tests/e2e/Services/Account/AccountCustomClientTest.php (1)

2187-2216: Extract redirect-chain assertions into a helper to reduce drift.

The two OAuth redirect walkthroughs are almost identical. A small helper (e.g., followOAuthRedirectChain) would keep expectations consistent and make future flow changes safer.

Also applies to: 2247-2277

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/e2e/Services/Account/AccountCustomClientTest.php` around lines 2187 -
2216, Extract the repeated OAuth redirect walkthrough into a private helper
(e.g., followOAuthRedirectChain) to centralize the
GET->301->GET->301->GET->301->GET->200 sequence and reduce duplicated
assertions; implement a method that accepts the Client instance and initial URL,
performs successive oauthClient->call(Client::METHOD_GET, ..., followRedirects:
false) calls, asserts the intermediate 301 status-codes and the expected
location prefixes (the same prefixes currently asserted with
assertStringStartsWith), checks for the two session cookies ('a_session_' .
$this->getProject()['$id'] . '_legacy' and 'a_session_' .
$this->getProject()['$id']), returns the final response and extracted
oauthUserCookie, and then replace both duplicated blocks (around the current
assertions using Client::METHOD_GET and cookie checks) with calls to this helper
to reuse the logic.

app/controllers/api/account.php (1)

212-226: Consider handling the missing provider case more gracefully.

The current logic throws USER_INVALID_TOKEN at line 219 if the secret decodes as a valid JWT but lacks a provider claim. This exception isn't caught by the JWTException catch block, so it propagates up.

While practically unlikely (an attacker would need the symmetric key to craft such a JWT), this conflates two distinct error conditions:

1. "This is a malformed OAuth2 JWT"
2. "This is not an OAuth2 JWT at all"

Consider restructuring so that a JWT without provider is treated the same as a non-JWT (fall through), and let the validation at line 244 catch OAuth2 tokens without providers. This would be more defensive:

Suggested approach

     try {
         $jwtDecoder = new JWT(System::getEnv('_APP_OPENSSL_KEY_V1'), 'HS256', 60, 0);
         $payload = $jwtDecoder->decode($secret);
 
-        if (empty($payload['provider'])) {
-            throw new Exception(Exception::USER_INVALID_TOKEN);
+        if (!empty($payload['provider']) && !empty($payload['secret'])) {
+            $oauthProvider = $payload['provider'];
+            $secret = $payload['secret'];
         }
-
-        $oauthProvider = $payload['provider'];
-        $secret = $payload['secret'];
     } catch (\Ahc\Jwt\JWTException) {
         // Not a JWT — use secret as-is (non-OAuth flows)
     }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@app/controllers/api/account.php` around lines 212 - 226, The JWT decode block
using $jwtDecoder currently throws Exception::USER_INVALID_TOKEN when
$payload['provider'] is empty, which escapes the JWTException catch and
conflates "malformed OAuth2 JWT" with "not an OAuth2 JWT"; change the logic in
the try block so that if $payload['provider'] is missing you do NOT throw
Exception::USER_INVALID_TOKEN but instead treat it like a non-JWT: leave
$oauthProvider as null and preserve $secret (or reset $secret to the original
raw value) so execution falls through to the existing downstream validation
(which will catch invalid OAuth2 tokens), while still only catching
\Ahc\Jwt\JWTException for real decode errors.