Fixed change incorrect GET endpoints to POST

[Patrykb0802]

Identify API endpoints incorrectly using GET for state-changing operations.
Replace them with appropriate HTTP methods (primarily POST), update all usages, and verify behavior with manual and/or automated tests.

[coderabbitai]

📝 CodeRabbit Plan Mode

Generate an implementation plan and prompts that you can use with your favorite coding agent.

✅ Successfully generated implementation plan.

💡 Use @coderabbitai <feedback> to replan

Examples

• Example 1
• Example 2

---

🔗 Similar Issues

Possible Duplicates

• Wrong endpoint type in AuthenticationAPI #3225

👤 Suggested Assignees

• Patrykb0802

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord or schedule a call!

[coderabbitai]

Coding Plan

Approach

Correct REST API endpoints that incorrectly use GET for state-changing operations by replacing them with appropriate HTTP methods (primarily POST). Update all client-side usages and documentation to reflect these changes.

Observations

This is a Spring Boot-based SCADA system with a Vue.js frontend. The backend uses Spring MVC REST controllers in src/org/scada_lts/web/mvc/api/ with conventional Spring annotations (@GetMapping, @PostMapping, etc.). The frontend consists of a Vue.js application (scadalts-ui/src/) using axios for HTTP requests, plus legacy JSP pages (WebContent/WEB-INF/jsp/) that may use jQuery AJAX. API documentation is maintained as OpenAPI 3.0 YAML files in doc/. The codebase has established patterns for proper REST semantics in several APIs (e.g., SystemSettingsAPI with GET/POST pairs and admin authorization checks), but several endpoints violate HTTP semantics by using GET for mutations.

Assumptions

Assumption 1: Backwards Compatibility Approach

Options Considered:

• Add new POST endpoints while keeping GET for backwards compatibility, then deprecate
• Directly replace GET with POST as a breaking change
• Use HTTP 307 redirects from GET to POST for gradual migration

Chosen Option: Directly replace GET with POST as a breaking change

Rationale: Direct replacement (breaking change) because: (1) the ticket explicitly asks to "replace" rather than add alternatives, (2) GET performing mutations is a security concern that should be fixed immediately, (3) exploration found no active frontend usage for most endpoints, and (4) this appears to be an internal SCADA system rather than a public API with numerous consumers. If backwards compatibility becomes critical during implementation, the approach can be adjusted to maintain temporary GET endpoints with deprecation warnings.

Assumption 2: Appropriate HTTP Method Selection

Options Considered:

• Use POST for all state-changing operations (simple, consistent)
• Use PUT for updates, DELETE for deletions, POST for creates/actions
• Follow strict REST semantics with idempotency considerations

Chosen Option: Follow strict REST semantics with idempotency considerations

Rationale: Apply REST semantics based on operation type: POST for non-idempotent actions (toggle, run, execute, refresh), PUT for idempotent updates (setValue, enable), DELETE for removals, and POST for creates (createFolder). This aligns with HTTP standards where PUT is idempotent and POST may have side effects. The codebase already shows this pattern in properly-implemented endpoints like DataSourceAPI's createDataSource (POST) and proper DELETE operations.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Backend API Method Corrections

Update Spring MVC controller classes to use correct HTTP methods for state-changing operations, ensuring consistency with existing REST patterns in the codebase.

Task 1: Fix Authentication Endpoints

Authentication operations should not use GET as they modify session state and expose credentials in URLs/logs.

• Change GET /api/auth/{username}/{password} in AuthenticationAPI.java to use POST with request body containing credentials
• Change GET /api/auth/logout/{username} to POST /api/auth/logout
• Update both methods to use @PostMapping annotation and extract credentials from @RequestBody instead of @PathVariable
• Consider security implications: POST prevents credential exposure in server logs and browser history

Task 2: Fix Data Source Management Endpoints

Update DataSourceAPI.java to use appropriate HTTP methods for state-changing operations on data sources.

• Change GET /api/datasource/toggle to POST, keeping @RequestParam for datasource ID
• Change GET /api/datasource/datapoints/enable to PUT (idempotent enable operation), keeping @RequestParam for datasource ID
• Both endpoints should follow the pattern established by existing createDataSource and updateDataSource methods

Task 3: Fix Point Value Operations

Update PointValueAPI.java to replace multiple GET endpoints that perform write operations with appropriate methods.

• Change GET /api/point_value/setValue/{xid}/{type}/{value} to PUT (idempotent value setting)
• Change three update methods (updateMetaDataPointByScript, updateMetaDataPointsByScript, updateAllMetaDataPointsByScript) from GET to PUT
• Keep path variable patterns but change annotation from @RequestMapping(method=RequestMethod.GET) to @PutMapping or @RequestMapping(method=RequestMethod.PUT)
• These are updates to existing resources, making PUT the semantically correct choice

Task 4: Fix Report Operations

Update ReportsAPI.java to use POST for non-idempotent report actions.

• Change GET /run/{id} to POST (running a report generates a new instance, non-idempotent)
• Change GET /instances/{id}/preventPurge/{preventPurge} to PUT (setting a boolean flag, idempotent)
• Update annotations while maintaining existing path variable structure

Task 5: Fix System Maintenance Operations

Update SystemSettingsAPI.java to use POST for destructive data operations.

• Change GET /purgeNow to POST (triggers immediate purge action)
• Change GET /purgeData to POST (purges all data, destructive operation)
• Follow the authorization pattern already established in SystemSettingsAPI: extract user via Common.getUser(request), verify user.isAdmin() before executing operation
• Return appropriate ResponseEntity with HttpStatus.OK or HttpStatus.UNAUTHORIZED

Task 6: Fix Resource and View Hierarchy Operations

Update ResourcesAPI.java and ViewHierarchyAPI.java for cache refresh and folder creation operations.

• Change GET /api/resources/imagesRefresh in ResourcesAPI to POST (cache refresh is a server-side action)
• Change GET /api/view_hierarchy/createFolder/{name}/{parentId} in ViewHierarchyAPI to POST (creating a resource)
• Update ViewHierarchyAPI to follow the pattern of other create operations in the codebase

Task 7: Fix Reactivation Check Endpoint

Update ReactivationDsAPI.java if the endpoint performs state changes beyond simple checking.

• Review the implementation of checkEnableReactivation to determine if it only reads state or also modifies it
• If it performs mutations, change from GET to POST
• If it's purely a read operation despite the naming, consider renaming to clarify intent rather than changing HTTP method

🤖 Prompt for AI agents

Update Spring MVC REST controller classes to use proper HTTP methods for
state-changing operations. Replace GET with POST/PUT/DELETE based on REST
semantics.

In AuthenticationAPI.java:
- Change authentication endpoint from GET to @PostMapping, extract credentials
from @RequestBody instead of @PathVariable
- Change logout endpoint from GET to @PostMapping

In DataSourceAPI.java:
- Change toggle endpoint from GET to @PostMapping
- Change enable endpoint from GET to @PutMapping

In PointValueAPI.java:
- Change setValue endpoint from GET to @PutMapping
- Change updateMetaDataPoint methods from GET to @PutMapping

In ReportsAPI.java:
- Change run endpoint from GET to @PostMapping
- Change preventPurge endpoint from GET to @PutMapping

In SystemSettingsAPI.java:
- Change purgeNow endpoint from GET to @PostMapping with admin authorization
check
- Change purgeData endpoint from GET to @PostMapping with admin authorization
check

In ResourcesAPI.java:
- Change imagesRefresh endpoint from GET to @PostMapping

In ViewHierarchyAPI.java:
- Change createFolder endpoint from GET to @PostMapping

In ReactivationDsAPI.java:
- Review checkEnableReactivation implementation; if it mutates state, change
from GET to @PostMapping

Phase 2: Frontend Integration Updates

Update client-side code to use the new HTTP methods when calling the modified endpoints.

Task 1: Search for Direct API Calls

Conduct targeted search for any frontend code calling the modified endpoints.

• Search Vue.js components and store modules in scadalts-ui/src/ for axios calls to modified endpoint paths
• Search JSP files in WebContent/WEB-INF/jsp/ for jQuery $.ajax or $.get calls to modified endpoints
• Check for any API wrapper/service modules that might abstract these calls
• Document all call sites found, noting which endpoints are actually in use

Task 2: Update Frontend HTTP Calls

For each call site found, update the HTTP method and request structure.

• Change axios.get() calls to axios.post() or axios.put() as appropriate
• For authentication endpoints, restructure to send credentials in request body instead of URL parameters
• Update jQuery $.get() or $.ajax({type:'GET'}) calls to use POST/PUT with appropriate data payloads
• Ensure request parameters move from URL path/query to request body where appropriate for POST requests

Task 3: Handle Special Cases

Address authentication and error handling implications of the HTTP method changes.

• For authentication endpoint changes, ensure credentials are passed in request body rather than URL
• Update error handling logic if any code specifically checks for GET request patterns
• Verify CSRF token handling if the application uses CSRF protection (common with POST requests in Spring)

🤖 Prompt for AI agents

Update frontend code to use new HTTP methods for modified API endpoints.

Search for and update calls to modified endpoints:
- In Vue.js files (`scadalts-ui/src/`): search for axios calls to
authentication, datasource, point_value, reports, system settings, resources,
and view_hierarchy endpoints
- In JSP files (`WebContent/WEB-INF/jsp/`): search for jQuery $.ajax or $.get
calls to the same endpoints

For each call site found:
- Change axios.get() to axios.post() or axios.put() based on the backend changes
- Change jQuery $.get() to $.post() or $.ajax({type:'POST'}) or
$.ajax({type:'PUT'})
- For authentication endpoints, restructure to send credentials in request body
instead of URL parameters
- Move request parameters from URL path/query to request body where appropriate
- Verify CSRF token handling for POST/PUT requests
- Update error handling logic that may check for specific HTTP methods

Phase 3: API Documentation Updates

Synchronize OpenAPI specifications with the backend changes to maintain accurate API documentation.

Task 1: Update OpenAPI Specifications

Modify the YAML files in doc/ to reflect the new HTTP methods.

• Update EventsAPI.yaml if any event-related endpoints were modified
• Update ExportConfigAPI.yaml, ThreadInfoAPI.yaml, WorkItemInfoAPI.yaml if affected
• For each modified endpoint, change the HTTP method key in the YAML (get → post, get → put, get → delete)
• Update request schema definitions to reflect request body payloads for endpoints that previously used path parameters
• Add or update requestBody sections for POST/PUT operations that now accept data in the request body

Task 2: Review and Validate Documentation

Ensure the OpenAPI specs remain valid and comprehensive.

• Validate YAML syntax using Swagger Editor or OpenAPI validation tools
• Verify that all path parameters, request bodies, and response schemas are correctly defined
• Update endpoint descriptions and summaries if needed to clarify the operations
• Check that HTTP status codes in responses align with the new methods (e.g., 201 Created for POST operations)

🤖 Prompt for AI agents

Update OpenAPI 3.0 YAML files in `doc/` to reflect the HTTP method changes.

For each modified endpoint:
- Change the HTTP method key in YAML (get → post, get → put, or get → delete)
- Update request schema definitions for endpoints that now use request body
instead of path parameters
- Add or update requestBody sections for POST/PUT operations
- Update endpoint descriptions and summaries to clarify operations
- Verify HTTP status codes align with new methods (201 for POST creates, 200 for
PUT updates)

Validate all modified YAML files:
- Check YAML syntax is valid
- Verify path parameters, request bodies, and response schemas are correctly
defined
- Ensure documentation is comprehensive and accurate

Phase 4: Testing and Verification

Verify that the changes work correctly and don't break existing functionality.

Task 1: Update Automated Tests

Modify any existing tests that interact with the changed endpoints.

• Search for JUnit tests in test/ that call the modified API endpoints
• Update test code to use correct HTTP methods and request structures
• For Cypress E2E tests in scadalts-ui/cypress/integration/, update cy.request() calls to use new methods
• Add basic tests for the modified endpoints if none exist, focusing on the critical authentication and data modification operations

Task 2: Manual Verification Testing

Perform exploratory testing to ensure the changes work in the full application context.

• Test authentication flow with the new POST-based login endpoint
• Verify data source toggle and enable operations work correctly
• Test report generation and purge operations
• Check that proper authorization is enforced (admin checks for system settings operations)
• Verify error responses and status codes are appropriate for each operation

Task 3: Document Migration Notes

Create guidance for any users or integrations affected by the breaking changes.

• Document all modified endpoints with old method → new method mapping
• Provide example curl commands or request samples showing the new request format
• Note any parameter location changes (URL path → request body)
• If a compatibility layer or migration period is needed, document the approach and timeline

🤖 Prompt for AI agents

Update and verify tests for the modified API endpoints.

Update existing tests:
- Search for JUnit tests in `test/` that call modified endpoints
- Update test code to use correct HTTP methods (POST/PUT instead of GET)
- Update request structures to match new parameter locations (request body vs
URL)
- Update Cypress E2E tests in `scadalts-ui/cypress/integration/` to use new HTTP
methods in cy.request() calls
- Add basic tests for critical endpoints if none exist (authentication, data
modification operations)

Perform manual testing:
- Test authentication flow with POST-based login
- Verify data source operations (toggle, enable)
- Test report operations (run, preventPurge)
- Test system maintenance operations (purgeNow, purgeData) with admin
authorization
- Verify appropriate error responses and status codes

Create migration documentation:
- Document all endpoint changes (old method → new method mapping)
- Provide example requests showing new format
- Note parameter location changes (URL → request body)
- Document any compatibility considerations

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

Update Spring MVC REST controller classes to use proper HTTP methods for
state-changing operations. Replace GET with POST/PUT/DELETE based on REST
semantics.

In AuthenticationAPI.java:
- Change authentication endpoint from GET to @PostMapping, extract credentials
from @RequestBody instead of @PathVariable
- Change logout endpoint from GET to @PostMapping

In DataSourceAPI.java:
- Change toggle endpoint from GET to @PostMapping
- Change enable endpoint from GET to @PutMapping

In PointValueAPI.java:
- Change setValue endpoint from GET to @PutMapping
- Change updateMetaDataPoint methods from GET to @PutMapping

In ReportsAPI.java:
- Change run endpoint from GET to @PostMapping
- Change preventPurge endpoint from GET to @PutMapping

In SystemSettingsAPI.java:
- Change purgeNow endpoint from GET to @PostMapping with admin authorization
check
- Change purgeData endpoint from GET to @PostMapping with admin authorization
check

In ResourcesAPI.java:
- Change imagesRefresh endpoint from GET to @PostMapping

In ViewHierarchyAPI.java:
- Change createFolder endpoint from GET to @PostMapping

In ReactivationDsAPI.java:
- Review checkEnableReactivation implementation; if it mutates state, change
from GET to @PostMapping
===============================================================================

Task: 2

Update frontend code to use new HTTP methods for modified API endpoints.

Search for and update calls to modified endpoints:
- In Vue.js files (`scadalts-ui/src/`): search for axios calls to
authentication, datasource, point_value, reports, system settings, resources,
and view_hierarchy endpoints
- In JSP files (`WebContent/WEB-INF/jsp/`): search for jQuery $.ajax or $.get
calls to the same endpoints

For each call site found:
- Change axios.get() to axios.post() or axios.put() based on the backend changes
- Change jQuery $.get() to $.post() or $.ajax({type:'POST'}) or
$.ajax({type:'PUT'})
- For authentication endpoints, restructure to send credentials in request body
instead of URL parameters
- Move request parameters from URL path/query to request body where appropriate
- Verify CSRF token handling for POST/PUT requests
- Update error handling logic that may check for specific HTTP methods
===============================================================================

Task: 3

Update OpenAPI 3.0 YAML files in `doc/` to reflect the HTTP method changes.

For each modified endpoint:
- Change the HTTP method key in YAML (get → post, get → put, or get → delete)
- Update request schema definitions for endpoints that now use request body
instead of path parameters
- Add or update requestBody sections for POST/PUT operations
- Update endpoint descriptions and summaries to clarify operations
- Verify HTTP status codes align with new methods (201 for POST creates, 200 for
PUT updates)

Validate all modified YAML files:
- Check YAML syntax is valid
- Verify path parameters, request bodies, and response schemas are correctly
defined
- Ensure documentation is comprehensive and accurate
===============================================================================

Task: 4

Update and verify tests for the modified API endpoints.

Update existing tests:
- Search for JUnit tests in `test/` that call modified endpoints
- Update test code to use correct HTTP methods (POST/PUT instead of GET)
- Update request structures to match new parameter locations (request body vs
URL)
- Update Cypress E2E tests in `scadalts-ui/cypress/integration/` to use new HTTP
methods in cy.request() calls
- Add basic tests for critical endpoints if none exist (authentication, data
modification operations)

Perform manual testing:
- Test authentication flow with POST-based login
- Verify data source operations (toggle, enable)
- Test report operations (run, preventPurge)
- Test system maintenance operations (purgeNow, purgeData) with admin
authorization
- Verify appropriate error responses and status codes

Create migration documentation:
- Document all endpoint changes (old method → new method mapping)
- Provide example requests showing new format
- Note parameter location changes (URL → request body)
- Document any compatibility considerations

💡 Iterate on the plan with: @coderabbitai <feedback>

Example Feedback
- @coderabbitai You can skip phase 3. Add a simple unit test case for phase 2.
- @coderabbitai For assumption 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord or schedule a call!

[Limraj]

@Patrykb0802 These listed APIs and fixes seem sensible.