Reject a bundle with more entries than the configured maximum

Author: thomas-samoht

app.conf.example

@@ -94,3 +94,7 @@ expected_audiences = https://localhost:8501
 default_page_size = 50
 # Upper limit for `_count`, larger values are clamped to this value
 max_page_size = 100
+
+[bundle]
+# Maximum number of entries in a transaction Bundle, larger bundles are rejected
+max_entries = 100

app/config.py

@@ -107,6 +107,10 @@ def validate_page_sizes(self) -> Self:
         return self
 
 
+class ConfigBundle(BaseModel):
+    max_entries: int = Field(default=100, ge=1)
+
+
 class ConfigLogging(GFConfigLogging):
     _split_console_streams = field_validator("console_streams", mode="before")(split_comma_separated())
 
@@ -120,6 +124,7 @@ class Config(BaseModel):
     uvicorn: ConfigUvicorn
     authorization_headers: ConfigAuthorizationHeaders
     pagination: ConfigPagination = Field(default_factory=ConfigPagination)
+    bundle: ConfigBundle = Field(default_factory=ConfigBundle)
 
 
 def read_ini_file(path: str) -> Any:

app/container.py

@@ -70,7 +70,7 @@ def container_config(binder: inject.Binder) -> None:
     )
     binder.bind(LocalizationListService, localization_list_service)
 
-    bundle_service = BundleService(localization_list_service)
+    bundle_service = BundleService(localization_list_service, max_entries=config.bundle.max_entries)
     binder.bind(BundleService, bundle_service)
 
     binder.bind(ConfigCryptoServiceApi, config.crypto_service_api)

app/errors/mapping.py

@@ -4,6 +4,7 @@
 
 from app.models.fhir.resources.operation_outcome.resource import IssueType
 from app.services.exceptions import (
+    BundleTooLargeError,
     ConflictError,
     CryptoServiceError,
     ForbiddenError,
@@ -43,6 +44,7 @@ class ErrorSpec(BaseModel):
     PseudonymError: ErrorSpec(severity="error", fhir_code="invalid", http_status=422, log_as="invalid_request"),
     PseudonymExchangeError: ErrorSpec(severity="error", fhir_code="invalid", http_status=400, log_as="failure"),
     CryptoServiceError: ErrorSpec(severity="error", fhir_code="transient", http_status=502, log_as="failure"),
+    BundleTooLargeError: ErrorSpec(severity="error", fhir_code="too-costly", http_status=413, log_as="invalid_request"),
 }
 
 # Applied to any exception without a mapped type (rendered as HTTP 500). Unmapped

app/routers/fhir/base.py

@@ -10,7 +10,6 @@
 from app.models.fhir.resources.operation_outcome.resource import OperationOutcome
 from app.models.response import FHIRJSONResponse
 from app.routers.dependencies import get_auth_context
-from app.services.exceptions import InvalidModelError
 from app.services.fhir.bundle import BundleService
 
 logger = logging.getLogger(__name__)
@@ -24,9 +23,7 @@ def register(
     ctx: Annotated[AuthContext, Depends(get_auth_context)],
 ) -> Any:
     results_bundle = Bundle[Any](entry=[])
-    valid_bundle = bundle_service.validate_localization_bundle_structure(data)
-    if not valid_bundle:
-        raise InvalidModelError("Bundle.entry is invalid")
+    bundle_service.validate_entry_count(data)
     for i, entry in enumerate(data.entry):
         result = bundle_service.process_entry(
             ctx=ctx,

app/services/exceptions.py

@@ -85,3 +85,7 @@ class PseudonymExchangeError(Exception):
 
 class CryptoServiceError(Exception):
     pass
+
+
+class BundleTooLargeError(Exception):
+    pass

app/services/fhir/bundle.py

@@ -18,6 +18,8 @@
 from app.models.ura import UraNumber
 from app.services.auth.auth_context import AuthContextService
 from app.services.exceptions import (
+    BundleTooLargeError,
+    InvalidModelError,
     InvalidResourceError,
     UnauthorizedManagingRequestError,
     UnauthorizedScopeError,
@@ -48,11 +50,9 @@ def _entry_for_exception(index: int, exc: Exception) -> BundleEntry[Any]:
 
 
 class BundleService:
-    def __init__(
-        self,
-        localization_list_service: LocalizationListService,
-    ) -> None:
+    def __init__(self, localization_list_service: LocalizationListService, max_entries: int) -> None:
         self.localization_list_service = localization_list_service
+        self.max_entries = max_entries
 
     def process_entry(self, ctx: AuthContext, entry: BundleEntry[Any], index: int) -> BundleEntry[Any]:
         if entry.request is None:
@@ -258,9 +258,11 @@ def requires_managing_request(method: str) -> bool:
         """Whether an entry is a managing operation and so needs a source_id"""
         return method in ("POST", "DELETE")
 
-    @staticmethod
-    def validate_localization_bundle_structure(bundle: Bundle[Any]) -> bool:
-        return len(bundle.entry) > 0
+    def validate_entry_count(self, bundle: Bundle[Any]) -> None:
+        if not bundle.entry:
+            raise InvalidModelError("Bundle.entry is invalid")
+        if len(bundle.entry) > self.max_entries:
+            raise BundleTooLargeError(f"Bundle.entry holds more than the maximum of {self.max_entries} entries")
 
     def resolve_request_url(self, url: str, index: int) -> EntryRequestDto | BundleEntry[LocalizationList]:
         try:

tests/errors/test_mapping.py

@@ -4,6 +4,7 @@
 from app.models.auth.data import AuthorizationScope
 from app.models.fhir.resources.operation_outcome.resource import IssueType
 from app.services.exceptions import (
+    BundleTooLargeError,
     ConflictError,
     CryptoServiceError,
     ForbiddenError,
@@ -41,6 +42,9 @@ def _scope_error() -> UnauthorizedScopeError:
         pytest.param(ValueError("boom"), DEFAULT_SPEC, id="value-error-is-unexpected"),
         pytest.param(PseudonymExchangeError("rejected"), _spec("invalid", 400, "failure"), id="pseudonym-exchange"),
         pytest.param(CryptoServiceError("down"), _spec("transient", 502, "failure"), id="crypto-service"),
+        pytest.param(
+            BundleTooLargeError("too many"), _spec("too-costly", 413, "invalid_request"), id="bundle-too-large"
+        ),
         pytest.param(InvalidModelError("bad"), _spec("structure", 400, "invalid_request"), id="invalid-model"),
         pytest.param(_scope_error(), _spec("security", 403), id="unauthorized-scope-via-mro"),
         pytest.param(UnauthorizedManagingRequestError(), _spec("security", 403), id="unauthorized-managing-via-mro"),

tests/routers/conftest.py

@@ -124,7 +124,9 @@ def make_test_client(
     app.dependency_overrides[get_key_info_service] = lambda: key_info_service
     app.dependency_overrides[get_pseudonym_referral_service] = lambda: pseudonym_referral_service
     app.dependency_overrides[get_localization_list_service] = lambda: localization_list_service
-    app.dependency_overrides[get_bundle_service] = lambda: BundleService(localization_list_service)
+    app.dependency_overrides[get_bundle_service] = lambda: BundleService(
+        localization_list_service, max_entries=get_test_config().bundle.max_entries
+    )
 
     def override_auth_ctx(request: Request) -> AuthContext:
         request.state.auth = auth_context

tests/routers/test_fhir_base.py

@@ -13,6 +13,7 @@
 from app.services.referral_service import ReferralService
 from tests.conftest import make_list_resource
 from tests.routers.conftest import TEST_URA, make_auth_context, make_test_client
+from tests.test_config import get_test_config
 
 FHIR_JSON = {"Content-Type": "application/fhir+json"}
 
@@ -47,6 +48,16 @@ def test_processes_a_post_entry(self, client: TestClient) -> None:
         assert entry["response"]["status"] == "201"
         assert entry["resource"]["id"] is not None
 
+    def test_rejects_a_bundle_over_the_entry_limit_without_processing_it(self, client: TestClient) -> None:
+        entries = [_post_entry()] * (get_test_config().bundle.max_entries + 1)
+        with capture_records("app") as records:
+            response = client.post("/fhir", json=_bundle(*entries), headers=FHIR_JSON)
+
+        assert response.status_code == 413
+        assert response.json()["issue"][0]["code"] == "too-costly"
+        assert len(records.for_event(Log.INVALID_REQUEST)) == 1
+        assert records.for_event(Log.REGISTERED_REFERRAL) == []
+
     def test_rejects_an_empty_bundle(self, client: TestClient) -> None:
         response = client.post("/fhir", json=_bundle(), headers=FHIR_JSON)