refactor: ♻️ API endpoint updates

[slugb0t]

Summary by Sourcery

Harden license detail requests and update generated release badge URLs for the current API routes.

Bug Fixes:

• Harden license detail lookups by requiring authentication, enforcing a fetch timeout, handling unsuccessful upstream responses, and returning a controlled gateway error when SPDX requests fail.

Enhancements:

• Update Zenodo release badge snippets to use the API badge endpoint and link to the repository DOI page.

[fairdataihub-bot]

Thank you for submitting this pull request! We appreciate your contribution to the project. Before we can merge it, we need to review the changes you've made to ensure they align with our code standards and meet the requirements of the project. We'll get back to you as soon as we can with feedback. Thanks again!

[sourcery-ai]

Reviewer's Guide

Adds protection and robust error handling to the SPDX license details API endpoint, including timeouts and logging, and updates generated badge/DOI snippet URLs in the Zenodo release dashboard page to use the new /api/badge and /doi routes.

Sequence diagram for updated SPDX license details API endpoint

sequenceDiagram
  participant Client
  participant LicenseAPI as request_license_get
  participant SPDX as SPDX_server
  participant Logwatch as logwatch

  Client->>LicenseAPI: HTTP GET /api/request/license/{licenseid}
  LicenseAPI->>LicenseAPI: protectRoute(event)
  LicenseAPI->>LicenseAPI: find license in licensesJSON
  alt license found
    LicenseAPI->>SPDX: fetch(license.detailsUrl, AbortSignal.timeout(10000))
    alt response.ok
      SPDX-->>LicenseAPI: JSON licenseText
      LicenseAPI-->>Client: 200 { licenseText, ... }
    else fetch fails or !response.ok
      LicenseAPI->>Logwatch: logwatch.error({ action:"request:license", ... })
      LicenseAPI-->>Client: 502 license-details-fetch-failed
    end
  else license not found
    LicenseAPI-->>Client: 404
  end

Loading

File-Level Changes

Change	Details	Files
Harden SPDX license details fetch endpoint with auth enforcement, timeout, error handling, and logging.	Require route protection via protectRoute to ensure endpoint is only used by authenticated sessions. Introduce SPDX_FETCH_TIMEOUT_MS constant and use AbortSignal.timeout when calling fetch to avoid hanging requests. Validate fetch response status and treat non-2xx responses as errors. On fetch/network errors, log structured error details via logwatch.error and return a 502 createError with statusMessage 'license-details-fetch-failed'. Preserve original behavior of returning licenseText (or empty string) and seeAlso from the SPDX response.	ui/server/api/request/license/[licenseid].get.ts
Update release page badge/embed snippets to new badge API and DOI target URLs.	Change Markdown snippet to use /api/badge as the image URL and /doi as the link target. Update HTML snippet so the anchor href points to /doi while the img src uses /api/badge. Adjust the "Image URL" snippet item to reference /api/badge instead of /badge.	ui/pages/dashboard/[owner]/[repo]/release/zenodo.vue

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[fairdataihub-bot]

Thanks for making updates to your pull request. Our team will take a look and provide feedback as soon as possible. Please wait for any GitHub Actions to complete before editing your pull request. If you have any additional questions or concerns, feel free to let us know. Thank you for your contributions!

[what-the-diff]

PR Summary

• Website Badge URL Updates
  The website's code is adjusted to ensure the badge links (that were previously not working correctly) now correctly point to the relevant pages where users can access API and DOI information.

• Improved Error Handling in License Fetching Mechanism
  Several enhancements have been made to how the system fetches software license details. These include:

  • The addition of a timeout feature, which prevents the system from waiting indefinitely due to slow responding servers.
  • Enabling error logs to better trace problems when retrieving license details, improving overall diagnostics and troubleshooting.
  • The inclusion of a feature that ensures the system handles faulty responses in a more controlled and smooth manner.

[sourcery-ai]

Hey - I've left some high level feedback:

• Consider making SPDX_FETCH_TIMEOUT_MS configurable (e.g., via runtime config/env) rather than hard-coded so it can be tuned without redeploying if SPDX latency characteristics change.
• Using AbortSignal.timeout may be runtime-dependent; if this code can run in environments without native support, consider a small helper/utility that falls back to a manual timeout controller.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Consider making `SPDX_FETCH_TIMEOUT_MS` configurable (e.g., via runtime config/env) rather than hard-coded so it can be tuned without redeploying if SPDX latency characteristics change.
- Using `AbortSignal.timeout` may be runtime-dependent; if this code can run in environments without native support, consider a small helper/utility that falls back to a manual timeout controller.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}