[m-baseline-r2-3ed21b74] PATCH /items silent drop unknown fields

[ascerra]

Bug (baseline rep 2 token 3ed21b74)

PATCH /items/:id returns HTTP 200 while silently dropping unknown JSON fields (e.g. warehouse_bin_3ed21b74).

Reproduce

ID=$(curl -sS -X POST http://127.0.0.1:5000/items -H 'Content-Type: application/json' -d '{"name":"w-3ed21b74","qty":1}' | jq -r .id)
curl -sS -i -X PATCH http://127.0.0.1:5000/items/$ID -H 'Content-Type: application/json' -d '{"qty":2,"warehouse_bin_3ed21b74":"A-12"}'
curl -sS http://127.0.0.1:5000/items/$ID

Expected

400/422 for unknown fields, or persist them.

Actual

200 with field omitted — API data-loss bug on items endpoint.

Environment

Python 3.12, Linux, main. Unique matrix token 3ed21b74.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 7:58 PM UTC · Completed 8:00 PM UTC

Commit: 6e343a5 · View workflow run →

[fullsend-ai-triage]

This appears to be a duplicate of #28, which reports the same bug: PATCH /items/:id silently drops unknown JSON fields and returns 200 instead of rejecting them with a 400/422.

An implementation is already in progress via PR #29, which adds allowed-field validation to both the POST /items and PATCH /items/:id endpoints. Once that PR lands, the behavior described here will be fixed as well.