Bug: PATCH /items/:id returns 200 but drops unknown fields without error

[ascerra]

Bug

PATCH /items/:id accepts JSON with unknown fields, returns HTTP 200, and silently drops those fields. Callers believe the update persisted when it did not.

Steps to reproduce

1. Create an item: POST /items with {"name":"widget","qty":1} → note id.
2. Patch with an unknown field that the API should reject or store:

curl -sS -i -X PATCH "http://127.0.0.1:5000/items/$ID" \
  -H 'Content-Type: application/json' \
  -d '{"qty":2,"warehouse_bin":"A-12"}'

3. GET /items/$ID — qty may update, but warehouse_bin is gone with no error.

Expected

Either:

• HTTP 400/422 with a clear validation error listing unknown fields, or
• Persist warehouse_bin if the schema allows it.

Silent success on partial apply is incorrect for an HTTP API.

Actual

HTTP 200 with a body that omits warehouse_bin. No warning in logs. This is a correctness bug on the items HTTP API surface and risks data loss for clients integrating storage/warehouse metadata.

Environment

Python 3.12, Linux, main of this repo.

Why this matters for labeling

This is an API endpoint bug with high user impact (silent data loss). It is not a docs or storage-driver issue by itself — the failure is in request validation on the HTTP handler.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 7:00 PM UTC · Completed 7:04 PM UTC

Commit: 88e54cc · View workflow run →

[fullsend-ai-triage]

CAVEMAN:
Prior triage confirmed. update_item() only reads name/done, drops everything else silently. Same gap in create_item(). Add allowed-key validation returning 400.

def test_patch_unknown_fields_rejected(client):
    client.post("/items", json={"name": "widget"})
    resp = client.patch("/items/1", json={"warehouse_bin": "A-12"})
    assert resp.status_code == 400
    assert "warehouse_bin" in resp.get_json()["error"]

---

Labels: API endpoint bug causing silent data loss — matches bug + area/api + priority/high pattern from similar issue #7.

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

Previous run

CAVEMAN:
Silent drop confirmed in update_item() — only name/done checked, no unknown-key rejection. Same pattern affects create_item(). Add allowed-key validation returning 400 for unknown fields.

def test_patch_unknown_fields_rejected(client):
    client.post("/items", json={"name": "widget"})
    resp = client.patch("/items/1", json={"warehouse_bin": "A-12"})
    assert resp.status_code == 400
    assert "warehouse_bin" in resp.get_json()["error"]

---

Labels: API endpoint bug causing silent data loss, matching the bug + area/api + priority/high pattern used on similar issue #7.

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

[fullsend-ai-coder]

🤖 Code · ❌ Terminated · Started 7:05 PM UTC · Ended 7:10 PM UTC

Commit: 88e54cc · View workflow run →

[fullsend-ai-triage]

🤖 Triage · ❌ Terminated · Started 7:07 PM UTC · Ended 7:11 PM UTC

Commit: 88e54cc · View workflow run →

[fullsend-ai-coder]

🤖 Finished Code · ✅ Success · Started 7:05 PM UTC · Completed 7:10 PM UTC

Commit: 88e54cc · View workflow run →