Bug 29900

Summary: API calls should update datelastseen for API patron
Product: Koha Reporter: Andrew Fuerste-Henry <andrew>
Component: PatronsAssignee: Bugs List <koha-bugs>
Status: Needs Signoff --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: bibliwho, carthur, Chip.Halvorsen, cj.lynce, gmcharlt, jonathan.druart, kyle, sally.healey
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536
GIT URL: Change sponsored?: Sponsored
Patch complexity: Small patch Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:
Bug Depends on: 15504    
Bug Blocks:    
Attachments: TESTING SCRIPT: api_verify_lastseen.pl
Bug 29900: API calls should update datelastseen for API patron
TEST SCRIPT: api_basic_test.pl
TEST SCRIPT: api_oauth2_test.pl
Bug 29900: API calls should update datelastseen for API patron

Description Andrew Fuerste-Henry 2022-01-18 15:56:35 UTC
Updating the datelastseen on API patrons when the API is called would help prevent those patrons from being accidentally batch deleted due to a lack of actual checkouts.
Comment 1 Katrin Fischer 2022-01-20 21:35:49 UTC
Should all API actions update the date? 

I am not sure what Koha does when the patron is edited (like adding a note), but I feel that this should probably not count as an activity?
Comment 2 Andrew Fuerste-Henry 2022-01-20 21:49:27 UTC
(In reply to Katrin Fischer from comment #1)
> Should all API actions update the date? 
> 
> I am not sure what Koha does when the patron is edited (like adding a note),
> but I feel that this should probably not count as an activity?

I'm sorry, I was unclear. I don't mean that every time we touch Patron A's record via an API route we should update Patron A's datelastseen. Instead, I mean if Patron B is the account to which my API credentials are attached for a given service, every time that service uses an API call to do something we should update Patron B's datelastseen. Patron B isn't a real patron, isn't really checking things out or returning them. Updating their datelastseen would help show that this API is still being used and the patron should not be deleted.
Comment 3 Katrin Fischer 2022-01-20 22:09:27 UTC
Got it! Thx for clarifying Andrew!
Comment 4 CJ Lynce 2025-08-18 21:28:59 UTC
Created attachment 185533 [details]
TESTING SCRIPT: api_verify_lastseen.pl

Script for testing an API call to verify patron username and password.
Comment 5 CJ Lynce 2025-08-18 21:30:03 UTC
Comment on attachment 185533 [details]
TESTING SCRIPT: api_verify_lastseen.pl

Attached to wrong bug
Comment 6 CJ Lynce 2025-08-19 20:51:39 UTC
Created attachment 185578 [details] [review]
Bug 29900: API calls should update datelastseen for API patron

This patch adds the option to update borrowers.lastseen when a koha account
    is used for REST API access. Both REST Basic Authentication and OAuth2
    methods will update borrowers.lastseen upon successful authentication.
    These options can be enabled or disabled independently for both Basic
    Authentication and OAuth2 key-based authentication using the
    TrackLastPatronActivityTriggers system preference.

Testing Prep:
A.  Ensure RESTBasicAuth is enabled in system preferences.
B.  Ensure RESTOAuth2ClientCredentials is enabled in system preferences.
C.  Create a new borrower account with username "apibasic" and set a password.
D.  Create a new borrower acccount 'apioauth2'.
E.  Configure a new API client key and secret for borrower 'apiauth2'.
F.  Configure both borrowers 'apibasic' and 'apioauth2' to Set Permissions to
        authenticate patron passwords using the API. (api_validate_password)

To test:
1.  Edit the TrackLastPatronActivityTriggers syspref and check "Logging In" in only.
2.  Check the lastseen date of your api borrowers using a SQL report
        SELECT borrowernumber, userid, lastseen FROM borrowers WHERE userid LIKE 'api%'
        NOTE: **Ensure the cache expiry of the SQL report is set to 0**
3.  The lastseen for both users should be null.
4.  Run the attached api_basic_test.pl test script.
    **Change API_USERNAME and API_PASSWORD to the username and password of 'apibasic' user.
    (script contains expected output for successful verification)
5.  Run the attached api_oauth2_test.pl test script.
    **Change API_CLIENT_ID and API_SECRET to the client ID and secret key of 'apioauth2' user.
    (script contains expected output for successful verification)
6.  Re-check the lastseen date of your api users via SQL. Both users should have no lastseen.

7.  Apply Patch
8.  'restart_all' Koha services.

9.  Edit the TrackLastPatronActivityTriggers syspref and check both:
        a. "REST API service uses Basic Authentication" and
        b. "REST API service uses OAuth2 authentication"
10. Run the attached api_basic_test.pl test script.
        **Change API_USERNAME and API_PASSWORD to the username and password of 'apibasic' user.
        (script contains expected output for successful verification)
11. Re-check the lastseen date of 'apibasic' via SQL. This should now be updated.
12. 'restart_all' Koha services.
13. Run the attached api_oauth2_test.pl test script.
        **Change API_CLIENT_ID and API_SECRET to the client ID and secret key of 'apioauth2' user.
        (script contains expected output for successful verification)
14.. Re-check the lastseen date of 'apioauth2' via SQL. This should now be updated.

For good measure:
15. Edit the TrackLastPatronActivityTriggers syspref and **UNcheck** all options. option
16. 'restart_all' Koha services.
17. Rerun the api_basic_test.pl and api_oauth2_test.pl scripts.
18. Re-check the lastseen date of your new user again via SQL (step 4)
		The lastseen should have remained the same as previous.
Comment 7 CJ Lynce 2025-08-19 20:52:09 UTC
Created attachment 185579 [details]
TEST SCRIPT: api_basic_test.pl
Comment 8 CJ Lynce 2025-08-19 20:52:26 UTC
Created attachment 185580 [details]
TEST SCRIPT: api_oauth2_test.pl
Comment 9 CJ Lynce 2025-08-19 20:53:54 UTC
Created attachment 185581 [details] [review]
Bug 29900: API calls should update datelastseen for API patron

This patch adds the option to update borrowers.lastseen when a koha account
    is used for REST API access. Both REST Basic Authentication and OAuth2
    methods will update borrowers.lastseen upon successful authentication.
    These options can be enabled or disabled independently for both Basic
    Authentication and OAuth2 key-based authentication using the
    TrackLastPatronActivityTriggers system preference.

Testing Prep:
A.  Ensure RESTBasicAuth is enabled in system preferences.
B.  Ensure RESTOAuth2ClientCredentials is enabled in system preferences.
C.  Create a new borrower account with username "apibasic" and set a password.
D.  Create a new borrower acccount 'apioauth2'.
E.  Configure a new API client key and secret for borrower 'apiauth2'.
F.  Configure both borrowers 'apibasic' and 'apioauth2' to Set Permissions to
        authenticate patron passwords using the API. (api_validate_password)

To test:
1.  Edit the TrackLastPatronActivityTriggers syspref and check "Logging In" in only.
2.  Check the lastseen date of your api borrowers using a SQL report
        SELECT borrowernumber, userid, lastseen FROM borrowers WHERE userid LIKE 'api%'
        NOTE: **Ensure the cache expiry of the SQL report is set to 0**
3.  The lastseen for both users should be null.
4.  Run the attached api_basic_test.pl test script.
    **Change API_USERNAME and API_PASSWORD to the username and password of 'apibasic' user.
    (script contains expected output for successful verification)
5.  Run the attached api_oauth2_test.pl test script.
    **Change API_CLIENT_ID and API_SECRET to the client ID and secret key of 'apioauth2' user.
    (script contains expected output for successful verification)
6.  Re-check the lastseen date of your api users via SQL. Both users should have no lastseen.

7.  Apply Patch
8.  'restart_all' Koha services.

9.  Edit the TrackLastPatronActivityTriggers syspref and check both:
        a. "REST API service uses Basic Authentication" and
        b. "REST API service uses OAuth2 authentication"
10. Run the attached api_basic_test.pl test script.
        **Change API_USERNAME and API_PASSWORD to the username and password of 'apibasic' user.
        (script contains expected output for successful verification)
11. Re-check the lastseen date of 'apibasic' via SQL. This should now be updated.
12. 'restart_all' Koha services.
13. Run the attached api_oauth2_test.pl test script.
        **Change API_CLIENT_ID and API_SECRET to the client ID and secret key of 'apioauth2' user.
        (script contains expected output for successful verification)
14.. Re-check the lastseen date of 'apioauth2' via SQL. This should now be updated.

For good measure:
15. Edit the TrackLastPatronActivityTriggers syspref and **UNcheck** all options. option
16. 'restart_all' Koha services.
17. Rerun the api_basic_test.pl and api_oauth2_test.pl scripts.
18. Re-check the lastseen date of your new user again via SQL (step 4)
		The lastseen should have remained the same as previous.

Sponsored-by: Westlake Porter Public Library <https://westlakelibrary.org>