Repository navigation
SDK audit (Nov 2026): validate required ID lists, detect required params defaulting to None - #48
Merged
Merged
Conversation
Etsy marks shop_section_ids as required on getListingsByShopSectionId, but the SDK defaulted it to None and silently sent the request without it, which Etsy rejects. Make it a required argument so the mistake surfaces at call time. Positional and keyword callers that already pass it are unaffected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8uubJkTpeiKDrKinRqZDy
Passing None or [] to get_listings_by_shop_section_id built an invalid request (the literal "None" or an empty value). Raise ValueError instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8uubJkTpeiKDrKinRqZDy
Contributor
Test Coverage ReportOverall: 100% (1775/1775 statements covered) Coverage by file
Updated by PR Tests |
- Add join_ids(name, ids) in common/Utils.py: raises ValueError for an
empty list (including an empty generator) and TypeError for a string,
which previously got split into characters ("111,222" -> "1,1,1,,,2,2,2").
- Use it in all six methods with spec-required ID lists:
get_listings_by_shop_section_id, get_listings_by_listing_ids,
get_listings_inventory_by_listing_ids, get_listings_shipping_by_listing_ids,
get_payment_account_ledger_entry_payments, get_payments.
- Behavior note: these methods now raise ValueError/TypeError locally for
empty or string ID lists instead of sending a request Etsy rejects with
a RequestException. Documented in CLAUDE.md and the method docstring.
- audit_sdk.py: param_drift gains an "optional" direction flagging params
the spec marks required but the SDK defaults to None, so this class of
bug is caught by /maintain-audit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8uubJkTpeiKDrKinRqZDy
amitray007
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Audit result: 1 Must Fix, 0 Should Fix, 0 Informational. A follow-up code review widened the fix to the whole class of bug.
Run against
specs/baseline.json(2026-10-23). The live spec and Etsy release notes couldn't be fetched from this environment (proxy 403), so this audit doesn't cover anything Etsy changed after that date. The baseline was not updated.Fix
get_listings_by_shop_section_id: Etsy marksshop_section_idsas required, but the SDK defaulted it toNoneand sent the request without it. It's now a required argument.join_ids(name, ids)helper incommon/Utils.py, used by all six methods that take a spec-required ID list:get_listings_by_shop_section_id,get_listings_by_listing_ids,get_listings_inventory_by_listing_ids,get_listings_shipping_by_listing_ids,get_payment_account_ledger_entry_paymentsandget_payments. It raisesValueErrorfor an empty list (empty generators included) andTypeErrorfor a string, which used to be split into characters ("111,222"became1,1,1,,,2,2,2).ValueError/TypeErrorlocally for empty or string ID lists, instead of sending a request that Etsy rejects with aRequestException. This is documented in CLAUDE.md and the method docstring. Those calls never worked, so this ships as a patch.Audit tooling
audit_sdk.py:param_drifthas a newoptionaldirection. It flags params the spec marks required but the SDK defaults toNone, so/maintain-auditwill catch this kind of bug next time. Run against master'sListing.py, it flagsshop_section_ids.Audit findings
audit-ignore.jsonsuppressions re-checked against the code, and each reason still holds. No stale ignores.Test plan
pytest: 495 passedjoin_ids(lists, tuples, generators, empty,None, strings); every one of the six methods rejects bad ID lists without callingmake_request; auditoptionaldirection andnone_defaultsscanpython scripts/audit_sdk.py: clean on this branch, flagsshop_section_idson master's code/maintain-auditsomewhere that can reach etsy.com, to check against the live spec🤖 Generated with Claude Code
https://claude.ai/code/session_01F8uubJkTpeiKDrKinRqZDy