auth0 / auth0-PHP

PHP SDK for Auth0 Authentication and Management APIs.
https://auth0.com/docs/libraries/auth0-php
MIT License
380 stars 209 forks source link

Cannot empty initiate_login_uri with API #731

Closed grubolsch closed 10 months ago

grubolsch commented 11 months ago

Checklist

SDK Version

8.7

PHP Version

PHP 8.2

Description

When performing a call to update a client with the call https://auth0.com/docs/api/management/v2/clients/patch-clients-by-id, we get an error when me make the field initiate_login_uri empty.

Failed to update Auth0 client(s) {"integration_id":"89826f96-ed00-4110-8fca-5a909cb6442c","exception":"[object] (App\Auth0\Auth0SDKException(code: 400): Auth0 responded with status code 400 instead of 201. Response body: {\"statusCode\":400,\"error\":\"Bad Request\",\"message\":\"Payload validation error: 'Expected type string but found type null' on property initiate_login_uri (Initiate login uri, must be https).\",\"errorCode\":\"invalid_body\"} at /var/www/html/app/Auth0/Auth0SDKException.php:17)

Problem is the class vendor/auth0/auth0-php/src/Utility/Toolkit/Filter/StringFilter.php, line 40, it changes all empty string '' values to a NULL, but the API cannot handle this.

We need a change so this field is not set to NULL when empty.

Currently, I have fixed it in the \Auth0\SDK\API\Management\Clients::update class, to add an extra check and restore the empty value. This code fixes it:

public function update(
        string $id,
        ?array $body = null,
        ?RequestOptions $options = null,
    ): ResponseInterface {
        [$id] = Toolkit::filter([$id])->string()->trim();
        [$body] = Toolkit::filter([$body])->array()->trim();

        if(isset($body['initiate_login_uri']) && $body['initiate_login_uri'] === null) {
            $body['initiate_login_uri'] = '';
        }

        Toolkit::assert([
            [$id, \Auth0\SDK\Exception\ArgumentException::missing('id')],
        ])->isString();

        return $this->getHttpClient()
            ->method('patch')->addPath(['clients', $id])
            ->withBody($body ?? [])
            ->withOptions($options)
            ->call();
    }

How can we reproduce this issue?

Do a call with \Auth0\SDK\API\Management\Clients::update with an empty initiate_login_uri.