validate nil attachment POST param (#3721)

app/controllers/concerns/form_attachment_create.rb

@@ -11,7 +11,10 @@ def create
     form_attachment_model = self.class::FORM_ATTACHMENT_MODEL
     form_attachment = form_attachment_model.new
     namespace = form_attachment_model.to_s.underscore.split('/').last
-    form_attachment.set_file_data!(params[namespace][:file_data])
+
+    file_data = params.require(namespace).permit(:file_data)
+
+    form_attachment.set_file_data!(file_data)
     form_attachment.save!
     render(json: form_attachment)
   end

app/swagger/requests/hca_attachments.rb

@@ -40,6 +40,13 @@ class HcaAttachments
               end
             end
           end
+
+          response 400 do
+            key :description, 'Bad Gateway: incorrect parameters'
+            schema do
+              key :'$ref', :Errors
+            end
+          end
         end
       end
     end

app/swagger/requests/upload_supporting_evidence.rb

@@ -29,7 +29,7 @@ class UploadSupportingEvidence
             end
           end
 
-          response 500 do
+          response 400 do
             key :description, 'Bad Gateway: incorrect parameters'
             schema do
               key :'$ref', :Errors

spec/controllers/v0/hca_attachments_controller_spec.rb

@@ -11,5 +11,12 @@
 
       expect(JSON.parse(response.body)['data']['attributes']['guid']).to eq HcaAttachment.last.guid
     end
+
+    it 'validates input parameters' do
+      post(:create)
+      expect(response).to have_http_status(:bad_request)
+      expect(JSON.parse(response.body)['errors'].first['detail'])
+        .to eq('The required parameter "hca_attachment", is missing')
+    end
   end
 end

spec/request/swagger_spec.rb

@@ -272,6 +272,10 @@
         )
       end
 
+      it 'returns a 400 if no attachment data is given' do
+        expect(subject).to validate(:post, '/v0/hca_attachments', 400, '')
+      end
+
       it 'supports submitting a health care application', run_at: '2017-01-31' do
         VCR.use_cassette('hca/submit_anon', match_requests_on: [:body]) do
           expect(subject).to validate(
@@ -568,8 +572,8 @@
         )
       end
 
-      it 'returns a 500 if no attachment data is given' do
-        expect(subject).to validate(:post, '/v0/upload_supporting_evidence', 500, '')
+      it 'returns a 400 if no attachment data is given' do
+        expect(subject).to validate(:post, '/v0/upload_supporting_evidence', 400, '')
       end
     end
 

spec/request/upload_supporting_evidence_spec.rb

@@ -18,12 +18,12 @@
     context 'with invalid parameters' do
       it 'returns a 500 with no parameters' do
         post '/v0/upload_supporting_evidence', params: nil
-        expect(response).to have_http_status(:internal_server_error)
+        expect(response).to have_http_status(:bad_request)
       end
 
       it 'returns a 500 with no file_data' do
         post '/v0/upload_supporting_evidence', params: JSON.parse('{"supporting_evidence_attachment": {}}')
-        expect(response).to have_http_status(:internal_server_error)
+        expect(response).to have_http_status(:bad_request)
       end
     end
   end