PR 3: System Routes and Run Execution Endpoints

Author: pulk17

mod_api/__init__.py

@@ -35,3 +35,5 @@
 
 # Route modules
 from mod_api.routes import auth as auth_routes  # noqa: E402, F401
+from mod_api.routes import runs as runs_routes  # noqa: E402, F401
+from mod_api.routes import system as system_routes  # noqa: E402, F401

mod_api/middleware/error_handler.py

@@ -150,19 +150,19 @@ def handle_value_error(error):
 def convert_api_errors_to_json(response):
     """Catch routing errors that were handled by global app handlers and convert them to JSON."""
     if request.path.startswith(_API_PREFIX):
-        if response.status_code >= 500:
+        if response.status_code >= 500 and not response.is_json:
             new_resp = make_error_response(
                 'internal_error', 'An unexpected error occurred.', http_status=response.status_code
             )
             response.data = new_resp.data
             response.mimetype = new_resp.mimetype
             return response
-        if response.status_code == 404:
+        if response.status_code == 404 and not response.is_json:
             new_resp = make_error_response('not_found', 'Resource not found.', http_status=404)
             response.data = new_resp.data
             response.mimetype = new_resp.mimetype
             return response
-        if response.status_code == 405:
+        if response.status_code == 405 and not response.is_json:
             new_resp = make_error_response('method_not_allowed', 'Method not allowed.', http_status=405)
             response.data = new_resp.data
             response.mimetype = new_resp.mimetype

mod_api/routes/auth.py

@@ -70,9 +70,8 @@ def create_token(validated_data=None):
         'runs:read', 'runs:write', 'results:read',
         'system:read'
     }
-    if user.role.value in ('admin', 'contributor', 'tester'):
-        allowed_scopes.add('tokens:manage')
     if user.role.value == 'admin':
+        allowed_scopes.add('tokens:manage')
         allowed_scopes.add('baselines:write')
 
     invalid_scopes = set(scopes) - allowed_scopes
@@ -129,7 +128,11 @@ def create_token(validated_data=None):
 
 @mod_api.route('/auth/tokens/current', methods=['DELETE'])
 def revoke_current_token():
-    """Revoke whatever token is in the Authorization header right now."""
+    """Revoke whatever token is in the Authorization header right now.
+
+    Note: This endpoint is intentionally scope-free. Any valid token
+    is allowed to revoke itself regardless of its scopes.
+    """
     token = getattr(g, 'api_token', None)
     if token is None:
         return make_error_response(