From 9be29d6fec3c21a412f8d59b185c584ec7684446 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1s=20Cohen=20Arazi?= Date: Mon, 22 Sep 2025 09:56:17 -0300 Subject: [PATCH] Bug 40847: Add input validation tests for OAuth login This patch adds tests to document the current behavior of OAuth login endpoint with missing or invalid parameters. Valitation is added for the interface parameter on the spec. Test plan: 1. Apply patch 2. Run: $ ktd --shell k$ prove t/db_dependent/api/v1/oauth.t => SUCCESS: Tests pass! Current behavior documented 3. Sign off :-D --- api/v1/swagger/paths/oauth.yaml | 3 +++ t/db_dependent/api/v1/oauth.t | 26 +++++++++++++++++++++++++- 2 files changed, 28 insertions(+), 1 deletion(-) diff --git a/api/v1/swagger/paths/oauth.yaml b/api/v1/swagger/paths/oauth.yaml index 27e08379fc..3cc4c86848 100644 --- a/api/v1/swagger/paths/oauth.yaml +++ b/api/v1/swagger/paths/oauth.yaml @@ -63,6 +63,9 @@ description: Name of the interface this login is for required: true type: string + enum: + - opac + - staff - name: code in: query description: Code returned from OAuth server for Authorization Code grant diff --git a/t/db_dependent/api/v1/oauth.t b/t/db_dependent/api/v1/oauth.t index 185f4b40ff..105ac579af 100755 --- a/t/db_dependent/api/v1/oauth.t +++ b/t/db_dependent/api/v1/oauth.t @@ -37,7 +37,7 @@ my $schema = Koha::Database->new->schema; my $builder = t::lib::TestBuilder->new(); if ( can_load( modules => { 'Net::OAuth2::AuthorizationServer' => undef } ) ) { - plan tests => 3; + plan tests => 4; } else { plan skip_all => 'Net::OAuth2::AuthorizationServer not available'; } @@ -113,6 +113,30 @@ subtest 'Net::OAuth2::AuthorizationServer missing tests' => sub { $schema->storage->txn_rollback; }; +subtest 'OAuth login input validation tests' => sub { + plan tests => 6; + + $schema->storage->txn_begin; + + # Mock system preferences + t::lib::Mocks::mock_preference( 'OPACBaseURL', 'http://opac.example.com' ); + t::lib::Mocks::mock_preference( 'staffClientBaseURL', 'http://staff.example.com' ); + t::lib::Mocks::mock_preference( 'OpacPublic', 1 ); + + # Test invalid interface parameter (should be validated by OpenAPI enum) + $t->get_ok('/api/v1/oauth/login/test_provider/invalid') + ->status_is( 400, 'Invalid interface returns 400 due to OpenAPI enum validation' ); + + # Test non-existent provider (should redirect with error) + $t->get_ok('/api/v1/oauth/login/nonexistent_provider/opac') + ->status_is( 302, 'Non-existent provider redirects with error' ); + + # Test missing provider_code and interface are handled by OpenAPI (404) + $t->get_ok('/api/v1/oauth/login//opac')->status_is( 404, 'Missing provider_code returns 404' ); + + $schema->storage->txn_rollback; +}; + sub run_oauth_tests { my ($test_case) = @_; -- 2.51.0