Merge pull request #59079 from nextcloud/fix/do-not-store-auth-code

fix(oauth2): Do not store the code in throttle metadata

Author: come-nc

apps/oauth2/lib/Controller/OauthApiController.php

@@ -93,7 +93,7 @@ public function getToken(
 			$response = new JSONResponse([
 				'error' => 'invalid_request',
 			], Http::STATUS_BAD_REQUEST);
-			$response->throttle(['invalid_request' => 'token not found', 'code' => $code]);
+			$response->throttle(['invalid_request' => 'token not found']);
 			return $response;
 		}
 

apps/oauth2/tests/Controller/OauthApiControllerTest.php

@@ -98,7 +98,7 @@ public function testGetTokenInvalidCode(): void {
 		$expected = new JSONResponse([
 			'error' => 'invalid_request',
 		], Http::STATUS_BAD_REQUEST);
-		$expected->throttle(['invalid_request' => 'token not found', 'code' => 'invalidcode']);
+		$expected->throttle(['invalid_request' => 'token not found']);
 
 		$this->accessTokenMapper->method('getByCode')
 			->with('invalidcode')
@@ -194,7 +194,7 @@ public function testRefreshTokenInvalidRefreshToken(): void {
 		$expected = new JSONResponse([
 			'error' => 'invalid_request',
 		], Http::STATUS_BAD_REQUEST);
-		$expected->throttle(['invalid_request' => 'token not found', 'code' => 'invalidrefresh']);
+		$expected->throttle(['invalid_request' => 'token not found']);
 
 		$this->accessTokenMapper->method('getByCode')
 			->with('invalidrefresh')