$dbh->do(q{

        INSERT IGNORE INTO `systempreferences`

            (variable,value,explanation,options,type)

        VALUES

            ('AllowPatronsManageAPIKeysInOPAC', '0', 'If enabled, patrons can manage their own API keys in the OPAC', NULL, 'YesNo');

    });

('AllowPatronsManageAPIKeysInOPAC', '0', NULL, 'If enabled, patrons can manage their own API keys in the OPAC',  'YesNo'),

        -

            - pref: AllowPatronsManageAPIKeysInOPAC

              choices:

                  yes: Allow

                  no: "Don't allow"

            - "patrons to manage their own API keys in the OPAC."

            [% IF Koha.Preference('AllowPatronsManageAPIKeysInOPAC') %]

                [% IF apikeysview %]

                  <li class="active">

                [% ELSE %]

                  <li>

                [% END %]

                  <a href="/cgi-bin/koha/opac-apikeys.pl">your API keys</a>

            [% END %]

            </li>

[% INCLUDE 'doc-head-open.inc' %]

<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your API keys</title>

[% INCLUDE 'doc-head-close.inc' %]

[% BLOCK cssinclude %][% END %]

</head>

[% INCLUDE 'bodytag.inc' bodyid='opac-user' bodyclass='scrollto' %]

[% INCLUDE 'masthead.inc' %]

<div class="main">

    <ul class="breadcrumb">

        <li><a href="/cgi-bin/koha/opac-main.pl">Home</a> <span class="divider">&rsaquo;</span></li>

        <li>

            <a href="/cgi-bin/koha/opac-user.pl">

                [% INCLUDE 'patron-title.inc' category_type=patron.category.category_type firstname=patron.firstname surname=patron.surname othernames=patron.othernames %]

            </a>

            <span class="divider">&rsaquo;</span>

        </li>

        <li><a href="/cgi-bin/koha/opac-apikeys.pl">Your API keys</a></li>

    </ul>

    <div class="container-fluid">

        <div class="row-fluid">

            <div class="span2">

                <div id="navigation">

                    [% INCLUDE 'navigation.inc' IsPatronPage = 1 %]

                </div>

            </div>

            <div class="span10">

                <div id="apikeys" class="maincontent">

                    <h1>Your API keys</h1>

                    <p>

                        <button id="show-api-form" style="display:none" class="btn btn-default btn-sm" type="button"><i class="fa fa-plus"></i> Generate new key</button>

                    </p>

                    <form id="add-api-key" action="/cgi-bin/koha/opac-apikeys.pl" method="post">

                        <fieldset>

                            <legend>Generate new client id/secret pair</legend>

                            <input type="hidden" name="patron_id" value="[% patron.id %]" />

                            <input type="hidden" name="csrf_token" value="[% csrf_token %]" />

                            <input type="hidden" name="op" value="generate" />

                            <label for="description">Description: </label>

                            <input type="text" name="description" />

                        </fieldset>

                        <fieldset class="action">

                            <button class="btn btn-default btn-sm" type="submit">Save</button> <a href="#" style="display:none" class="cancel cancel-api-key">Cancel</a>

                        </fieldset>

                    </form>

                    [% IF api_keys && api_keys.size > 0 %]

                        <table class="table table-bordered table-striped">

                            <thead>

                                <tr>

                                    <th>Description</th>

                                    <th>Client ID</th>

                                    <th>Secret</th>

                                    <th>Active</th>

                                    <th>Actions</th>

                                </tr>

                            </thead>

                            <tbody>

                                [% FOREACH key IN api_keys %]

                                    <tr>

                                        <td>[% key.description %]</td>

                                        <td>[% key.client_id %]</td>

                                        <td>[% key.secret %]</td>

                                        <td>[% IF key.active %]Yes[% ELSE %]No[% END %]</td>

                                        <td>

                                            <form action="/cgi-bin/koha/opac-apikeys.pl" method="post" class="form-inline">

                                                <input type="hidden" name="key" value="[% key.id %]" />

                                                <input type="hidden" name="csrf_token" value="[% csrf_token %]" />

                                                <input type="hidden" name="op" value="delete" />

                                                <button class="btn btn-link btn-xs delete-key" type="submit"><i class="fa fa-trash"></i> Delete</button>

                                            </form>

                                            <form action="/cgi-bin/koha/opac-apikeys.pl" method="post" class="form-inline">

                                                <input type="hidden" name="key" value="[% key.id %]" />

                                                <input type="hidden" name="csrf_token" value="[% csrf_token %]" />

                                                [% IF key.active %]

                                                    <input type="hidden" name="op" value="revoke" />

                                                    <button class="btn btn-link btn-xs" type="submit"><i class="fa fa-remove"></i> Revoke</button>

                                                [% ELSE %]

                                                    <input type="hidden" name="op" value="activate" />

                                                    <button class="btn btn-link btn-xs" type="submit"><i class="fa fa-play"></i> Activate</button>

                                                [% END %]

                                            </form>

                                        </td>

                                    </tr>

                                [% END %]

                            </tbody>

                        </table>

                    [% ELSE %]

                        <p>No keys defined for the current patron.</p>

                    [% END %]

                </div> <!-- /#apikeys -->

            </div> <!-- /.span10 -->

        </div> <!-- /.row-fluid -->

    </div> <!-- /.container-fluid -->

</div> <!-- /#main -->

[% BLOCK jsinclude %]

    <script>

        $(document).ready(function(){

            $("#add-api-key, #show-api-form, .cancel-api-key").toggle();

            $("#show-api-form, .cancel-api-key").on("click", function(){

                $("#add-api-key, #show-api-form").toggle();

            });

            $(".delete-key").on("click", function(){

                return confirm(_("Are you sure you want to delete this key?"));

            });

        });

    </script>

[% END %]

[% INCLUDE 'opac-bottom.inc' %]

#!/usr/bin/env perl

# This file is part of Koha.

#

# Copyright 2015 BibLibre

#

# Koha is free software; you can redistribute it and/or modify it

# under the terms of the GNU General Public License as published by

# the Free Software Foundation; either version 3 of the License, or

# (at your option) any later version.

#

# Koha is distributed in the hope that it will be useful, but

# WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with Koha; if not, see <http://www.gnu.org/licenses>.

use Modern::Perl;

use CGI;

use C4::Auth;

use C4::Output;

use Koha::ApiKeys;

use Koha::Patrons;

use Koha::Token;

my $cgi = new CGI;

my ($template, $loggedinuser, $cookie) = get_template_and_user({

    template_name   => 'opac-apikeys.tt',

    query           => $cgi,

    type            => 'opac',

    authnotrequired => 0

});

my $patron_id = $loggedinuser;

my $patron = Koha::Patrons->find( $patron_id );

if ( not defined $patron

    or !C4::Context->preference('AllowPatronsManageAPIKeysInOPAC') )

{

    # patron_id invalid -> exit

    print $cgi->redirect("/cgi-bin/koha/errors/404.pl");    # escape early

    exit;

}

my $op = $cgi->param('op') // '';

if ( $op eq 'generate' or

     $op eq 'delete' or

     $op eq 'revoke' or

     $op eq 'activate' ) {

    die "Wrong CSRF token"

    unless Koha::Token->new->check_csrf({

        session_id => scalar $cgi->cookie('CGISESSID'),

        token      => scalar $cgi->param('csrf_token'),

    });

}

if ($op) {

    if ($op eq 'generate') {

        my $description = $cgi->param('description') // '';

        my $apikey = Koha::ApiKey->new({

            patron_id   => $patron_id,

            description => $description

        });

        $apikey->store;

        print $cgi->redirect('/cgi-bin/koha/opac-apikeys.pl');

        exit;

    }

    if ($op eq 'delete') {

        my $key_id  = $cgi->param('key');

        my $api_key = Koha::ApiKeys->find({ patron_id => $patron_id, client_id => $key_id });

        if ($api_key) {

            $api_key->delete;

        }

        print $cgi->redirect('/cgi-bin/koha/opac-apikeys.pl');

        exit;

    }

    if ($op eq 'revoke') {

        my $key_id  = $cgi->param('key');

        my $api_key = Koha::ApiKeys->find({ patron_id => $patron_id, client_id => $key_id });

        if ($api_key) {

            $api_key->active(0);

            $api_key->store;

        }

        print $cgi->redirect('/cgi-bin/koha/opac-apikeys.pl');

        exit;

    }

    if ($op eq 'activate') {

        my $key_id  = $cgi->param('key');

        my $api_key = Koha::ApiKeys->find({ patron_id => $patron_id, client_id => $key_id });

        if ($api_key) {

            $api_key->active(1);

            $api_key->store;

        }

        print $cgi->redirect('/cgi-bin/koha/opac-apikeys.pl');

        exit;

    }

}

my @api_keys = Koha::ApiKeys->search({ patron_id => $patron_id });

$template->param(

    api_keys    => \@api_keys,

    apikeysview => 1,

    csrf_token  => Koha::Token->new->generate_csrf({ session_id => scalar $cgi->cookie('CGISESSID') }),

    patron      => $patron

);

output_html_with_http_headers $cgi, $cookie, $template->output;

-