[romanetar]

ref: https://app.clickup.com/t/86bcwp5qp

Summary

• ClientApiController::curateUpdatePayload() now strips client_id, client_secret, client_secret_expires_at and owner from the update payload.
• Credentials change only via ClientCredentialGenerator (create / regenerate). ClientFactory::build() and CreateOAuth2TestClient are untouched.
• owner sent as a string no longer yields a 500 TypeError.
• Reviewed update validation rules: every other field assigned by populate() is already validated (application_type is checked in ClientService::update(), resource_server has an instanceof guard).

Tests

• testUpdateIgnoresCredentialsAndOwner (fails with 500 without the fix)
• testRegenerateClientSecretStillRotatesAndDispatchesEvent
• tests/ClientApiTest.php: 23 tests OK

Pending

• Check no external consumer of the admin API sets client_secret via update.
• Confirm the edit-client UI shows no error when it resends client_secret.

Summary by CodeRabbit

• Bug Fixes
  • Client updates now preserve the client’s ID, secret, secret expiration, and owner, even if those fields are included in an update request.
  • Confirmed that regenerating a client secret produces a new 64-character secret and records the regeneration event.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The client API now removes client ID, credentials, expiration, and owner fields from update payloads. Tests check that stored values remain unchanged and verify secret regeneration behavior.

Changes: Client API safeguards

Layer / File(s)	Summary
Filter protected update fields and verify client behavior app/Http/Controllers/Api/ClientApiController.php, tests/ClientApiTest.php	The controller removes client ID, secret, secret expiration, and owner fields from update payloads. Tests verify that these stored values remain unchanged after an update and that secret regeneration changes the secret and dispatches an event.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested labels: security

Suggested reviewers: smarcet

Merge Risk: Minimal · up to 0ec4e

Protected fields are ignored on updates, while secret regeneration remains available. No merge-blocking risk was identified.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: preventing mass assignment of OAuth2 client credentials during updates.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 2 files.

Finishing Touches

Generate docstrings

• Commit to this branch
• Create a new PR

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2c9c5904-0e79-4339-a002-7093f8297ca0

Commits

Reviewing files that changed from the base of the PR and between 50a2871 and 0ec4ec0.

Files selected for processing: 2

• app/Http/Controllers/Api/ClientApiController.php
• tests/ClientApiTest.php

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[github-actions]

📘 OpenAPI / Swagger preview

➡️ https://OpenStackweb.github.io/openstackid/openapi/pr-180/

This page is automatically updated on each push to this PR.