Bug 40847

Summary: OAuth endpoint missing some validations
Product: Koha Reporter: Tomás Cohen Arazi (tcohen) <tomascohen>
Component: REST APIAssignee: Tomás Cohen Arazi (tcohen) <tomascohen>
Status: Failed QA --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: dcook, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: Trivial patch Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: Bug 40847: Add input validation tests for OAuth login

Description Tomás Cohen Arazi (tcohen) 2025-09-22 13:19:50 UTC
I found the endpoint would benefit from more validations on:

* Provider
* Interface


This is not properly tested either.
Comment 1 Tomás Cohen Arazi (tcohen) 2025-09-22 13:22:25 UTC
Created attachment 186690 [details] [review]
Bug 40847: Add input validation tests for OAuth login

This patch adds tests to document the current behavior of OAuth login
endpoint with missing or invalid parameters.

Valitation is added for the interface parameter on the spec.

Test plan:
1. Apply patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/oauth.t
=> SUCCESS: Tests pass! Current behavior documented
3. Sign off :-D
Comment 2 David Cook 2025-09-23 05:25:34 UTC
I was going crazy over this one. The unit tests were passing, but I couldn't reproduce in the browser...

But that's because I was going to /api/v1/public/oauth/login/test/invalid instead of /api/v1/oauth/login/test/invalid


I think for api/v1/swagger/paths/oauth.yaml it can only be "staff" and for api/v1/swagger/paths/public_oauth.yaml it should only be "opac"?