On matser, when I try to visit the API spec: http://localhost:8080/api/v1/.html http://localhost:8081/api/v1/.html I get an error: error "Authentication failure."
This is caused by bug 25045. Do you think the spec should be subject to this check? Or always available? I vote for the latter, just gathering opinions while I write the solution.
Always available makes sense to me.
Created attachment 104318 [details] [review] Bug 25327: Regression tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Created attachment 104319 [details] [review] Bug 25327: Do not call authenticate_api_request to render the spec The original code for Koha::REST::V1::Auth::under called authenticate_api_request when requesting the API spec. This didn't make sense, and recent changes on what conditions are tested for public routes, broke the route. We could add another condition, but it really doesn't make sense to call authenticate_api_request if it should be publicly available in any configuration, as discussed on the bug. This patch adds a trivial check and the requested route, and lets the request through in any case in 'under'. To test: 1. Point your browser to: http://kohadev.myDNSname.org:8080/api/v1/ http://kohadev.myDNSname.org:8080/api/v1/.html => FAIL: In both cases you get an authorization error. 2. Apply the regression tests patch 3. Run: $ kshell k$ prove t/db_dependent/api/v1/auth.t => FAIL: The tests reflect the situation, and fail 4. Apply this patch 5. Repeat 1 and 3 => SUCCESS: All good! 6. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Created attachment 104489 [details] [review] Bug 25327: Regression tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Created attachment 104490 [details] [review] Bug 25327: Do not call authenticate_api_request to render the spec The original code for Koha::REST::V1::Auth::under called authenticate_api_request when requesting the API spec. This didn't make sense, and recent changes on what conditions are tested for public routes, broke the route. We could add another condition, but it really doesn't make sense to call authenticate_api_request if it should be publicly available in any configuration, as discussed on the bug. This patch adds a trivial check and the requested route, and lets the request through in any case in 'under'. To test: 1. Point your browser to: http://kohadev.myDNSname.org:8080/api/v1/ http://kohadev.myDNSname.org:8080/api/v1/.html => FAIL: In both cases you get an authorization error. 2. Apply the regression tests patch 3. Run: $ kshell k$ prove t/db_dependent/api/v1/auth.t => FAIL: The tests reflect the situation, and fail 4. Apply this patch 5. Repeat 1 and 3 => SUCCESS: All good! 6. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Created attachment 104494 [details] [review] Bug 25327: Regression tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 104495 [details] [review] Bug 25327: Do not call authenticate_api_request to render the spec The original code for Koha::REST::V1::Auth::under called authenticate_api_request when requesting the API spec. This didn't make sense, and recent changes on what conditions are tested for public routes, broke the route. We could add another condition, but it really doesn't make sense to call authenticate_api_request if it should be publicly available in any configuration, as discussed on the bug. This patch adds a trivial check and the requested route, and lets the request through in any case in 'under'. To test: 1. Point your browser to: http://kohadev.myDNSname.org:8080/api/v1/ http://kohadev.myDNSname.org:8080/api/v1/.html => FAIL: In both cases you get an authorization error. 2. Apply the regression tests patch 3. Run: $ kshell k$ prove t/db_dependent/api/v1/auth.t => FAIL: The tests reflect the situation, and fail 4. Apply this patch 5. Repeat 1 and 3 => SUCCESS: All good! 6. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Nice work everyone! Pushed to master for 20.05
not backported to 19.11 - missing dependencies
Created attachment 106082 [details] [review] [19.11.x] Bug 25327: Regression tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 106083 [details] [review] [19.11.x] Bug 25327: Do not call authenticate_api_request to render the spec The original code for Koha::REST::V1::Auth::under called authenticate_api_request when requesting the API spec. This didn't make sense, and recent changes on what conditions are tested for public routes, broke the route. We could add another condition, but it really doesn't make sense to call authenticate_api_request if it should be publicly available in any configuration, as discussed on the bug. This patch adds a trivial check and the requested route, and lets the request through in any case in 'under'. To test: 1. Point your browser to: http://kohadev.myDNSname.org:8080/api/v1/ http://kohadev.myDNSname.org:8080/api/v1/.html => FAIL: In both cases you get an authorization error. 2. Apply the regression tests patch 3. Run: $ kshell k$ prove t/db_dependent/api/v1/auth.t => FAIL: The tests reflect the situation, and fail 4. Apply this patch 5. Repeat 1 and 3 => SUCCESS: All good! 6. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
backported to 19.11.x for 19.11.07
Missing dependencies for 19.05.x, can't backport.