From 5a5ea2335eaa63e21c53e7ee393e2bac566019d6 Mon Sep 17 00:00:00 2001 From: CJ Lynce Date: Tue, 19 Aug 2025 20:40:53 +0000 Subject: [PATCH] Bug 29900: API calls should update datelastseen for API patron This patch adds the option to update borrowers.lastseen when a koha account is used for REST API access. Both REST Basic Authentication and OAuth2 methods will update borrowers.lastseen upon successful authentication. These options can be enabled or disabled independently for both Basic Authentication and OAuth2 key-based authentication using the TrackLastPatronActivityTriggers system preference. Testing Prep: A. Ensure RESTBasicAuth is enabled in system preferences. B. Ensure RESTOAuth2ClientCredentials is enabled in system preferences. C. Create a new borrower account with username "apibasic" and set a password. D. Create a new borrower acccount 'apioauth2'. E. Configure a new API client key and secret for borrower 'apiauth2'. F. Configure both borrowers 'apibasic' and 'apioauth2' to Set Permissions to authenticate patron passwords using the API. (api_validate_password) To test: 1. Edit the TrackLastPatronActivityTriggers syspref and check "Logging In" in only. 2. Check the lastseen date of your api borrowers using a SQL report SELECT borrowernumber, userid, lastseen FROM borrowers WHERE userid LIKE 'api%' NOTE: **Ensure the cache expiry of the SQL report is set to 0** 3. The lastseen for both users should be null. 4. Run the attached api_basic_test.pl test script. **Change API_USERNAME and API_PASSWORD to the username and password of 'apibasic' user. (script contains expected output for successful verification) 5. Run the attached api_oauth2_test.pl test script. **Change API_CLIENT_ID and API_SECRET to the client ID and secret key of 'apioauth2' user. (script contains expected output for successful verification) 6. Re-check the lastseen date of your api users via SQL. Both users should have no lastseen. 7. Apply Patch 8. 'restart_all' Koha services. 9. Edit the TrackLastPatronActivityTriggers syspref and check both: a. "REST API service uses Basic Authentication" and b. "REST API service uses OAuth2 authentication" 10. Run the attached api_basic_test.pl test script. **Change API_USERNAME and API_PASSWORD to the username and password of 'apibasic' user. (script contains expected output for successful verification) 11. Re-check the lastseen date of 'apibasic' via SQL. This should now be updated. 12. 'restart_all' Koha services. 13. Run the attached api_oauth2_test.pl test script. **Change API_CLIENT_ID and API_SECRET to the client ID and secret key of 'apioauth2' user. (script contains expected output for successful verification) 14.. Re-check the lastseen date of 'apioauth2' via SQL. This should now be updated. For good measure: 15. Edit the TrackLastPatronActivityTriggers syspref and **UNcheck** all options. option 16. 'restart_all' Koha services. 17. Rerun the api_basic_test.pl and api_oauth2_test.pl scripts. 18. Re-check the lastseen date of your new user again via SQL (step 4) The lastseen should have remained the same as previous. Sponsored-by: Westlake Porter Public Library --- Koha/REST/V1/Auth.pm | 6 ++++++ .../prog/en/modules/admin/preferences/patrons.pref | 2 ++ 2 files changed, 8 insertions(+) diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm index d7deddcb76..91ec6f3b5a 100644 --- a/Koha/REST/V1/Auth.pm +++ b/Koha/REST/V1/Auth.pm @@ -176,6 +176,9 @@ sub authenticate_api_request { if ($valid_token) { my $patron_id = Koha::ApiKeys->find( $valid_token->{client_id} )->patron_id; $user = Koha::Patrons->find($patron_id); + + #record lastseen for API user using OAuth2 + $user->update_lastseen('api_oauth2'); } else { # If we have "Authorization: Bearer" header and oauth authentication @@ -350,6 +353,9 @@ sub _basic_auth { Koha::Exceptions::Authorization::Unauthorized->throw( error => 'Password has expired' ); } + #update lastseen for API user + $patron->update_lastseen('api_basic_auth'); + return $patron; } diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/patrons.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/patrons.pref index 5a84a24557..b9bf7fc095 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/patrons.pref +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/patrons.pref @@ -110,6 +110,8 @@ Patrons: check_in: "Checking in an item" hold: "Placing a hold on an item" article: "Placing an article request" + api_basic_auth: "REST API service uses Basic Authentication" + api_oauth2: "REST API service uses OAuth2 authentication" - - pref: AutoApprovePatronProfileSettings choices: -- 2.39.5