From 54d2ab424c4ccf2849557c9e646128be8931f2f0 Mon Sep 17 00:00:00 2001 From: David Cook Date: Wed, 23 Jul 2025 18:23:16 -0300 Subject: [PATCH] Bug 36561: Add new permission `api_validate_password` This change adds a `api_validate_password` permission which allows a user to only validate borrowers by using the /api/v1/auth/password/validation endpoint. This avoids scenarios where you want third-parties to authenticate a user without giving them full permissions to perform CRUD operations on user data. To test: 1. Apply patch 2. Run "koha-upgrade-schema kohadev" 3. koha-plack --reload kohadev 4. prove -v t/db_dependent/api/v1/password_validation.t 5. Visit http://localhost:8081/cgi-bin/koha/members/member-flags.pl?member=51 6. Note that a new subpermission `api_validate_password` appears under the "borrowers" permission Signed-off-by: David Nind Signed-off-by: Nick Clemens Signed-off-by: Tomas Cohen Arazi --- .../data/mysql/atomicupdate/bug_36561.pl | 20 +++++++++++++++++++ .../data/mysql/mandatory/userpermissions.sql | 1 + .../prog/en/includes/permissions.inc | 3 +++ 3 files changed, 24 insertions(+) create mode 100755 installer/data/mysql/atomicupdate/bug_36561.pl diff --git a/installer/data/mysql/atomicupdate/bug_36561.pl b/installer/data/mysql/atomicupdate/bug_36561.pl new file mode 100755 index 00000000000..87623d85544 --- /dev/null +++ b/installer/data/mysql/atomicupdate/bug_36561.pl @@ -0,0 +1,20 @@ +use Modern::Perl; +use Koha::Installer::Output qw(say_warning say_success say_info); + +return { + bug_number => "36561", + description => "Add new permission for validation passwords on the API", + up => sub { + my ($args) = @_; + my ( $dbh, $out ) = @$args{qw(dbh out)}; + + $dbh->do( + q{ + INSERT IGNORE INTO permissions (module_bit, code, description) + VALUES (4, 'api_validate_password', 'Validate patron passwords using the API') + } + ); + + say_success( $out, "Added new permission 'borrowers:api_validate_password'" ); + }, +}; diff --git a/installer/data/mysql/mandatory/userpermissions.sql b/installer/data/mysql/mandatory/userpermissions.sql index d5121c91fd2..1ff3f33d1e5 100644 --- a/installer/data/mysql/mandatory/userpermissions.sql +++ b/installer/data/mysql/mandatory/userpermissions.sql @@ -44,6 +44,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES ( 3, 'manage_search_filters', 'Manage custom search filters'), ( 3, 'manage_identity_providers', 'Manage identity providers'), ( 3, 'manage_record_sources', 'Manage record sources'), + ( 4, 'api_validate_password', 'Validate patron passwords using the API'), ( 4, 'delete_borrowers', 'Delete patrons'), ( 4, 'edit_borrowers', 'Add, modify and view patron information'), ( 4, 'list_borrowers', 'Search, list and view patrons'), diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc index a0e17a2d418..9ee9543772d 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/permissions.inc @@ -236,6 +236,9 @@ View patron infos from any libraries. If not set the logged in user could only access patron infos from its own library or group of libraries. ([% name | html %]) + [%- CASE 'api_validate_password' -%] + Validate patron passwords using the API + ([% name | html %]) [%- CASE 'send_messages_to_borrowers' -%] Send messages to patrons ([% name | html %]) -- 2.50.1