From 5209f6fd1b43249e6ab24cb2ad0510d8cc6edde1 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Thu, 12 Oct 2023 14:51:47 +0100 Subject: [PATCH] Bug 29523: WIP - Add support for 'unredact_list' This work in progress patch adds support for an 'unredact_list' method to be added at the Koha::* class level allowing for individual classes to specify which fields they wish to expose to restricted users regardless. It drops the type handling as we move from TO_JSON to to_api.. I'm considering whether we should really be moving both public and redaction handling into TO_JSON as apposed to to_api... but it adds complication to the strings mapping --- Koha/Object.pm | 55 +++++++++++++++++++++++++++++++++----------------- Koha/Patron.pm | 12 +++++++++++ 2 files changed, 48 insertions(+), 19 deletions(-) diff --git a/Koha/Object.pm b/Koha/Object.pm index 529ec503436..987e04b812e 100644 --- a/Koha/Object.pm +++ b/Koha/Object.pm @@ -405,11 +405,6 @@ sub TO_JSON { elsif ( _numeric_column_type( $columns_info->{$col}->{data_type} ) and looks_like_number( $unblessed->{$col} ) ) { - - if ( $self->{_redact} ) { - $unblessed->{$col} = 0; - } - # TODO: Remove once the solution for # https://github.com/perl5-dbi/DBD-mysql/issues/212 # is ported to whatever distro we support by that time @@ -419,10 +414,6 @@ sub TO_JSON { elsif ( _decimal_column_type( $columns_info->{$col}->{data_type} ) and looks_like_number( $unblessed->{$col} ) ) { - if ( $self->{_redact} ) { - $unblessed->{$col} = 0.00; - } - # TODO: Remove once the solution for # https://github.com/perl5-dbi/DBD-mysql/issues/212 # is ported to whatever distro we support by that time @@ -430,9 +421,6 @@ sub TO_JSON { $unblessed->{$col} += 0.00; } elsif ( _datetime_column_type( $columns_info->{$col}->{data_type} ) ) { - if ( $self->{_redact} ) { - $unblessed->{$col} = "0000-01-01 00:00:01"; - } eval { return unless $unblessed->{$col}; $unblessed->{$col} = output_pref({ @@ -441,9 +429,6 @@ sub TO_JSON { }); }; } - elsif ( $self->{_redact} ) { - $unblessed->{$col} = '*****'; - } } return $unblessed; } @@ -565,10 +550,6 @@ Returns a representation of the object, suitable for API output. sub to_api { my ( $self, $params ) = @_; - unless ( $self->is_accessible($params) ) { - $self->{_redact} = 1; - } - my $json_object = $self->TO_JSON; # Make sure we duplicate the $params variable to avoid @@ -600,6 +581,24 @@ sub to_api { } } + # Remove forbidden attributes if required (including their coded values) + if ( !$self->is_accessible($params) ) { + for my $field ( keys %{$json_object} ) { + unless ( any { $_ eq $field } @{ $self->unredact_list } ) { + $json_object->{$field} = '#####' + } + + } + + if ($strings) { + foreach my $field ( keys %{$string_map} ) { + unless ( any { $_ eq $field } @{ $self->unredact_list } ) { + $string_map->{$field} = '#####' + } + } + } + } + my $to_api_mapping = $self->to_api_mapping; # Rename attributes and coded values if there's a mapping @@ -732,6 +731,24 @@ sub public_read_list return []; } +=head3 unredact_list + + my @unredact_list = @{$object->unredact_list}; + +Generic method that returns the list of database columns that are allowed to +be passed to render objects on the API when the user making the request should +not ordinarily have unrestricted access to the data (as returned by the is_accesible method). + +Note: this only returns an empty I. Each class should have its +own implementation. + +=cut + +sub unredact_list + { + return []; +} + =head3 from_api_mapping my $mapping = $object->from_api_mapping; diff --git a/Koha/Patron.pm b/Koha/Patron.pm index 2006ad5087f..c32e07b7427 100644 --- a/Koha/Patron.pm +++ b/Koha/Patron.pm @@ -2308,6 +2308,18 @@ sub is_accessible { return $consumer->can_see_patron_infos($self); } + +=head3 unredact_list + +This method returns the list of database fields that should be visable, even for restricted users, +for both API and UI output purposes + +=cut + +sub unredact_list { + return ['branchcode']; +} + =head3 to_api my $json = $patron->to_api; -- 2.41.0