Bug 25045 - Add a way to restrict anonymous access to public routes (OpacPublic behaviour)
Summary: Add a way to restrict anonymous access to public routes (OpacPublic behaviour)
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Tomás Cohen Arazi
QA Contact: Jonathan Druart
URL:
Keywords:
Depends on: 22061 24862 24909
Blocks: 25327 25484
  Show dependency treegraph
 
Reported: 2020-04-02 14:55 UTC by Jonathan Druart
Modified: 2021-12-13 21:09 UTC (History)
11 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
This enhancement allows libraries to distinctly disable the OPAC but allow the public facing API's to be enabled. **New system preference**: `RESTPublicAnonymousRequests` defaults to enabled.
Version(s) released in:
20.05.00, 19.11.07


Attachments
Bug 25045: Add the RESTPublicAnonymousRequests syspref (3.39 KB, patch)
2020-04-13 14:50 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 25045: Unit tests (2.10 KB, patch)
2020-04-13 14:50 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 25045: Allow restricting anonymous requests on the public API (2.19 KB, patch)
2020-04-13 14:50 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 25045: (follow-up) Add a note to OpacPublic (1.34 KB, patch)
2020-04-13 14:50 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 25045: Add the RESTPublicAnonymousRequests syspref (3.46 KB, patch)
2020-04-24 11:07 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 25045: Unit tests (2.17 KB, patch)
2020-04-24 11:08 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 25045: Allow restricting anonymous requests on the public API (2.26 KB, patch)
2020-04-24 11:08 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 25045: (follow-up) Add a note to OpacPublic (1.41 KB, patch)
2020-04-24 11:08 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 25045: (QA follow-up) Fix note display on OpacPublic description (1.26 KB, patch)
2020-04-24 11:35 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 25045: Add the RESTPublicAnonymousRequests syspref (3.52 KB, patch)
2020-04-24 12:54 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 25045: Unit tests (2.22 KB, patch)
2020-04-24 12:54 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 25045: Allow restricting anonymous requests on the public API (2.32 KB, patch)
2020-04-24 12:54 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 25045: (follow-up) Add a note to OpacPublic (1.66 KB, patch)
2020-04-24 12:54 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 25045: (follow-up) Add the RESTPublicAnonymousRequests syspref (1.59 KB, patch)
2020-04-27 10:47 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 25045: (RM follow-up) Add the RESTPublicAnonymousRequests syspref (1.35 KB, patch)
2020-04-27 10:52 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 25045: (RM follow-up) Correction to updatedatebase.pl (1.29 KB, patch)
2020-04-27 12:42 UTC, Martin Renvoize
Details | Diff | Splinter Review
[19.11.x] Bug 25045: (follow-up) Fix typo adding the RESTPublicAnonymousRequests syspref (2.60 KB, patch)
2020-06-19 12:35 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
[19.11.x] Bug 25045: (follow-up) Fix typo adding the RESTPublicAnonymousRequests syspref (2.75 KB, patch)
2020-06-19 12:40 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2020-04-02 14:55:02 UTC
There is RESTPublicAPI to deal with that, but both are enabled by default.
One could think that turning OpacPublic off will make all the data non-accessible, but that's wrong.

Maybe we need a note on OpacPublic to explain the situation.
Comment 1 Tomás Cohen Arazi 2020-04-02 16:00:03 UTC
This was broadly discussed by the time this got implemented. The idea was that one could want the OPACDisabled, but enable the API for, say, using it from an external system, like a discovery tool like VuFind.

That said, I think we need to add a clear message on the OPACPublic syspref about the API, and probably an entry warning about !OPACPublic && RESTPublicAPI meaning the API is accessible.
Comment 2 Tomás Cohen Arazi 2020-04-02 17:32:30 UTC
Hmm, I got the OpacPublic behaviour wrong. This needs to be discussed in a dev meeting I belive.

OpacPublic doesn't disable the OPAC as I thought (based on my memories from the 'have an on/off switch for the API' discussion), but only allow interacting with it after there's a valid session.

We might need to develop some way to identify public routes that don't require a session. We don't have such routes yet, but worth considering as there are routes like the one for fetching records on the QA queue. We should add that to the agenda.
Comment 3 Tomás Cohen Arazi 2020-04-13 14:50:02 UTC
Created attachment 102846 [details] [review]
Bug 25045: Add the RESTPublicAnonymousRequests syspref
Comment 4 Tomás Cohen Arazi 2020-04-13 14:50:06 UTC
Created attachment 102847 [details] [review]
Bug 25045: Unit tests
Comment 5 Tomás Cohen Arazi 2020-04-13 14:50:11 UTC
Created attachment 102848 [details] [review]
Bug 25045: Allow restricting anonymous requests on the public API

This patch introduces a check on the authenticate_api_request method for
the RESTPublicAnonymousRequests system preference. If disabled,
anonymous  requests get rejected.

The idea is to replicate the homologous OpacPublic system preference
behaviour.

To test:
1. Apply the Unit tests patch
2. Run:
   $ kshell
  k$ prove t/db_dependent/api/v1/auth_authenticate_api_request.t
=> FAIL: Tests fail, 200 is answered instead of 401 on the route.
3. Apply this patch
4. Repeat 2.
=> SUCCESS: Tests pass!
5. Sign off :-D
Comment 6 Tomás Cohen Arazi 2020-04-13 14:50:16 UTC
Created attachment 102849 [details] [review]
Bug 25045: (follow-up) Add a note to OpacPublic

This patch tweaks the OpacPublic system preference description so users
don't expect, incorrectly, this syspref to disable the public API
anonymous access.
Comment 7 Tomás Cohen Arazi 2020-04-13 14:54:50 UTC
Any feedback on the wording is greatly appreciated.
Comment 8 Jonathan Druart 2020-04-14 09:12:05 UTC
Maybe that does not make sense but, don't you think we should make is_public mandatory in authenticate_api_request?

That would prevent a future call to forget it.
Comment 9 Jonathan Druart 2020-04-14 09:13:29 UTC
(In reply to Jonathan Druart from comment #8)
> Maybe that does not make sense but, don't you think we should make is_public
> mandatory in authenticate_api_request?
> 
> That would prevent a future call to forget it.

Scratch that, it does not make sense.
There won't be bad side-effects if it's not passed.
Comment 10 Jonathan Druart 2020-04-14 09:15:07 UTC
The "Note" does not appear in the syspref's description.
Comment 11 Kyle M Hall 2020-04-24 11:07:53 UTC
Created attachment 103651 [details] [review]
Bug 25045: Add the RESTPublicAnonymousRequests syspref

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 12 Kyle M Hall 2020-04-24 11:08:10 UTC
Created attachment 103652 [details] [review]
Bug 25045: Unit tests

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 13 Kyle M Hall 2020-04-24 11:08:14 UTC
Created attachment 103653 [details] [review]
Bug 25045: Allow restricting anonymous requests on the public API

This patch introduces a check on the authenticate_api_request method for
the RESTPublicAnonymousRequests system preference. If disabled,
anonymous  requests get rejected.

The idea is to replicate the homologous OpacPublic system preference
behaviour.

To test:
1. Apply the Unit tests patch
2. Run:
   $ kshell
  k$ prove t/db_dependent/api/v1/auth_authenticate_api_request.t
=> FAIL: Tests fail, 200 is answered instead of 401 on the route.
3. Apply this patch
4. Repeat 2.
=> SUCCESS: Tests pass!
5. Sign off :-D

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 14 Kyle M Hall 2020-04-24 11:08:18 UTC
Created attachment 103654 [details] [review]
Bug 25045: (follow-up) Add a note to OpacPublic

This patch tweaks the OpacPublic system preference description so users
don't expect, incorrectly, this syspref to disable the public API
anonymous access.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 15 Tomás Cohen Arazi 2020-04-24 11:35:30 UTC
Created attachment 103655 [details] [review]
Bug 25045: (QA follow-up) Fix note display on OpacPublic description

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 16 Jonathan Druart 2020-04-24 12:54:26 UTC
Created attachment 103675 [details] [review]
Bug 25045: Add the RESTPublicAnonymousRequests syspref

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 17 Jonathan Druart 2020-04-24 12:54:29 UTC
Created attachment 103676 [details] [review]
Bug 25045: Unit tests

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 18 Jonathan Druart 2020-04-24 12:54:33 UTC
Created attachment 103677 [details] [review]
Bug 25045: Allow restricting anonymous requests on the public API

This patch introduces a check on the authenticate_api_request method for
the RESTPublicAnonymousRequests system preference. If disabled,
anonymous  requests get rejected.

The idea is to replicate the homologous OpacPublic system preference
behaviour.

To test:
1. Apply the Unit tests patch
2. Run:
   $ kshell
  k$ prove t/db_dependent/api/v1/auth_authenticate_api_request.t
=> FAIL: Tests fail, 200 is answered instead of 401 on the route.
3. Apply this patch
4. Repeat 2.
=> SUCCESS: Tests pass!
5. Sign off :-D

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 19 Jonathan Druart 2020-04-24 12:54:37 UTC
Created attachment 103678 [details] [review]
Bug 25045: (follow-up) Add a note to OpacPublic

This patch tweaks the OpacPublic system preference description so users
don't expect, incorrectly, this syspref to disable the public API
anonymous access.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 25045: (QA follow-up) Fix note display on OpacPublic description

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 20 Martin Renvoize 2020-04-27 10:18:33 UTC
Nice work everyone!

Pushed to master for 20.05
Comment 21 Jonathan Druart 2020-04-27 10:47:59 UTC
Created attachment 103748 [details] [review]
Bug 25045: (follow-up) Add the RESTPublicAnonymousRequests syspref
Comment 22 Martin Renvoize 2020-04-27 10:52:11 UTC
Created attachment 103749 [details] [review]
Bug 25045: (RM follow-up) Add the RESTPublicAnonymousRequests syspref

The atomic update alos included a quoting mistake

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 23 Martin Renvoize 2020-04-27 10:52:27 UTC
Nice work everyone!

Pushed to master for 20.05
Comment 24 Martin Renvoize 2020-04-27 12:42:49 UTC
Created attachment 103773 [details] [review]
Bug 25045: (RM follow-up) Correction to updatedatebase.pl

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 25 Joy Nelson 2020-05-05 20:38:23 UTC
not backported to 19.11.x
Comment 26 Joy Nelson 2020-05-08 20:48:04 UTC
missing dependencies, not backported
Comment 27 David Cook 2020-06-17 03:13:54 UTC
Bug 24909 has been pushed now, so in theory this could be pushed too, although personally I'm not a huge fan of pushing database updates to stable releases...
Comment 28 Aleisha Amohia 2020-06-18 00:10:15 UTC
won't be backporting this to 19.11.x due to the db update.
Comment 29 Tomás Cohen Arazi 2020-06-18 02:24:22 UTC
(In reply to David Cook from comment #27)
> Bug 24909 has been pushed now, so in theory this could be pushed too,
> although personally I'm not a huge fan of pushing database updates to stable
> releases...

This one is basically a syspref. Database structure changes are the problematic ones.
Comment 30 David Cook 2020-06-18 02:35:57 UTC
(In reply to Tomás Cohen Arazi from comment #29)
> (In reply to David Cook from comment #27)
> > Bug 24909 has been pushed now, so in theory this could be pushed too,
> > although personally I'm not a huge fan of pushing database updates to stable
> > releases...
> 
> This one is basically a syspref. Database structure changes are the
> problematic ones.

That's a good point! I admit that I didn't drill down into the patches to examine. I just saw the updatedatabase.pl in the description and got anxious. 

I run a lot of 19.11 instances, and I would love to see this backported. 

I withdraw my earlier objection.
Comment 31 Aleisha Amohia 2020-06-18 21:34:44 UTC
I have tried to apply but tests fail on my devbox for 19.11.x.

$ prove -v t/db_dependent/api/v1/auth_authenticate_api_request.t 
t/db_dependent/api/v1/auth_authenticate_api_request.t .. 
1..3
# Subtest: token-based tests
    1..10
[2020-06-19 09:33:05.84026] [12653] [debug] POST "/api/v1/oauth/token" (5ef232ce)
[2020-06-19 09:33:05.84638] [12653] [debug] Routing to controller "Koha::REST::V1::Auth" and action "under"
[2020-06-19 09:33:05.84791] [12653] [debug] Routing to controller "Koha::REST::V1::OAuth" and action "token"
[2020-06-19 09:33:05.86256] [12653] [debug] 200 OK (0.022287s, 44.869/s)
    ok 1 - POST /api/v1/oauth/token
    ok 2 - 200 OK
    ok 3 - exact match for JSON Pointer "/expires_in"
    ok 4 - exact match for JSON Pointer "/token_type"
    ok 5 - has value for JSON Pointer "/access_token"
[2020-06-19 09:33:05.86597] [12653] [debug] GET "/api/v1/patrons" (01e901a8)
[2020-06-19 09:33:05.86677] [12653] [debug] Routing to controller "Koha::REST::V1::Auth" and action "under"
[2020-06-19 09:33:05.88419] [12653] [debug] Routing to controller "Koha::REST::V1::Patrons" and action "list"
[2020-06-19 09:33:06.11926] [12653] [debug] 200 OK (0.253264s, 3.948/s)
    ok 6 - GET /api/v1/patrons
    ok 7 - 200 OK
    ok 8 - The 'koha.user' object is defined in the stash
    ok 9 - Stashed koha.user object type is Koha::Patron
    ok 10 - The stashed user is the right one
ok 1 - token-based tests
# Subtest: cookie-based tests
    1..5
[2020-06-19 09:33:06.29506] [12653] [debug] GET "/api/v1/patrons" (4f027938)
[2020-06-19 09:33:06.29565] [12653] [debug] Routing to controller "Koha::REST::V1::Auth" and action "under"
[2020-06-19 09:33:06.29736] [12653] [debug] 503 Service Unavailable (0.00229s, 436.681/s)
    ok 1 - GET /api/v1/patrons
    not ok 2 - 200 OK

    #   Failed test '200 OK'
    #   at t/db_dependent/api/v1/auth_authenticate_api_request.t line 112.
    #          got: '503'
    #     expected: '200'
    not ok 3 - The 'koha.user' object is defined in the stash

    #   Failed test 'The 'koha.user' object is defined in the stash'
    #   at t/db_dependent/api/v1/auth_authenticate_api_request.t line 115.
    # Looks like you planned 5 tests but ran 3.
    # Looks like you failed 2 tests of 3 run.
not ok 2 - cookie-based tests

#   Failed test 'cookie-based tests'
#   at t/db_dependent/api/v1/auth_authenticate_api_request.t line 120.
# Subtest: anonymous requests to public API
    1..4
[2020-06-19 09:33:06.54596] [12653] [debug] GET "/api/v1/public/biblios/3" (1a0aa1cd)
[2020-06-19 09:33:06.54737] [12653] [debug] Routing to controller "Koha::REST::V1::Auth" and action "under"
[2020-06-19 09:33:06.54867] [12653] [debug] 503 Service Unavailable (0.002694s, 371.195/s)
    ok 1 - GET /api/v1/public/biblios/3
    not ok 2 - Unauthorized anonymous attempt to access a resource

    #   Failed test 'Unauthorized anonymous attempt to access a resource'
    #   at t/db_dependent/api/v1/auth_authenticate_api_request.t line 143.
    #          got: '503'
    #     expected: '401'
[2020-06-19 09:33:06.55176] [12653] [debug] GET "/api/v1/public/biblios/3" (ece5c188)
[2020-06-19 09:33:06.55231] [12653] [debug] Routing to controller "Koha::REST::V1::Auth" and action "under"
[2020-06-19 09:33:06.55343] [12653] [debug] 503 Service Unavailable (0.001661s, 602.047/s)
    ok 3 - GET /api/v1/public/biblios/3
    not ok 4 - Successfull anonymous access to a resource

    #   Failed test 'Successfull anonymous access to a resource'
    #   at t/db_dependent/api/v1/auth_authenticate_api_request.t line 149.
    #          got: '503'
    #     expected: '200'
    # Looks like you failed 2 tests of 4.
not ok 3 - anonymous requests to public API

#   Failed test 'anonymous requests to public API'
#   at t/db_dependent/api/v1/auth_authenticate_api_request.t line 153.
# Looks like you failed 2 tests of 3.
Dubious, test returned 2 (wstat 512, 0x200)
Failed 2/3 subtests 

Test Summary Report
-------------------
t/db_dependent/api/v1/auth_authenticate_api_request.t (Wstat: 512 Tests: 3 Failed: 2)
  Failed tests:  2-3
  Non-zero exit status: 2
Files=1, Tests=3,  8 wallclock secs ( 0.02 usr  0.01 sys +  3.77 cusr  1.14 csys =  4.94 CPU)
Result: FAIL

Please fix up and I will backport!
Comment 32 Tomás Cohen Arazi 2020-06-18 21:42:06 UTC
(In reply to Aleisha Amohia from comment #31)
> I have tried to apply but tests fail on my devbox for 19.11.x.
> 
> $ prove -v t/db_dependent/api/v1/auth_authenticate_api_request.t 
> t/db_dependent/api/v1/auth_authenticate_api_request.t .. 
> 1..3
> # Subtest: token-based tests
>     1..10
> [2020-06-19 09:33:05.84026] [12653] [debug] POST "/api/v1/oauth/token"
> (5ef232ce)
> [2020-06-19 09:33:05.84638] [12653] [debug] Routing to controller
> "Koha::REST::V1::Auth" and action "under"
> [2020-06-19 09:33:05.84791] [12653] [debug] Routing to controller
> "Koha::REST::V1::OAuth" and action "token"
> [2020-06-19 09:33:05.86256] [12653] [debug] 200 OK (0.022287s, 44.869/s)
>     ok 1 - POST /api/v1/oauth/token
>     ok 2 - 200 OK
>     ok 3 - exact match for JSON Pointer "/expires_in"
>     ok 4 - exact match for JSON Pointer "/token_type"
>     ok 5 - has value for JSON Pointer "/access_token"
> [2020-06-19 09:33:05.86597] [12653] [debug] GET "/api/v1/patrons" (01e901a8)
> [2020-06-19 09:33:05.86677] [12653] [debug] Routing to controller
> "Koha::REST::V1::Auth" and action "under"
> [2020-06-19 09:33:05.88419] [12653] [debug] Routing to controller
> "Koha::REST::V1::Patrons" and action "list"
> [2020-06-19 09:33:06.11926] [12653] [debug] 200 OK (0.253264s, 3.948/s)
>     ok 6 - GET /api/v1/patrons
>     ok 7 - 200 OK
>     ok 8 - The 'koha.user' object is defined in the stash
>     ok 9 - Stashed koha.user object type is Koha::Patron
>     ok 10 - The stashed user is the right one
> ok 1 - token-based tests
> # Subtest: cookie-based tests
>     1..5
> [2020-06-19 09:33:06.29506] [12653] [debug] GET "/api/v1/patrons" (4f027938)
> [2020-06-19 09:33:06.29565] [12653] [debug] Routing to controller
> "Koha::REST::V1::Auth" and action "under"
> [2020-06-19 09:33:06.29736] [12653] [debug] 503 Service Unavailable
> (0.00229s, 436.681/s)
>     ok 1 - GET /api/v1/patrons
>     not ok 2 - 200 OK
> 
>     #   Failed test '200 OK'
>     #   at t/db_dependent/api/v1/auth_authenticate_api_request.t line 112.
>     #          got: '503'
>     #     expected: '200'
>     not ok 3 - The 'koha.user' object is defined in the stash
> 
>     #   Failed test 'The 'koha.user' object is defined in the stash'
>     #   at t/db_dependent/api/v1/auth_authenticate_api_request.t line 115.
>     # Looks like you planned 5 tests but ran 3.
>     # Looks like you failed 2 tests of 3 run.
> not ok 2 - cookie-based tests
> 
> #   Failed test 'cookie-based tests'
> #   at t/db_dependent/api/v1/auth_authenticate_api_request.t line 120.
> # Subtest: anonymous requests to public API
>     1..4
> [2020-06-19 09:33:06.54596] [12653] [debug] GET "/api/v1/public/biblios/3"
> (1a0aa1cd)
> [2020-06-19 09:33:06.54737] [12653] [debug] Routing to controller
> "Koha::REST::V1::Auth" and action "under"
> [2020-06-19 09:33:06.54867] [12653] [debug] 503 Service Unavailable
> (0.002694s, 371.195/s)
>     ok 1 - GET /api/v1/public/biblios/3
>     not ok 2 - Unauthorized anonymous attempt to access a resource
> 
>     #   Failed test 'Unauthorized anonymous attempt to access a resource'
>     #   at t/db_dependent/api/v1/auth_authenticate_api_request.t line 143.
>     #          got: '503'
>     #     expected: '401'
> [2020-06-19 09:33:06.55176] [12653] [debug] GET "/api/v1/public/biblios/3"
> (ece5c188)
> [2020-06-19 09:33:06.55231] [12653] [debug] Routing to controller
> "Koha::REST::V1::Auth" and action "under"
> [2020-06-19 09:33:06.55343] [12653] [debug] 503 Service Unavailable
> (0.001661s, 602.047/s)
>     ok 3 - GET /api/v1/public/biblios/3
>     not ok 4 - Successfull anonymous access to a resource
> 
>     #   Failed test 'Successfull anonymous access to a resource'
>     #   at t/db_dependent/api/v1/auth_authenticate_api_request.t line 149.
>     #          got: '503'
>     #     expected: '200'
>     # Looks like you failed 2 tests of 4.
> not ok 3 - anonymous requests to public API
> 
> #   Failed test 'anonymous requests to public API'
> #   at t/db_dependent/api/v1/auth_authenticate_api_request.t line 153.
> # Looks like you failed 2 tests of 3.
> Dubious, test returned 2 (wstat 512, 0x200)
> Failed 2/3 subtests 
> 
> Test Summary Report
> -------------------
> t/db_dependent/api/v1/auth_authenticate_api_request.t (Wstat: 512 Tests: 3
> Failed: 2)
>   Failed tests:  2-3
>   Non-zero exit status: 2
> Files=1, Tests=3,  8 wallclock secs ( 0.02 usr  0.01 sys +  3.77 cusr  1.14
> csys =  4.94 CPU)
> Result: FAIL
> 
> Please fix up and I will backport!

I'll do it tomorrow
Comment 33 Tomás Cohen Arazi 2020-06-19 12:35:28 UTC
Created attachment 106080 [details] [review]
[19.11.x] Bug 25045: (follow-up) Fix typo adding the RESTPublicAnonymousRequests syspref
Comment 34 Tomás Cohen Arazi 2020-06-19 12:40:48 UTC
Created attachment 106081 [details] [review]
[19.11.x] Bug 25045: (follow-up) Fix typo adding the RESTPublicAnonymousRequests syspref
Comment 35 Tomás Cohen Arazi 2020-06-19 13:06:36 UTC
Aleisha, in this case it is all patches, including the last patch that specifically targets 19.11.x.
Comment 36 Aleisha Amohia 2020-06-21 22:28:38 UTC
backported to 19.11.x for 19.11.07
Comment 37 Victor Grousset/tuxayo 2020-07-02 22:27:13 UTC
Missing dependencies for 19.05.x, can't backport.

Not sure I understand the details actually. Help need to analyze if someone with a 19.05.x would like this. Keep in mind that it's oldoldstable though so no guarantees.
Comment 38 Tomás Cohen Arazi 2020-07-02 22:40:07 UTC
There are no anonymous access public routes in 19.05. So not needed.
Comment 39 Victor Grousset/tuxayo 2020-07-03 06:10:40 UTC
Thanks! :)