From d84e4e03124e25a7187b210a82418aa13272783f Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 2 Aug 2026 10:12:28 +0000
Subject: [PATCH] test: cover JSON body parsing for /api/provider

Guards the selective express.json allowlist so custom provider upsert
requests keep a parsed body.

Co-authored-by: Serhii Dziupin <makeittech@users.noreply.github.com>
---
 .../server/lib/opencode/core-routes.test.js   | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/packages/web/server/lib/opencode/core-routes.test.js b/packages/web/server/lib/opencode/core-routes.test.js
index 45d38b8f..200a1c13 100644
--- a/packages/web/server/lib/opencode/core-routes.test.js
+++ b/packages/web/server/lib/opencode/core-routes.test.js
@@ -127,6 +127,37 @@ describe('core-routes', () => {
     expect(response.body).toEqual({ body: { content: 'Snippet body' } });
   });
 
+  it('should parse JSON bodies for custom provider upsert routes', async () => {
+    const app = express();
+    registerCommonRequestMiddleware(app, { express });
+    app.put('/api/provider', (req, res) => {
+      res.json({ body: req.body });
+    });
+
+    const response = await request(app)
+      .put('/api/provider')
+      .send({
+        providerID: 'campus-llm',
+        config: {
+          name: 'Campus LLM',
+          options: { baseURL: 'https://llm.example.edu/v1' },
+          models: { fast: { name: 'Fast' } },
+        },
+      })
+      .expect(200);
+
+    expect(response.body).toEqual({
+      body: {
+        providerID: 'campus-llm',
+        config: {
+          name: 'Campus LLM',
+          options: { baseURL: 'https://llm.example.edu/v1' },
+          models: { fast: { name: 'Fast' } },
+        },
+      },
+    });
+  });
+
   it('should require API auth before probing loopback preview URLs', async () => {
     const app = express();
     const originalFetch = globalThis.fetch;