taler-typescript-core

commit 8ed984d70a327d1cdf3c529b419cd5f8b4650b38
parent 9123ba52f26d6e39f4f411d879a5db692b19670a
Author: Hernâni Marques <hernani@vecirex.net>
Date:   Sat, 18 Jul 2026 01:47:52 +0200

fix/taler-merchant-webui (11340): mitigate HTTP 401 by enforcing lowercase username also on signup (and admin-create), not just login

Diffstat:
M
packages/taler-merchant-webui/src/components/instance/DefaultInstanceFormFields.tsx
 | 
1
+
M
packages/taler-merchant-webui/src/paths/admin/create/CreatePage.tsx
 | 
6
+++++-
M
packages/taler-merchant-webui/src/paths/newAccount/index.tsx
 | 
7
+++++--

3 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/packages/taler-merchant-webui/src/components/instance/DefaultInstanceFormFields.tsx b/packages/taler-merchant-webui/src/components/instance/DefaultInstanceFormFields.tsx
@@ -64,6 +64,7 @@ export function DefaultInstanceFormFields({
           label={i18n.str`Username`}
           tooltip={i18n.str`Name of the instance in URLs. The 'admin' instance is special in that it is used to administer other instances.`}
           autoComplete="username"
+          fromStr={(s) => s.toLowerCase()}
         />
       )}
 
diff --git a/packages/taler-merchant-webui/src/paths/admin/create/CreatePage.tsx b/packages/taler-merchant-webui/src/paths/admin/create/CreatePage.tsx
@@ -168,8 +168,10 @@ export function CreatePage({ onConfirm, onBack, forceId }: Props): VNode {
 
   const hasErrors = errors !== undefined;
 
+  // #11340: Basic-auth username is case-sensitive; lowercase avoids 401.
   const data: TalerMerchantApi.InstanceConfigurationMessage = {
     ...(value as TalerMerchantApi.InstanceConfigurationMessage),
+    id: (value.id ?? "").toLowerCase(),
     auth: {
       method: MerchantAuthMethod.TOKEN,
       password: value.password!,
@@ -185,6 +187,8 @@ export function CreatePage({ onConfirm, onBack, forceId }: Props): VNode {
     ) => {
       if (!data.address) data.address = {};
       if (!data.jurisdiction) data.jurisdiction = {};
+      // #11340: keep instance id lowercase for Basic-auth token create.
+      data.id = data.id.toLowerCase();
       const instanceResp = await lib.instance.createInstance(token, data, {
         challengeIds,
       });
@@ -207,7 +211,7 @@ export function CreatePage({ onConfirm, onBack, forceId }: Props): VNode {
   );
   create.onSuccess = (success, oldtoken, data) => {
     if (success) {
-      logIn(data.id, success.access_token);
+      logIn(data.id.toLowerCase(), success.access_token);
     }
     onConfirm();
   };
diff --git a/packages/taler-merchant-webui/src/paths/newAccount/index.tsx b/packages/taler-merchant-webui/src/paths/newAccount/index.tsx
@@ -179,6 +179,8 @@ export function NewAccount({ onCancel, onCreated }: Props): VNode {
   const { actionHandler, showError } = useNotificationContext();
   const mfa = useMerchantChallengeHandlerContext();
 
+  // #11340: Basic-auth username is case-sensitive; lowercase avoids 401.
+  const id = (value.id ?? "").toLowerCase();
   const request: InstanceConfigurationMessage = {
     address: {},
     auth: {
@@ -192,7 +194,7 @@ export function NewAccount({ onCancel, onCreated }: Props): VNode {
       Duration.toTalerProtocolDuration(oneDay),
     default_refund_delay:
       config.default_refund_delay ?? Duration.toTalerProtocolDuration(twoDays),
-    id: value.id!,
+    id,
     jurisdiction: {},
     name: value.name!,
     use_stefan: true,
@@ -213,7 +215,7 @@ export function NewAccount({ onCancel, onCreated }: Props): VNode {
   );
   create.onSuccess = (success, req) => {
     if (success) {
-      logIn(req.id, success.access_token);
+      logIn(req.id.toLowerCase(), success.access_token);
     }
     saveForm({});
     onCreated();
@@ -263,6 +265,7 @@ export function NewAccount({ onCancel, onCreated }: Props): VNode {
                 label={i18n.str`Username`}
                 tooltip={i18n.str`Name of the instance in URLs. The 'admin' instance is special in that it is used to administer other instances.`}
                 autoComplete="username"
+                fromStr={(s) => s.toLowerCase()}
                 focus
               />