fix(serialization-json): handle CSV string in get_collection_of_enum_values for flags enums

[Hugo Pereira Brito (HugoPBrito)]

Summary

Fixes #515

get_collection_of_enum_values() in JsonParseNode silently returns [] when the JSON node is a string instead of a list. This breaks deserialization of flags enums that are serialized as comma-separated strings by the API (e.g. "deviceCodeFlow" or "deviceCodeFlow,authenticationTransfer").

Problem

Flags enums marked with x-ms-enum-flags: isFlags: true in OpenAPI metadata are generated by Kiota to use get_collection_of_enum_values() as their deserializer (microsoft/kiota#3237). However, the Microsoft Graph API serializes these as CSV strings, not JSON arrays.

The current code:

def get_collection_of_enum_values(self, enum_class):
    if isinstance(self._json_node, list):
        return list(map(...))
    return []  # <-- string input always hits this path

This directly affects ConditionalAccessAuthenticationFlows.transferMethods in the Microsoft Graph SDK, which always deserializes as [] regardless of the actual API response.

Fix

Added CSV string handling after the existing list check:

if isinstance(self._json_node, str) and self._json_node:
    return [
        result
        for value in self._json_node.split(",")
        if (result := self._create_new_node(value.strip()).get_enum_value(enum_class)) is not None
    ]

The fix is backward-compatible — behavior for list inputs is completely unchanged.

Tests

5 new test cases added covering:

• CSV string with multiple values ("dunhill,oval")
• CSV string with spaces ("dunhill, oval")
• Single string value ("dunhill")
• Empty string ("")
• CSV string with unknown members ("dunhill,unknownValue,oval" — unknown values silently skipped)

All 86 tests pass (81 existing + 5 new), zero regressions.

Verification

• Verified the bug against a live Microsoft Graph API (v1.0) with a real Conditional Access policy that has Device Code Flow configured
• Confirmed the API returns "transferMethods": "deviceCodeFlow" as a string (not an array)
• Confirmed the fix resolves the issue for ConditionalAccessAuthenticationFlows in msgraph-sdk v1.23.0
• Verified the same code is still on main (v1.9.9)

[Hugo Pereira Brito (HugoPBrito)]

Hugo Pereira Brito (@HugoPBrito) please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

• (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.

@microsoft-github-policy-service agree

• (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.

@microsoft-github-policy-service agree company="Microsoft"

Contributor License Agreement

@microsoft-github-policy-service agree company="Prowler"

[Vincent Biret (baywet)]

Thanks for the contribution!

The TextParseNode most likely has the same issue. Would you mind double checking and replicating the fix if necessary please?

[Hugo Pereira Brito (HugoPBrito)]

Thanks for the review Vincent Biret (@baywet)!

I checked both TextParseNode and FormParseNode:

• TextParseNode.get_collection_of_enum_values() (line 149-154) raises Exception("Text does not support structured data") — it doesn't attempt to parse at all, so it's not affected by this bug.

• FormParseNode.get_collection_of_enum_values() (line 186-199) already does self._node.split(',') since self._node is always a string in form-urlencoded data. It correctly handles CSV values already.

So the issue was specific to JsonParseNode, where the value comes from json.loads() and the method only checked for isinstance(self._json_node, list), missing the case where JSON represents a flags enum as a plain string value (not an array).

Let me know if you'd like me to adjust anything!

[Vincent Biret (baywet)]

Thanks for confirming!

[Copilot]

Pull request overview

Fixes deserialization of flags enums serialized as CSV strings by adding string handling to get_collection_of_enum_values() in JsonParseNode.

Changes:

• Added CSV string parsing logic to get_collection_of_enum_values() for flags enums
• Added 5 new test cases covering CSV strings, single values, empty strings, spaces, and unknown members

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
packages/serialization/json/kiota_serialization_json/json_parse_node.py	Added str handling branch to parse comma-separated enum values
packages/serialization/json/tests/unit/test_json_parse_node.py	Added 5 tests for the new CSV string parsing behavior

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Vincent Biret (baywet)]

Hugo Pereira Brito (@HugoPBrito) can you fix the formatting before we merge this PR please?

[Hugo Pereira Brito (HugoPBrito)]

Sure! I'm on it.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Vincent Biret (baywet)]

Thanks for the contribution!