Mojolicious::Plugin::OpenAPI version 1.17 added a feature for fetching API spec in route chain. For us, this type of functionality is used in authentication with our own workaround introduced in Bug 18137. Our own workaround no longer works if M::P::OpenAPI version >=1.17. When upgrading Mojolicious::Plugin::OpenAPI dependency, this patch will fix the issue.
Created attachment 64774 [details] [review] Bug 18890: REST API: Fix fetching operation spec in route chain Mojolicious::Plugin::OpenAPI version 1.17 added a feature for fetching API spec in route chain. For us, this type of functionality is used in authentication with our own workaround introduced in Bug 18137. Our own workaround no longer works if M::P::OpenAPI version >=1.17. When upgrading Mojolicious::Plugin::OpenAPI dependency, this patch will fix the issue. To test: 1. prove t/db_dependent/api/v1
Created attachment 64777 [details] [review] Bug 18890: Fix cities.t The update also causes some tests authorization tests to fail with HTTP 400 response instead of the expected 401/403. It seems that the parameters were not properly validated before and the tests were mistakenly passing. To test: 1. prove t/db_dependent/api/v1/cities.t
Created attachment 64778 [details] [review] Bug 18890: Fix holds.t The update also causes some tests authorization tests to fail with HTTP 400 response instead of the expected 401/403. It seems that the parameters were not properly validated before and the tests were mistakenly passing. To test: 1. prove t/db_dependent/api/v1/holds.t
Created attachment 68370 [details] [review] Bug 18890: REST API: Fix fetching operation spec in route chain Mojolicious::Plugin::OpenAPI version 1.17 added a feature for fetching API spec in route chain. For us, this type of functionality is used in authentication with our own workaround introduced in Bug 18137. Our own workaround no longer works if M::P::OpenAPI version >=1.17. When upgrading Mojolicious::Plugin::OpenAPI dependency, this patch will fix the issue. To test: 1. prove t/db_dependent/api/v1 Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Created attachment 68371 [details] [review] Bug 18890: Fix cities.t The update also causes some tests authorization tests to fail with HTTP 400 response instead of the expected 401/403. It seems that the parameters were not properly validated before and the tests were mistakenly passing. To test: 1. prove t/db_dependent/api/v1/cities.t Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Created attachment 68372 [details] [review] Bug 18890: Fix holds.t The update also causes some tests authorization tests to fail with HTTP 400 response instead of the expected 401/403. It seems that the parameters were not properly validated before and the tests were mistakenly passing. To test: 1. prove t/db_dependent/api/v1/holds.t Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Had to cpan2deb Mojolicious::Plugin::OpenAPI and JSON::Validator on a Debian 8 old git install to test. I tested cities and holds no problem. acquisition_vendors has a similar 400 vs 403 issue, but I didn't look into it. I'll Fail QA and hope for a patch to that test too, as the test plan in comment #1 is what triggered that problem.
This is 6 years old now - is it still valid with the current implementation of our API?
(In reply to Katrin Fischer from comment #8) > This is 6 years old now - is it still valid with the current implementation > of our API? Not valid. Already fixed by Bug 22522 Thanks for noticing this.
Thx for the feedback :) Closing.