Bugzilla – Attachment 55099 Details for
Bug 14868
REST API: Swagger2-driven permission checking
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 14868: Display required permissions in permission error response
Bug-14868-Display-required-permissions-in-permissi.patch (text/plain), 2.27 KB, created by
Benjamin Rokseth
on 2016-09-01 20:59:31 UTC
(
hide
)
Description:
Bug 14868: Display required permissions in permission error response
Filename:
MIME Type:
Creator:
Benjamin Rokseth
Created:
2016-09-01 20:59:31 UTC
Size:
2.27 KB
patch
obsolete
>From f7a3e60ec7e599f8f55c02be64b9d69ad531cee8 Mon Sep 17 00:00:00 2001 >From: Lari Taskula <larit@student.uef.fi> >Date: Tue, 23 Aug 2016 15:38:44 +0300 >Subject: [PATCH] Bug 14868: Display required permissions in permission error > response > >When user does not have required permissions to use API operation, it would be >useful to let them know which permissions he is missing. Since they are now >defined in Swagger, we can easily render them into the response. > >To test: >1. Use a patron without any permissions >2. Make GET request to http://yourlib/api/v1/patrons >3. Observe permission error and see that required_permissions are displayed. >4. Run t/db_dependent/api/v1/patrons.t > >Signed-off-by: Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no> >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >--- > Koha/REST/V1.pm | 3 ++- > t/db_dependent/api/v1/patrons.t | 5 +++-- > 2 files changed, 5 insertions(+), 3 deletions(-) > >diff --git a/Koha/REST/V1.pm b/Koha/REST/V1.pm >index 4cb6236..03342d4 100644 >--- a/Koha/REST/V1.pm >+++ b/Koha/REST/V1.pm >@@ -87,7 +87,8 @@ sub authenticate_api_request { > my $permissions = $authorization->{'permissions'}; > return $next->($c) if C4::Auth::haspermission($user->userid, $permissions); > return $c->render_swagger( >- { error => "Authorization failure. Missing required permission(s)." }, >+ { error => "Authorization failure. Missing required permission(s).", >+ required_permissions => $permissions }, > {}, > 403 > ); >diff --git a/t/db_dependent/api/v1/patrons.t b/t/db_dependent/api/v1/patrons.t >index 6286234..f4b9410 100644 >--- a/t/db_dependent/api/v1/patrons.t >+++ b/t/db_dependent/api/v1/patrons.t >@@ -17,7 +17,7 @@ > > use Modern::Perl; > >-use Test::More tests => 19; >+use Test::More tests => 20; > use Test::Mojo; > use t::lib::TestBuilder; > >@@ -84,7 +84,8 @@ $t->request_ok($tx) > $tx = $t->ua->build_tx(GET => "/api/v1/patrons/" . ($borrower->{ borrowernumber }-1)); > $tx->req->cookies({name => 'CGISESSID', value => $session->id}); > $t->request_ok($tx) >- ->status_is(403); >+ ->status_is(403) >+ ->json_is('/required_permissions', {"borrowers" => "1"}); > > # User without permissions, but is the owner of the object > $tx = $t->ua->build_tx(GET => "/api/v1/patrons/" . $borrower->{borrowernumber}); >-- >2.1.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 14868
:
42761
|
52577
|
52578
|
52579
|
52592
|
52593
|
52594
|
52602
|
52603
|
52604
|
52963
|
52964
|
52965
|
52966
|
52967
|
52981
|
52992
|
52993
|
52994
|
52995
|
52996
|
54457
|
54458
|
54459
|
54631
|
54632
|
54633
|
54765
|
54766
|
54767
|
54770
|
54771
|
54894
|
54895
|
54896
|
54897
|
55084
|
55085
|
55086
|
55087
|
55088
|
55089
|
55099
|
55100
|
55101
|
55102
|
55103
|
55104
|
55105