Skip to content

fix: Leave pagination params out of the at least one parameter guard - #639

Merged
razor-x merged 1 commit into
mainfrom
claude/python-sdk-audit-o2iid9-06-param-guard
Aug 28, 2026
Merged

fix: Leave pagination params out of the at least one parameter guard#639
razor-x merged 1 commit into
mainfrom
claude/python-sdk-audit-o2iid9-06-param-guard

Conversation

@razor-x

@razor-x razor-x commented Aug 27, 2026

Copy link
Copy Markdown
Member

What

The "at least one parameter is required" guard counted every parameter, so seam.access_codes.list(limit=20) satisfied a guard whose purpose is to require a filter, a page cursor alone satisfied it from page two onward, and create_paginator had a second hand-written copy with the same defect (SDK audit finding M7; ports JS #1008 / PHP #474 — pagination knobs are not filters).

  • The codegen layout now computes an explicit atLeastOneParameterNames list — the endpoint's parameters minus limit and page_cursor, and only for endpoints where every parameter is optional (the same computation as the JS SDK). The generated guard checks exactly those names; nothing is emitted when the list is empty.
  • Endpoints with an individually required parameter drop the blanket guard entirely — Python's own signature already enforces those, so the old if not payload there was dead code (JS made the same call). Their docstrings also lose the now-wrong :raises ValueError line.
  • @route_metadata carries at_least_one_parameter_names instead of the boolean has_required_parameters, and both create_paginator guards (sync and async) consult the names, fixing the {"limit": 20} and page-cursor escapes there too.

This is a template + layout change; all route-file changes are regenerated output (guard raise sites go from 50 to 20 across the tree — the other 30 were the dead blanket guards).

Stacked on #638 (both edit the same route-method template); diff shrinks as the stack merges.

Testing

New test/required_parameters_test.py (sync + async): limit-only and page_cursor-only calls raise with the pinned message on both the route method and create_paginator; a real filter passes and paginates; the unpaginated events.list(limit=5) raises.

Revert check: with the old generated stack restored, the new tests fail with DID NOT RAISE ValueError — the audit's silent-pass symptom.

Full suite: 225 passed; mypy, pylint (10.00), black clean; regeneration is drift-free.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Y1RzepycXEYA3LStfjt8cY


Generated by Claude Code

@razor-x
razor-x requested a review from a team as a code owner August 27, 2026 21:29
@razor-x
razor-x changed the base branch from main to claude/python-sdk-audit-o2iid9-05-invalid-response August 28, 2026 00:15
@razor-x
razor-x force-pushed the claude/python-sdk-audit-o2iid9-06-param-guard branch from 15be375 to dcf57e1 Compare August 28, 2026 19:30
@razor-x
razor-x force-pushed the claude/python-sdk-audit-o2iid9-06-param-guard branch from dcf57e1 to e0f0805 Compare August 28, 2026 20:36
@razor-x
razor-x force-pushed the claude/python-sdk-audit-o2iid9-06-param-guard branch from e0f0805 to e9b25a4 Compare August 28, 2026 20:43
@razor-x
razor-x force-pushed the claude/python-sdk-audit-o2iid9-06-param-guard branch from e9b25a4 to 445f35e Compare August 28, 2026 21:04
Base automatically changed from claude/python-sdk-audit-o2iid9-05-invalid-response to main August 28, 2026 21:09
@razor-x
razor-x force-pushed the claude/python-sdk-audit-o2iid9-06-param-guard branch from 445f35e to 221e523 Compare August 28, 2026 21:09
@razor-x
razor-x force-pushed the claude/python-sdk-audit-o2iid9-06-param-guard branch from 221e523 to 2a33646 Compare August 28, 2026 21:12
@razor-x
razor-x merged commit 6e411b1 into main Aug 28, 2026
23 checks passed
@razor-x
razor-x deleted the claude/python-sdk-audit-o2iid9-06-param-guard branch August 28, 2026 21:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants