From 94ab498bf2db06fc1eb390e9afa5aa76e5429689 Mon Sep 17 00:00:00 2001 From: Tomas Cohen Arazi Date: Mon, 17 Jul 2023 15:48:20 -0300 Subject: [PATCH] Bug 32739: Allow other patron identifier on pwd validation This patch takes a step forward on the password validation endpoint, by renaming the `userid` attribute to `identifier` and making it be allowed to be the patron's cardnumber. The implementation relies on `C4::Auth::checkpw` to query for the patron. To test: 1. Apply this patches 2. Run: $ ktd --shell k$ prove t/db_dependent/api/v1/password_validation.t => SUCCESS: Tests pass! 3. Sign off :-D --- Koha/REST/V1/Auth/Password.pm | 15 ++++++++------- api/v1/swagger/paths/auth.yaml | 15 +++++++++++---- 2 files changed, 19 insertions(+), 11 deletions(-) diff --git a/Koha/REST/V1/Auth/Password.pm b/Koha/REST/V1/Auth/Password.pm index 9c99fd230ca..7533a5decdd 100644 --- a/Koha/REST/V1/Auth/Password.pm +++ b/Koha/REST/V1/Auth/Password.pm @@ -40,19 +40,20 @@ Controller method that checks a patron's password sub validate { my $c = shift->openapi->valid_input or return; - my $body = $c->validation->param('body'); - my $userid = $body->{userid} // ''; - my $patron = Koha::Patrons->find({ userid => $userid }); - unless ($patron) { + my $body = $c->req->json; + + my $identifier = $body->{identifier}; + + unless ( defined $identifier ) { return $c->render( status => 400, openapi => { error => "Validation failed" } ); } - my $password = $body->{password} // ""; + my $password = $body->{password} // ""; return try { - my ($status, $cardnumber, $userid) = C4::Auth::checkpw($patron->userid, $password ); - unless ( $status ) { + my ( $status, $cardnumber, $userid ) = C4::Auth::checkpw( $identifier, $password ); + unless ($status) { return $c->render( status => 400, openapi => { error => "Validation failed" } diff --git a/api/v1/swagger/paths/auth.yaml b/api/v1/swagger/paths/auth.yaml index 04e89e67360..81ef9501590 100644 --- a/api/v1/swagger/paths/auth.yaml +++ b/api/v1/swagger/paths/auth.yaml @@ -1062,18 +1062,25 @@ parameters: - name: body in: body - description: A JSON object containing username and password information + description: | + A JSON object containing a patron identifier and password information. + + The identifier will be used to match patrons on the database using the + following order: + + * userid + * cardnumber schema: type: object properties: - userid: - description: Username + identifier: + description: A patron identifier (`userid` or `cardnumber`) type: string password: description: Password (plain text) type: string required: - - userid + - identifier - password additionalProperties: false produces: -- 2.41.0