From 1a3eb9028c36704e93dc86642d78298b1621a631 Mon Sep 17 00:00:00 2001 From: David Cook Date: Wed, 24 Apr 2024 06:13:22 +0000 Subject: [PATCH] Bug 36561: Add "validate_borrowers" permission for /api/v1/auth/password/validation This change adds a "validate_borrowers" permission which allows a user to only validate borrowers by using the /api/v1/auth/password/validation endpoint. This avoids scenarios where you want third-parties to authenticate a user without giving them full permissions to perform CRUD operations on user data. To test: 1. Apply patch 2. Run "koha-upgrade-schema kohadev" 3. koha-plack --reload kohadev 4. prove -v t/db_dependent/api/v1/password_validation.t 5. Visit http://localhost:8081/cgi-bin/koha/members/member-flags.pl?member=51 6. Note that a new subpermission "validate_borrowers" appears under the "borrowers" permission --- api/v1/swagger/paths/auth.yaml | 3 ++- .../data/mysql/mandatory/userpermissions.sql | 1 + .../prog/en/includes/permissions.inc | 5 +++++ t/db_dependent/api/v1/password_validation.t | 15 ++++++++++++++- 4 files changed, 22 insertions(+), 2 deletions(-) diff --git a/api/v1/swagger/paths/auth.yaml b/api/v1/swagger/paths/auth.yaml index b9dee70cdca..5d29f194c53 100644 --- a/api/v1/swagger/paths/auth.yaml +++ b/api/v1/swagger/paths/auth.yaml @@ -1131,4 +1131,5 @@ $ref: ../swagger.yaml#/definitions/error x-koha-authorization: permissions: - borrowers: "1" + - borrowers: "validate_borrowers" + diff --git a/installer/data/mysql/mandatory/userpermissions.sql b/installer/data/mysql/mandatory/userpermissions.sql index 729c075548a..ce0e5cf2367 100644 --- a/installer/data/mysql/mandatory/userpermissions.sql +++ b/installer/data/mysql/mandatory/userpermissions.sql @@ -46,6 +46,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES ( 4, 'delete_borrowers', 'Delete patrons'), ( 4, 'edit_borrowers', 'Add, modify and view patron information'), ( 4, 'list_borrowers', 'Search, list and view patrons'), + ( 4, 'validate_borrowers', 'Check validity of username and password'), ( 4, 'view_borrower_infos_from_any_libraries', 'View patron infos from any libraries'), ( 6, 'place_holds', 'Place holds for patrons'), ( 6, 'modify_holds_priority', 'Modify holds priority'), diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc index 742e6e1c359..cac09b5a474 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc @@ -317,6 +317,11 @@ Search, list and view patrons ([% name | html %]) + [%- CASE 'validate_borrowers' -%] + + Check validity of username and password + + ([% name | html %]) [%- CASE 'view_borrower_infos_from_any_libraries' -%] View patron infos from any libraries. If not set the logged in user could only access patron infos from its own library or group of libraries. diff --git a/t/db_dependent/api/v1/password_validation.t b/t/db_dependent/api/v1/password_validation.t index 10527bc93d0..772895f6672 100755 --- a/t/db_dependent/api/v1/password_validation.t +++ b/t/db_dependent/api/v1/password_validation.t @@ -39,9 +39,22 @@ $schema->storage->txn_begin; my $librarian = $builder->build_object( { class => 'Koha::Patrons', - value => { flags => 2 ** 4 } # borrowers flag = 4 + value => { flags => 0 } #No top-level permissions } ); + +# Ensure our librarian can see users from all branches (once list_borrowers is added) +$builder->build( + { + source => 'UserPermission', + value => { + borrowernumber => $librarian->borrowernumber, + module_bit => 4, + code => 'validate_borrowers', + }, + } +); + my $password = 'thePassword123'; $librarian->set_password( { password => $password, skip_validation => 1 } ); my $userid = $librarian->userid; -- 2.30.2