[m-always-on-r2-034c7eb3] PATCH /items silent drop unknown fields

[ascerra]

Bug (always-on rep 2 token 034c7eb3)

PATCH /items/:id returns HTTP 200 while silently dropping unknown JSON fields (e.g. warehouse_bin_034c7eb3).

Reproduce

ID=$(curl -sS -X POST http://127.0.0.1:5000/items -H 'Content-Type: application/json' -d '{"name":"w-034c7eb3","qty":1}' | jq -r .id)
curl -sS -i -X PATCH http://127.0.0.1:5000/items/$ID -H 'Content-Type: application/json' -d '{"qty":2,"warehouse_bin_034c7eb3":"A-12"}'
curl -sS http://127.0.0.1:5000/items/$ID

Expected

400/422 for unknown fields, or persist them.

Actual

200 with field omitted — API data-loss bug on items endpoint.

Environment

Python 3.12, Linux, main. Unique matrix token 034c7eb3.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 7:27 PM UTC · Completed 7:29 PM UTC

Commit: de8fe31 · View workflow run →

[fullsend-ai-triage]

CAVEMAN:
Duplicate of #28. PR #29 already implements the fix (reject unknown fields with 400).