From 5d1c9c8c6a30f091edbefe8ef33771be6f10834f Mon Sep 17 00:00:00 2001
From: Tomas Cohen Arazi <tomascohen@theke.io>
Date: Mon, 30 Aug 2021 12:07:56 -0300
Subject: [PATCH] Bug 28772: Display API secret once

This patch makes the apikeys.pl display the generated API secret once,
when generated. After that, it won't be displayed by the UI.

To test:
1. Generate a new API key
=> FAIL: The secret is displayed in the API keys table
2. Visit some other page, and go back to the API keys page
=> FAIL: The API key secret is there
3. Apply this patch
4. Go to More > Manage API keys
=> SUCCESS: It no longer displays the secret
5. Generate a new API key
=> SUCCESS: The API key details (including the secret) are displayed.
=> SUCCESS: A message telling to copy the secret because it won't be
            displayed again is shown.
6. Repeat 4
=> SUCCESS: The secret is no longer displayed
7. Sign off :-D

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
---
 .../prog/en/modules/members/apikeys.tt        | 24 +++++++++++++++++--
 members/apikeys.pl                            |  7 ++++--
 2 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt
index 77779fd557..cc20d29601 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt
@@ -34,6 +34,28 @@
                 [% INCLUDE 'members-toolbar.inc' %]
 
                 <h1>API keys for [% INCLUDE 'patron-title.inc' %]</h1>
+
+            [% IF fresh_api_key %]
+                [%# A fresh api key was generated, display the secret, only once %]
+                <div class="rows">
+                    <span class="alert">Make sure to copy your API secret now. You won’t be able to see it again!</span>
+                    <ol>
+                        <li>
+                            <span class="label">Description: </span>
+                            [% fresh_api_key.description | html %]
+                        </li>
+                        <li>
+                            <span class="label">Client ID: </span>
+                            [% fresh_api_key.client_id | html %]
+                        </li>
+                        <li>
+                            <span class="label">Secret: </span>
+                            [% fresh_api_key.plain_text_secret | html %]
+                        </li>
+                    </ol>
+                </div>
+            [% END %]
+
                 <form id="add-api-key" action="/cgi-bin/koha/members/apikeys.pl" method="post" style="display:none">
                     <input type="hidden" name="patron_id" value="[% patron.id | html %]" />
                     <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
@@ -61,7 +83,6 @@
                                 <tr>
                                     <th>Description</th>
                                     <th>Client ID</th>
-                                    <th>Secret</th>
                                     <th>Active</th>
                                     <th class="noExport">Actions</th>
                                 </tr>
@@ -71,7 +92,6 @@
                                     <tr>
                                         <td>[% key.description | html %]</td>
                                         <td>[% key.client_id | html %]</td>
-                                        <td>[% key.secret | html %]</td>
                                         <td>[% IF key.active %]Yes[% ELSE %]No[% END %]</td>
                                         <td>
                                             <form action="/cgi-bin/koha/members/apikeys.pl" method="post">
diff --git a/members/apikeys.pl b/members/apikeys.pl
index f6fde368e4..85f592f22e 100755
--- a/members/apikeys.pl
+++ b/members/apikeys.pl
@@ -75,8 +75,11 @@ if ($op) {
             }
         );
         $api_key->store;
-        print $cgi->redirect( '/cgi-bin/koha/members/apikeys.pl?patron_id=' . $patron_id );
-        exit;
+
+        $template->param(
+            fresh_api_key => $api_key,
+            api_keys      => scalar Koha::ApiKeys->search({ patron_id => $patron_id }),
+        );
     }
 
     if ( $op eq 'delete' ) {
-- 
2.20.1