Bug 20407

Summary: Hide some fields from unauthorized users
Product: Koha Reporter: Alex Arnaud <alex.arnaud>
Component: REST apiAssignee: Alex Arnaud <alex.arnaud>
Status: Signed Off --- QA Contact:
Severity: enhancement    
Priority: P5 - low CC: katrin.fischer, martin.renvoize, mtompset, tomascohen
Version: master   
Hardware: All   
OS: All   
Whiteboard:
Change sponsored?: --- Patch complexity: ---
Bot Control: --- When did the bot last check this:
Who signed the patch off: Text to go in the release notes:
Attachments: Bug 20407 - REST API: Ability to hide fields from unauthorized users
Bug 20407 - REST API: Ability to hide fields from unauthorized users

Description Alex Arnaud 2018-03-14 16:27:29 UTC
The main goal here is to be able to make some fields/properties/columns "non public" to unauthorized people ( permission => catalogue ) by setting a "x-public" key to false in Swagger definitions files. Patch is coming...
Comment 1 Alex Arnaud 2018-03-14 16:31:32 UTC
Created attachment 72891 [details] [review]
Bug 20407 - REST API: Ability to hide fields from unauthorized users

Test plan:
  - apply this patch,
  - edit api/v1/swagger/definitions/city.json,
  - remove the keys "country" and "postal_code" from required,
  - add a key "x-public": false for country and postal_code
    "postal_code": {
      "description": "city postal code",
      "type": ["string", "null"],
      "x-public": false
    },
    "country": {
      "description": "city country",
      "type": ["string", "null"],
      "x-public": false
    }
  - logout from Koha and go to api/v1/cities,
  - you should not see country and postal_code,
  - login to Koha and refresh api/v1/cities,
  - you should see country and postal_code
Comment 2 M. Tompsett 2018-03-15 17:29:24 UTC
Created attachment 72982 [details] [review]
Bug 20407 - REST API: Ability to hide fields from unauthorized users

Test plan:
  - apply this patch,
  - edit api/v1/swagger/definitions/city.json,
  - remove the keys "country" and "postal_code" from required,
  - add a key "x-public": false for country and postal_code
    "postal_code": {
      "description": "city postal code",
      "type": ["string", "null"],
      "x-public": false
    },
    "country": {
      "description": "city country",
      "type": ["string", "null"],
      "x-public": false
    }
  - logout from Koha and go to api/v1/cities,
  - you should not see country and postal_code,
  - login to Koha and refresh api/v1/cities,
  - you should see country and postal_code

NOTE: Make sure to go to Koha administration and add cities before testing.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Comment 3 Martin Renvoize 2018-05-21 14:50:46 UTC
The slightly more accepted way of doing this to date that I have seen is to reduce the default response to only contain public fields and set the private fields to need explicitly requesting in the api call. This way, rather than sending back a 200 with varying content you send back either a 200 with what the consumer has asked for (or is expecting) or you send back a 401 Unauthorized and the client knows to authenticate).

The principle of Least Surprise.

I do like the x-public way of defining it in the spec though.. :)