Bug 20407

Summary: Hide some fields from unauthorized users
Product: Koha Reporter: Alex Arnaud <alex.arnaud>
Component: REST APIAssignee: Alex Arnaud <alex.arnaud>
Status: CLOSED WONTFIX QA Contact:
Severity: enhancement    
Priority: P5 - low CC: katrin.fischer, martin.renvoize, mtompset, tomascohen
Version: Main   
Hardware: All   
OS: All   
URL: https://wiki.koha-community.org/wiki/Partial_resources_RFC
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 20407 - REST API: Ability to hide fields from unauthorized users
Bug 20407 - REST API: Ability to hide fields from unauthorized users

Description Alex Arnaud 2018-03-14 16:27:29 UTC
The main goal here is to be able to make some fields/properties/columns "non public" to unauthorized people ( permission => catalogue ) by setting a "x-public" key to false in Swagger definitions files. Patch is coming...
Comment 1 Alex Arnaud 2018-03-14 16:31:32 UTC
Created attachment 72891 [details] [review]
Bug 20407 - REST API: Ability to hide fields from unauthorized users

Test plan:
  - apply this patch,
  - edit api/v1/swagger/definitions/city.json,
  - remove the keys "country" and "postal_code" from required,
  - add a key "x-public": false for country and postal_code
    "postal_code": {
      "description": "city postal code",
      "type": ["string", "null"],
      "x-public": false
    },
    "country": {
      "description": "city country",
      "type": ["string", "null"],
      "x-public": false
    }
  - logout from Koha and go to api/v1/cities,
  - you should not see country and postal_code,
  - login to Koha and refresh api/v1/cities,
  - you should see country and postal_code
Comment 2 Mark Tompsett 2018-03-15 17:29:24 UTC
Created attachment 72982 [details] [review]
Bug 20407 - REST API: Ability to hide fields from unauthorized users

Test plan:
  - apply this patch,
  - edit api/v1/swagger/definitions/city.json,
  - remove the keys "country" and "postal_code" from required,
  - add a key "x-public": false for country and postal_code
    "postal_code": {
      "description": "city postal code",
      "type": ["string", "null"],
      "x-public": false
    },
    "country": {
      "description": "city country",
      "type": ["string", "null"],
      "x-public": false
    }
  - logout from Koha and go to api/v1/cities,
  - you should not see country and postal_code,
  - login to Koha and refresh api/v1/cities,
  - you should see country and postal_code

NOTE: Make sure to go to Koha administration and add cities before testing.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Comment 3 Martin Renvoize 2018-05-21 14:50:46 UTC
The slightly more accepted way of doing this to date that I have seen is to reduce the default response to only contain public fields and set the private fields to need explicitly requesting in the api call. This way, rather than sending back a 200 with varying content you send back either a 200 with what the consumer has asked for (or is expecting) or you send back a 401 Unauthorized and the client knows to authenticate).

The principle of Least Surprise.

I do like the x-public way of defining it in the spec though.. :)
Comment 4 Tomás Cohen Arazi 2018-10-11 19:45:01 UTC
On a recent dev meeting it was voted to have a separate namespace (/public) for public facing endpoints. So while the logic here is valuable, this bug won't see progress as-is.
Comment 5 Tomás Cohen Arazi 2019-11-08 18:20:54 UTC
We implemented the separate /public namespace already.