There is RESTPublicAPI to deal with that, but both are enabled by default. One could think that turning OpacPublic off will make all the data non-accessible, but that's wrong. Maybe we need a note on OpacPublic to explain the situation.
This was broadly discussed by the time this got implemented. The idea was that one could want the OPACDisabled, but enable the API for, say, using it from an external system, like a discovery tool like VuFind. That said, I think we need to add a clear message on the OPACPublic syspref about the API, and probably an entry warning about !OPACPublic && RESTPublicAPI meaning the API is accessible.
Hmm, I got the OpacPublic behaviour wrong. This needs to be discussed in a dev meeting I belive. OpacPublic doesn't disable the OPAC as I thought (based on my memories from the 'have an on/off switch for the API' discussion), but only allow interacting with it after there's a valid session. We might need to develop some way to identify public routes that don't require a session. We don't have such routes yet, but worth considering as there are routes like the one for fetching records on the QA queue. We should add that to the agenda.
Created attachment 102846 [details] [review] Bug 25045: Add the RESTPublicAnonymousRequests syspref
Created attachment 102847 [details] [review] Bug 25045: Unit tests
Created attachment 102848 [details] [review] Bug 25045: Allow restricting anonymous requests on the public API This patch introduces a check on the authenticate_api_request method for the RESTPublicAnonymousRequests system preference. If disabled, anonymous requests get rejected. The idea is to replicate the homologous OpacPublic system preference behaviour. To test: 1. Apply the Unit tests patch 2. Run: $ kshell k$ prove t/db_dependent/api/v1/auth_authenticate_api_request.t => FAIL: Tests fail, 200 is answered instead of 401 on the route. 3. Apply this patch 4. Repeat 2. => SUCCESS: Tests pass! 5. Sign off :-D
Created attachment 102849 [details] [review] Bug 25045: (follow-up) Add a note to OpacPublic This patch tweaks the OpacPublic system preference description so users don't expect, incorrectly, this syspref to disable the public API anonymous access.
Any feedback on the wording is greatly appreciated.
Maybe that does not make sense but, don't you think we should make is_public mandatory in authenticate_api_request? That would prevent a future call to forget it.
(In reply to Jonathan Druart from comment #8) > Maybe that does not make sense but, don't you think we should make is_public > mandatory in authenticate_api_request? > > That would prevent a future call to forget it. Scratch that, it does not make sense. There won't be bad side-effects if it's not passed.
The "Note" does not appear in the syspref's description.
Created attachment 103651 [details] [review] Bug 25045: Add the RESTPublicAnonymousRequests syspref Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Created attachment 103652 [details] [review] Bug 25045: Unit tests Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Created attachment 103653 [details] [review] Bug 25045: Allow restricting anonymous requests on the public API This patch introduces a check on the authenticate_api_request method for the RESTPublicAnonymousRequests system preference. If disabled, anonymous requests get rejected. The idea is to replicate the homologous OpacPublic system preference behaviour. To test: 1. Apply the Unit tests patch 2. Run: $ kshell k$ prove t/db_dependent/api/v1/auth_authenticate_api_request.t => FAIL: Tests fail, 200 is answered instead of 401 on the route. 3. Apply this patch 4. Repeat 2. => SUCCESS: Tests pass! 5. Sign off :-D Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Created attachment 103654 [details] [review] Bug 25045: (follow-up) Add a note to OpacPublic This patch tweaks the OpacPublic system preference description so users don't expect, incorrectly, this syspref to disable the public API anonymous access. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Created attachment 103655 [details] [review] Bug 25045: (QA follow-up) Fix note display on OpacPublic description Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Created attachment 103675 [details] [review] Bug 25045: Add the RESTPublicAnonymousRequests syspref Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 103676 [details] [review] Bug 25045: Unit tests Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 103677 [details] [review] Bug 25045: Allow restricting anonymous requests on the public API This patch introduces a check on the authenticate_api_request method for the RESTPublicAnonymousRequests system preference. If disabled, anonymous requests get rejected. The idea is to replicate the homologous OpacPublic system preference behaviour. To test: 1. Apply the Unit tests patch 2. Run: $ kshell k$ prove t/db_dependent/api/v1/auth_authenticate_api_request.t => FAIL: Tests fail, 200 is answered instead of 401 on the route. 3. Apply this patch 4. Repeat 2. => SUCCESS: Tests pass! 5. Sign off :-D Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 103678 [details] [review] Bug 25045: (follow-up) Add a note to OpacPublic This patch tweaks the OpacPublic system preference description so users don't expect, incorrectly, this syspref to disable the public API anonymous access. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Bug 25045: (QA follow-up) Fix note display on OpacPublic description Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Nice work everyone! Pushed to master for 20.05
Created attachment 103748 [details] [review] Bug 25045: (follow-up) Add the RESTPublicAnonymousRequests syspref
Created attachment 103749 [details] [review] Bug 25045: (RM follow-up) Add the RESTPublicAnonymousRequests syspref The atomic update alos included a quoting mistake Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Created attachment 103773 [details] [review] Bug 25045: (RM follow-up) Correction to updatedatebase.pl Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
not backported to 19.11.x
missing dependencies, not backported
Bug 24909 has been pushed now, so in theory this could be pushed too, although personally I'm not a huge fan of pushing database updates to stable releases...
won't be backporting this to 19.11.x due to the db update.
(In reply to David Cook from comment #27) > Bug 24909 has been pushed now, so in theory this could be pushed too, > although personally I'm not a huge fan of pushing database updates to stable > releases... This one is basically a syspref. Database structure changes are the problematic ones.
(In reply to Tomás Cohen Arazi from comment #29) > (In reply to David Cook from comment #27) > > Bug 24909 has been pushed now, so in theory this could be pushed too, > > although personally I'm not a huge fan of pushing database updates to stable > > releases... > > This one is basically a syspref. Database structure changes are the > problematic ones. That's a good point! I admit that I didn't drill down into the patches to examine. I just saw the updatedatabase.pl in the description and got anxious. I run a lot of 19.11 instances, and I would love to see this backported. I withdraw my earlier objection.
I have tried to apply but tests fail on my devbox for 19.11.x. $ prove -v t/db_dependent/api/v1/auth_authenticate_api_request.t t/db_dependent/api/v1/auth_authenticate_api_request.t .. 1..3 # Subtest: token-based tests 1..10 [2020-06-19 09:33:05.84026] [12653] [debug] POST "/api/v1/oauth/token" (5ef232ce) [2020-06-19 09:33:05.84638] [12653] [debug] Routing to controller "Koha::REST::V1::Auth" and action "under" [2020-06-19 09:33:05.84791] [12653] [debug] Routing to controller "Koha::REST::V1::OAuth" and action "token" [2020-06-19 09:33:05.86256] [12653] [debug] 200 OK (0.022287s, 44.869/s) ok 1 - POST /api/v1/oauth/token ok 2 - 200 OK ok 3 - exact match for JSON Pointer "/expires_in" ok 4 - exact match for JSON Pointer "/token_type" ok 5 - has value for JSON Pointer "/access_token" [2020-06-19 09:33:05.86597] [12653] [debug] GET "/api/v1/patrons" (01e901a8) [2020-06-19 09:33:05.86677] [12653] [debug] Routing to controller "Koha::REST::V1::Auth" and action "under" [2020-06-19 09:33:05.88419] [12653] [debug] Routing to controller "Koha::REST::V1::Patrons" and action "list" [2020-06-19 09:33:06.11926] [12653] [debug] 200 OK (0.253264s, 3.948/s) ok 6 - GET /api/v1/patrons ok 7 - 200 OK ok 8 - The 'koha.user' object is defined in the stash ok 9 - Stashed koha.user object type is Koha::Patron ok 10 - The stashed user is the right one ok 1 - token-based tests # Subtest: cookie-based tests 1..5 [2020-06-19 09:33:06.29506] [12653] [debug] GET "/api/v1/patrons" (4f027938) [2020-06-19 09:33:06.29565] [12653] [debug] Routing to controller "Koha::REST::V1::Auth" and action "under" [2020-06-19 09:33:06.29736] [12653] [debug] 503 Service Unavailable (0.00229s, 436.681/s) ok 1 - GET /api/v1/patrons not ok 2 - 200 OK # Failed test '200 OK' # at t/db_dependent/api/v1/auth_authenticate_api_request.t line 112. # got: '503' # expected: '200' not ok 3 - The 'koha.user' object is defined in the stash # Failed test 'The 'koha.user' object is defined in the stash' # at t/db_dependent/api/v1/auth_authenticate_api_request.t line 115. # Looks like you planned 5 tests but ran 3. # Looks like you failed 2 tests of 3 run. not ok 2 - cookie-based tests # Failed test 'cookie-based tests' # at t/db_dependent/api/v1/auth_authenticate_api_request.t line 120. # Subtest: anonymous requests to public API 1..4 [2020-06-19 09:33:06.54596] [12653] [debug] GET "/api/v1/public/biblios/3" (1a0aa1cd) [2020-06-19 09:33:06.54737] [12653] [debug] Routing to controller "Koha::REST::V1::Auth" and action "under" [2020-06-19 09:33:06.54867] [12653] [debug] 503 Service Unavailable (0.002694s, 371.195/s) ok 1 - GET /api/v1/public/biblios/3 not ok 2 - Unauthorized anonymous attempt to access a resource # Failed test 'Unauthorized anonymous attempt to access a resource' # at t/db_dependent/api/v1/auth_authenticate_api_request.t line 143. # got: '503' # expected: '401' [2020-06-19 09:33:06.55176] [12653] [debug] GET "/api/v1/public/biblios/3" (ece5c188) [2020-06-19 09:33:06.55231] [12653] [debug] Routing to controller "Koha::REST::V1::Auth" and action "under" [2020-06-19 09:33:06.55343] [12653] [debug] 503 Service Unavailable (0.001661s, 602.047/s) ok 3 - GET /api/v1/public/biblios/3 not ok 4 - Successfull anonymous access to a resource # Failed test 'Successfull anonymous access to a resource' # at t/db_dependent/api/v1/auth_authenticate_api_request.t line 149. # got: '503' # expected: '200' # Looks like you failed 2 tests of 4. not ok 3 - anonymous requests to public API # Failed test 'anonymous requests to public API' # at t/db_dependent/api/v1/auth_authenticate_api_request.t line 153. # Looks like you failed 2 tests of 3. Dubious, test returned 2 (wstat 512, 0x200) Failed 2/3 subtests Test Summary Report ------------------- t/db_dependent/api/v1/auth_authenticate_api_request.t (Wstat: 512 Tests: 3 Failed: 2) Failed tests: 2-3 Non-zero exit status: 2 Files=1, Tests=3, 8 wallclock secs ( 0.02 usr 0.01 sys + 3.77 cusr 1.14 csys = 4.94 CPU) Result: FAIL Please fix up and I will backport!
(In reply to Aleisha Amohia from comment #31) > I have tried to apply but tests fail on my devbox for 19.11.x. > > $ prove -v t/db_dependent/api/v1/auth_authenticate_api_request.t > t/db_dependent/api/v1/auth_authenticate_api_request.t .. > 1..3 > # Subtest: token-based tests > 1..10 > [2020-06-19 09:33:05.84026] [12653] [debug] POST "/api/v1/oauth/token" > (5ef232ce) > [2020-06-19 09:33:05.84638] [12653] [debug] Routing to controller > "Koha::REST::V1::Auth" and action "under" > [2020-06-19 09:33:05.84791] [12653] [debug] Routing to controller > "Koha::REST::V1::OAuth" and action "token" > [2020-06-19 09:33:05.86256] [12653] [debug] 200 OK (0.022287s, 44.869/s) > ok 1 - POST /api/v1/oauth/token > ok 2 - 200 OK > ok 3 - exact match for JSON Pointer "/expires_in" > ok 4 - exact match for JSON Pointer "/token_type" > ok 5 - has value for JSON Pointer "/access_token" > [2020-06-19 09:33:05.86597] [12653] [debug] GET "/api/v1/patrons" (01e901a8) > [2020-06-19 09:33:05.86677] [12653] [debug] Routing to controller > "Koha::REST::V1::Auth" and action "under" > [2020-06-19 09:33:05.88419] [12653] [debug] Routing to controller > "Koha::REST::V1::Patrons" and action "list" > [2020-06-19 09:33:06.11926] [12653] [debug] 200 OK (0.253264s, 3.948/s) > ok 6 - GET /api/v1/patrons > ok 7 - 200 OK > ok 8 - The 'koha.user' object is defined in the stash > ok 9 - Stashed koha.user object type is Koha::Patron > ok 10 - The stashed user is the right one > ok 1 - token-based tests > # Subtest: cookie-based tests > 1..5 > [2020-06-19 09:33:06.29506] [12653] [debug] GET "/api/v1/patrons" (4f027938) > [2020-06-19 09:33:06.29565] [12653] [debug] Routing to controller > "Koha::REST::V1::Auth" and action "under" > [2020-06-19 09:33:06.29736] [12653] [debug] 503 Service Unavailable > (0.00229s, 436.681/s) > ok 1 - GET /api/v1/patrons > not ok 2 - 200 OK > > # Failed test '200 OK' > # at t/db_dependent/api/v1/auth_authenticate_api_request.t line 112. > # got: '503' > # expected: '200' > not ok 3 - The 'koha.user' object is defined in the stash > > # Failed test 'The 'koha.user' object is defined in the stash' > # at t/db_dependent/api/v1/auth_authenticate_api_request.t line 115. > # Looks like you planned 5 tests but ran 3. > # Looks like you failed 2 tests of 3 run. > not ok 2 - cookie-based tests > > # Failed test 'cookie-based tests' > # at t/db_dependent/api/v1/auth_authenticate_api_request.t line 120. > # Subtest: anonymous requests to public API > 1..4 > [2020-06-19 09:33:06.54596] [12653] [debug] GET "/api/v1/public/biblios/3" > (1a0aa1cd) > [2020-06-19 09:33:06.54737] [12653] [debug] Routing to controller > "Koha::REST::V1::Auth" and action "under" > [2020-06-19 09:33:06.54867] [12653] [debug] 503 Service Unavailable > (0.002694s, 371.195/s) > ok 1 - GET /api/v1/public/biblios/3 > not ok 2 - Unauthorized anonymous attempt to access a resource > > # Failed test 'Unauthorized anonymous attempt to access a resource' > # at t/db_dependent/api/v1/auth_authenticate_api_request.t line 143. > # got: '503' > # expected: '401' > [2020-06-19 09:33:06.55176] [12653] [debug] GET "/api/v1/public/biblios/3" > (ece5c188) > [2020-06-19 09:33:06.55231] [12653] [debug] Routing to controller > "Koha::REST::V1::Auth" and action "under" > [2020-06-19 09:33:06.55343] [12653] [debug] 503 Service Unavailable > (0.001661s, 602.047/s) > ok 3 - GET /api/v1/public/biblios/3 > not ok 4 - Successfull anonymous access to a resource > > # Failed test 'Successfull anonymous access to a resource' > # at t/db_dependent/api/v1/auth_authenticate_api_request.t line 149. > # got: '503' > # expected: '200' > # Looks like you failed 2 tests of 4. > not ok 3 - anonymous requests to public API > > # Failed test 'anonymous requests to public API' > # at t/db_dependent/api/v1/auth_authenticate_api_request.t line 153. > # Looks like you failed 2 tests of 3. > Dubious, test returned 2 (wstat 512, 0x200) > Failed 2/3 subtests > > Test Summary Report > ------------------- > t/db_dependent/api/v1/auth_authenticate_api_request.t (Wstat: 512 Tests: 3 > Failed: 2) > Failed tests: 2-3 > Non-zero exit status: 2 > Files=1, Tests=3, 8 wallclock secs ( 0.02 usr 0.01 sys + 3.77 cusr 1.14 > csys = 4.94 CPU) > Result: FAIL > > Please fix up and I will backport! I'll do it tomorrow
Created attachment 106080 [details] [review] [19.11.x] Bug 25045: (follow-up) Fix typo adding the RESTPublicAnonymousRequests syspref
Created attachment 106081 [details] [review] [19.11.x] Bug 25045: (follow-up) Fix typo adding the RESTPublicAnonymousRequests syspref
Aleisha, in this case it is all patches, including the last patch that specifically targets 19.11.x.
backported to 19.11.x for 19.11.07
Missing dependencies for 19.05.x, can't backport. Not sure I understand the details actually. Help need to analyze if someone with a 19.05.x would like this. Keep in mind that it's oldoldstable though so no guarantees.
There are no anonymous access public routes in 19.05. So not needed.
Thanks! :)