Bug 22061

Summary: Add route to change patron's password (public)
Product: Koha Reporter: Tomás Cohen Arazi <tomascohen>
Component: REST APIAssignee: Tomás Cohen Arazi <tomascohen>
Status: CLOSED FIXED QA Contact:
Severity: new feature    
Priority: P5 - low CC: josef.moravec, katrin.fischer, kyle, martin.renvoize, nick, oleonard
Version: master   
Hardware: All   
OS: All   
URL: https://wiki.koha-community.org/wiki/Public_patrons_password_endpoint_RFC
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
This new feature allows a user to change their own password via the public API
Version(s) released in:
Bug Depends on: 17006    
Bug Blocks: 22216, 22227, 25045, 29272    
Attachments: Bug 22061: Add RESTPublicAPI syspref
Bug 22061: Add a /public namespace that can be switched on/off
Bug 22061: Unit tests
Bug 22061: OpenAPI spec
Bug 22061: Public route to change password
Bug 22061: OpenAPI spec
Bug 22061: Public route to change password
Bug 22061: Add RESTPublicAPI syspref
Bug 22061: Add a /public namespace that can be switched on/off
Bug 22061: Unit tests
Bug 22061: OpenAPI spec
Bug 22061: Public route to change password
Bug 22061: (QA follow-up) Rename password_2 => password_repeated
Bug 22061: Add RESTPublicAPI syspref
Bug 22061: Add RESTPublicAPI syspref
Bug 22061: Add a /public namespace that can be switched on/off
Bug 22061: Unit tests
Bug 22061: OpenAPI spec
Bug 22061: Public route to change password
Bug 22061: (QA follow-up) Rename password_2 => password_repeated
Bug 22061: (follow-up) set_password expects a hashref

Description Tomás Cohen Arazi 2019-01-02 15:22:51 UTC

    
Comment 1 Tomás Cohen Arazi 2019-01-03 12:08:57 UTC
I'm changing the bug description, because I didn't manage to have tests for the on/off switch without a real implemented route.
Comment 2 Tomás Cohen Arazi 2019-01-03 12:09:59 UTC
Created attachment 83613 [details] [review]
Bug 22061: Add RESTPublicAPI syspref
Comment 3 Tomás Cohen Arazi 2019-01-03 12:10:03 UTC
Created attachment 83614 [details] [review]
Bug 22061: Add a /public namespace that can be switched on/off

This patch adds a check in Koha::REST::V1::Auth::under to catch all
routes that begin with 'public' (inside /api/v1). If they match, and the
RESTPublicAPI syspref is off, then an exception is thrown, rendering a
403 error to the consumer.

Otherwise the routes are processed as usual. This is THE on/off switch
for the public REST API. The target use case: people not wanting an OPAC
or public interaction with the API besides privileged users.

In order to test, the rest of the patches are needed because the only
way to test a route is having it in the spec.

To test:
- Apply the patches
- Run:
  $ kshell
 k$ prove t/db_dependent/api/v1/auth.t
=> SUCCESS: tests pass!
- Sign off :-D
Comment 4 Tomás Cohen Arazi 2019-01-03 12:11:06 UTC
Leaving this as ASSIGNED until I solve some bugs found in the process.
Comment 5 Tomás Cohen Arazi 2019-01-07 11:32:20 UTC
Created attachment 83680 [details] [review]
Bug 22061: Unit tests
Comment 6 Tomás Cohen Arazi 2019-01-07 11:32:25 UTC
Created attachment 83681 [details] [review]
Bug 22061: OpenAPI spec
Comment 7 Tomás Cohen Arazi 2019-01-07 11:32:28 UTC
Created attachment 83682 [details] [review]
Bug 22061: Public route to change password

This patch implements a route to change patron's password for
unprivileged users. It's intended for using in the OPAC (or however
consumers find it useful).

It is a starting point for the public API, and the bug also implements
the on/off switch some community members asked for.

To test:
- Apply this patches
- Run:
  $ kshell
 k$ prove t/db_dependent/api/v1/patrons_password.t \
          t/db_dependent/api/v1/auth.t
=> SUCCESS: Tests pass! i.e.
        - RESTPublicAPI is honoured
        - The /public/patrons/:patron_id/password endpoint works as
        expected
- Use your favourite API testing tool to try the endpoint.
- Sign off :-D
Comment 8 Josef Moravec 2019-01-09 15:26:54 UTC
t/db_dependent/api/v1/patrons_password.t .. Could not load document from /home/vagrant/kohaclone/api/v1/swagger/paths/public_patrons.json: Can't open file "/home/vagrant/kohaclone/api/v1/swagger/paths/public_patrons.json": No such file or directory at /usr/share/perl5/JSON/Validator.pm line 154.
Comment 9 Tomás Cohen Arazi 2019-01-09 16:32:11 UTC
Created attachment 83755 [details] [review]
Bug 22061: OpenAPI spec
Comment 10 Tomás Cohen Arazi 2019-01-09 16:32:14 UTC
Created attachment 83756 [details] [review]
Bug 22061: Public route to change password

This patch implements a route to change patron's password for
unprivileged users. It's intended for using in the OPAC (or however
consumers find it useful).

It is a starting point for the public API, and the bug also implements
the on/off switch some community members asked for.

To test:
- Apply this patches
- Run:
  $ kshell
 k$ prove t/db_dependent/api/v1/patrons_password.t \
          t/db_dependent/api/v1/auth.t
=> SUCCESS: Tests pass! i.e.
        - RESTPublicAPI is honoured
        - The /public/patrons/:patron_id/password endpoint works as
        expected
- Use your favourite API testing tool to try the endpoint.
- Sign off :-D
Comment 11 Josef Moravec 2019-01-09 19:15:53 UTC
Created attachment 83764 [details] [review]
Bug 22061: Add RESTPublicAPI syspref

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 12 Josef Moravec 2019-01-09 19:15:59 UTC
Created attachment 83765 [details] [review]
Bug 22061: Add a /public namespace that can be switched on/off

This patch adds a check in Koha::REST::V1::Auth::under to catch all
routes that begin with 'public' (inside /api/v1). If they match, and the
RESTPublicAPI syspref is off, then an exception is thrown, rendering a
403 error to the consumer.

Otherwise the routes are processed as usual. This is THE on/off switch
for the public REST API. The target use case: people not wanting an OPAC
or public interaction with the API besides privileged users.

In order to test, the rest of the patches are needed because the only
way to test a route is having it in the spec.

To test:
- Apply the patches
- Run:
  $ kshell
 k$ prove t/db_dependent/api/v1/auth.t
=> SUCCESS: tests pass!
- Sign off :-D

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 13 Josef Moravec 2019-01-09 19:16:05 UTC
Created attachment 83766 [details] [review]
Bug 22061: Unit tests

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 14 Josef Moravec 2019-01-09 19:16:10 UTC
Created attachment 83767 [details] [review]
Bug 22061: OpenAPI spec

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 15 Josef Moravec 2019-01-09 19:16:15 UTC
Created attachment 83768 [details] [review]
Bug 22061: Public route to change password

This patch implements a route to change patron's password for
unprivileged users. It's intended for using in the OPAC (or however
consumers find it useful).

It is a starting point for the public API, and the bug also implements
the on/off switch some community members asked for.

To test:
- Apply this patches
- Run:
  $ kshell
 k$ prove t/db_dependent/api/v1/patrons_password.t \
          t/db_dependent/api/v1/auth.t
=> SUCCESS: Tests pass! i.e.
        - RESTPublicAPI is honoured
        - The /public/patrons/:patron_id/password endpoint works as
        expected
- Use your favourite API testing tool to try the endpoint.
- Sign off :-D

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 16 Tomás Cohen Arazi 2019-01-18 12:20:11 UTC
On the dev meeting it was requested that we change the 'password2' parameter into something that explains that it is a repeated password more explicitly.

I'll do it on a follow-up, but wanted to mention that the inspiration for this implementation was Django's:
https://django-rest-auth.readthedocs.io/en/latest/api_endpoints.html

and the fact that most of the examples on the web are quite similar too.
Comment 17 Tomás Cohen Arazi 2019-01-18 16:36:15 UTC
Created attachment 84207 [details] [review]
Bug 22061: (QA follow-up) Rename password_2 => password_repeated

As voted when the RFC was discussed, the attribute gets renamed. The
tests are adjusted accordingly.

To test:
- Run:
  $ kshell
 k$ prove t/db_dependent/api/v1/patrons_password.t
=> SUCCESS: Tests pass!

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 18 Kyle M Hall 2019-01-22 15:29:27 UTC
Created attachment 84288 [details] [review]
Bug 22061: Add RESTPublicAPI syspref

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 19 Kyle M Hall 2019-01-22 15:30:56 UTC
Created attachment 84289 [details] [review]
Bug 22061: Add RESTPublicAPI syspref

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 20 Kyle M Hall 2019-01-22 15:31:05 UTC
Created attachment 84290 [details] [review]
Bug 22061: Add a /public namespace that can be switched on/off

This patch adds a check in Koha::REST::V1::Auth::under to catch all
routes that begin with 'public' (inside /api/v1). If they match, and the
RESTPublicAPI syspref is off, then an exception is thrown, rendering a
403 error to the consumer.

Otherwise the routes are processed as usual. This is THE on/off switch
for the public REST API. The target use case: people not wanting an OPAC
or public interaction with the API besides privileged users.

In order to test, the rest of the patches are needed because the only
way to test a route is having it in the spec.

To test:
- Apply the patches
- Run:
  $ kshell
 k$ prove t/db_dependent/api/v1/auth.t
=> SUCCESS: tests pass!
- Sign off :-D

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 21 Kyle M Hall 2019-01-22 15:31:08 UTC
Created attachment 84291 [details] [review]
Bug 22061: Unit tests

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 22 Kyle M Hall 2019-01-22 15:31:12 UTC
Created attachment 84292 [details] [review]
Bug 22061: OpenAPI spec

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 23 Kyle M Hall 2019-01-22 15:31:15 UTC
Created attachment 84293 [details] [review]
Bug 22061: Public route to change password

This patch implements a route to change patron's password for
unprivileged users. It's intended for using in the OPAC (or however
consumers find it useful).

It is a starting point for the public API, and the bug also implements
the on/off switch some community members asked for.

To test:
- Apply this patches
- Run:
  $ kshell
 k$ prove t/db_dependent/api/v1/patrons_password.t \
          t/db_dependent/api/v1/auth.t
=> SUCCESS: Tests pass! i.e.
        - RESTPublicAPI is honoured
        - The /public/patrons/:patron_id/password endpoint works as
        expected
- Use your favourite API testing tool to try the endpoint.
- Sign off :-D

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 24 Kyle M Hall 2019-01-22 15:31:18 UTC
Created attachment 84294 [details] [review]
Bug 22061: (QA follow-up) Rename password_2 => password_repeated

As voted when the RFC was discussed, the attribute gets renamed. The
tests are adjusted accordingly.

To test:
- Run:
  $ kshell
 k$ prove t/db_dependent/api/v1/patrons_password.t
=> SUCCESS: Tests pass!

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 25 Tomás Cohen Arazi 2019-01-28 15:45:18 UTC
Created attachment 84489 [details] [review]
Bug 22061: (follow-up) set_password expects a hashref

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 26 Nick Clemens 2019-01-28 16:11:50 UTC
Awesome work all!

Pushed to master for 19.05
Comment 27 Martin Renvoize 2019-02-01 15:25:08 UTC
New feature, will not be backported at this time to 18.11.x series.