@@ -, +, @@ unauthorized users - apply this patch, - edit api/v1/swagger/definitions/city.json, - remove the keys "country" and "postal_code" from required, - add a key "x-public": false for country and postal_code "postal_code": { "description": "city postal code", "type": ["string", "null"], "x-public": false }, "country": { "description": "city country", "type": ["string", "null"], "x-public": false } - logout from Koha and go to api/v1/cities, - you should not see country and postal_code, - login to Koha and refresh api/v1/cities, - you should see country and postal_code --- Koha/REST/Plugin/Objects.pm | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) --- a/Koha/REST/Plugin/Objects.pm +++ a/Koha/REST/Plugin/Objects.pm @@ -91,11 +91,26 @@ sub register { }); } - my @objects_list = map { - ( defined $to_api ) - ? $to_api->( $_->TO_JSON ) - : $_->TO_JSON - } $objects->as_list; + my $spec = $c->openapi->spec(); + my $properties = $spec->{responses}{200}{schema}{items}{properties}; + + my $user = $c->stash('koha.user'); + my @hidden_properties; + unless ( $user && $user->has_permission({ catalogue => 1 }) ) { + foreach my $property ( keys %$properties ) { + if ( defined( $properties->{ $property }{'x-public'} ) + && !$properties->{ $property }{'x-public'}) { + push @hidden_properties, $property; + } + } + } + + my @objects_list; + foreach my $o ( @{ $objects->as_list } ) { + my $json = defined($to_api) ? $to_api->( $o->TO_JSON ) : $o->TO_JSON; + delete @{ $json }{ @hidden_properties }; + push @objects_list, $json; + } return \@objects_list; } --