search

lessonly / scim_rails

SCIM Adapter for Rails.
MIT License
68 stars 76 forks source link

Exception when patch endpoint receives unexpected request format. #29

Closed rreinhardt9 closed 4 years ago

rreinhardt9 commented 4 years ago

When the PATCH endpoint (which is not complete or scim complaint yet) receives a request with a payload that is not supported yet, it intends to return a 422 and message like: "Invalid PATCH request. This PATCH endpoint only supports deprovisioning and reprovisioning records.","status":"422"

However, when receiving the following invalid body:

{"schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"], "Operations": [{"op":"Add","path":"displayName","value":"Norris, Chuck"}]}

the gem raises a 500 error because it's expecting "value" to contain an object not a string.

Here is a full curl request to reproduce:

curl -X PATCH 'http://dev:api_key@localhost:3000/scim/v2/Users/819216' -d '{"schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"], "Operations": [{"op":"Add","path":"displayName","value":"Norris, Chuck"}]}' -H 'Content-Type: application/scim+json'

To solve this, let's add more specific validation for the types of patch requests we do except currently so that we can return that 422 instead of raising a 500 error when someone supplies an invalid patch body.

rreinhardt9 commented 4 years ago

@wthenrichs Here is that issue we were seeing, I'll open a PR with a proposed fix shortly.