Response codes in AuthController (review of the code)

There are some endpoints in the AuthController. Each of them returns response code and this issue is to validate them and suggest the correct ones:

https://github.com/zowe/api-layer/blob/2ce6e5bb44f5862a1fe91a6a4cd8398aff6f7a08/zaas-service/src/main/java/org/zowe/apiml/zaas/controllers/AuthController.java#L118-L123

TokenNotValidException could be thrown from multiple reasons: empty string, non-parseable token, revoked token, invalid token, etc. But the response code is always 400 which should be related only to the token structure.

https://github.com/zowe/api-layer/blob/2ce6e5bb44f5862a1fe91a6a4cd8398aff6f7a08/zaas-service/src/main/java/org/zowe/apiml/zaas/controllers/AuthController.java#L176-180

The authentication should be done by configuration. It is not necessary to read security context (just adding Authentication as a new argument is enough).

This implementation looks like it could receive annonymous authentication. Then it could end with NullPointerException.

https://github.com/zowe/api-layer/blob/2ce6e5bb44f5862a1fe91a6a4cd8398aff6f7a08/zaas-service/src/main/java/org/zowe/apiml/zaas/controllers/AuthController.java#L213-216
This method (and very probably also others similar to this one) could throw CachingServiceClientException. It generates 500 as default, but in the case of unacessible caching service it should 503.

https://github.com/zowe/api-layer/blob/2ce6e5bb44f5862a1fe91a6a4cd8398aff6f7a08/zaas-service/src/main/java/org/zowe/apiml/zaas/controllers/AuthController.java#L307-311

If token is not valid for the scope (serviceId is not in the scope of the token), the response code should be 403

https://github.com/zowe/api-layer/blob/2ce6e5bb44f5862a1fe91a6a4cd8398aff6f7a08/zaas-service/src/main/java/org/zowe/apiml/zaas/controllers/AuthController.java#L322-324

There is no content to return which is difference between 200 and 204. The response code should be 204 or 503, because the reason to don't distribute the token is that there is no service up (to be notified).

https://github.com/zowe/api-layer/blob/2ce6e5bb44f5862a1fe91a6a4cd8398aff6f7a08/zaas-service/src/main/java/org/zowe/apiml/zaas/controllers/AuthController.java#L348

It is very theoretical but this method could return empty map. In this case the response code should be 404.

https://github.com/zowe/api-layer/blob/2ce6e5bb44f5862a1fe91a6a4cd8398aff6f7a08/zaas-service/src/main/java/org/zowe/apiml/zaas/controllers/AuthController.java#L417-424

There is also issue #4175 to describe an issue with missing key. Depends on it there is no reason to return 500 when there is not exactly one record in the response. When there is no one it should in general return 404, but I guess there is an aim to tell user that system is not ready. Let's say we can check if z/OSMF (or OIDC provider in the case) is not ready and return 503.

https://github.com/zowe/api-layer/blob/2ce6e5bb44f5862a1fe91a6a4cd8398aff6f7a08/zaas-service/src/main/java/org/zowe/apiml/zaas/controllers/AuthController.java#L474-477

When OIDC provider is no define 401 makes sense since the token was not validated. But this information is not helpfull. It is much better is we return 503 as service is not available.

notes:

• All these methods were copied to the apiml module and so they have an WebFlux variant that should be fixed as well
• It is based on conversation:
  • https://github.com/zowe/api-layer/pull/4108/files#r2156875047

Start with the referenced AuthController.java line ranges and compare each response path with the relevant exception or provider state. Review issue #4175 and the linked pull request discussion, then inspect the copied WebFlux variant in the apiml module. Done means the listed response cases are validated and corrected consistently in both controller variants.