Bug 40847 - OAuth endpoint missing some validations
Summary: OAuth endpoint missing some validations
Status: Failed QA
Alias: None
Product: Koha
Classification: Unclassified
Component: REST API (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal
Assignee: Tomás Cohen Arazi (tcohen)
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-09-22 13:19 UTC by Tomás Cohen Arazi (tcohen)
Modified: 2025-09-23 05:25 UTC (History)
2 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 40847: Add input validation tests for OAuth login (2.91 KB, patch)
2025-09-22 13:22 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Tomás Cohen Arazi (tcohen) 2025-09-22 13:19:50 UTC
I found the endpoint would benefit from more validations on:

* Provider
* Interface


This is not properly tested either.
Comment 1 Tomás Cohen Arazi (tcohen) 2025-09-22 13:22:25 UTC
Created attachment 186690 [details] [review]
Bug 40847: Add input validation tests for OAuth login

This patch adds tests to document the current behavior of OAuth login
endpoint with missing or invalid parameters.

Valitation is added for the interface parameter on the spec.

Test plan:
1. Apply patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/oauth.t
=> SUCCESS: Tests pass! Current behavior documented
3. Sign off :-D
Comment 2 David Cook 2025-09-23 05:25:34 UTC
I was going crazy over this one. The unit tests were passing, but I couldn't reproduce in the browser...

But that's because I was going to /api/v1/public/oauth/login/test/invalid instead of /api/v1/oauth/login/test/invalid


I think for api/v1/swagger/paths/oauth.yaml it can only be "staff" and for api/v1/swagger/paths/public_oauth.yaml it should only be "opac"?