fix(FR-3058): send empty JSON body for non-GET requests with null body

packages/backend.ai-client/src/client.ts

@@ -209,7 +209,7 @@
     timeout: number = 0,
     retry: number = 0,
     opts: Record<string, unknown> = {},
   ): Promise<any> {
     // `errorType` starts out as one of the numeric `Client.ERR_*` sentinels and
     // may later be re-assigned to a URI-shaped string (e.g.
     // `https://api.backend.ai/probs/client-request-error`) before being
@@ -226,7 +226,7 @@
     // otherwise. The callers downstream of this method also expect
     // different shapes (most read JSON fields directly). Type as `any`
     // here and document this in the type-mismatch follow-up file.
     let body: any;
     let requestTimer: ReturnType<typeof setTimeout> | undefined;
     let requestTimerForSoftTimeout: ReturnType<typeof setTimeout> | undefined;
     let isSoftTimeoutTriggered = false;
@@ -485,7 +485,7 @@
     }
     try {
       localStorage.setItem('backendaiwebui.logs', JSON.stringify(log_stack));
     } catch (e) {
       // console.warn('Local storage is full. Clearing part of the logs.');
       // localStorage is full, we will keep the recent 2/3 of the logs.
       let webuiLogs = JSON.parse(
@@ -870,7 +870,7 @@
     try {
       await this._wrapWithPromise(rqst);
       return Promise.resolve(true);
     } catch (e) {
       return Promise.resolve(false);
     }
   }
@@ -891,7 +891,7 @@
       } else {
         //console.log("login failed");
       }
     } catch (err) {
       // console.log(err);
       return Promise.resolve(false);
     }
@@ -991,7 +991,7 @@
    * Login into webserver with auth cookie token. This requires additional webserver package.
    *
    */
   async token_login(token: string, extraParams: object = {}): Promise<any> {
     const body = token ? { sToken: token } : {};
     if (extraParams) {
       Object.assign(body, extraParams);
@@ -1063,7 +1063,7 @@
    * Leave from manager user. This requires additional webserver package.
    *
    */
   async signout(userid: string, password: string): Promise<any> {
     let body = {
       username: userid,
       password: password,
@@ -1075,7 +1075,7 @@
   /**
    * Update user's full_name.
    */
   async update_full_name(email: string, fullName: string): Promise<any> {
     let body = {
       email: email,
       full_name: fullName,
@@ -1097,7 +1097,7 @@
     oldPassword: string,
     newPassword: string,
     newPassword2: string,
   ): Promise<any> {
     let body = {
       old_password: oldPassword,
       new_password: newPassword,
@@ -1113,7 +1113,7 @@
     return this._wrapWithPromise(rqst);
   }
 
   async initialize_totp(): Promise<any> {
     let rqst = this.newSignedRequest('POST', '/totp', {}, null);
     return this._wrapWithPromise(rqst);
   }
@@ -1680,7 +1680,11 @@
     let authBody: string;
     let d = new Date();
     if (body === null || body === undefined) {
-      requestBody = '';
+      // Some backends require a valid JSON body even when empty.
+      // Send '{}' for methods that carry a body; keep '' for GET/HEAD.
+      // authBody mirrors requestBody so the v<4 signature (which hashes the
+      // body) matches what is actually sent; v4+ excludes the body anyway.
+      requestBody = method !== 'GET' && method !== 'HEAD' ? '{}' : '';
       authBody = requestBody;
     } else if (
       typeof (body as { getBoundary?: () => string }).getBoundary ===

src/lib/backend.ai-client-node.ts

@@ -1316,7 +1316,12 @@ class Client {
     let authBody;
     let d = new Date();
     if (body === null || body === undefined) {
-      requestBody = '';
+      // Some backends require a valid JSON body even when empty.
+      // Send '{}' for methods that carry a body; keep '' for GET/HEAD.
+      // authBody must match the actual body: on legacy (v<4) backends the
+      // signature hashes the body, so a mismatch fails verification. On v4+
+      // the body is excluded from the signature (see below), so this is safe.
+      requestBody = method !== 'GET' && method !== 'HEAD' ? '{}' : '';
       authBody = requestBody;
     } else if (
       typeof body.getBoundary === 'function' ||