Flask Command Validation and Transaction Replay

A Flask route receives an HTTP command, not a trusted model update. JSON parsing can establish that a body is present and syntactically valid; it cannot establish that reviewer 47 may approve case 62. Browser CSRF protection answers another question about credentialed submissions, while a transaction answers whether the case state, audit row, and outbox intent commit together. Those boundaries should stay separate. A dropped response after commit leaves the browser unable to tell whether approval happened. Give the logical command a stable operation ID, store its result under a unique database constraint, and let an exact replay retrieve the original outcome. A changed payload under the same ID must be rejected rather than silently treated as the original command.

Working case

A reviewer clicks Approve while case 62 is in review. The server commits approval and its audit row, but a proxy drops the response. The browser retries with a new operation ID and a second audit event appears. A different reviewer sends well-formed JSON with a guessed case ID; an input validator accepts it, yet the reviewer has no assignment. The repaired route checks content type and body limits, validates the operation ID and expected revision, derives identity from a server session, and delegates to a transaction service. That service checks current assignment and case state under a lock, inserts one operation and outbox row, commits, and returns the stored result for a byte-equivalent replay.

Implementation boundary

import re
from flask import abort, jsonify, request, session
from .security import csrf

def approve_permit(case_id: int, approval_service):
    csrf.protect()
    if not request.is_json:
        abort(415)
    command = request.get_json(silent=True)
    if not isinstance(command, dict):
        abort(400)
    if set(command) != {"operation_id", "expected_revision", "reason"}:
        abort(400)
    revision = command["expected_revision"]
    operation_id = command["operation_id"]
    reason = command["reason"]
    if type(revision) is not int or revision < 0:
        abort(400)
    if not isinstance(operation_id, str) or not re.fullmatch(r"[a-f0-9]{32}", operation_id):
        abort(400)
    if not isinstance(reason, str) or not 1 <= len(reason) <= 500:
        abort(400)
    reviewer_id = session.get("reviewer_id")
    if reviewer_id is None:
        abort(401)
    result = approval_service.approve_once(reviewer_id, case_id, command)
    return jsonify({"case_id": result.case_id, "status": result.status})

Set an application-wide request-body limit suitable for this endpoint family and reject non-JSON content before parsing. Validate a strict object shape and bounded values; a Python bool must not slip through an integer revision check, since bool subclasses int. Protect cookie-authenticated browser mutations with a real CSRF mechanism; SameSite cookies alone do not settle every threat model. In the service, compare the command's expected revision against locked current state, and use a uniqueness constraint on reviewer and operation ID or another deliberate namespace. Store a digest of the canonical command fields with the outcome. Make the transaction own case change, operation record, and outbox row. Never send email inside a database transaction that might be retried.

Cost and boundaries

JSON and token checks are cheap compared with contention on a hot case. A row lock serializes conflicting approvals and can increase tail latency, so keep the transaction short and avoid provider calls within it. Operation records occupy storage for the defined replay horizon; deleting them too early permits old retries to repeat the effect. An outbox row adds a write but makes promised delivery observable after a crash. A replay read can return quickly without taking another approval lock once the committed operation is found, provided the stored payload digest matches. Monitor lock waits, duplicate-operation conflicts, stale revision responses, outbox age, and body-size rejection rather than using only successful HTTP counts.

Failure trace

Send malformed JSON, an array body, a bool revision, an oversized body, and a valid command from reviewer 81. None may mutate case 62. Submit a browser form without its CSRF token and verify the guard runs before business logic. Race two approval requests with the same operation ID; inspect the database for one case transition, one audit result, and one outbox event. Commit and discard the response, then replay the exact command and require the saved result. Change the reason while reusing the ID and require a conflict. Inject failure before the outbox insert and verify case state and audit roll back together. Revoke assignment between read and write and confirm the transaction checks current authorization.

Verification

Malformed bodies and bool revisions are rejected before write work.
Current permission and expected revision are checked inside the transaction.
An exact replay returns one stored outcome; a changed replay conflicts.

Practice drill

Implement a Flask approval command for permit 62. Specify a stable operation ID, expected revision, and bounded reason. Write an input parser that rejects bool as a revision and refuses unknown keys. In a service, lock the case row where the database supports it, verify reviewer assignment, and store case state, operation result, and outbox event atomically. Add a uniqueness constraint rather than a process-local set. Test exact replay, changed-payload replay, concurrent same-key requests, rollback, stale revision, and revoked assignment. Record the result's public fields separately from internal audit details. Explain how the chosen database handles lock syntax and serialization conflicts.

Decision note

The HTTP edge validates a command; the database arbitrates its one authorized, replayable outcome.

Common Mistakes

Confusing valid JSON with authorization.
Using an in-memory set to arbitrate concurrent retries.
Calling an email provider from a transaction closure.

Apply and check

Build Project: Flask permit service boundaries and review Web Development: Flask context and service boundaries quiz.