From b0af5e7f3548ccd39814a5469ee1cfa68bf3a09e Mon Sep 17 00:00:00 2001 From: lebaudantoine Date: Wed, 11 Mar 2026 16:50:23 +0100 Subject: [PATCH] =?UTF-8?q?=F0=9F=A7=AA(backend)=20add=20failing=20test=20?= =?UTF-8?q?for=20client=5Fid=20enumeration=20issue?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Currently the inactive status is revealed before verifying the secret, creating an authentication state oracle. Introduce a failing test to capture the issue before applying the fix. --- .../core/tests/test_external_api_token.py | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/src/backend/core/tests/test_external_api_token.py b/src/backend/core/tests/test_external_api_token.py index fb6f147e..17b63dd8 100644 --- a/src/backend/core/tests/test_external_api_token.py +++ b/src/backend/core/tests/test_external_api_token.py @@ -122,6 +122,28 @@ def test_api_applications_generate_token_inactive_application(): assert "Application is inactive" in str(response.data) +def test_api_applications_generate_token_inactive_application_wrong_secret(): + """An inactive application with a wrong secret should return 401.""" + user = UserFactory(email="user@example.com") + application = ApplicationFactory(is_active=False) + + client = APIClient() + response = client.post( + "/external-api/v1.0/application/token/", + { + "client_id": application.client_id, + "client_secret": "wrong-secret", + "grant_type": "client_credentials", + "scope": user.email, + }, + format="json", + ) + + assert response.status_code == 401 + assert "Invalid credentials" in str(response.data) + assert "inactive" not in str(response.data).lower() + + def test_api_applications_generate_token_invalid_email_format(): """Invalid email format should return 400.""" application = ApplicationFactory(is_active=True)