From aa4bc4d1b075299ae8f32a97bf5241352b36271a Mon Sep 17 00:00:00 2001 From: David Cook Date: Wed, 23 Jul 2025 18:26:08 -0300 Subject: [PATCH] Bug 36561: Make /auth/password/validation use new permission This patch updates the /auth/password/validation endpoint to use the new api_validate_password permission instead of the generic borrowers permission. This provides more granular control over who can use the password validation API endpoint. To test: 1. Apply this patches 2. Rebuild the API spec $ ktd --shell k$ yarn api:bundle 3. Run: $ ktd --shell k$ prove t/db_dependent/api/v1/password_validation.t => SUCCESS: Tests pass! 4. Sign off :-D Signed-off-by: David Nind Signed-off-by: Nick Clemens Signed-off-by: Tomas Cohen Arazi --- api/v1/swagger/paths/auth.yaml | 2 +- t/db_dependent/api/v1/password_validation.t | 15 ++++++++++++++- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/api/v1/swagger/paths/auth.yaml b/api/v1/swagger/paths/auth.yaml index 052565e4de6..700023cf555 100644 --- a/api/v1/swagger/paths/auth.yaml +++ b/api/v1/swagger/paths/auth.yaml @@ -1183,4 +1183,4 @@ $ref: ../swagger.yaml#/definitions/error x-koha-authorization: permissions: - borrowers: "1" + borrowers: api_validate_password diff --git a/t/db_dependent/api/v1/password_validation.t b/t/db_dependent/api/v1/password_validation.t index 74b025d96db..6e59d52a51c 100755 --- a/t/db_dependent/api/v1/password_validation.t +++ b/t/db_dependent/api/v1/password_validation.t @@ -40,9 +40,22 @@ $schema->storage->txn_begin; my $librarian = $builder->build_object( { class => 'Koha::Patrons', - value => { flags => 2**4 } # borrowers flag = 4 + value => { flags => 0 } # No top-level permissions } ); + +# Ensure our librarian can see users from all branches (once list_borrowers is added) +$builder->build( + { + source => 'UserPermission', + value => { + borrowernumber => $librarian->borrowernumber, + module_bit => 4, + code => 'api_validate_password', + }, + } +); + my $password = 'thePassword123'; $librarian->set_password( { password => $password, skip_validation => 1 } ); my $userid = $librarian->userid; -- 2.50.1