From bbac515846c7cfbaf058d1c634d7b87c132e9c6c Mon Sep 17 00:00:00 2001 From: CJ Lynce Date: Tue, 19 Aug 2025 20:40:53 +0000 Subject: [PATCH] Bug 29900: API calls should update datelastseen for API patron This patch adds the option to update borrowers.lastseen when a koha account is used for REST API access. Both REST Basic Authentication and OAuth2 methods will update borrowers.lastseen upon successful authentication. These options can be enabled or disabled independently for both Basic Authentication and OAuth2 key-based authentication using the TrackLastPatronActivityTriggers system preference. Testing Prep: A. Ensure RESTBasicAuth is enabled in system preferences. B. Ensure RESTOAuth2ClientCredentials is enabled in system preferences. C. Create a new borrower account with username "apibasic" and set a password. D. Create a new borrower acccount 'apioauth2'. E. Configure a new API client key and secret for borrower 'apiauth2'. F. Configure both borrowers 'apibasic' and 'apioauth2' to Set Permissions to authenticate patron passwords using the API. (api_validate_password) To test: 1. Edit the TrackLastPatronActivityTriggers syspref and check "Logging In" in only. 2. Check the lastseen date of your api borrowers using a SQL report SELECT borrowernumber, userid, lastseen FROM borrowers WHERE userid LIKE 'api%' NOTE: **Ensure the cache expiry of the SQL report is set to 0** 3. The lastseen for both users should be null. 4. Run the attached api_basic_test.pl test script. **Change API_USERNAME and API_PASSWORD to the username and password of 'apibasic' user. (script contains expected output for successful verification) 5. Run the attached api_oauth2_test.pl test script. **Change API_CLIENT_ID and API_SECRET to the client ID and secret key of 'apioauth2' user. (script contains expected output for successful verification) 6. Re-check the lastseen date of your api users via SQL. Both users should have no lastseen. 7. Apply Patch 8. 'restart_all' Koha services. 9. Edit the TrackLastPatronActivityTriggers syspref and check both: a. "REST API service uses Basic Authentication" and b. "REST API service uses OAuth2 authentication" 10. Run the attached api_basic_test.pl test script. **Change API_USERNAME and API_PASSWORD to the username and password of 'apibasic' user. (script contains expected output for successful verification) 11. Re-check the lastseen date of 'apibasic' via SQL. This should now be updated. 12. 'restart_all' Koha services. 13. Run the attached api_oauth2_test.pl test script. **Change API_CLIENT_ID and API_SECRET to the client ID and secret key of 'apioauth2' user. (script contains expected output for successful verification) 14.. Re-check the lastseen date of 'apioauth2' via SQL. This should now be updated. For good measure: 15. Edit the TrackLastPatronActivityTriggers syspref and **UNcheck** all options. option 16. 'restart_all' Koha services. 17. Rerun the api_basic_test.pl and api_oauth2_test.pl scripts. 18. Re-check the lastseen date of your new user again via SQL (step 4) The lastseen should have remained the same as previous. Sponsored-by: Westlake Porter Public Library Signed-off-by: Brendan Lawlor --- Koha/REST/V1/Auth.pm | 6 ++++++ .../prog/en/modules/admin/preferences/patrons.pref | 2 ++ 2 files changed, 8 insertions(+) diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm index 22a4199ce4..3502f40cb0 100644 --- a/Koha/REST/V1/Auth.pm +++ b/Koha/REST/V1/Auth.pm @@ -176,6 +176,9 @@ sub authenticate_api_request { if ($valid_token) { my $patron_id = Koha::ApiKeys->find( $valid_token->{client_id} )->patron_id; $user = Koha::Patrons->find($patron_id); + + #record lastseen for API user using OAuth2 + $user->update_lastseen('api_oauth2'); } else { # If we have "Authorization: Bearer" header and oauth authentication @@ -349,6 +352,9 @@ sub _basic_auth { Koha::Exceptions::Authorization::Unauthorized->throw( error => 'Password has expired' ); } + #update lastseen for API user + $patron->update_lastseen('api_basic_auth'); + return $patron; } diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/patrons.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/patrons.pref index d94bc0dd4b..ffc634a735 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/patrons.pref +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/patrons.pref @@ -112,6 +112,8 @@ Patrons: hold: "Placing a hold on an item" article: "Placing an article request" api_verify: "Patron authentication via API" + api_basic_auth: "REST API service uses Basic Authentication" + api_oauth2: "REST API service uses OAuth2 authentication" - - pref: AutoApprovePatronProfileSettings choices: -- 2.39.5