View | Details | Raw Unified | Return to bug 29523
Collapse All | Expand All

(-)a/api/v1/swagger/swagger.yaml (-3 / +22 lines)
Lines 767-775 info: Link Here
767
    name: Koha Development Team
767
    name: Koha Development Team
768
    url: https://koha-community.org/
768
    url: https://koha-community.org/
769
  description: |
769
  description: |
770
    ## Introduction
770
    ## Background
771
771
    
772
    This API is documented in **OpenAPI format**.
772
    The API supports two sets of endpoints, one targetted at library staff and the other at at library users.
773
    
774
    Those endpoints under the `/public` path are aimed at delivering functionality tailored to library users and offer 
775
    a more restricted set of functions, overrides and data in thier responses for data privacy and library policy 
776
    reasons. Many of these endpoints do not require authentication for fetching public data, though an authenticated 
777
    session will expose additional options and allow users to see more data where it is part of their own record.
778
779
    All other endpoints are targetted at the staff interface level and allow for additional functionality and a more 
780
    unrestricted view of data.  These endpoints, however, have a level of redaction built in for resources that the
781
    api consumer should not have access to.  For example, user data for users who do not belong to the same library 
782
    or library group of your api user will be reduced to just minimum neccesary for a valid response. Object keys will
783
    be consistent for all responses, but their values may be removed depending on access.
773
784
774
    ## Authentication
785
    ## Authentication
775
786
Lines 782-787 info: Link Here
782
    Both _Basic authentication_ and the _OAuth2_ flow, need to be enabled
793
    Both _Basic authentication_ and the _OAuth2_ flow, need to be enabled
783
    by system preferences.
794
    by system preferences.
784
795
796
    ## Authorization
797
    
798
    The API uses existing user profiles to restrict access to resources based on user permissions and the library the 
799
    API user is assigned to.  This may result, at times, in resources being returned in a redacted form with all keys
800
    present but sensative values nulled.
801
    
802
    We do not yet support OAuth Scopes or the Authorization Code grant flow.
803
   
785
    ## Errors
804
    ## Errors
786
805
787
    The API uses standard HTTP status codes to indicate the success or failure
806
    The API uses standard HTTP status codes to indicate the success or failure
(-)a/t/db_dependent/Koha/Object.t (-17 / +54 lines)
Lines 397-403 subtest "to_api() tests" => sub { Link Here
397
    'Koha::Exceptions::Object::MethodNotCoveredByTests',
397
    'Koha::Exceptions::Object::MethodNotCoveredByTests',
398
        'Unknown method exception thrown if is_count not specified';
398
        'Unknown method exception thrown if is_count not specified';
399
399
400
    subtest 'unprivileged request tests' => sub {
400
    subtest 'public request tests' => sub {
401
401
402
        my @all_attrs = Koha::Libraries->columns();
402
        my @all_attrs = Koha::Libraries->columns();
403
        my $public_attrs = { map { $_ => 1 } @{ Koha::Library->public_read_list() } };
403
        my $public_attrs = { map { $_ => 1 } @{ Koha::Library->public_read_list() } };
Lines 535-550 subtest "to_api() tests" => sub { Link Here
535
        $schema->storage->txn_rollback;
535
        $schema->storage->txn_rollback;
536
    };
536
    };
537
537
538
    subtest 'accessible usage tests' => sub {
538
    subtest 'unprivileged requests redaction tests' => sub {
539
539
540
        plan tests => 2;
540
        my @all_attrs        = Koha::Patrons->columns();
541
        my $unredacted_attrs = { map { $_ => 1 } @{ Koha::Patron->unredact_list() } };
542
        my $mapping          = Koha::Patron->to_api_mapping;
543
        my @mapped_to_null   = grep { !defined( $mapping->{$_} ) } keys %{$mapping};
544
545
        plan tests => ( scalar @all_attrs * 3 ) - scalar @mapped_to_null;
541
546
542
        $schema->storage->txn_begin;
547
        $schema->storage->txn_begin;
543
548
544
        my $library_1 = $builder->build_object( { class => 'Koha::Libraries' } );
549
        my $library_1 = $builder->build_object( { class => 'Koha::Libraries' } );
545
        my $library_2 = $builder->build_object( { class => 'Koha::Libraries' } );
550
        my $library_2 = $builder->build_object( { class => 'Koha::Libraries' } );
546
551
547
        my $patron = $builder->build_object(
552
        my $api_consumer = $builder->build_object(
548
            {
553
            {
549
                class => 'Koha::Patrons',
554
                class => 'Koha::Patrons',
550
                value => {
555
                value => {
Lines 554-573 subtest "to_api() tests" => sub { Link Here
554
            }
559
            }
555
        );
560
        );
556
561
557
        my $patron_1 = $builder->build_object(
562
        my $patron_1 =
558
            { class => 'Koha::Patrons', value => { branchcode => $library_1->id } }
563
            $builder->build_object( { class => 'Koha::Patrons', value => { branchcode => $library_1->id } } );
559
        );
564
        my $patron_2 =
560
        my $patron_2 = $builder->build_object(
565
            $builder->build_object( { class => 'Koha::Patrons', value => { branchcode => $library_2->id } } );
561
            { class => 'Koha::Patrons', value => { branchcode => $library_2->id } }
562
        );
563
566
564
        t::lib::Mocks::mock_userenv( { patron => $patron } );
567
        t::lib::Mocks::mock_userenv( { patron => $api_consumer } );
565
568
566
        is(
569
        my $visible_user  = $patron_1->to_api( { user => $api_consumer } );
567
            $patron_1->to_api( { user => $patron } )->{firstname}, $patron_1->firstname,
570
        my $redacted_user = $patron_2->to_api( { user => $api_consumer } );
568
            'Returns unredacted object hash'
571
569
        );
572
        foreach my $attr (@all_attrs) {
570
        is( $patron_2->to_api( { user => $patron } )->{firstname}, undef, 'Returns redacted object hash' );
573
            my $mapped = exists $mapping->{$attr} ? $mapping->{$attr} : $attr;
574
            if ( defined($mapped) ) {
575
                ok(
576
                    exists $visible_user->{$mapped},
577
                    "Mapped attribute '$attr' is present"
578
                );
579
                if ( exists $unredacted_attrs->{$attr} ) {
580
                    is(
581
                        $visible_user->{$mapped}, $patron_1->TO_JSON->{$attr},
582
                        "Unredacted attribute '$attr' is visible when user is accessible"
583
                    );
584
                    is(
585
                        $redacted_user->{$mapped}, $patron_2->TO_JSON->{$attr},
586
                        "Unredacted attribute '$attr' is visible when user is inaccessible"
587
                    );
588
                } else {
589
                    is(
590
                        $visible_user->{$mapped}, $patron_1->TO_JSON->{$attr},
591
                        "Redacted attribute '$attr' is visible when user is accessible"
592
                    );
593
                    is(
594
                        $redacted_user->{$mapped}, undef,
595
                        "Redacted attribute '$attr' is undefined when user is inaccessible"
596
                    );
597
                }
598
            } else {
599
                ok(
600
                    !exists $visible_user->{$attr},
601
                    "Mapped to null attribute '$attr' is not present when accessible"
602
                );
603
                ok(
604
                    !exists $redacted_user->{$attr},
605
                    "Mapped to null attribute '$attr' is not present when inaccessible"
606
                );
607
            }
608
        }
571
609
572
        $schema->storage->txn_rollback;
610
        $schema->storage->txn_rollback;
573
    };
611
    };
574
- 

Return to bug 29523