From f735648d33c79156ed284d160dbe77f39b49c70d Mon Sep 17 00:00:00 2001 From: Alex Arnaud Date: Wed, 14 Mar 2018 16:30:06 +0000 Subject: [PATCH] Bug 20407 - REST API: Ability to hide fields from unauthorized users Test plan: - apply this patch, - edit api/v1/swagger/definitions/city.json, - remove the keys "country" and "postal_code" from required, - add a key "x-public": false for country and postal_code "postal_code": { "description": "city postal code", "type": ["string", "null"], "x-public": false }, "country": { "description": "city country", "type": ["string", "null"], "x-public": false } - logout from Koha and go to api/v1/cities, - you should not see country and postal_code, - login to Koha and refresh api/v1/cities, - you should see country and postal_code Signed-off-by: Mark Tompsett --- Koha/REST/Plugin/Objects.pm | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/Koha/REST/Plugin/Objects.pm b/Koha/REST/Plugin/Objects.pm index 3653f91..6e63c03 100644 --- a/Koha/REST/Plugin/Objects.pm +++ b/Koha/REST/Plugin/Objects.pm @@ -91,11 +91,26 @@ sub register { }); } - my @objects_list = map { - ( defined $to_api ) - ? $to_api->( $_->TO_JSON ) - : $_->TO_JSON - } $objects->as_list; + my $spec = $c->openapi->spec(); + my $properties = $spec->{responses}{200}{schema}{items}{properties}; + + my $user = $c->stash('koha.user'); + my @hidden_properties; + unless ( $user && $user->has_permission({ catalogue => 1 }) ) { + foreach my $property ( keys %$properties ) { + if ( defined( $properties->{ $property }{'x-public'} ) + && !$properties->{ $property }{'x-public'}) { + push @hidden_properties, $property; + } + } + } + + my @objects_list; + foreach my $o ( @{ $objects->as_list } ) { + my $json = defined($to_api) ? $to_api->( $o->TO_JSON ) : $o->TO_JSON; + delete @{ $json }{ @hidden_properties }; + push @objects_list, $json; + } return \@objects_list; } -- 2.1.4