Validate Conversation ID

changelog/7022.improvement.md

@@ -0,0 +1,7 @@
+The following endpoints now require the existence of the conversation for the specified conversation ID, raising an exception and returning a 404 status code.
+
+* `GET /conversations/<conversation_id:path>/story`
+
+* `POST /conversations/<conversation_id:path>/execute`
+
+* `POST /conversations/<conversation_id:path>/predict`

rasa/core/tracker_store.py

@@ -184,9 +184,23 @@ def create_tracker(
         return tracker
 
     def save(self, tracker):
-        """Save method that will be overridden by specific tracker"""
+        """Save method that will be overridden by specific tracker."""
         raise NotImplementedError()
 
+    def exists(self, conversation_id: Text) -> bool:
+        """Checks if tracker exists for the specified ID.
+
+        This method may be overridden by the specific tracker store for
+        faster implementations.
+
+        Args:
+            conversation_id: Conversation ID to check if the tracker exists.
+
+        Returns:
+            `True` if the tracker exists, `False` otherwise.
+        """
+        return self.retrieve(conversation_id) is not None
+
     def retrieve(self, sender_id: Text) -> Optional[DialogueStateTracker]:
         """Retrieves tracker for the latest conversation session.
 

rasa/server.py

@@ -10,6 +10,7 @@
 from http import HTTPStatus
 from inspect import isawaitable
 from pathlib import Path
+from http import HTTPStatus
 from typing import (
     Any,
     Callable,
@@ -154,6 +155,25 @@ def decorated(*args, **kwargs):
     return decorator
 
 
+def ensure_conversation_exists() -> Callable[..., HTTPResponse]:
+    """Wraps a request handler ensuring the conversation exists."""
+
+    def decorator(f: Callable[..., HTTPResponse]) -> HTTPResponse:
+        @wraps(f)
+        def decorated(request: Request, *args: Any, **kwargs: Any) -> HTTPResponse:
+            conversation_id = kwargs["conversation_id"]
+            if request.app.agent.tracker_store.exists(conversation_id):
+                return f(request, *args, **kwargs)
+            else:
+                raise ErrorResponse(
+                    HTTPStatus.NOT_FOUND, "Not found", "Conversation ID not found."
+                )
+
+        return decorated
+
+    return decorator
+
+
 def requires_auth(app: Sanic, token: Optional[Text] = None) -> Callable[[Any], Any]:
     """Wraps a request handler with token authentication."""
 
@@ -800,6 +820,7 @@ async def replace_events(request: Request, conversation_id: Text):
     @app.get("/conversations/<conversation_id:path>/story")
     @requires_auth(app, auth_token)
     @ensure_loaded_agent(app)
+    @ensure_conversation_exists()
     async def retrieve_story(request: Request, conversation_id: Text):
         """Get an end-to-end story corresponding to this conversation."""
         until_time = rasa.utils.endpoints.float_arg(request, "until")
@@ -826,6 +847,7 @@ async def retrieve_story(request: Request, conversation_id: Text):
     @app.post("/conversations/<conversation_id:path>/execute")
     @requires_auth(app, auth_token)
     @ensure_loaded_agent(app)
+    @ensure_conversation_exists()
     async def execute_action(request: Request, conversation_id: Text):
         request_params = request.json
 
@@ -934,6 +956,7 @@ async def trigger_intent(request: Request, conversation_id: Text) -> HTTPRespons
     @app.post("/conversations/<conversation_id:path>/predict")
     @requires_auth(app, auth_token)
     @ensure_loaded_agent(app)
+    @ensure_conversation_exists()
     async def predict(request: Request, conversation_id: Text) -> HTTPResponse:
         try:
             # Fetches the appropriate bot response in a json format

tests/test_server.py

@@ -1270,6 +1270,13 @@ async def test_put_tracker(rasa_app: SanicASGITestClient):
     assert events.deserialise_events(evts) == test_events
 
 
+async def test_predict_without_conversation_id(rasa_app: SanicASGITestClient):
+    _, response = await rasa_app.post("/conversations/non_existent_id/predict")
+
+    assert response.status == HTTPStatus.NOT_FOUND
+    assert response.json()["message"] == "Conversation ID not found."
+
+
 async def test_sorted_predict(rasa_app: SanicASGITestClient):
     await _create_tracker_for_sender(rasa_app, "sortedpredict")
 
@@ -1468,6 +1475,16 @@ async def test_execute(rasa_app: SanicASGITestClient):
     assert parsed_content["messages"]
 
 
+async def test_execute_without_conversation_id(rasa_app: SanicASGITestClient):
+    data = {INTENT_NAME_KEY: "utter_greet"}
+    _, response = await rasa_app.post(
+        "/conversations/non_existent_id/execute", json=data
+    )
+
+    assert response.status == HTTPStatus.NOT_FOUND
+    assert response.json()["message"] == "Conversation ID not found."
+
+
 async def test_execute_with_missing_action_name(rasa_app: SanicASGITestClient):
     test_sender = "test_execute_with_missing_action_name"
     await _create_tracker_for_sender(rasa_app, test_sender)
@@ -1775,6 +1792,18 @@ async def test_get_story(
     assert response.content.decode().strip() == expected
 
 
+async def test_get_story_without_conversation_id(
+    rasa_app: SanicASGITestClient, monkeypatch: MonkeyPatch
+):
+    conversation_id = "some-conversation-ID"
+    url = f"/conversations/{conversation_id}/story"
+
+    _, response = await rasa_app.get(url)
+
+    assert response.status == HTTPStatus.NOT_FOUND
+    assert response.json()["message"] == "Conversation ID not found."
+
+
 async def test_get_story_does_not_update_conversation_session(
     rasa_app: SanicASGITestClient, monkeypatch: MonkeyPatch
 ):