From fe29a4363d42728d9abb0e60a19080eab9a9262a Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Thu, 12 Oct 2023 14:51:47 +0100 Subject: [PATCH] Bug 29523: Add support for 'unredact_list' This patch adds support for an 'unredact_list' method at the Koha::* class level allowing for individual classes to specify which fields they wish to expose to restricted users regardless of their restriction. It is to be used in combination with the is_accessible method introduced earlier in this patchset which is used to denote whether the current user should be allowed to see the full record or only a subset of it as defined in the unredacted_list. We undefine any fields not listed in the unredact_list for the API response. This has the effect of still returning the full object of keys, but setting most fields to a JSON null. --- Koha/Object.pm | 55 +++++++++++++++++++++++++++++++++----------------- Koha/Patron.pm | 12 +++++++++++ 2 files changed, 48 insertions(+), 19 deletions(-) diff --git a/Koha/Object.pm b/Koha/Object.pm index 529ec503436..46cb74af047 100644 --- a/Koha/Object.pm +++ b/Koha/Object.pm @@ -405,11 +405,6 @@ sub TO_JSON { elsif ( _numeric_column_type( $columns_info->{$col}->{data_type} ) and looks_like_number( $unblessed->{$col} ) ) { - - if ( $self->{_redact} ) { - $unblessed->{$col} = 0; - } - # TODO: Remove once the solution for # https://github.com/perl5-dbi/DBD-mysql/issues/212 # is ported to whatever distro we support by that time @@ -419,10 +414,6 @@ sub TO_JSON { elsif ( _decimal_column_type( $columns_info->{$col}->{data_type} ) and looks_like_number( $unblessed->{$col} ) ) { - if ( $self->{_redact} ) { - $unblessed->{$col} = 0.00; - } - # TODO: Remove once the solution for # https://github.com/perl5-dbi/DBD-mysql/issues/212 # is ported to whatever distro we support by that time @@ -430,9 +421,6 @@ sub TO_JSON { $unblessed->{$col} += 0.00; } elsif ( _datetime_column_type( $columns_info->{$col}->{data_type} ) ) { - if ( $self->{_redact} ) { - $unblessed->{$col} = "0000-01-01 00:00:01"; - } eval { return unless $unblessed->{$col}; $unblessed->{$col} = output_pref({ @@ -441,9 +429,6 @@ sub TO_JSON { }); }; } - elsif ( $self->{_redact} ) { - $unblessed->{$col} = '*****'; - } } return $unblessed; } @@ -565,10 +550,6 @@ Returns a representation of the object, suitable for API output. sub to_api { my ( $self, $params ) = @_; - unless ( $self->is_accessible($params) ) { - $self->{_redact} = 1; - } - my $json_object = $self->TO_JSON; # Make sure we duplicate the $params variable to avoid @@ -600,6 +581,24 @@ sub to_api { } } + # Remove forbidden attributes if required (including their coded values) + if ( !$self->is_accessible($params) ) { + for my $field ( keys %{$json_object} ) { + unless ( any { $_ eq $field } @{ $self->unredact_list } ) { + $json_object->{$field} = undef; + } + + } + + if ($strings) { + foreach my $field ( keys %{$string_map} ) { + unless ( any { $_ eq $field } @{ $self->unredact_list } ) { + $string_map->{$field} = undef; + } + } + } + } + my $to_api_mapping = $self->to_api_mapping; # Rename attributes and coded values if there's a mapping @@ -732,6 +731,24 @@ sub public_read_list return []; } +=head3 unredact_list + + my @unredact_list = @{$object->unredact_list}; + +Generic method that returns the list of database columns that are allowed to +be passed to render objects on the API when the user making the request should +not ordinarily have unrestricted access to the data (as returned by the is_accesible method). + +Note: this only returns an empty I. Each class should have its +own implementation. + +=cut + +sub unredact_list + { + return []; +} + =head3 from_api_mapping my $mapping = $object->from_api_mapping; diff --git a/Koha/Patron.pm b/Koha/Patron.pm index 2006ad5087f..c32e07b7427 100644 --- a/Koha/Patron.pm +++ b/Koha/Patron.pm @@ -2308,6 +2308,18 @@ sub is_accessible { return $consumer->can_see_patron_infos($self); } + +=head3 unredact_list + +This method returns the list of database fields that should be visable, even for restricted users, +for both API and UI output purposes + +=cut + +sub unredact_list { + return ['branchcode']; +} + =head3 to_api my $json = $patron->to_api; -- 2.41.0