POST instance: don't attempt to parse instance from body when it's empty or not json

src/Altinn.App.Api/Controllers/InstancesController.cs

@@ -188,7 +188,7 @@
     [ProducesResponseType(typeof(Instance), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status400BadRequest)]
     [RequestSizeLimit(RequestSizeLimit)]
     public async Task<ActionResult<Instance>> Post(
         [FromRoute] string org,
         [FromRoute] string app,
         [FromQuery] int? instanceOwnerPartyId,
@@ -1147,7 +1147,7 @@
             // NOTE: part.Name is nullable on the type here, but `RequestPartValidator.ValidatePart` which is called
             // further up the stack will error out if it actually null, so we just sanity-check here
             // and throw if it is null.
             // TODO: improve the modelling of this type.
             if (part.Name is null)
             {
                 throw new InvalidOperationException("Unexpected state - part name is null");
@@ -1228,14 +1228,8 @@
     {
         RequestPart? instancePart = parts.Find(part => part.Name == "instance");
 
-        // assume that first part with no name is an instanceTemplate
-        if (
-            instancePart == null
-            && parts.Count == 1
-            && parts[0].ContentType.Contains("application/json")
-            && parts[0].Name == null
-            && parts[0].Bytes.Length > 0
-        )
+        // If the request has a single part with no name, assume it is the instance template
+        if (instancePart == null && parts.Count == 1 && parts[0].Name == null)
         {
             instancePart = parts[0];
         }
@@ -1244,7 +1238,17 @@
         {
             parts.Remove(instancePart);
 
-            return System.Text.Json.JsonSerializer.Deserialize<Instance>(instancePart.Bytes, _jsonSerializerOptionsWeb);
+            // Some clients might set contentType to application/json even if the body is empty
+            if (
+                instancePart is { Bytes.Length: > 0 }
+                && instancePart.ContentType.Contains("application/json", StringComparison.Ordinal)
+            )
+            {
+                return System.Text.Json.JsonSerializer.Deserialize<Instance>(
+                    instancePart.Bytes,
+                    _jsonSerializerOptionsWeb
+                );
+            }
         }
 
         return null;

test/Altinn.App.Api.Tests/Controllers/InstancesController_PostNewInstance.cs

@@ -1,5 +1,6 @@
 using System.Net;
 using System.Net.Http.Headers;
+using System.Net.Http.Json;
 using System.Text;
 using System.Text.Json;
 using System.Text.Json.Nodes;
@@ -273,6 +274,56 @@ public async Task InstationAllowedByOrg_Returns_Forbidden_For_user()
         createResponse.StatusCode.Should().Be(HttpStatusCode.Forbidden, createResponseContent);
     }
 
+    [Fact]
+    public async Task PostNewInstanceWithInstanceTemplate()
+    {
+        string org = "tdd";
+        string app = "contributer-restriction";
+        int instanceOwnerPartyId = 501337;
+        int userId = 1337;
+        HttpClient client = GetRootedClient(org, app, userId, null);
+
+        using var content = JsonContent.Create(
+            new Instance() { InstanceOwner = new InstanceOwner() { PartyId = instanceOwnerPartyId.ToString() }, }
+        );
+
+        var response = await client.PostAsync($"{org}/{app}/instances", content);
+        response.Should().HaveStatusCode(HttpStatusCode.Created);
+        var responseContent = await response.Content.ReadAsStringAsync();
+        var instance = JsonSerializer.Deserialize<Instance>(responseContent, JsonSerializerOptions);
+        instance.Should().NotBeNull();
+        instance!.Id.Should().NotBeNullOrEmpty();
+
+        TestData.DeleteInstanceAndData(org, app, instance.Id);
+    }
+
+    [Fact]
+    public async Task PostNewInstanceWithMissingTemplate()
+    {
+        string org = "tdd";
+        string app = "contributer-restriction";
+        int instanceOwnerPartyId = 501337;
+        int userId = 1337;
+        HttpClient client = GetRootedClient(org, app, userId, null);
+
+        using var content = new ByteArrayContent([])
+        {
+            Headers = { ContentType = new MediaTypeHeaderValue("application/json") }
+        };
+
+        var response = await client.PostAsync(
+            $"{org}/{app}/instances?instanceOwnerPartyId={instanceOwnerPartyId}",
+            content
+        );
+        response.Should().HaveStatusCode(HttpStatusCode.Created);
+        var responseContent = await response.Content.ReadAsStringAsync();
+        var instance = JsonSerializer.Deserialize<Instance>(responseContent, JsonSerializerOptions);
+        instance.Should().NotBeNull();
+        instance!.Id.Should().NotBeNullOrEmpty();
+
+        TestData.DeleteInstanceAndData(org, app, instance.Id);
+    }
+
     [Fact]
     public async Task InstationAllowedByOrg_Returns_Forbidden_For_User_SimplifiedEndpoint()
     {