https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #146 from Clemens Tubach <clemens.tubach@kit.edu> --- Created attachment 202461 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202461&action=edit Bug 39224: (QA follow-up) Enforce provider config validation at store time Config invariants were only enforced in set_config(), which callers can bypass entirely (set_from_api, direct accessor writes). Following the pattern established by Koha::File::Transport - which validates in store() so an invalid transport can never be persisted - the provider's mandatory config attributes are now also checked at store time, resolving the concrete subclass through the collection's polymorphic map. The REST controller already routes Koha::Exceptions::MissingParameter to a 400 response, so API behaviour is unchanged for valid requests. Test plan: 1. prove t/db_dependent/Koha/Auth/Identity/Provider.t 2. Attempt to save an OAuth provider without config via the API => SUCCESS: 400 missing_parameter response, nothing persisted Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.