View | Details | Raw Unified | Return to bug 32739
Collapse All | Expand All

(-)a/Koha/REST/V1/Auth/Password.pm (-5 / +29 lines)
Lines 44-58 sub validate { Link Here
44
    my $userid = $body->{userid} // '';
44
    my $userid = $body->{userid} // '';
45
    my $patron = Koha::Patrons->find({ userid => $userid });
45
    my $patron = Koha::Patrons->find({ userid => $userid });
46
46
47
    unless ($patron) {
47
    my $body = $c->req->json;
48
        return $c->render( status => 400, openapi => { error => "Validation failed" } );
48
49
    my $identifier = $body->{identifier};
50
    my $userid     = $body->{userid};
51
52
    unless ( defined $identifier or defined $userid ) {
53
        return $c->render(
54
            status  => 400,
55
            openapi => { error => "Validation failed" },
56
        );
57
    }
58
59
    if ( defined $identifier and defined $userid ) {
60
        return $c->render(
61
            status  => 400,
62
            openapi => { error => "Bad request. Only one identifier attribute can be passed." },
63
        );
49
    }
64
    }
50
65
51
    my $password   = $body->{password}   // "";
66
    if ($userid) {
67
        return $c->render(
68
            status  => 400,
69
            openapi => { error => "Validation failed" },
70
        ) unless Koha::Patrons->find( { userid => $userid } );
71
    }
72
73
    $identifier //= $userid;
74
75
    my $password = $body->{password} // "";
52
76
53
    return try {
77
    return try {
54
        my ($status, $cardnumber, $userid) = C4::Auth::checkpw($patron->userid, $password );
78
        my ( $status, $cardnumber, $userid ) = C4::Auth::checkpw( $identifier, $password );
55
        unless ( $status ) {
79
        unless ($status) {
56
            return $c->render(
80
            return $c->render(
57
                status  => 400,
81
                status  => 400,
58
                openapi => { error => "Validation failed" }
82
                openapi => { error => "Validation failed" }
(-)a/api/v1/swagger/paths/auth.yaml (-4 / +16 lines)
Lines 1062-1079 Link Here
1062
    parameters:
1062
    parameters:
1063
      - name: body
1063
      - name: body
1064
        in: body
1064
        in: body
1065
        description: A JSON object containing username and password information
1065
        description: |
1066
          A JSON object containing a patron identifier and password information.
1067
1068
          The identifier will be used to match patrons on the database using the
1069
          following order:
1070
1071
          * userid
1072
          * cardnumber
1073
1074
          Optionally, you can specify the `userid` attribute if you don't want it
1075
          to be checked against the patron cardnumbers.
1066
        schema:
1076
        schema:
1067
          type: object
1077
          type: object
1068
          properties:
1078
          properties:
1069
            userid:
1079
            identifier:
1070
              description: Username
1080
              description: A patron identifier (`userid` or `cardnumber`)
1071
              type: string
1081
              type: string
1072
            password:
1082
            password:
1073
              description: Password (plain text)
1083
              description: Password (plain text)
1074
              type: string
1084
              type: string
1085
            userid:
1086
              description: A patron userid
1087
              type: string
1075
          required:
1088
          required:
1076
            - userid
1077
            - password
1089
            - password
1078
          additionalProperties: false
1090
          additionalProperties: false
1079
    produces:
1091
    produces:
(-)a/t/db_dependent/api/v1/password_validation.t (-15 / +10 lines)
Lines 136-143 subtest 'Password validation - authorized requests tests' => sub { Link Here
136
    };
136
    };
137
137
138
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
138
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
139
      ->status_is(204, 'Validating using `cardnumber` works')
139
        ->status_is( 204, 'Validating using `cardnumber` works' )->content_is(q{});
140
      ->content_is(q{});
141
140
142
    $json = {
141
    $json = {
143
        identifier => $librarian->cardnumber,
142
        identifier => $librarian->cardnumber,
Lines 145-152 subtest 'Password validation - authorized requests tests' => sub { Link Here
145
    };
144
    };
146
145
147
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
146
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
148
      ->status_is(204, 'Validating using `cardnumber` works')
147
        ->status_is( 204, 'Validating using `cardnumber` works' )->content_is(q{});
149
      ->content_is(q{});
150
148
151
    $json = {
149
    $json = {
152
        identifier => $deleted_cardnumber,
150
        identifier => $deleted_cardnumber,
Lines 154-161 subtest 'Password validation - authorized requests tests' => sub { Link Here
154
    };
152
    };
155
153
156
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
154
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
157
      ->status_is(400, 'Validating using and invalid identifier fails')
155
        ->status_is( 400, 'Validating using and invalid identifier fails' )
158
      ->json_is({ error => 'Validation failed' });
156
        ->json_is( { error => 'Validation failed' } );
159
157
160
    $json = {
158
    $json = {
161
        identifier => $deleted_userid,
159
        identifier => $deleted_userid,
Lines 163-170 subtest 'Password validation - authorized requests tests' => sub { Link Here
163
    };
161
    };
164
162
165
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
163
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
166
      ->status_is(400, 'Validating using and invalid identifier fails')
164
        ->status_is( 400, 'Validating using and invalid identifier fails' )
167
      ->json_is({ error => 'Validation failed' });
165
        ->json_is( { error => 'Validation failed' } );
168
166
169
    $json = {
167
    $json = {
170
        password => $password,
168
        password => $password,
Lines 172-179 subtest 'Password validation - authorized requests tests' => sub { Link Here
172
    };
170
    };
173
171
174
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
172
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
175
      ->status_is(400, 'Validating using and invalid userid fails')
173
        ->status_is( 400, 'Validating using and invalid userid fails' )->json_is( { error => 'Validation failed' } );
176
      ->json_is({ error => 'Validation failed' });
177
174
178
    $json = {
175
    $json = {
179
        password => $password,
176
        password => $password,
Lines 181-188 subtest 'Password validation - authorized requests tests' => sub { Link Here
181
    };
178
    };
182
179
183
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
180
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
184
      ->status_is(204, 'Validating using the `userid` attribute works')
181
        ->status_is( 204, 'Validating using the `userid` attribute works' )->content_is(q{});
185
      ->content_is(q{});
186
182
187
    $json = {
183
    $json = {
188
        password => $password,
184
        password => $password,
Lines 199-206 subtest 'Password validation - authorized requests tests' => sub { Link Here
199
    };
195
    };
200
196
201
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
197
    $t->post_ok( "//$userid:$password@/api/v1/auth/password/validation" => json => $json )
202
      ->status_is(400, 'Passing both parameters forbidden')
198
        ->status_is( 400, 'Passing both parameters forbidden' )
203
      ->json_is({ error => 'Bad request. Only one identifier attribute can be passed.' });
199
        ->json_is( { error => 'Bad request. Only one identifier attribute can be passed.' } );
204
200
205
    $schema->storage->txn_rollback;
201
    $schema->storage->txn_rollback;
206
};
202
};
207
- 

Return to bug 32739