fixed PUT client endpoint behaviour for unknown fields

esignet-service/README.md

@@ -195,7 +195,7 @@ The `public_key` hash is stored for uniqueness enforcement. `enc_public_key` and
 PUT /client-mgmt/client/{client_id}
 ```
 
-Mutable fields: `clientName`, `clientNameLangMap`, `logoUri`, `redirectUris`, `userClaims`, `authContextRefs`, `grantTypes`, `clientAuthMethods`, `status`, `additionalConfig`. `relyingPartyId` and `publicKey` are immutable after creation.
+Mutable fields: `clientName`, `clientNameLangMap`, `logoUri`, `redirectUris`, `userClaims`, `authContextRefs`, `grantTypes`, `clientAuthMethods`, `status`, `additionalConfig`. `clientId`, `relyingPartyId` and `publicKey` are immutable after creation; sending any of them, or any field not listed above, fails the request with `invalid_request`.
 
 ### Database schema
 

esignet-service/internal/clientmgmt/handler.go

@@ -105,8 +105,13 @@ func (h *Handler) updateClient(profile Profile) http.HandlerFunc {
 			writeSpecError(r.Context(), w, "invalid_input", "requestTime is required")
 			return
 		}
+		updateReq, err := DecodeUpdateRequest(body)
+		if err != nil {
+			writeSpecError(r.Context(), w, "invalid_request", err.Error())
+			return
+		}
 
-		resp, err := h.svc.UpdateClient(r.Context(), profile, clientID, req.Request)
+		resp, err := h.svc.UpdateClient(r.Context(), profile, clientID, updateReq)
 		if err != nil {
 			h.handleServiceError(r.Context(), w, err, "update client")
 			return

esignet-service/internal/clientmgmt/handler_test.go

@@ -231,6 +231,35 @@ func (ts *HandlerTestSuite) TestUpdateClientHandler() {
 		require.Equal(t, "invalid_input", errObj["errorCode"])
 	})
 
+	for _, extra := range []string{
+		`"clientId":"hacked-id"`,
+		`"relyingPartyId":"bogus-rp"`,
+		`"publicKey":{"kty":"RSA","n":"ZZZZ","e":"AQAB"}`,
+		`"unknownField":"x"`,
+	} {
+		t.Run("rejects "+extra, func(t *testing.T) {
+			q := &fakeQuerier{updateRow: existingClientRow()}
+			h := newTestHandler(q)
+			mux := http.NewServeMux()
+			h.RegisterRoutes(mux, nil)
+			updateJSON, err := json.Marshal(validUpdateRequest())
+			require.NoError(t, err)
+			reqJSON := string(updateJSON[:len(updateJSON)-1]) + `,` + extra + `}`
+			body := []byte(`{"requestTime":"2026-07-27T00:00:00.000Z","request":` + reqJSON + `}`)
+			req := httptest.NewRequest(http.MethodPut, "/client-mgmt/client/client-1", bytes.NewReader(body))
+			rec := httptest.NewRecorder()
+			mux.ServeHTTP(rec, req)
+
+			require.Equal(t, http.StatusOK, rec.Code)
+			decoded := decodeEnvelope(t, rec.Body.Bytes())
+			errs := decoded["errors"].([]any)
+			errObj := errs[0].(map[string]any)
+			require.Equal(t, "invalid_request", errObj["errorCode"])
+			require.Nil(t, decoded["response"])
+			require.Empty(t, q.updateParams.ID, "update must not reach the database")
+		})
+	}
+
 	t.Run("missing request time", func(t *testing.T) {
 		h := newTestHandler(&fakeQuerier{})
 		mux := http.NewServeMux()

esignet-service/internal/clientmgmt/model.go

@@ -7,8 +7,10 @@
 package clientmgmt
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
+	"strings"
 
 	"github.com/mosip/esignet/internal/common"
 )
@@ -257,3 +259,28 @@ func DecodePatchRequest(data []byte) (PatchClientRequest, PatchFields, error) {
 	}
 	return req, fields, nil
 }
+
+// DecodeUpdateRequest strictly unmarshals the request object of a PUT body.
+// Fields outside UpdateClientRequest — including the immutable clientId,
+// relyingPartyId and publicKey — are rejected instead of silently dropped.
+func DecodeUpdateRequest(data []byte) (UpdateClientRequest, error) {
+	var envelope struct {
+		Request json.RawMessage `json:"request"`
+	}
+	if err := json.Unmarshal(data, &envelope); err != nil {
+		return UpdateClientRequest{}, err
+	}
+	var req UpdateClientRequest
+	if len(envelope.Request) == 0 || string(envelope.Request) == "null" {
+		return req, nil
+	}
+	dec := json.NewDecoder(bytes.NewReader(envelope.Request))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&req); err != nil {
+		if field, found := strings.CutPrefix(err.Error(), "json: unknown field "); found {
+			return UpdateClientRequest{}, fmt.Errorf("unknown field %s", field)
+		}
+		return UpdateClientRequest{}, err
+	}
+	return req, nil
+}

esignet-service/internal/clientmgmt/model_test.go

@@ -174,6 +174,47 @@ func (ts *ModelTestSuite) TestDecodePatchRequest() {
 	}
 }
 
+func (ts *ModelTestSuite) TestDecodeUpdateRequest() {
+	t := ts.T()
+	t.Run("mutable fields decoded", func(t *testing.T) {
+		req, err := DecodeUpdateRequest([]byte(`{"requestTime":"x","request":{"clientName":"App","status":"active","additionalConfig":{"a":1}}}`))
+		require.NoError(t, err)
+		assert.Equal(t, "App", req.ClientName)
+		assert.Equal(t, "active", req.Status)
+		assert.JSONEq(t, `{"a":1}`, string(req.AdditionalConfig))
+	})
+
+	t.Run("missing or null request", func(t *testing.T) {
+		for _, body := range []string{`{}`, `{"request":null}`} {
+			req, err := DecodeUpdateRequest([]byte(body))
+			require.NoError(t, err)
+			assert.Equal(t, UpdateClientRequest{}, req)
+		}
+	})
+
+	for _, field := range []string{"clientId", "relyingPartyId", "publicKey", "unknownField"} {
+		t.Run(field+" rejected", func(t *testing.T) {
+			_, err := DecodeUpdateRequest([]byte(`{"request":{"clientName":"App","` + field + `":"x"}}`))
+			require.Error(t, err)
+			assert.Equal(t, `unknown field "`+field+`"`, err.Error())
+		})
+	}
+
+	for _, tt := range []struct {
+		name string
+		body string
+	}{
+		{"invalid top-level json", `not-json`},
+		{"request not an object", `{"request":"x"}`},
+		{"field wrong type", `{"request":{"clientName":123}}`},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := DecodeUpdateRequest([]byte(tt.body))
+			assert.Error(t, err)
+		})
+	}
+}
+
 func (ts *ModelTestSuite) TestResponseWrapper_successResponse() {
 	t := ts.T()
 	resp := ClientResponse{ClientID: "c1", Status: "ACTIVE"}