Attachment 103674 Details for Bug 24909 – Bug 24909: Add unprivileged route to get a bibliographic record

[patch] Bug 24909: Add unprivileged route to get a bibliographic record

Bug-24909-Add-unprivileged-route-to-get-a-bibliogr.patch (text/plain), 5.23 KB, created by Jonathan Druart on 2020-04-24 12:53:43 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2020-04-24 12:53:43 UTC

Size: 5.23 KB

patch

obsolete

>From 4ba3c0cb926cccf19d3de85279d69485c005e87c Mon Sep 17 00:00:00 2001
>From: Tomas Cohen Arazi <tomascohen@theke.io>
>Date: Thu, 19 Mar 2020 17:04:31 -0300
>Subject: [PATCH] Bug 24909: Add unprivileged route to get a bibliographic
> record
>
>This patch adds a route to get bibliographic records without privileged
>access. This needs to match the OPAC expected behaviour.
>
>Some things were considered on the implementation:
>- The ViewPolicy filter that hides/shows things based on the frameworks
>  needded to be used, as in the OPAC.
>- OpacHiddenItems and OpacHiddenItemsExceptions need to be considered
>  for hiding records the same way the OPAC is expected to.
>- Avoid using OpacHiddenItemsExceptions, but rely on the patron category
>  instead (use Koha::Patron::Category->override_hidden_items abstraction
>  is used instead so it should keep working once 22547 is moved
>  forward).
>- Tests should cover all the use cases:
>  * logged in user
>  * anonymous user
>  * logged in with category that overrides
>  * logged in with category that doesn't override
>
>This is all implemented on the tests.
>
>To test:
>1. Apply the tests patch
>2. Run:
>   $ kshell
>  k$ prove t/db_dependent/api/v1/biblios.t
>=> FAIL: Route not implemented
>3. Apply the rest of the patches
>4. Repeat 2
>=> SUCCESS: Tests pass!
>5. Try it with your favourite API tool (Postman?)
>6. Sign off :-D
>
>Note: please notice there isn't a default fallback behaviour for when
>you don't specify the Accept header, so testing this on a regular
>browser will just print the accepted mime types instead of the record
>itself.
>
>To test this with a tool (like Postman) you should enable
>RESTBasicAuthe and make the tool use Basic authentication with valid
>credentials. And you need to specify any of the following strings on the
>Accept header:
>- application/marcxml+xml
>- application/marc-in-json
>- application/marc
>- text/plain
>
>Signed-off-by: David Nind <david@davidnind.com>
>
>Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>---
> Koha/REST/V1/Biblios.pm | 97 +++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 97 insertions(+)
>
>diff --git a/Koha/REST/V1/Biblios.pm b/Koha/REST/V1/Biblios.pm
>index af13f283bd..121d66fbe3 100644
>--- a/Koha/REST/V1/Biblios.pm
>+++ b/Koha/REST/V1/Biblios.pm
>@@ -20,6 +20,7 @@ use Modern::Perl;
> use Mojo::Base 'Mojolicious::Controller';
> 
> use Koha::Biblios;
>+use Koha::RecordProcessor;
> use C4::Biblio qw(DelBiblio);
> 
> use MARC::Record::MiJ;
>@@ -148,4 +149,100 @@ sub delete {
>     };
> }
> 
>+=head3 get_public
>+
>+Controller function that handles retrieving a single biblio object
>+
>+=cut
>+
>+sub get_public {
>+    my $c = shift->openapi->valid_input or return;
>+
>+    my $biblio = Koha::Biblios->find(
>+        { biblionumber => $c->validation->param('biblio_id') },
>+        { prefetch     => ['metadata'] } );
>+
>+    unless ($biblio) {
>+        return $c->render(
>+            status  => 404,
>+            openapi => {
>+                error => "Object not found."
>+            }
>+        );
>+    }
>+
>+    return try {
>+
>+        my $record = $biblio->metadata->record;
>+
>+        my $opachiddenitems_rules = C4::Context->yaml_preference('OpacHiddenItems');
>+        my $patron = $c->stash('koha.user');
>+
>+        # Check if the biblio should be hidden for unprivileged access
>+        # unless there's a logged in user, and there's an exception for it's
>+        # category
>+        unless ( $patron and $patron->category->override_hidden_items ) {
>+            if ( $biblio->hidden_in_opac({ rules => $opachiddenitems_rules }) )
>+            {
>+                return $c->render(
>+                    status  => 404,
>+                    openapi => {
>+                        error => "Object not found."
>+                    }
>+                );
>+            }
>+        }
>+
>+        my $marcflavour = C4::Context->preference("marcflavour");
>+
>+        my $record_processor = Koha::RecordProcessor->new({
>+            filters => 'ViewPolicy',
>+            options => {
>+                interface => 'opac',
>+                frameworkcode => $biblio->frameworkcode
>+            }
>+        });
>+        # Apply framework's filtering to MARC::Record object
>+        $record_processor->process($record);
>+
>+        $c->respond_to(
>+            marcxml => {
>+                status => 200,
>+                format => 'marcxml',
>+                text   => $record->as_xml_record
>+            },
>+            mij => {
>+                status => 200,
>+                format => 'mij',
>+                text   => $record->to_mij
>+            },
>+            marc => {
>+                status => 200,
>+                format => 'marc',
>+                text   => $record->as_usmarc
>+            },
>+            txt => {
>+                status => 200,
>+                format => 'text/plain',
>+                text   => $record->as_formatted
>+            },
>+            any => {
>+                status  => 406,
>+                openapi => [
>+                    "application/marcxml+xml",
>+                    "application/marc-in-json",
>+                    "application/marc",
>+                    "text/plain"
>+                ]
>+            }
>+        );
>+    }
>+    catch {
>+        return $c->render(
>+            status  => 500,
>+            openapi => { error => "Something went wrong, check the logs ($_)" }
>+        );
>+    };
>+}
>+
> 1;
>-- 
>2.20.1

Actions: View | Diff | Splinter Review

Attachments on bug 24909: 101057 | 101058 | 101059 | 102163 | 102164 | 102165 | 103672 | 103673 | 103674