From 17f50761e90c81e998cf9214fc4e40813abdb217 Mon Sep 17 00:00:00 2001 From: Matt Blenkinsop Date: Fri, 17 Jan 2025 17:04:22 +0000 Subject: [PATCH] Bug 38930: Add API endpoint This patch adds an API endpoint to return a hash of a user's permissions --- Koha/REST/V1/UserPermissions.pm | 52 +++++++++++++++++++ .../swagger/definitions/user_permission.yaml | 7 +++ api/v1/swagger/paths/user_permissions.yaml | 49 +++++++++++++++++ api/v1/swagger/swagger.yaml | 4 ++ .../prog/js/vue/fetch/patron-api-client.js | 9 ++++ 5 files changed, 121 insertions(+) create mode 100644 Koha/REST/V1/UserPermissions.pm create mode 100644 api/v1/swagger/definitions/user_permission.yaml create mode 100644 api/v1/swagger/paths/user_permissions.yaml diff --git a/Koha/REST/V1/UserPermissions.pm b/Koha/REST/V1/UserPermissions.pm new file mode 100644 index 00000000000..42e572506a9 --- /dev/null +++ b/Koha/REST/V1/UserPermissions.pm @@ -0,0 +1,52 @@ +package Koha::REST::V1::UserPermissions; + +# This file is part of Koha. +# +# Koha is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# Koha is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Koha; if not, see . + +use Modern::Perl; + +use Mojo::Base 'Mojolicious::Controller'; + +use Try::Tiny qw( catch try ); + +use Koha::Auth::Permissions; + +use C4::Auth; + +=head1 API + +=head2 Methods + +=head3 get + +=cut + +sub get { + my $c = shift->openapi->valid_input or return; + + return try { + my $patron = $c->stash('koha.user'); + + my $userflags = C4::Auth::getuserflags($patron->flags, $patron->id); + + my $permissions = Koha::Auth::Permissions->get_authz_from_flags({ flags => $userflags }); + + return $c->render( status => 200, openapi => { permissions => $permissions }, ); + } catch { + $c->unhandled_exception($_); + }; +} + +1; \ No newline at end of file diff --git a/api/v1/swagger/definitions/user_permission.yaml b/api/v1/swagger/definitions/user_permission.yaml new file mode 100644 index 00000000000..62a84d5a668 --- /dev/null +++ b/api/v1/swagger/definitions/user_permission.yaml @@ -0,0 +1,7 @@ +--- +type: object +properties: + permissions: + type: object + description: the permissions object for the user +additionalProperties: false \ No newline at end of file diff --git a/api/v1/swagger/paths/user_permissions.yaml b/api/v1/swagger/paths/user_permissions.yaml new file mode 100644 index 00000000000..bc0d4963e39 --- /dev/null +++ b/api/v1/swagger/paths/user_permissions.yaml @@ -0,0 +1,49 @@ +--- +/user_permissions: + get: + x-mojo-to: UserPermissions#get + operationId: getUserPermissions + description: This resource returns the permissions for the user attached to the request + summary: List of permissions and subpermissions + tags: + - permissions + parameters: + - $ref: "../swagger.yaml#/parameters/match" + - $ref: "../swagger.yaml#/parameters/order_by" + - $ref: "../swagger.yaml#/parameters/page" + - $ref: "../swagger.yaml#/parameters/per_page" + - $ref: "../swagger.yaml#/parameters/q_param" + - $ref: "../swagger.yaml#/parameters/q_body" + produces: + - application/json + responses: + "200": + description: A list of permissions + schema: + type: object + $ref: "../swagger.yaml#/definitions/user_permission" + "400": + description: | + Bad request. Possible `error_code` attribute values: + + * `invalid_query` + schema: + $ref: "../swagger.yaml#/definitions/error" + "403": + description: Access forbidden + schema: + $ref: "../swagger.yaml#/definitions/error" + "500": + description: | + Internal server error. Possible `error_code` attribute values: + + * `internal_server_error` + schema: + $ref: "../swagger.yaml#/definitions/error" + "503": + description: Under maintenance + schema: + $ref: "../swagger.yaml#/definitions/error" + x-koha-authorization: + permissions: + catalogue: 1 \ No newline at end of file diff --git a/api/v1/swagger/swagger.yaml b/api/v1/swagger/swagger.yaml index ff7b94a174e..b094db0ab41 100644 --- a/api/v1/swagger/swagger.yaml +++ b/api/v1/swagger/swagger.yaml @@ -182,6 +182,8 @@ definitions: $ref: ./definitions/ticket_update.yaml transfer_limit: $ref: ./definitions/transfer_limit.yaml + user_permission: + $ref: ./definitions/user_permission.yaml vendor: $ref: ./definitions/vendor.yaml vendor_issue: @@ -569,6 +571,8 @@ paths: $ref: ./paths/transfer_limits.yaml#/~1transfer_limits~1batch "/transfer_limits/{limit_id}": $ref: "./paths/transfer_limits.yaml#/~1transfer_limits~1{limit_id}" + "/user_permissions": + $ref: "./paths/user_permissions.yaml#/~1user_permissions" parameters: advancededitormacro_id_pp: description: Advanced editor macro internal identifier diff --git a/koha-tmpl/intranet-tmpl/prog/js/vue/fetch/patron-api-client.js b/koha-tmpl/intranet-tmpl/prog/js/vue/fetch/patron-api-client.js index 4c39e977fda..d22950433ca 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/vue/fetch/patron-api-client.js +++ b/koha-tmpl/intranet-tmpl/prog/js/vue/fetch/patron-api-client.js @@ -15,6 +15,15 @@ export class PatronAPIClient extends HttpClient { }), }; } + + get userPermissions() { + return { + get: () => + this.get({ + endpoint: "user_permissions", + }), + }; + } } export default PatronAPIClient; -- 2.48.1