Merge pull request #479 from tisnik/forbid-unknown-attributes-for-request-payload

Forbid unknown attributes for request payload

Author: tisnik

docs/openapi.json

@@ -818,6 +818,7 @@
                         ]
                     }
                 },
+                "additionalProperties": false,
                 "type": "object",
                 "required": [
                     "attachment_type",
@@ -1444,6 +1445,7 @@
                         ]
                     }
                 },
+                "additionalProperties": false,
                 "type": "object",
                 "required": [
                     "conversation_id",
@@ -1514,6 +1516,7 @@
                         ]
                     }
                 },
+                "additionalProperties": false,
                 "type": "object",
                 "title": "FeedbackStatusUpdateRequest",
                 "description": "Model representing a feedback status update request.\n\nAttributes:\n    status: Value of the desired feedback enabled state.\n\nExample:\n    ```python\n    feedback_request = FeedbackRequest(\n        status=false\n    )\n    ```"

src/models/requests.py

@@ -46,6 +46,7 @@ class Attachment(BaseModel):
 
     # provides examples for /docs endpoint
     model_config = {
+        "extra": "forbid",
         "json_schema_extra": {
             "examples": [
                 {
@@ -64,7 +65,7 @@ class Attachment(BaseModel):
                     "content": "foo: bar",
                 },
             ]
-        }
+        },
     }
 
 
@@ -284,7 +285,7 @@ class FeedbackRequest(BaseModel):
         examples=[-1, 1],
     )
 
-    # Optional user feedback limited to 1–4096 characters to prevent abuse.
+    # Optional user feedback limited to 1-4096 characters to prevent abuse.
     user_feedback: Optional[str] = Field(
         default=None,
         max_length=4096,
@@ -304,6 +305,7 @@ class FeedbackRequest(BaseModel):
 
     # provides examples for /docs endpoint
     model_config = {
+        "extra": "forbid",
         "json_schema_extra": {
             "examples": [
                 {
@@ -331,7 +333,7 @@ class FeedbackRequest(BaseModel):
                     "categories": ["incomplete", "not_relevant"],
                 },
             ]
-        }
+        },
     }
 
     @field_validator("conversation_id")
@@ -402,6 +404,9 @@ class FeedbackStatusUpdateRequest(BaseModel):
         examples=[True, False],
     )
 
+    # Reject unknown fields
+    model_config = {"extra": "forbid"}
+
     def get_value(self) -> bool:
         """Return the value of the status attribute."""
         return self.status