Fix PATCH /Users/{userId}/status ignoring caller's Accept header - #4053
Merged
Conversation
updateAccountStatus (backing unlock-account and force-password-change) was missing @responsebody -- dropped by accident in 6159e2f (2016) when this endpoint moved from PUT to PATCH, while every sibling endpoint in this @controller class kept it. Without @responsebody, Spring falls back to view-name resolution instead of the normal HttpMessageConverter path; a client that omits an explicit `Accept: application/json` header (e.g. uaa-cli's unlock-user, which uses a raw PATCH via its curl helper) gets routed to Thymeleaf trying to resolve a nonexistent template, and 500s. With Accept: application/json explicitly sent, a ContentNegotiatingView Resolver JSON fallback view papered over the missing annotation, which is why the existing MockMvc tests (which do set that header) never caught this. Restoring @responsebody makes the endpoint correctly return JSON regardless of the caller's Accept header, like every other endpoint here. Side effect: the response Content-Type changes from the JSON view's `application/json;charset=UTF-8` to the standard HttpMessageConverter's `application/json` (no charset param), matching every other endpoint in this file -- the two affected MockMvc test classes are updated to match. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes PATCH /Users/{userId}/status response handling in ScimUserEndpoints so it consistently returns a JSON body via Spring’s HttpMessageConverter path (instead of falling back to view-name resolution when Accept is missing), aligning this endpoint with its siblings in the same controller.
Changes:
- Restores
@ResponseBodyonScimUserEndpoints#updateAccountStatusto avoid view resolution and ensure JSON responses. - Updates MockMvc assertions to expect
application/json(no charset parameter) for the status PATCH response. - Removes the now-unneeded
APPLICATION_JSON_UTF8test constant from the two affected MockMvc test classes.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
server/src/main/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpoints.java |
Restores @ResponseBody on the status PATCH endpoint to ensure JSON response serialization. |
uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpointsMockMvcTests.java |
Updates expected response Content-Type from JSON+UTF8 to APPLICATION_JSON and removes unused UTF8 constant. |
uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpointsMockMvcZonePathTests.java |
Same test expectation update/removal as the non-zone-path test class. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Copilot review feedback on #4053: the existing MockMvc helper always sets Accept: application/json, so it never exercised the view-resolution vs HttpMessageConverter behavior that the missing @responsebody bug actually depended on. Add a variant that omits the Accept header and assert 200 + correct JSON, matching how uaa-cli's unlock-user issues this request. Confirmed this test fails without @responsebody (reverted it locally, re-ran, saw the failure) and passes with it restored. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
cf-foundation-community-automation
Bot
moved this to Inbox
in Foundational Infrastructure Working Group
3 tasks
strehle
approved these changes
Aug 25, 2026
github-project-automation
Bot
moved this from Inbox
to Pending Merge | Prioritized
in Foundational Infrastructure Working Group
github-project-automation
Bot
moved this from Pending Merge | Prioritized
to Done
in Foundational Infrastructure Working Group
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
updateAccountStatus(backing account-unlock and force-password-change,PATCH /Users/{userId}/statusinScimUserEndpoints) is missing@ResponseBody— accidentally dropped in6159e2f4(2016) when the endpoint moved from PUT to PATCH, while every sibling endpoint in this@Controllerclass kept it.@ResponseBody, Spring falls back to view-name resolution instead of the normalHttpMessageConverterpath. A client that doesn't send an explicitAccept: application/jsonheader gets routed into Thymeleaf trying (and failing) to resolve a template named after the request path, and the call 500s.uaa-cli'sunlock-usercommand issues a raw PATCH without anAcceptheader and always gets a 500 against currentdevelop.Accept: application/json, which happens to trigger aContentNegotiatingViewResolverJSON fallback view that papers over the missing annotation.Restoring
@ResponseBodymakes the endpoint correctly return JSON regardless of the caller'sAcceptheader, consistent with every other endpoint in this file.Side effect: the response
Content-Typechanges from the JSON fallback view'sapplication/json;charset=UTF-8to the standardHttpMessageConverter'sapplication/json(no charset param) — matching every other endpoint here. Updated the two affected MockMvc test classes (ScimUserEndpointsMockMvcTests,ScimUserEndpointsMockMvcZonePathTests) to match; removed the now-unusedAPPLICATION_JSON_UTF8test constant that existed only for this endpoint.Test plan
./gradlew :cloudfoundry-identity-uaa:test --tests ScimUserEndpointsMockMvcTests --tests ScimUserEndpointsMockMvcZonePathTests— 150/150 passingPATCH /Users/{id}/statuswithout anAcceptheader 500s ondevelop, returns 200 with correct JSON after this fixAccept: application/jsonexplicitly set,developalready returns 200 (explains why existing tests didn't catch this)