@@ -, +, @@ --- Koha/Library.pm | 15 --------------- Koha/Library/Allowlist.pm | 22 ++++++++++++++++++++++ Koha/Object.pm | 25 +++++++++++++++++-------- t/db_dependent/Koha/Object.t | 4 +++- t/db_dependent/Koha/Objects.t | 4 +++- 5 files changed, 45 insertions(+), 25 deletions(-) create mode 100644 Koha/Library/Allowlist.pm --- a/Koha/Library.pm +++ a/Koha/Library.pm @@ -266,21 +266,6 @@ sub validate_hold_sibling { ->count > 0; } -=head3 public_read_list - -This method returns the list of publically readable database fields for both API and UI output purposes - -=cut - -sub public_read_list { - return [ - 'branchcode', 'branchname', 'branchaddress1', - 'branchaddress2', 'branchaddress3', 'branchzip', - 'branchcity', 'branchstate', 'branchcountry', - 'branchfax', 'branchemail', 'branchurl' - ]; -} - =head3 to_api_mapping This method returns the mapping for representing a Koha::Library object --- a/Koha/Library/Allowlist.pm +++ a/Koha/Library/Allowlist.pm @@ -0,0 +1,22 @@ +package Koha::Patron::Allowlist; + +use Modern::Perl; +use parent 'Koha::Allowlist'; + +sub load { + my ($self) = @_; + my @public_read = qw( + branchcode branchname branchaddress1 + branchaddress2 branchaddress3 branchzip + branchcity branchstate branchcountry + branchfax branchemail branchurl ); + $self->add(@public_read); + + my @staff_read = qw( + branchillemail branchreplyto branchreturnpath + branchip branchnotes marcorgcode + ); + $self->add(@staff_read) if $self->{interface} eq 'staff'; +} + +1; --- a/Koha/Object.pm +++ a/Koha/Object.pm @@ -24,7 +24,7 @@ use Carp qw( croak ); use Mojo::JSON; use Scalar::Util qw( blessed looks_like_number ); use Try::Tiny qw( catch try ); -use List::MoreUtils qw( any ); +use Module::Load::Conditional qw( can_load ); use Koha::Database; use Koha::Exceptions::Object; @@ -552,15 +552,24 @@ Returns a representation of the object, suitable for API output. sub to_api { my ( $self, $params ) = @_; my $json_object = $self->TO_JSON; + $params //= {}; # Remove forbidden attributes if required - # FIXME: We should eventually require public_read_list in all objects and drop the conditional here. - if ( $params->{public} - and $self->can('public_read_list') ) - { - for my $field ( keys %{$json_object} ) { - delete $json_object->{$field} unless any { $_ eq $field } @{$self->public_read_list}; - } + # FIXME: All modules should have a corresponding allowlist eventually + my $allowclass = ref($self) . '::Allowlist'; + if ( can_load( modules => { $allowclass => undef } ) ) { + my $allowlist = $allowclass->new( + { interface => $params->{public} ? 'opac' : 'staff' } ); + $allowlist->load; + my $blocked = $allowlist->apply( { input => $json_object } ); + Koha::Logger->get->debug( + ref($self) + . "::to_api allowlist blocked fields: " + . ( + join ', ', + map { $_ . '=' . $blocked->{$_} } sort keys %$blocked + ) + ) if keys %$blocked; } my $to_api_mapping = $self->to_api_mapping; --- a/t/db_dependent/Koha/Object.t +++ a/t/db_dependent/Koha/Object.t @@ -31,6 +31,7 @@ use Koha::Database; use Koha::Acquisition::Orders; use Koha::DateUtils qw( dt_from_string ); use Koha::Libraries; +use Koha::Library::Allowlist; use Koha::Patrons; use Koha::ApiKeys; @@ -376,7 +377,8 @@ subtest "to_api() tests" => sub { subtest 'unprivileged request tests' => sub { my @all_attrs = Koha::Libraries->columns(); - my $public_attrs = { map { $_ => 1 } @{ Koha::Library->public_read_list() } }; + my $allowlist = Koha::Library::Allowlist->new({ interface => 'opac' })->load(); + my $public_attrs = $allowlist->{_entries}; my $mapping = Koha::Library->to_api_mapping; plan tests => scalar @all_attrs * 2; --- a/t/db_dependent/Koha/Objects.t +++ a/t/db_dependent/Koha/Objects.t @@ -32,6 +32,7 @@ use Koha::Biblios; use Koha::Patron::Category; use Koha::Patron::Categories; use Koha::Patrons; +use Koha::Library::Allowlist; use Koha::Database; use Koha::DateUtils qw( dt_from_string ); @@ -401,7 +402,8 @@ subtest "to_api() tests" => sub { subtest 'unprivileged request tests' => sub { my @all_attrs = Koha::Libraries->columns(); - my $public_attrs = { map { $_ => 1 } @{ Koha::Library->public_read_list() } }; + my $allowlist = Koha::Library::Allowlist->new({ interface => 'opac' })->load(); + my $public_attrs = $allowlist->{_entries}; my $mapping = Koha::Library->to_api_mapping; # Create sample libraries --