Bug 36536

Summary: Make REST API's validateUserAndPassword update borrowers.lastseen
Product: Koha Reporter: Magnus Enger <magnus>
Component: REST APIAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact:
Severity: normal    
Priority: P5 - low CC: tomascohen
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 15504    
Bug Blocks:    

Description Magnus Enger 2024-04-05 13:23:27 UTC
Since ILS-DI (which specifically means the AuthenticatePatron verb) is an option that can be selected for TrackLastPatronActivityTriggers, I would expect the validateUserAndPassword of the REST API to also contribute to updating borrowers.lastseen. Since there is no separate option for activalting it, I thought maybe the REST API is considered so much "core" to Koha that the logins are tracked when "Logging in" is activated as an option for TrackLastPatronActivityTriggers. But it looks like it is not. 

To reproduce in KTD: 

TrackLastPatronActivityTriggers = [Select all]
RESTBasicAuth = Enable

Check the lastseen value of the "koha" user in the database:
select borrowernumber, lastseen from borrowers where borrowernumber = 51;
The value should be NULL, or some past timestamp. 

Run this script: 
https://wiki.koha-community.org/wiki/REST_API:_Checking_username_and_password

Check the lastseen value of the "koha" user again. I would expect it to have been updated when the script ran, but it is not. 

Not sure if validateUserAndPassword should be considered as just another way of "Logging in", or if it should be a separate option for TrackLastPatronActivityTriggers, but the latter would give maximum flexibility.