Summary: | API calls should update datelastseen for API patron | ||
---|---|---|---|
Product: | Koha | Reporter: | Andrew Fuerste-Henry <andrew> |
Component: | Patrons | Assignee: | Bugs List <koha-bugs> |
Status: | Needs Signoff --- | QA Contact: | Testopia <testopia> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | bibliwho, carthur, Chip.Halvorsen, cj.lynce, gmcharlt, jonathan.druart, kyle, sally.healey |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36536 | ||
GIT URL: | Change sponsored?: | Sponsored | |
Patch complexity: | Small patch | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: | Circulation function: | ||
Bug Depends on: | 15504 | ||
Bug Blocks: | |||
Attachments: |
TESTING SCRIPT: api_verify_lastseen.pl
Bug 29900: API calls should update datelastseen for API patron TEST SCRIPT: api_basic_test.pl TEST SCRIPT: api_oauth2_test.pl Bug 29900: API calls should update datelastseen for API patron |
Description
Andrew Fuerste-Henry
2022-01-18 15:56:35 UTC
Should all API actions update the date? I am not sure what Koha does when the patron is edited (like adding a note), but I feel that this should probably not count as an activity? (In reply to Katrin Fischer from comment #1) > Should all API actions update the date? > > I am not sure what Koha does when the patron is edited (like adding a note), > but I feel that this should probably not count as an activity? I'm sorry, I was unclear. I don't mean that every time we touch Patron A's record via an API route we should update Patron A's datelastseen. Instead, I mean if Patron B is the account to which my API credentials are attached for a given service, every time that service uses an API call to do something we should update Patron B's datelastseen. Patron B isn't a real patron, isn't really checking things out or returning them. Updating their datelastseen would help show that this API is still being used and the patron should not be deleted. Got it! Thx for clarifying Andrew! Created attachment 185533 [details]
TESTING SCRIPT: api_verify_lastseen.pl
Script for testing an API call to verify patron username and password.
Comment on attachment 185533 [details]
TESTING SCRIPT: api_verify_lastseen.pl
Attached to wrong bug
Created attachment 185578 [details] [review] Bug 29900: API calls should update datelastseen for API patron This patch adds the option to update borrowers.lastseen when a koha account is used for REST API access. Both REST Basic Authentication and OAuth2 methods will update borrowers.lastseen upon successful authentication. These options can be enabled or disabled independently for both Basic Authentication and OAuth2 key-based authentication using the TrackLastPatronActivityTriggers system preference. Testing Prep: A. Ensure RESTBasicAuth is enabled in system preferences. B. Ensure RESTOAuth2ClientCredentials is enabled in system preferences. C. Create a new borrower account with username "apibasic" and set a password. D. Create a new borrower acccount 'apioauth2'. E. Configure a new API client key and secret for borrower 'apiauth2'. F. Configure both borrowers 'apibasic' and 'apioauth2' to Set Permissions to authenticate patron passwords using the API. (api_validate_password) To test: 1. Edit the TrackLastPatronActivityTriggers syspref and check "Logging In" in only. 2. Check the lastseen date of your api borrowers using a SQL report SELECT borrowernumber, userid, lastseen FROM borrowers WHERE userid LIKE 'api%' NOTE: **Ensure the cache expiry of the SQL report is set to 0** 3. The lastseen for both users should be null. 4. Run the attached api_basic_test.pl test script. **Change API_USERNAME and API_PASSWORD to the username and password of 'apibasic' user. (script contains expected output for successful verification) 5. Run the attached api_oauth2_test.pl test script. **Change API_CLIENT_ID and API_SECRET to the client ID and secret key of 'apioauth2' user. (script contains expected output for successful verification) 6. Re-check the lastseen date of your api users via SQL. Both users should have no lastseen. 7. Apply Patch 8. 'restart_all' Koha services. 9. Edit the TrackLastPatronActivityTriggers syspref and check both: a. "REST API service uses Basic Authentication" and b. "REST API service uses OAuth2 authentication" 10. Run the attached api_basic_test.pl test script. **Change API_USERNAME and API_PASSWORD to the username and password of 'apibasic' user. (script contains expected output for successful verification) 11. Re-check the lastseen date of 'apibasic' via SQL. This should now be updated. 12. 'restart_all' Koha services. 13. Run the attached api_oauth2_test.pl test script. **Change API_CLIENT_ID and API_SECRET to the client ID and secret key of 'apioauth2' user. (script contains expected output for successful verification) 14.. Re-check the lastseen date of 'apioauth2' via SQL. This should now be updated. For good measure: 15. Edit the TrackLastPatronActivityTriggers syspref and **UNcheck** all options. option 16. 'restart_all' Koha services. 17. Rerun the api_basic_test.pl and api_oauth2_test.pl scripts. 18. Re-check the lastseen date of your new user again via SQL (step 4) The lastseen should have remained the same as previous. Created attachment 185579 [details]
TEST SCRIPT: api_basic_test.pl
Created attachment 185580 [details]
TEST SCRIPT: api_oauth2_test.pl
Created attachment 185581 [details] [review] Bug 29900: API calls should update datelastseen for API patron This patch adds the option to update borrowers.lastseen when a koha account is used for REST API access. Both REST Basic Authentication and OAuth2 methods will update borrowers.lastseen upon successful authentication. These options can be enabled or disabled independently for both Basic Authentication and OAuth2 key-based authentication using the TrackLastPatronActivityTriggers system preference. Testing Prep: A. Ensure RESTBasicAuth is enabled in system preferences. B. Ensure RESTOAuth2ClientCredentials is enabled in system preferences. C. Create a new borrower account with username "apibasic" and set a password. D. Create a new borrower acccount 'apioauth2'. E. Configure a new API client key and secret for borrower 'apiauth2'. F. Configure both borrowers 'apibasic' and 'apioauth2' to Set Permissions to authenticate patron passwords using the API. (api_validate_password) To test: 1. Edit the TrackLastPatronActivityTriggers syspref and check "Logging In" in only. 2. Check the lastseen date of your api borrowers using a SQL report SELECT borrowernumber, userid, lastseen FROM borrowers WHERE userid LIKE 'api%' NOTE: **Ensure the cache expiry of the SQL report is set to 0** 3. The lastseen for both users should be null. 4. Run the attached api_basic_test.pl test script. **Change API_USERNAME and API_PASSWORD to the username and password of 'apibasic' user. (script contains expected output for successful verification) 5. Run the attached api_oauth2_test.pl test script. **Change API_CLIENT_ID and API_SECRET to the client ID and secret key of 'apioauth2' user. (script contains expected output for successful verification) 6. Re-check the lastseen date of your api users via SQL. Both users should have no lastseen. 7. Apply Patch 8. 'restart_all' Koha services. 9. Edit the TrackLastPatronActivityTriggers syspref and check both: a. "REST API service uses Basic Authentication" and b. "REST API service uses OAuth2 authentication" 10. Run the attached api_basic_test.pl test script. **Change API_USERNAME and API_PASSWORD to the username and password of 'apibasic' user. (script contains expected output for successful verification) 11. Re-check the lastseen date of 'apibasic' via SQL. This should now be updated. 12. 'restart_all' Koha services. 13. Run the attached api_oauth2_test.pl test script. **Change API_CLIENT_ID and API_SECRET to the client ID and secret key of 'apioauth2' user. (script contains expected output for successful verification) 14.. Re-check the lastseen date of 'apioauth2' via SQL. This should now be updated. For good measure: 15. Edit the TrackLastPatronActivityTriggers syspref and **UNcheck** all options. option 16. 'restart_all' Koha services. 17. Rerun the api_basic_test.pl and api_oauth2_test.pl scripts. 18. Re-check the lastseen date of your new user again via SQL (step 4) The lastseen should have remained the same as previous. Sponsored-by: Westlake Porter Public Library <https://westlakelibrary.org> |