Bug 30611 - Add ability to trigger a patron password reset from the staff client
Summary: Add ability to trigger a patron password reset from the staff client
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Martin Renvoize
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on: 27812
Blocks:
  Show dependency treegraph
 
Reported: 2022-04-25 15:22 UTC by Martin Renvoize
Modified: 2023-12-28 20:42 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
This enhancement adds a button to the patron details page in the client to allow librarians, with appropriate permissions, to trigger a password reset for patrons. The result is a notice sent to the user with a fresh password reset link allowing the user to enter a new password for their account.
Version(s) released in:
22.05.00


Attachments
Bug 30611: Add STAFF_PASSWORD_RESET notice (3.01 KB, patch)
2022-04-29 11:19 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 30611: Add ability for staff to send password reset emails (4.49 KB, patch)
2022-04-29 11:19 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 30611: Add STAFF_PASSWORD_RESET notice (3.08 KB, patch)
2022-04-29 12:26 UTC, Biblibre Sandboxes
Details | Diff | Splinter Review
Bug 30611: Add ability for staff to send password reset emails (4.55 KB, patch)
2022-04-29 12:26 UTC, Biblibre Sandboxes
Details | Diff | Splinter Review
Bug 30611: (QA follow-up) Only show reset option for allowed categories (1.64 KB, patch)
2022-05-06 10:39 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 30611: (follow-up) Use constants (1.09 KB, patch)
2022-05-06 10:46 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 30611: Add STAFF_PASSWORD_RESET notice (3.20 KB, patch)
2022-05-09 07:20 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 30611: Add ability for staff to send password reset emails (4.65 KB, patch)
2022-05-09 07:20 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 30611: (QA follow-up) Only show reset option for allowed categories (1.73 KB, patch)
2022-05-09 07:20 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 30611: (follow-up) Use constants (1.18 KB, patch)
2022-05-09 07:20 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize 2022-04-25 15:22:21 UTC
With the removal of the ability to include the plaintext password in the acctdetails, now welcome, notice it would be great to give patrons another option for setting their login details.

We have the ability to reset forgotten passwords from the OPAC using a limited time token embedded in a URL. It would be great to have the same option in the WELCOME notice.
Comment 1 Martin Renvoize 2022-04-25 15:23:52 UTC
Should this be part of the 'WELCOME' notice, or should it be it's own notice entirely which can be triggered independently from the various places the welcome notice can be triggered?

Perhaps it could be an optional part of the welcome notice that is picked at the trigger time?
Comment 2 Katrin Fischer 2022-04-25 15:48:01 UTC
I think maybe it would make sense to have an option to trigger the password reset email manually instead. 

The validity of the password reset URLs is limited, so it might be better to point people to the feature itself, maybe by including a direct link to the password request form.
Comment 3 Martin Renvoize 2022-04-29 11:19:14 UTC
Created attachment 134357 [details] [review]
Bug 30611: Add STAFF_PASSWORD_RESET notice

This patch adds a new STAFF_PASSWORD_RESET notice template for password
recoveries initiated via the staff client as aposed for those initiated
by the end user.
Comment 4 Martin Renvoize 2022-04-29 11:19:18 UTC
Created attachment 134358 [details] [review]
Bug 30611: Add ability for staff to send password reset emails

This patch adds the ability for staff with the edit_borrowers permission
to send password reset emails to users.

The staff initiated password reset has it's own notice,
STAFF_PASSWORD_RESET, and the reset link produced has an extended
timeout of 5 days, as apposed to the usual 2 day limit.

Test plan
1) Apply patch and run the database update
2) Login to the staff client with a user who has the 'edit_borrowers'
   permission.
3) Note that a new, 'Send password reset' option appears under the
   'More' menu on the patron details page.
4) Clicking the button will queue the STAFF_PASSWORD_RESET notice and
   redirect the user to the Notices tab.
Comment 5 Martin Renvoize 2022-04-29 11:27:21 UTC
I think this should perhaps target 22.05 as it adds back in an alternative to the functionality lost with bug 27812.
Comment 6 Biblibre Sandboxes 2022-04-29 12:26:08 UTC
Created attachment 134378 [details] [review]
Bug 30611: Add STAFF_PASSWORD_RESET notice

This patch adds a new STAFF_PASSWORD_RESET notice template for password
recoveries initiated via the staff client as aposed for those initiated
by the end user.

Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk>
Comment 7 Biblibre Sandboxes 2022-04-29 12:26:12 UTC
Created attachment 134379 [details] [review]
Bug 30611: Add ability for staff to send password reset emails

This patch adds the ability for staff with the edit_borrowers permission
to send password reset emails to users.

The staff initiated password reset has it's own notice,
STAFF_PASSWORD_RESET, and the reset link produced has an extended
timeout of 5 days, as apposed to the usual 2 day limit.

Test plan
1) Apply patch and run the database update
2) Login to the staff client with a user who has the 'edit_borrowers'
   permission.
3) Note that a new, 'Send password reset' option appears under the
   'More' menu on the patron details page.
4) Clicking the button will queue the STAFF_PASSWORD_RESET notice and
   redirect the user to the Notices tab.

Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk>
Comment 8 Sally 2022-04-29 12:29:04 UTC
Works brilliantly, thanks Martin.  This is a great feature - saves me from having to load the OPAC repeatedly throughout the day.
Comment 9 Marcel de Rooy 2022-05-06 09:12:25 UTC
QAing
Comment 10 Marcel de Rooy 2022-05-06 09:16:55 UTC
+    my $days = $staff ? 5 : 2;

No blocker. But these should at least be constants, but probably pref or config controlled.
Comment 11 Marcel de Rooy 2022-05-06 09:25:05 UTC
I think we should check at least pref OpacResetPassword to make the link we are sending to be working.
Comment 12 Martin Renvoize 2022-05-06 09:47:51 UTC
Good call.. I had completely overlooked that.
Comment 13 Martin Renvoize 2022-05-06 10:39:31 UTC
Created attachment 134719 [details] [review]
Bug 30611: (QA follow-up) Only show reset option for allowed categories

This patch adds a check that the patron can reach the password reset
page using category.effective_reset_password which handles fallback to
OpacResetPassword system preference transparently.

Test plan
1) Set at least one patron category to dissallow patron password resets
2) Search for a patron of that category
3) Confirm the 'Send password reset' option no longer appears
Comment 14 Martin Renvoize 2022-05-06 10:46:13 UTC
Created attachment 134720 [details] [review]
Bug 30611: (follow-up) Use constants

Update ternary for token timeout to use perl constants
Comment 15 Marcel de Rooy 2022-05-09 07:18:46 UTC
Another victim of Attempt to reload Koha/Template/Plugin/Branches.pm aborted.
Ignoring it :)
Comment 16 Marcel de Rooy 2022-05-09 07:19:12 UTC
Always linked to includes btw
Comment 17 Marcel de Rooy 2022-05-09 07:20:09 UTC
Created attachment 134774 [details] [review]
Bug 30611: Add STAFF_PASSWORD_RESET notice

This patch adds a new STAFF_PASSWORD_RESET notice template for password
recoveries initiated via the staff client as aposed for those initiated
by the end user.

Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Chmod 755 on atomic update file.
Comment 18 Marcel de Rooy 2022-05-09 07:20:13 UTC
Created attachment 134775 [details] [review]
Bug 30611: Add ability for staff to send password reset emails

This patch adds the ability for staff with the edit_borrowers permission
to send password reset emails to users.

The staff initiated password reset has it's own notice,
STAFF_PASSWORD_RESET, and the reset link produced has an extended
timeout of 5 days, as apposed to the usual 2 day limit.

Test plan
1) Apply patch and run the database update
2) Login to the staff client with a user who has the 'edit_borrowers'
   permission.
3) Note that a new, 'Send password reset' option appears under the
   'More' menu on the patron details page.
4) Clicking the button will queue the STAFF_PASSWORD_RESET notice and
   redirect the user to the Notices tab.

Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 19 Marcel de Rooy 2022-05-09 07:20:17 UTC
Created attachment 134776 [details] [review]
Bug 30611: (QA follow-up) Only show reset option for allowed categories

This patch adds a check that the patron can reach the password reset
page using category.effective_reset_password which handles fallback to
OpacResetPassword system preference transparently.

Test plan
1) Set at least one patron category to dissallow patron password resets
2) Search for a patron of that category
3) Confirm the 'Send password reset' option no longer appears

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 20 Marcel de Rooy 2022-05-09 07:20:21 UTC
Created attachment 134777 [details] [review]
Bug 30611: (follow-up) Use constants

Update ternary for token timeout to use perl constants

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 21 Fridolin Somers 2022-05-11 01:19:03 UTC
Pushed to master for 22.05, thanks to everybody involved 🦄
Comment 22 Fridolin Somers 2022-05-11 06:14:59 UTC
Arf this breaks unit test :
kohadev-koha@kohadevbox:/kohadevbox/koha$ prove xt/sample_notices.t 
xt/sample_notices.t .. 1/? 
#   Failed test 'No sample notice to add'
#   at xt/sample_notices.t line 84.
# Sample notices to add in fr-FR/1-Obligatoire/sample_notices.sql: STAFF_PASSWORD_RESET
# Looks like you failed 1 test of 6.

Note there is Bug 27619
Comment 23 Martin Renvoize 2022-05-11 06:16:43 UTC
On it.. :)
Comment 24 Martin Renvoize 2022-05-11 06:18:17 UTC
Ah yes, I think I kind of assumed bug 27619 would be in before this one.. I was happy to wait.

It's easy to fix this by adding the sample notice to the fr SQL.. but maybe it's more pertinent for me to QA 27619 to get that in?
Comment 25 Fridolin Somers 2022-05-11 08:22:42 UTC
(In reply to Martin Renvoize from comment #24)
> Ah yes, I think I kind of assumed bug 27619 would be in before this one.. I
> was happy to wait.
> 
> It's easy to fix this by adding the sample notice to the fr SQL.. but maybe
> it's more pertinent for me to QA 27619 to get that in?

I prefer a quick fix on sample notices to the fr in order to calm jenkins
Comment 26 Fridolin Somers 2022-05-17 23:36:03 UTC
In the end, bug 27619 was pushed.
All good here.