https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43850 Bug ID: 43850 Summary: Convert two-factor registration verification endpoint to a JSON body Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs@lists.koha-community.org Reporter: martin.renvoize@openfifth.co.uk QA Contact: tomascohen@gmail.com CC: tomascohen@gmail.com Target Milestone: --- Follow-up to bug 43310. POST /api/v1/auth/two-factor/registration/verification declares secret32 and pin_code as in: formData parameters in api/v1/swagger/paths/auth.yaml. The shared JSON client (api-client.js) therefore cannot call it without hand-building a form-encoded body and overriding Content-Type, as members/two_factor_auth.tt now does. Proposed: - Change the endpoint to take a JSON body (in: body with a small schema) and read it with $c->req->json in Koha::REST::V1::TwoFactorAuth::verification. - Update both callers: members/two_factor_auth.tt and modules/auth.tt (which still uses jQuery.ajax for both 2FA endpoints and could move to api-client.js too). - Update t/db_dependent/api/v1/two_factor_auth.t, which currently posts form data. - Make the invalid-PIN case machine readable (status code or error code) so the UI does not compare against the English string "Invalid pin". Also: - The 204 No Content handling added to http-client.js in bug 43310 affects every caller of the shared client. Audit callers of post/put/patch that expect a response body. - Add a page-level Cypress spec for the staff 2FA registration flow (enable, wrong PIN, correct PIN). This needs a way to set the TwoFactorAuthentication syspref and compute a TOTP code from the displayed secret. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.