Bug: GET query params not coerced to int causes TypeError in /clients/{id}/access/check

[nycomp]

Bug Description

The GET /auth/v1/clients/{id}/access/check endpoint expects an int for the permission query parameter, but query parameters are always strings. This causes a TypeError when the endpoint tries to perform bitwise operations.

Location

• File: campus/auth/resources/client.py:270
• Route: campus/auth/routes/clients.py:181-200

Error

TypeError: unsupported operand type(s) for &: 'int' and 'str'

Root Cause

The parameter.reconcile() function in flask_campus does not perform type coercion for query parameters. The route signature specifies permission: int, but GET query params are always strings.

Steps to Reproduce

# Via curl or test client
GET /auth/v1/clients/{client_id}/access/check?vault=test&permission=1

Expected Behavior

The endpoint should either:

1. Coerce query param string to int before calling the route handler
2. Or explicitly parse permission as int in the route handler

Contract Test Blocked

• tests/contract/test_auth_clients.py::TestAuthClientsContract::test_check_client_access is skipped due to this bug

Related

• Found during Phase 3 of integration test refactor
• HTTP contract test coverage expansion