The main goal here is to be able to make some fields/properties/columns "non public" to unauthorized people ( permission => catalogue ) by setting a "x-public" key to false in Swagger definitions files. Patch is coming...
Created attachment 72891 [details] [review] Bug 20407 - REST API: Ability to hide fields from unauthorized users Test plan: - apply this patch, - edit api/v1/swagger/definitions/city.json, - remove the keys "country" and "postal_code" from required, - add a key "x-public": false for country and postal_code "postal_code": { "description": "city postal code", "type": ["string", "null"], "x-public": false }, "country": { "description": "city country", "type": ["string", "null"], "x-public": false } - logout from Koha and go to api/v1/cities, - you should not see country and postal_code, - login to Koha and refresh api/v1/cities, - you should see country and postal_code
Created attachment 72982 [details] [review] Bug 20407 - REST API: Ability to hide fields from unauthorized users Test plan: - apply this patch, - edit api/v1/swagger/definitions/city.json, - remove the keys "country" and "postal_code" from required, - add a key "x-public": false for country and postal_code "postal_code": { "description": "city postal code", "type": ["string", "null"], "x-public": false }, "country": { "description": "city country", "type": ["string", "null"], "x-public": false } - logout from Koha and go to api/v1/cities, - you should not see country and postal_code, - login to Koha and refresh api/v1/cities, - you should see country and postal_code NOTE: Make sure to go to Koha administration and add cities before testing. Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
The slightly more accepted way of doing this to date that I have seen is to reduce the default response to only contain public fields and set the private fields to need explicitly requesting in the api call. This way, rather than sending back a 200 with varying content you send back either a 200 with what the consumer has asked for (or is expecting) or you send back a 401 Unauthorized and the client knows to authenticate). The principle of Least Surprise. I do like the x-public way of defining it in the spec though.. :)
On a recent dev meeting it was voted to have a separate namespace (/public) for public facing endpoints. So while the logic here is valuable, this bug won't see progress as-is.
We implemented the separate /public namespace already.