Merge pull request #441 from trakrf/fix/tra-883-oauth-415-detail

fix(api): TRA-883 — oauth/token 415 detail names both accepted media types

Author: mikestankavich

backend/internal/middleware/middleware.go

@@ -113,6 +113,11 @@ const bulkCSVUploadPath = "/api/v1/assets/bulk"
 // remains JSON-only.
 const oauthTokenPath = "/api/v1/oauth/token"
 
+// oauthTokenUnsupportedMediaDetail is the 415 detail for oauthTokenPath. Unlike
+// the JSON-only write paths, this endpoint accepts two media types, so the
+// detail names both rather than under-reporting application/json (TRA-883).
+const oauthTokenUnsupportedMediaDetail = "Content-Type must be application/json or application/x-www-form-urlencoded"
+
 // ContentType enforces declared Content-Type per method (BB32 D4 / TRA-703).
 // The public docs commit to a strict per-method matrix on every write
 // endpoint, and missing or otherwise-unlisted Content-Type returns 415 with
@@ -160,7 +165,7 @@ func ContentType(next http.Handler) http.Handler {
 				next.ServeHTTP(w, r)
 				return
 			}
-			httputil.Respond415(w, r, GetRequestID(r.Context()))
+			httputil.Respond415Detail(w, r, oauthTokenUnsupportedMediaDetail, GetRequestID(r.Context()))
 			return
 		}
 

backend/internal/middleware/middleware_test.go

@@ -357,6 +357,36 @@ func TestContentType_OAuthTokenAcceptsFormUrlencoded(t *testing.T) {
 	}
 }
 
+// TestContentType_OAuthTokenUnsupportedMediaNamesBothTypes verifies the 415
+// detail on /api/v1/oauth/token names BOTH accepted media types, not just
+// application/json — the endpoint genuinely accepts form-urlencoded as well
+// (TRA-883 / Round 2.4 F2). text/plain is the unsupported Content-Type; a
+// bare `curl -d` would auto-set form-urlencoded and pass, so the probe sets
+// text/plain explicitly.
+func TestContentType_OAuthTokenUnsupportedMediaNamesBothTypes(t *testing.T) {
+	next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Fatal("handler must not be reached on unsupported Content-Type")
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/oauth/token",
+		strings.NewReader("grant_type=client_credentials"))
+	req.Header.Set("Content-Type", "text/plain")
+	rr := httptest.NewRecorder()
+
+	ContentType(next).ServeHTTP(rr, req)
+
+	if rr.Code != http.StatusUnsupportedMediaType {
+		t.Fatalf("status = %d, want 415", rr.Code)
+	}
+	var resp apierrors.ErrorResponse
+	if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if !strings.Contains(resp.Error.Detail, "application/json") ||
+		!strings.Contains(resp.Error.Detail, "application/x-www-form-urlencoded") {
+		t.Errorf("detail = %q, must name both application/json and application/x-www-form-urlencoded", resp.Error.Detail)
+	}
+}
+
 func TestAuth_MissingHeader_Respond401(t *testing.T) {
 	h := Auth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { t.Fatal("should not reach handler") }))
 	w := httptest.NewRecorder()

backend/internal/util/httputil/method_error.go

@@ -42,6 +42,16 @@ func Respond415(w http.ResponseWriter, r *http.Request, requestID string) {
 	if r.Method == http.MethodPatch {
 		detail = "Content-Type must be application/merge-patch+json on PATCH operations"
 	}
+	Respond415Detail(w, r, detail, requestID)
+}
+
+// Respond415Detail writes the same normalized 415 envelope as Respond415 but
+// with a caller-supplied detail. Routes that accept media types beyond the
+// default application/json — the oauth/token endpoint also takes
+// application/x-www-form-urlencoded (RFC 6749) — use this so the detail names
+// every accepted type instead of under-reporting JSON only (TRA-883). type and
+// title stay canonical; only the non-contractual detail varies.
+func Respond415Detail(w http.ResponseWriter, r *http.Request, detail, requestID string) {
 	WriteJSONError(w, r, http.StatusUnsupportedMediaType, apierrors.ErrUnsupportedMedia,
 		detail, requestID)
 }

backend/internal/util/httputil/method_error_test.go

@@ -82,6 +82,17 @@ func TestRespond415_PatchNamesMergePatch(t *testing.T) {
 	assertRespond415Envelope(t, w, "Content-Type must be application/merge-patch+json on PATCH operations", "req-4p")
 }
 
+// Respond415Detail writes the canonical 415 envelope with a caller-supplied
+// detail, used by routes that accept more than application/json (oauth/token
+// also takes application/x-www-form-urlencoded; TRA-883).
+func TestRespond415Detail_UsesCallerDetail(t *testing.T) {
+	w := httptest.NewRecorder()
+	r := httptest.NewRequest("POST", "/api/v1/oauth/token", nil)
+	detail := "Content-Type must be application/json or application/x-www-form-urlencoded"
+	httputil.Respond415Detail(w, r, detail, "req-4o")
+	assertRespond415Envelope(t, w, detail, "req-4o")
+}
+
 func assertRespond415Envelope(t *testing.T, w *httptest.ResponseRecorder, wantDetail, wantReqID string) {
 	t.Helper()