View | Details | Raw Unified | Return to bug 20568
Collapse All | Expand All

(-)a/installer/data/mysql/atomicupdate/bug_20568_api_keys.perl (-7 lines)
Lines 20-32 if(CheckVersion($DBversion)) { Link Here
20
        });
20
        });
21
    }
21
    }
22
22
23
    $dbh->do(q{
24
        INSERT IGNORE INTO `systempreferences`
25
            (variable,value,explanation,options,type)
26
        VALUES
27
            ('AllowPatronsManageAPIKeysInOPAC', '0', 'If enabled, patrons can manage their own API keys in the OPAC', NULL, 'YesNo');
28
    });
29
30
    print "Upgrade to $DBversion done (Bug 20568 - Add API key management interface for patrons)\n";
23
    print "Upgrade to $DBversion done (Bug 20568 - Add API key management interface for patrons)\n";
31
    SetVersion($DBversion);
24
    SetVersion($DBversion);
32
}
25
}
(-)a/installer/data/mysql/sysprefs.sql (-1 lines)
Lines 30-36 INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` Link Here
30
('AllowNotForLoanOverride','0','','If ON, Koha will allow the librarian to loan a not for loan item.','YesNo'),
30
('AllowNotForLoanOverride','0','','If ON, Koha will allow the librarian to loan a not for loan item.','YesNo'),
31
('AllowOfflineCirculation','0','','If on, enables HTML5 offline circulation functionality.','YesNo'),
31
('AllowOfflineCirculation','0','','If on, enables HTML5 offline circulation functionality.','YesNo'),
32
('AllowPatronToSetCheckoutsVisibilityForGuarantor',  '0', NULL, 'If enabled, the patron can set checkouts to be visible to his or her guarantor',  'YesNo'),
32
('AllowPatronToSetCheckoutsVisibilityForGuarantor',  '0', NULL, 'If enabled, the patron can set checkouts to be visible to his or her guarantor',  'YesNo'),
33
('AllowPatronsManageAPIKeysInOPAC', '0', NULL, 'If enabled, patrons can manage their own API keys in the OPAC',  'YesNo'),
34
('AllowPKIAuth','None','None|Common Name|emailAddress','Use the field from a client-side SSL certificate to look a user in the Koha database','Choice'),
33
('AllowPKIAuth','None','None|Common Name|emailAddress','Use the field from a client-side SSL certificate to look a user in the Koha database','Choice'),
35
('AllowPurchaseSuggestionBranchChoice','0','1','Allow user to choose branch when making a purchase suggestion','YesNo'),
34
('AllowPurchaseSuggestionBranchChoice','0','1','Allow user to choose branch when making a purchase suggestion','YesNo'),
36
('AllowRenewalIfOtherItemsAvailable','0',NULL,'If enabled, allow a patron to renew an item with unfilled holds if other available items can fill that hold.','YesNo'),
35
('AllowRenewalIfOtherItemsAvailable','0',NULL,'If enabled, allow a patron to renew an item with unfilled holds if other available items can fill that hold.','YesNo'),
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/web_services.pref (-6 lines)
Lines 5-16 Web services: Link Here
5
            - pref: "RESTdefaultPageSize"
5
            - pref: "RESTdefaultPageSize"
6
              class: integer
6
              class: integer
7
            - "per page"
7
            - "per page"
8
        -
9
            - pref: AllowPatronsManageAPIKeysInOPAC
10
              choices:
11
                  yes: Allow
12
                  no: "Don't allow"
13
            - "patrons to manage their own API keys in the OPAC."
14
    OAI-PMH:
8
    OAI-PMH:
15
        -
9
        -
16
            - pref: OAI-PMH
10
            - pref: OAI-PMH
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/includes/usermenu.inc (-10 lines)
Lines 124-139 Link Here
124
                <a href="/cgi-bin/koha/opac-illrequests.pl">your interlibrary loan requests</a></li>
124
                <a href="/cgi-bin/koha/opac-illrequests.pl">your interlibrary loan requests</a></li>
125
            [% END %]
125
            [% END %]
126
126
127
128
            [% IF Koha.Preference('AllowPatronsManageAPIKeysInOPAC') %]
129
                [% IF apikeysview %]
130
                  <li class="active">
131
                [% ELSE %]
132
                  <li>
133
                [% END %]
134
                  <a href="/cgi-bin/koha/opac-apikeys.pl">your API keys</a>
135
            [% END %]
136
            </li>
137
        </ul>
127
        </ul>
138
    </div>
128
    </div>
139
[% END %]
129
[% END %]
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-apikeys.tt (-110 lines)
Lines 1-110 Link Here
1
[% INCLUDE 'doc-head-open.inc' %]
2
<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your API keys</title>
3
[% INCLUDE 'doc-head-close.inc' %]
4
[% BLOCK cssinclude %][% END %]
5
</head>
6
[% INCLUDE 'bodytag.inc' bodyid='opac-user' bodyclass='scrollto' %]
7
[% INCLUDE 'masthead.inc' %]
8
9
<div class="main">
10
    <ul class="breadcrumb">
11
        <li><a href="/cgi-bin/koha/opac-main.pl">Home</a> <span class="divider">&rsaquo;</span></li>
12
        <li>
13
            <a href="/cgi-bin/koha/opac-user.pl">
14
                [% INCLUDE 'patron-title.inc' category_type=patron.category.category_type firstname=patron.firstname surname=patron.surname othernames=patron.othernames %]
15
            </a>
16
            <span class="divider">&rsaquo;</span>
17
        </li>
18
        <li><a href="/cgi-bin/koha/opac-apikeys.pl">Your API keys</a></li>
19
    </ul>
20
21
    <div class="container-fluid">
22
        <div class="row-fluid">
23
            <div class="span2">
24
                <div id="navigation">
25
                    [% INCLUDE 'navigation.inc' IsPatronPage = 1 %]
26
                </div>
27
            </div>
28
            <div class="span10">
29
                <div id="apikeys" class="maincontent">
30
                    <h1>Your API keys</h1>
31
                    <p>
32
                        <button id="show-api-form" style="display:none" class="btn btn-default btn-sm" type="button"><i class="fa fa-plus"></i> Generate new key</button>
33
                    </p>
34
                    <form id="add-api-key" action="/cgi-bin/koha/opac-apikeys.pl" method="post">
35
                        <fieldset>
36
                            <legend>Generate new client id/secret pair</legend>
37
                            <input type="hidden" name="patron_id" value="[% patron.id %]" />
38
                            <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
39
                            <input type="hidden" name="op" value="generate" />
40
                            <label for="description">Description: </label>
41
                            <input type="text" name="description" />
42
                        </fieldset>
43
                        <fieldset class="action">
44
                            <button class="btn btn-default btn-sm" type="submit">Save</button> <a href="#" style="display:none" class="cancel cancel-api-key">Cancel</a>
45
                        </fieldset>
46
                    </form>
47
                    [% IF api_keys && api_keys.size > 0 %]
48
                        <table class="table table-bordered table-striped">
49
                            <thead>
50
                                <tr>
51
                                    <th>Description</th>
52
                                    <th>Client ID</th>
53
                                    <th>Secret</th>
54
                                    <th>Active</th>
55
                                    <th>Actions</th>
56
                                </tr>
57
                            </thead>
58
                            <tbody>
59
                                [% FOREACH key IN api_keys %]
60
                                    <tr>
61
                                        <td>[% key.description %]</td>
62
                                        <td>[% key.client_id %]</td>
63
                                        <td>[% key.secret %]</td>
64
                                        <td>[% IF key.active %]Yes[% ELSE %]No[% END %]</td>
65
                                        <td>
66
                                            <form action="/cgi-bin/koha/opac-apikeys.pl" method="post" class="form-inline">
67
                                                <input type="hidden" name="key" value="[% key.id %]" />
68
                                                <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
69
                                                <input type="hidden" name="op" value="delete" />
70
                                                <button class="btn btn-link btn-xs delete-key" type="submit"><i class="fa fa-trash"></i> Delete</button>
71
                                            </form>
72
                                            <form action="/cgi-bin/koha/opac-apikeys.pl" method="post" class="form-inline">
73
                                                <input type="hidden" name="key" value="[% key.id %]" />
74
                                                <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
75
                                                [% IF key.active %]
76
                                                    <input type="hidden" name="op" value="revoke" />
77
                                                    <button class="btn btn-link btn-xs" type="submit"><i class="fa fa-remove"></i> Revoke</button>
78
                                                [% ELSE %]
79
                                                    <input type="hidden" name="op" value="activate" />
80
                                                    <button class="btn btn-link btn-xs" type="submit"><i class="fa fa-play"></i> Activate</button>
81
                                                [% END %]
82
                                            </form>
83
                                        </td>
84
                                    </tr>
85
                                [% END %]
86
                            </tbody>
87
                        </table>
88
                    [% ELSE %]
89
                        <p>No keys defined for the current patron.</p>
90
                    [% END %]
91
                </div> <!-- /#apikeys -->
92
            </div> <!-- /.span10 -->
93
        </div> <!-- /.row-fluid -->
94
    </div> <!-- /.container-fluid -->
95
</div> <!-- /#main -->
96
97
[% BLOCK jsinclude %]
98
    <script>
99
        $(document).ready(function(){
100
            $("#add-api-key, #show-api-form, .cancel-api-key").toggle();
101
            $("#show-api-form, .cancel-api-key").on("click", function(){
102
                $("#add-api-key, #show-api-form").toggle();
103
            });
104
            $(".delete-key").on("click", function(){
105
                return confirm(_("Are you sure you want to delete this key?"));
106
            });
107
        });
108
    </script>
109
[% END %]
110
[% INCLUDE 'opac-bottom.inc' %]
(-)a/opac/opac-apikeys.pl (-120 lines)
Lines 1-119 Link Here
1
#!/usr/bin/env perl
2
3
# This file is part of Koha.
4
#
5
# Copyright 2015 BibLibre
6
#
7
# Koha is free software; you can redistribute it and/or modify it
8
# under the terms of the GNU General Public License as published by
9
# the Free Software Foundation; either version 3 of the License, or
10
# (at your option) any later version.
11
#
12
# Koha is distributed in the hope that it will be useful, but
13
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
16
#
17
# You should have received a copy of the GNU General Public License
18
# along with Koha; if not, see <http://www.gnu.org/licenses>.
19
20
use Modern::Perl;
21
22
use CGI;
23
24
use C4::Auth;
25
use C4::Output;
26
27
use Koha::ApiKeys;
28
use Koha::Patrons;
29
use Koha::Token;
30
31
my $cgi = new CGI;
32
33
my ($template, $loggedinuser, $cookie) = get_template_and_user({
34
    template_name   => 'opac-apikeys.tt',
35
    query           => $cgi,
36
    type            => 'opac',
37
    authnotrequired => 0
38
});
39
40
my $patron_id = $loggedinuser;
41
my $patron = Koha::Patrons->find( $patron_id );
42
43
if ( not defined $patron
44
    or !C4::Context->preference('AllowPatronsManageAPIKeysInOPAC') )
45
{
46
    # patron_id invalid -> exit
47
    print $cgi->redirect("/cgi-bin/koha/errors/404.pl");    # escape early
48
    exit;
49
}
50
51
my $op = $cgi->param('op') // '';
52
53
if ( $op eq 'generate' or
54
     $op eq 'delete' or
55
     $op eq 'revoke' or
56
     $op eq 'activate' ) {
57
58
    die "Wrong CSRF token"
59
    unless Koha::Token->new->check_csrf({
60
        session_id => scalar $cgi->cookie('CGISESSID'),
61
        token      => scalar $cgi->param('csrf_token'),
62
    });
63
}
64
65
if ($op) {
66
    if ($op eq 'generate') {
67
        my $description = $cgi->param('description') // '';
68
        my $apikey = Koha::ApiKey->new({
69
            patron_id   => $patron_id,
70
            description => $description
71
        });
72
        $apikey->store;
73
        print $cgi->redirect('/cgi-bin/koha/opac-apikeys.pl');
74
        exit;
75
    }
76
77
    if ($op eq 'delete') {
78
        my $key_id  = $cgi->param('key');
79
        my $api_key = Koha::ApiKeys->find({ patron_id => $patron_id, client_id => $key_id });
80
        if ($api_key) {
81
            $api_key->delete;
82
        }
83
        print $cgi->redirect('/cgi-bin/koha/opac-apikeys.pl');
84
        exit;
85
    }
86
87
    if ($op eq 'revoke') {
88
        my $key_id  = $cgi->param('key');
89
        my $api_key = Koha::ApiKeys->find({ patron_id => $patron_id, client_id => $key_id });
90
        if ($api_key) {
91
            $api_key->active(0);
92
            $api_key->store;
93
        }
94
        print $cgi->redirect('/cgi-bin/koha/opac-apikeys.pl');
95
        exit;
96
    }
97
98
    if ($op eq 'activate') {
99
        my $key_id  = $cgi->param('key');
100
        my $api_key = Koha::ApiKeys->find({ patron_id => $patron_id, client_id => $key_id });
101
        if ($api_key) {
102
            $api_key->active(1);
103
            $api_key->store;
104
        }
105
        print $cgi->redirect('/cgi-bin/koha/opac-apikeys.pl');
106
        exit;
107
    }
108
}
109
110
my @api_keys = Koha::ApiKeys->search({ patron_id => $patron_id });
111
112
$template->param(
113
    api_keys    => \@api_keys,
114
    apikeysview => 1,
115
    csrf_token  => Koha::Token->new->generate_csrf({ session_id => scalar $cgi->cookie('CGISESSID') }),
116
    patron      => $patron
117
);
118
119
output_html_with_http_headers $cgi, $cookie, $template->output;
120
- 

Return to bug 20568