 +42,7 @@ class Topology(Resource):
         topology = TopologyModel.from_id(topology_id)
         topology.check_exists()
         topology.check_user_access(current_user['sub'], False)
-        data = topology.obj
+        data = TopologySchema().dump(topology.obj)
         return {'data': data}
 
     def put(self, topology_id):
@@ -60,10 +59,10 @@ class Topology(Resource):
 
         topology.set_property('name', result['topology']['name'])
         topology.set_property('rooms', result['topology']['rooms'])
-        topology.set_property('datetimeLastEdited', Database.datetime_to_string(datetime.now()))
+        topology.set_property('datetimeLastEdited', datetime.now())
 
         topology.update()
-        data = topology.obj
+        data = TopologySchema().dump(topology.obj)
         return {'data': data}
 
     def delete(self, topology_id):
@@ -84,7 +83,8 @@ class Topology(Resource):
         project.update()
 
         old_object = topology.delete()
-        return {'data': old_object}
+        data = TopologySchema().dump(old_object)
+        return {'data': data}
 
     class PutSchema(Schema):
         """