Repository: simphony/tornado-webapi

Issue:
Set the POST resource_id to string.
The id should be converted to string before generating the resource URL, this way we can return integers from the REST handler and still work fine.

Discussion:

Patch:
diff --git a/tornadowebapi/handler.py b/tornadowebapi/handler.py
index 609a1c5..6b78df0 100644
--- a/tornadowebapi/handler.py
+++ b/tornadowebapi/handler.py
@@ -102,7 +102,7 @@ class CollectionHandler(BaseHandler):
 
         self.set_status(httpstatus.OK)
         # Need to convert into a dict for security issue tornado/1009
-        self.write({"items": list(items)})
+        self.write({"items": [str(item) for item in items]})
         self.flush()
 
     @gen.coroutine
@@ -134,7 +134,7 @@ class CollectionHandler(BaseHandler):
             raise web.HTTPError(httpstatus.INTERNAL_SERVER_ERROR)
 
         location = with_end_slash(
-            url_path_join(self.request.full_url(), resource_id))
+            url_path_join(self.request.full_url(), str(resource_id)))
 
         self.set_status(httpstatus.CREATED)
         self.set_header("Location", location)


Test patch:
diff --git a/tornadowebapi/tests/test_webapi.py b/tornadowebapi/tests/test_webapi.py
index e3f3b8b..c67406d 100644
--- a/tornadowebapi/tests/test_webapi.py
+++ b/tornadowebapi/tests/test_webapi.py
@@ -26,8 +26,8 @@ class Student(Resource):
 
     @gen.coroutine
     def create(self, representation):
-        id = str(type(self).id)
-        self.collection[id] = representation
+        id = type(self).id
+        self.collection[str(id)] = representation
         type(self).id += 1
         return id
 
@@ -138,7 +138,7 @@ class TestREST(AsyncHTTPTestCase):
         res = self.fetch("/api/v1/students/")
         self.assertEqual(res.code, httpstatus.OK)
         self.assertEqual(escape.json_decode(res.body),
-                         {"items": [1, 2, 3]})
+                         {"items": ["1", "2", "3"]})
 
     def test_create(self):
         res = self.fetch(