https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43310 --- Comment #6 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 207566 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=207566&action=edit Bug 43310: (follow-up) Fix 2FA verification request and 204 handling The migration to api-client.js broke the 2FA registration verification flow in two ways that only surfaced at runtime when confirming the PIN code. Changes: - two_factor_auth.tt: the /auth/two-factor/registration/verification endpoint declares secret32 and pin_code as required `in: formData` parameters, so the OpenAPI validator expects form-encoded data. The migrated code sent a JSON body, which the validator rejected with "Missing property". jQuery's $.ajax sent form-encoded data by default; this patch restores that by posting URLSearchParams with an explicit application/x-www-form-urlencoded Content-Type. - http-client.js: _fetchJSON() unconditionally called response.json() on any successful response. The verification endpoint returns 204 No Content on success (render_resource_deleted), which has an empty body by definition (RFC 9110), but Mojolicious still sets a Content-Type: application/json header. Calling response.json() on the empty body ran JSON.parse("") and threw "unexpected end of data". This patch returns null for 204 responses instead of parsing the body, matching the semantics of "No Content" and resolving the promise as a success. This affects every caller of http-client.js, not just 2FA. Test plan: 1. Enable the TwoFactorAuthentication system preference 2. Go to your patron account > More > Two-factor authentication 3. Click "Enable two-factor authentication" => SUCCESS: QR code and secret are displayed 4. Scan the QR code and enter the generated PIN code, click Register => FAIL: "Missing property" error, then after the first fix a "JSON.parse: unexpected end of data" error appears in the console 5. Apply this patch, repeat from step 1 6. Enter a valid PIN code and click Register => SUCCESS: 2FA is enabled and the page reloads, no console errors 7. Repeat with a wrong PIN code => SUCCESS: "Invalid PIN code" error is shown 8. Sign off :-D Assisted-by: Sonnet 4.6 (Anthropic) -- You are receiving this mail because: You are watching all bug changes.