Bug 34287

Summary: Patron's should not be able to ask for checkoutability for different patrons
Product: Koha Reporter: Tomás Cohen Arazi (tcohen) <tomascohen>
Component: REST APIAssignee: Martin Renvoize (ashimema) <martin.renvoize>
Status: CLOSED FIXED QA Contact: Nick Clemens (kidclamp) <nick>
Severity: major    
Priority: P5 - low CC: 1joynelson, dcook, didier.gautheron, fridolin.somers, jonathan.druart, kyle, laurent.ducos, lucas, m.de.rooy, martin.renvoize, nick, nugged, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.00
Circulation function:
Bug Depends on: 30979    
Bug Blocks:    
Attachments: Bug 34287: Add check on public availability endpoint
Bug 34287: Amend unit test
Bug 34287: Add check on public availability endpoint
Bug 34287: Amend unit test
Bug 34287: Add check on public availability endpoint
Bug 34287: Amend unit test
Bug 34287: Add check on public availability endpoint

Description Tomás Cohen Arazi (tcohen) 2023-07-14 19:37:26 UTC
Bug 30979 implemented an endpoint for checking availability for checking out an item, and the description explains it is for checking out themselves... but it allows asking for any patron's checkoutability.

I open this bug to discuss that behvior.
Comment 1 Katrin Fischer 2023-07-16 10:29:25 UTC
I assume this is a public route? It does sound not quite right. Not sure what is returned, but could others learn about restrictions etc.?
Comment 2 Martin Renvoize (ashimema) 2023-09-12 07:13:29 UTC
Good catch.. I'm not sure I thought about that case.. there is already the staff version of this api endpoint for third party consumers so I think your right.. the public endpoint should be more locked down.
Comment 3 Martin Renvoize (ashimema) 2023-09-12 09:26:45 UTC
Created attachment 155544 [details] [review]
Bug 34287: Add check on public availability endpoint

A quick check for patron equals current user in the public availability
endpoint.
Comment 4 Lucas Gass (lukeg) 2023-09-13 21:26:02 UTC
Seems like a good fix except that unit tests seem to be failing now for t/db_dependent/api/v1/checkouts.t
Comment 5 Martin Renvoize (ashimema) 2023-09-20 12:48:54 UTC
Created attachment 155929 [details] [review]
Bug 34287: Amend unit test

This patch updates the unit test to confirm that checkout availability
should be restricted to the patron checking the availability options on
the public side.
Comment 6 Martin Renvoize (ashimema) 2023-09-20 12:48:56 UTC
Created attachment 155930 [details] [review]
Bug 34287: Add check on public availability endpoint

A quick check for patron equals current user in the public availability
endpoint.
Comment 7 Martin Renvoize (ashimema) 2023-09-20 12:49:58 UTC
Reworked and unit tested
Comment 8 Jonathan Druart 2023-09-26 10:36:56 UTC
Hum, I am confused, didn't we have a test to ensure that all our routes had the "x-koha-authorization" entry?
Comment 9 Katrin Fischer 2023-10-29 14:45:41 UTC
Created attachment 158043 [details] [review]
Bug 34287: Amend unit test

This patch updates the unit test to confirm that checkout availability
should be restricted to the patron checking the availability options on
the public side.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 10 Katrin Fischer 2023-10-29 14:45:44 UTC
Created attachment 158044 [details] [review]
Bug 34287: Add check on public availability endpoint

A quick check for patron equals current user in the public availability
endpoint.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 11 Nick Clemens (kidclamp) 2023-11-02 12:26:06 UTC
Created attachment 158251 [details] [review]
Bug 34287: Amend unit test

This patch updates the unit test to confirm that checkout availability
should be restricted to the patron checking the availability options on
the public side.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 12 Nick Clemens (kidclamp) 2023-11-02 12:26:08 UTC
Created attachment 158252 [details] [review]
Bug 34287: Add check on public availability endpoint

A quick check for patron equals current user in the public availability
endpoint.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 13 Tomás Cohen Arazi (tcohen) 2023-11-24 19:46:23 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 14 Fridolin Somers 2023-11-24 20:57:47 UTC
Depends on Bug 30979 not in 23.05.x