https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43310 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |34451 Depends on|34451 | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43310 --- Comment #1 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 203757 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=203757&action=edit Bug 43310: Migrate members/two_factor_auth.tt to use api-client.js This patch replaces raw jQuery.ajax() POST calls for 2FA registration and verification with the api-client.js pattern. Uses APIClient.default.koha.post since these are specialized auth endpoints without a dedicated api-client module. Test plan: 1. Apply patch 2. Enable TwoFactorAuthentication system preference 3. Go to your patron account > Two-factor authentication 4. Click "Enable two-factor authentication" => SUCCESS: QR code and secret displayed 5. Enter the PIN code and verify => SUCCESS: 2FA enabled, page reloads 6. Test with wrong PIN => SUCCESS: "Invalid PIN code" error shown 7. Sign off :-D -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43310 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tomascohen@gmail.com -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43310 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #203757|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43310 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA --- Comment #4 from David Nind <david@davidnind.com> --- When I go to set up two factor authentication, I get an error in a browser pop-up window when adding the PIN code: Error: Error: Missing property. Missing property. After applying the patch, I rebuilt everything and restarted everything: yarn build and restart_all I got the same errors if I used the staff interface with a URL instead of 127.0.0.1:8081. The web developer tools console also has these errors: XHR POST http://127.0.0.1:8081/api/v1/auth/two-factor/registration/verification [HTTP/1.1 400 Bad Request 23ms] POST http://127.0.0.1:8081/api/v1/auth/two-factor/registration/verification Status: 400 Bad Request Version: HTTP/1.1 Transferred: 330 B (129 B size) Referrer Policy: strict-origin-when-cross-origin Request Priority: Highest DNS Resolution: System Response headers: Connection: close Content-Length: 129 Content-Type: application/json;charset=UTF-8 Date: Wed, 07 Oct 2026 20:24:52 GMT Server: Apache/2.4.68 (Debian) Vary: User-Agent Request headers: Accept: */* Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Connection: keep-alive Content-Length: 61 Content-Type: application/json;charset=utf-8 Cookie: CGISESSID=23d8e928f82ef7728e17adedecf429c0 CSRF-TOKEN: ec93950ba742ccd42700d0ff7726810aa757e32f,915eb27ec863f20e632cec2c0e3ebe57e3c8caf7,1791402640 Host: 127.0.0.1:8081 Origin: http://127.0.0.1:8081 Priority: u=0 Referer: http://127.0.0.1:8081/cgi-bin/koha/members/two_factor_auth.pl?borrowernumber... Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Sec-GPC: 1 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:158.0) Gecko/20100101 Firefox/158.0 X-Requested-With: XMLHttpRequest Error: Missing property. Missing property. _fetchJSON http://127.0.0.1:8081/intranet-tmpl/prog/js/fetch/http-client.js:89 promise callback*_fetchJSON/< http://127.0.0.1:8081/intranet-tmpl/prog/js/fetch/http-client.js:77 promise callback*_fetchJSON http://127.0.0.1:8081/intranet-tmpl/prog/js/fetch/http-client.js:67 post http://127.0.0.1:8081/intranet-tmpl/prog/js/fetch/http-client.js:153 post http://127.0.0.1:8081/intranet-tmpl/prog/js/fetch/default-api-client.js:12 invokeTarget http://127.0.0.1:8081/intranet-tmpl/prog/js/fetch/api-client.js:156 promise callback*invokeTarget http://127.0.0.1:8081/intranet-tmpl/prog/js/fetch/api-client.js:148 apply http://127.0.0.1:8081/intranet-tmpl/prog/js/fetch/api-client.js:174 <anonymous> Ember jQuery 2 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43310 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #207374|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43310 --- Comment #6 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 207566 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=207566&action=edit Bug 43310: (follow-up) Fix 2FA verification request and 204 handling The migration to api-client.js broke the 2FA registration verification flow in two ways that only surfaced at runtime when confirming the PIN code. Changes: - two_factor_auth.tt: the /auth/two-factor/registration/verification endpoint declares secret32 and pin_code as required `in: formData` parameters, so the OpenAPI validator expects form-encoded data. The migrated code sent a JSON body, which the validator rejected with "Missing property". jQuery's $.ajax sent form-encoded data by default; this patch restores that by posting URLSearchParams with an explicit application/x-www-form-urlencoded Content-Type. - http-client.js: _fetchJSON() unconditionally called response.json() on any successful response. The verification endpoint returns 204 No Content on success (render_resource_deleted), which has an empty body by definition (RFC 9110), but Mojolicious still sets a Content-Type: application/json header. Calling response.json() on the empty body ran JSON.parse("") and threw "unexpected end of data". This patch returns null for 204 responses instead of parsing the body, matching the semantics of "No Content" and resolving the promise as a success. This affects every caller of http-client.js, not just 2FA. Test plan: 1. Enable the TwoFactorAuthentication system preference 2. Go to your patron account > More > Two-factor authentication 3. Click "Enable two-factor authentication" => SUCCESS: QR code and secret are displayed 4. Scan the QR code and enter the generated PIN code, click Register => FAIL: "Missing property" error, then after the first fix a "JSON.parse: unexpected end of data" error appears in the console 5. Apply this patch, repeat from step 1 6. Enter a valid PIN code and click Register => SUCCESS: 2FA is enabled and the page reloads, no console errors 7. Repeat with a wrong PIN code => SUCCESS: "Invalid PIN code" error is shown 8. Sign off :-D Assisted-by: Sonnet 4.6 (Anthropic) -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43310 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #207565|0 |1 is obsolete| | Attachment #207566|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43310 --- Comment #8 from David Nind <david@davidnind.com> --- Created attachment 207687 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=207687&action=edit Bug 43310: (follow-up) Fix 2FA verification request and 204 handling The migration to api-client.js broke the 2FA registration verification flow in two ways that only surfaced at runtime when confirming the PIN code. Changes: - two_factor_auth.tt: the /auth/two-factor/registration/verification endpoint declares secret32 and pin_code as required `in: formData` parameters, so the OpenAPI validator expects form-encoded data. The migrated code sent a JSON body, which the validator rejected with "Missing property". jQuery's $.ajax sent form-encoded data by default; this patch restores that by posting URLSearchParams with an explicit application/x-www-form-urlencoded Content-Type. - http-client.js: _fetchJSON() unconditionally called response.json() on any successful response. The verification endpoint returns 204 No Content on success (render_resource_deleted), which has an empty body by definition (RFC 9110), but Mojolicious still sets a Content-Type: application/json header. Calling response.json() on the empty body ran JSON.parse("") and threw "unexpected end of data". This patch returns null for 204 responses instead of parsing the body, matching the semantics of "No Content" and resolving the promise as a success. This affects every caller of http-client.js, not just 2FA. Test plan: 1. Enable the TwoFactorAuthentication system preference 2. Go to your patron account > More > Two-factor authentication 3. Click "Enable two-factor authentication" => SUCCESS: QR code and secret are displayed 4. Scan the QR code and enter the generated PIN code, click Register => FAIL: "Missing property" error, then after the first fix a "JSON.parse: unexpected end of data" error appears in the console 5. Apply this patch, repeat from step 1 6. Enter a valid PIN code and click Register => SUCCESS: 2FA is enabled and the page reloads, no console errors 7. Repeat with a wrong PIN code => SUCCESS: "Invalid PIN code" error is shown 8. Sign off :-D Assisted-by: Sonnet 4.6 (Anthropic) Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.