@@ -, +, @@ $ ktd --shell k$ prove t/db_dependent/api/v1/password_validation.t --- Koha/REST/V1/Auth/Password.pm | 15 ++++++++------- api/v1/swagger/paths/auth.yaml | 15 +++++++++++---- 2 files changed, 19 insertions(+), 11 deletions(-) --- a/Koha/REST/V1/Auth/Password.pm +++ a/Koha/REST/V1/Auth/Password.pm @@ -40,19 +40,20 @@ Controller method that checks a patron's password sub validate { my $c = shift->openapi->valid_input or return; - my $body = $c->validation->param('body'); - my $userid = $body->{userid} // ''; - my $patron = Koha::Patrons->find({ userid => $userid }); - unless ($patron) { + my $body = $c->req->json; + + my $identifier = $body->{identifier}; + + unless ( defined $identifier ) { return $c->render( status => 400, openapi => { error => "Validation failed" } ); } - my $password = $body->{password} // ""; + my $password = $body->{password} // ""; return try { - my ($status, $cardnumber, $userid) = C4::Auth::checkpw($patron->userid, $password ); - unless ( $status ) { + my ( $status, $cardnumber, $userid ) = C4::Auth::checkpw( $identifier, $password ); + unless ($status) { return $c->render( status => 400, openapi => { error => "Validation failed" } --- a/api/v1/swagger/paths/auth.yaml +++ a/api/v1/swagger/paths/auth.yaml @@ -1062,18 +1062,25 @@ parameters: - name: body in: body - description: A JSON object containing username and password information + description: | + A JSON object containing a patron identifier and password information. + + The identifier will be used to match patrons on the database using the + following order: + + * userid + * cardnumber schema: type: object properties: - userid: - description: Username + identifier: + description: A patron identifier (`userid` or `cardnumber`) type: string password: description: Password (plain text) type: string required: - - userid + - identifier - password additionalProperties: false produces: --